Data Processing Agreement (DPA) — Lexform service

Recitals — Parties and background

BETWEEN THE UNDERSIGNED

ZEVRA, a French simplified joint-stock company (société par actions simplifiée) with a share capital of EUR 1,000, registered with the Paris Trade and Companies Register under number 101 202 216 (EU VAT number FR55101202216), having its registered office at 47 rue Vivienne, 75002 Paris, France, represented by its President, HAUC CONSULTING, itself represented by Pierre Colliot, duly authorised.

Hereinafter "Zevra" or the "Processor".

AND

The customer having subscribed to the Lexform service, as identified in the order form, the online subscription form or the main agreement to which this agreement is appended.

Hereinafter the "Customer" or the "Controller".

Hereinafter jointly the "Parties" and individually a "Party".

RECITALS

Zevra publishes Lexform, a software service that pseudonymises professional documents before they are submitted to a generative artificial intelligence. Identities contained in a document (natural persons, companies, IBANs, social security numbers, addresses) are detected by a private AI engine hosted by Zevra in France and replaced with neutral tokens. The mapping table that allows identities to be restored is generated and kept exclusively on the user's device. Zevra never has access to it.

The Customer, a professional bound where applicable by professional secrecy, wishes to use Lexform to protect the personal data contained in its documents. In this context, Zevra processes personal data on behalf of the Customer and in accordance with its instructions.

This agreement (the "DPA") sets out the terms of such processing in accordance with Article 28 GDPR. It supplements the main agreement entered into between the Parties for the provision of the Lexform service (the "Agreement"). It has been drafted to be read and understood without an intermediary: each commitment is stated in a direct and verifiable manner.

Article 1 — Definitions

The terms "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meaning given to them in Article 4 GDPR.

Article 2 — Purpose and role of the parties

2.1 The purpose of the DPA is to set out the terms under which Zevra processes Data on behalf of the Customer in connection with the Service.

2.2 The Customer is the controller. It alone determines the purposes and means of the processing of Data, decides which Content is submitted to the Service and what it does with the Pseudonymised Content.

2.3 Zevra is the processor. It processes Data solely to provide the Service, in accordance with the Customer's instructions and within the limits of the DPA.

2.4 The management of the Customer's team space (creation of User accounts, roles, invitations, consumption caps) is carried out on behalf of the Customer: User account data is Data within the meaning of the DPA. Conversely, Zevra acts as a controller, and not as a processor, only for the processing operations necessary to run its own business: invoicing and accounting, security of its own infrastructure and the related technical logs. Such processing is described in Zevra's privacy policy and falls outside the DPA. Usage counters serve both purposes: they fall under the DPA where they enable the Customer to administer its Users' credits and caps, and under Zevra's own responsibility where they form the basis of invoicing.

2.5 The Parties acknowledge that the transmission of Pseudonymised Content to a Third-Party AI is a decision and an operation of the Customer. Zevra is not a party to the contracts entered into between the Customer and Third-Party AI providers and assumes no liability for the processing carried out by such providers. Article 6 specifies the extent of Zevra's involvement at that stage.

Article 3 — Description of the processing

3.1 The nature, purpose and duration of the processing, and the categories of Data and data subjects, are described in Annex 1.

3.2 The Customer warrants that it has a lawful basis for each processing operation it entrusts to Zevra and that it has complied with its obligations to inform data subjects. The Customer remains solely responsible for the lawfulness of the Content it submits to the Service and for compliance with any professional secrecy rules applicable to it.

3.3 The Customer shall not submit to the Service any Data whose processing by Zevra, even on a transient basis, would be prohibited by law or by a court decision.

Article 4 — Customer instructions

4.1 Zevra processes Data solely on documented instructions from the Customer, including with regard to any transfer to a third country or an international organisation, unless required to do so by European Union or French law. In the latter case, Zevra shall inform the Customer of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.

4.2 The Agreement, the