Legal
Data Processing Agreement
Last updated: October 25, 2026
1. Parties
This Data Processing Agreement (“DPA”) is entered into between:
- Data Controller (“Customer”): The organization or individual entering into a subscription or service agreement with ModulawAI, as identified in the applicable order form or service agreement.
- Data Processor (“ModulawAI”): ModulawAI Inc., a Delaware corporation, with its principal place of business at 7 Peter Utulu Close, Anu Crescent, Badore, Ajah, Lagos, Nigeria, and registered agent Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA, and its Nigerian subsidiary ModulawAI Nigeria Limited (RC-8401723).
This DPA forms part of the Terms and Conditions or service agreement between the Customer and ModulawAI (“Principal Agreement”) and is incorporated into it by reference.
2. Definitions
- “Personal Data” means any information relating to an identified or identifiable natural person processed by ModulawAI on behalf of the Customer through the Platform.
- “Processing” means any operation performed on Personal Data including collection, storage, retrieval, use, disclosure, or deletion.
- “Data Subject” means the individual whose Personal Data is processed.
- “Sub-processor” means any third party engaged by ModulawAI to process Personal Data on behalf of the Customer.
- “Applicable Data Protection Law” means, as applicable, the Nigeria Data Protection Act 2023 (“NDPA”), Regulation (EU) 2016/679 (“GDPR”), the GDPR as retained in UK law (“UK GDPR”) and the UK Data Protection Act 2018, and any other applicable data protection laws in the Customer’s or Data Subjects’ jurisdiction.
- “SCCs” and “UK Addendum” have the meanings given in section 10.
3. Processing instructions
ModulawAI shall process Personal Data only on documented instructions from the Customer, which shall initially be as set out in this DPA and the Principal Agreement. ModulawAI shall promptly notify the Customer if, in its opinion, any instruction infringes Applicable Data Protection Law.
ModulawAI processes Personal Data for the following purposes on the Customer’s behalf:
- Providing legal research, AI chatbot, and case management services.
- Storing and processing documents uploaded by the Customer or its users.
- Facilitating workspace, team, and client management features.
- Providing customer support at the Customer’s request.
4. Confidentiality
ModulawAI shall ensure that all personnel authorized to process Personal Data are bound by appropriate confidentiality obligations. ModulawAI personnel shall not access Customer’s uploaded legal documents except where strictly necessary for technical support, with the Customer’s prior consent, and subject to logging of such access.
5. Security
ModulawAI shall implement and maintain appropriate technical and organizational security measures including:
- AES-256 encryption of Personal Data at rest.
- TLS 1.2+ encryption of Personal Data in transit.
- Role-based access control and least-privilege access.
- Application audit logging and cloud audit logging (AWS CloudTrail).
- Incident response and breach notification procedures (see section 9).
- bcrypt password hashing for authentication credentials.
The measures in place today, and those still being completed, are set out in Annex II.
6. Sub-processors
The Customer hereby provides general authorization for ModulawAI to engage sub-processors. The authoritative, continuously-maintained list, including a changelog of additions and removals, is published at modulaw.ai/subprocessors. That list, as at the date the Customer accepts this DPA, forms Annex III. The snapshot below mirrors that page as of the “Last updated” date at the top of this agreement.
ModulawAI will give enterprise customers at least 30 days’ prior written notice of any intended addition or replacement of a sub-processor. Customers may object to a new sub-processor within that period by contacting dpo@modulaw.ai. If ModulawAI cannot reasonably accommodate the objection, the Customer may terminate the affected services without penalty.
ModulawAI shall impose data protection obligations on all sub-processors equivalent to those set out in this DPA, by written contract.
Snapshot of current sub-processors (as of October 25, 2026)
Infrastructure: Amazon Web Services (hosting, the MongoDB databases we run ourselves on EC2 including embeddings, S3 file storage, ElastiCache, CloudWatch logs, Word add-in hosting; United States); ModulawAI Nigeria Limited (administration and support; Nigeria).
AI inference: AWS Bedrock (Anthropic Claude, Amazon Nova and open-weight models); Amazon Textract (OCR); Fireworks AI; OpenRouter (embeddings routed to Microsoft Azure’s zero-data-retention endpoint). LangSmith run monitoring (metadata only).
Voice and real-time: LiveKit (self-hosted by ModulawAI on AWS in South Africa); Deepgram (speech-to-text); ElevenLabs (text-to-speech); Cartesia (TTS fallback); Africa’s Talking (SMS and phone calls).
Messaging and payments: Paystack and Stripe (payments); ZeptoMail / Zoho (transactional email); WhatsApp Business / Meta (OTP and notifications on user opt-in); Google reCAPTCHA (bot protection) and Firebase Cloud Messaging (push notifications).
Research and legal data sources: CourtListener; CanLII; EUR-Lex; TinyFish; Tavily.
Analytics and marketing (consent-gated): Google Analytics; Microsoft Clarity; Meta (Facebook Pixel); TikTok Pixel; X / Twitter Ads; Apollo.
7. Data subject rights assistance
ModulawAI shall, taking into account the nature of the processing, assist the Customer by appropriate technical and organizational measures to fulfill the Customer’s obligations to respond to Data Subject rights requests (access, rectification, erasure, restriction, portability, objection) under Applicable Data Protection Law. ModulawAI will notify the Customer of any Data Subject requests received directly by ModulawAI within 5 business days.
8. Data protection impact assessments
ModulawAI shall provide reasonable assistance to the Customer in carrying out Data Protection Impact Assessments and in consulting with relevant supervisory authorities where required by Applicable Data Protection Law, taking into account the nature of the processing and information available to ModulawAI.
9. Personal data breach notification
ModulawAI shall notify the Customer without undue delay, and in any event no later than 48 hours after becoming aware of a Personal Data breach affecting Customer data. The notification shall include, to the extent available:
- A description of the nature of the breach.
- Categories and approximate number of Data Subjects and records affected.
- Likely consequences of the breach.
- Measures taken or proposed to address the breach.
- A contact point for more information.
Where information is not yet available, ModulawAI provides it in phases without undue further delay. ModulawAI takes reasonable steps to contain the breach and mitigate its effects, and preserves evidence.
The Customer is responsible for notifying the relevant supervisory authority and Data Subjects as required by Applicable Data Protection Law.
10. International data transfers
Where Personal Data is transferred outside the Customer’s jurisdiction, ModulawAI shall ensure such transfers are made subject to appropriate safeguards under Applicable Data Protection Law, as follows.
10.1 Where processing happens. ModulawAI processes Personal Data in the United States (Amazon Web Services us-east-2, where we run our own databases, and us-east-1 for content delivery, and US-based sub-processors). Personnel of ModulawAI Nigeria Limited administer the service from Nigeria and may access Personal Data when needed to operate and support it. Live voice and video media are relayed through our own server in an AWS region in South Africa (af-south-1). Some sub-processors process in other countries, as listed in Annex III. ModulawAI does not process Personal Data in the European Economic Area and makes no EU data residency commitment.
10.2 EU Standard Contractual Clauses. To the extent Personal Data subject to the GDPR is transferred to ModulawAI in a country without an adequacy decision covering the transfer, the parties incorporate by reference the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the “SCCs“), completed as follows:
| SCC clause | Choice |
|---|---|
| Module | Module 2 (controller to processor) where the Customer is a controller. Module 3 (processor to processor) where the Customer is a processor |
| Clause 7 (docking clause) | Included |
| Clause 9(a) (sub-processors) | Option 2, general written authorisation. Time period: 30 days in advance, as in section 6 |
| Clause 11(a) (redress) | The optional independent dispute resolution body language is not used |
| Clause 13 (supervision) | Where the Customer is established in the EU: the supervisory authority of its Member State of establishment. Where it is not established in the EU but has appointed a representative under Art. 27 GDPR: the supervisory authority of the Member State where that representative is established. Otherwise: the supervisory authority of the Member State where the data subjects whose data is transferred are located |
| Clause 17 (governing law) | Option 1. The law of Ireland |
| Clause 18(b) (forum) | The courts of Ireland |
| Annex I | Annex I to this DPA |
| Annex II | Annex II to this DPA |
| Annex III | Annex III to this DPA |
10.3 Module 3. Where Module 3 applies, the Customer forwards to its controller, where needed, any notice ModulawAI gives under this DPA, and ModulawAI accepts instructions from the Customer as conveying the controller’s instructions.
10.4 UK Addendum. To the extent Personal Data subject to the UK GDPR is transferred to ModulawAI outside the UK without UK adequacy regulations covering the transfer, the parties incorporate by reference the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the UK Information Commissioner under s.119A(1) of the Data Protection Act 2018 (the “UK Addendum“), completed as follows:
- Table 1 (Parties): start date is the date the Customer accepts this DPA; the exporter is the Customer and the importer is ModulawAI Inc., with the details in Annex I; key contacts are the Customer’s workspace owner and security contact, and dpo@modulaw.ai.
- Table 2 (Selected SCCs): the Approved EU SCCs, Module 2 and Module 3, with the options in section 10.2 (clause 7 included; clause 9(a) option 2 with 30 days; clause 11 option not used).
- Table 3 (Appendix Information): Annex I (parties and description of transfer), Annex II (technical and organisational measures) and Annex III (sub-processors) of this DPA.
- Table 4 (Ending the Addendum): the Importer may end the UK Addendum as set out in its Section 19.
- Part 2 (Mandatory Clauses): the Mandatory Clauses of the Approved Addendum, template Addendum B1.0 issued by the Information Commissioner and laid before Parliament under s.119A of the Data Protection Act 2018 on 2 February 2022, as revised under its Section 18, are incorporated in full.
10.5 Onward transfers. ModulawAI makes onward transfers to sub-processors only where a transfer mechanism recognised by Applicable Data Protection Law is in place, such as an adequacy decision, the SCCs or the UK Addendum in the sub-processor’s terms, or, for ModulawAI Nigeria Limited, the intra-group agreement between ModulawAI, Inc. and ModulawAI Nigeria Limited.
10.6 Order of precedence. If this DPA conflicts with the SCCs or the UK Addendum, the SCCs or the UK Addendum prevail. ModulawAI’s cross-border transfer framework is also described in the Data Protection Policy.
11. Audit rights
ModulawAI shall make available to the Customer all information reasonably necessary to demonstrate compliance with this DPA, and shall allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, provided that:
- The Customer gives ModulawAI at least 30 days’ prior written notice.
- Audits are conducted no more than once per 12 months unless required by a supervisory authority.
- The Customer bears all costs of the audit unless the audit reveals material non-compliance by ModulawAI.
- The Customer executes a confidentiality agreement prior to any audit.
12. Liability
Each party’s liability under this DPA is subject to the limitations and exclusions set out in the Principal Agreement (Terms and Conditions). ModulawAI’s aggregate liability for breaches of this DPA shall not exceed the total fees paid by the Customer in the 12 months preceding the event giving rise to the claim, except where such limitation is not permitted by Applicable Data Protection Law or by the SCCs, including liability to Data Subjects under clause 12 of the SCCs.
13. Term and deletion
This DPA takes effect on the date the Customer first accepts the Terms and Conditions or executes an order form incorporating it, and remains in force for the duration of the Principal Agreement.
Upon termination or expiry of the Principal Agreement, ModulawAI shall, at the Customer’s choice, delete or return all Personal Data processed on the Customer’s behalf and delete existing copies, unless applicable law requires storage of the Personal Data:
- The Customer may export its content for 30 days after the end of the service, using the service’s export tools.
- After that period, or earlier on the Customer’s written request, ModulawAI deletes the Personal Data from live systems within 30 days.
- Personal Data in backups is overwritten on the backup provider’s expiry cycle. Until then it is kept isolated, remains protected by this DPA, and is not restored except for disaster recovery.
- On request, ModulawAI provides written certification of deletion, stating which stores were checked and when backup copies expire.
Any Personal Data that ModulawAI is required by law to keep remains protected by this DPA for as long as it is kept.
14. AI training prohibition
ModulawAI shall not use any Personal Data or Customer Content processed under this DPA to train, fine-tune, or improve any AI model (whether operated by ModulawAI or any third party), except where the Customer has given explicit, separate written consent for specific training purposes.
15. Governing law
This DPA is governed by the laws of the State of Delaware, USA, unless the Principal Agreement specifies otherwise, or unless mandatory provisions of Applicable Data Protection Law require a different governing law for specific obligations.
The SCCs are governed by the law of Ireland and the UK Addendum by the law of England and Wales, as stated in them.
Annex I: Description of processing and transfer
A. List of parties
- Data exporter: the Customer named in the order form or account, at the address stated there. Contact: the Customer’s workspace owner and security contact. Activities: use of the ModulawAI legal practice platform. Role: controller (Module 2) or processor (Module 3). Signature and date: by accepting this DPA in the service or signing the order form.
- Data importer: ModulawAI Inc., 7 Peter Utulu Close, Anu Crescent, Badore, Ajah, Lagos, Nigeria (US registered agent: Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713). Contact: dpo@modulaw.ai. Activities: providing the ModulawAI service under the Principal Agreement. Role: processor (Module 2) or sub-processor (Module 3). Signature and date: by accepting the Customer’s acceptance of this DPA.
B. Description of transfer
| Item | Description |
|---|---|
| Categories of data subjects | The Customer’s personnel and authorised users. The Customer’s clients and prospective clients. Counterparties, opposing parties and their counsel. Witnesses, experts and other persons named in matter files. Judges, court staff and officials named in documents. Guests on calls and recipients of emails, portal invitations and invoices sent through the service |
| Categories of personal data | Identity and contact data. Account and usage data (log-ins, IP address, device data, audit trail). Matter and case data (case records, notes, tasks, deadlines, documents, drafts). Communications (chats with the AI assistant, captured emails, team chat, WhatsApp messages). Voice and video (live call audio, recordings, transcripts). Financial data (invoices, time entries, payment status, bank details entered for payouts). Identity documents uploaded to matter files or intake forms. Any other personal data in documents the Customer uploads |
| Special category and criminal offence data | May be present, as decided by the Customer’s uploads. Safeguards: Annex II, in particular tenant isolation, encryption, access logging, restricted personnel access, and the rule in section 14 that Personal Data is never used for AI training |
| Frequency | Continuous, for the term of the Principal Agreement |
| Nature of processing | Hosting and storage; retrieval and search, including vector search over embeddings stored with the data; AI inference (summarisation, drafting, analysis, extraction) through model providers; OCR of scanned documents; speech-to-text and text-to-speech; real-time media relay for calls; email and notification delivery; billing and invoicing features; backup; security monitoring and logging; support |
| Purpose | To provide the service to the Customer under the Principal Agreement, including support, security and maintenance |
| Retention | For the term of the Principal Agreement, then as set out in section 13 |
| Transfers to sub-processors | Same nature and purpose as above, limited to what each sub-processor’s function needs, for the term of the Principal Agreement. See Annex III |
C. Competent supervisory authority
As set out for clause 13 in section 10.2.
Annex II: Technical and organisational measures
Only measures that are in place today are listed as in place. Where a measure is still being completed, this Annex says so. ModulawAI does not claim certifications it does not hold.
| Area | Measure | Status |
|---|---|---|
| Encryption in transit | TLS on all public endpoints. The web app is served over HTTPS | In place |
| Encryption at rest | Encryption at rest on our database servers’ Amazon EBS volumes and on Amazon S3 | In place |
| Field-level encryption | Application-level encryption of stored OAuth tokens and of bank details | OAuth tokens in place. Bank details in progress |
| Tenant isolation | Authorisation enforced in middleware and service layers across workspace, case, client, project and portal boundaries | In place |
| File access | Private storage bucket. Files are served only through links that expire | In place |
| Production access | Server access only through AWS Systems Manager Session Manager. No SSH and no static AWS keys on the server. Instance metadata service v2 required. Inbound traffic limited to HTTP and HTTPS. Cache reachable only from the backend | In place |
| Database access | Database network access restricted to a list of named addresses | In place |
| Authentication | Hashed passwords. httpOnly cookie sessions, CSRF tokens, refresh-token rotation with expiry, rate limiting. Multi-factor authentication available to users | In place. MFA is available, not enforced for all users |
| Administrative impersonation | Gated by a one-time passcode that expires in one hour and is written to the audit log | In place |
| Application audit logging | Audit log of authentication, case, client, document, financial, workspace and portal events, with actor and tenant identifiers | In place |
| Cloud audit logging | AWS CloudTrail with S3 data events and log file validation. S3 access logs | In place |
| Log minimisation | Application logs mask email addresses and phone numbers and reduce request bodies, prompts and transcripts to their size or key names. Application logs are kept 90 days. AI run monitoring (LangSmith) hides inputs and outputs in production and keeps metadata for 14 days | In place |
| AI vendors | No Customer Personal Data used for model training. AWS Bedrock account set to zero data retention with invocation logging off. Per-model vendor terms recorded in an internal register before a model is enabled | In place. Vendor register being completed |
| Backups | Encrypted database backups: a daily snapshot and continuous point-in-time recovery to Amazon S3, plus encrypted volume snapshots | In place. Point-in-time restore drill passed (October 2026) |
| Monitoring | Cloud alarms routed to on-call email. Storage integrity alert | In place. Security-event alerting being extended |
| Change management | Pull request review, CI gating, automated deployment with health check and automatic rollback | In place |
| Vulnerability management | Automated dependency updates. External penetration test | Dependency updates in place. Penetration test in progress |
| Incident response | Documented plan with severity, containment, evidence and notification steps. Customer notice within 48 hours (section 9) | Plan in place. Tabletop exercise not yet held |
| Personnel | Confidentiality obligations. Security awareness plan | In place. Training records being built |
| Governance | Information security management system aligned to ISO/IEC 27001:2022. Not certified | In progress |
| Deletion | Recycle bins purge after 30 days. Automatic expiry for tokens and short-lived records. End-to-end erasure across all stores | Recycle bins and expiry in place. Full erasure across all stores in progress |
Annex III: Sub-processors
The current list of sub-processors, with each one’s purpose, processing location and the transfer safeguards that apply, is published at modulaw.ai/subprocessors. That list, as at the date the Customer accepts this DPA, is Annex III. Changes follow section 6.
Execute this DPA
This page sets out our standard DPA terms. Enterprise customers requiring a countersigned DPA should contact us to initiate the process.
Email: dpo@modulaw.ai
ModulawAI Inc.
7 Peter Utulu Close, Anu Crescent, Badore, Ajah, Lagos, Nigeria (Principal Office)
Registered Agent: Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA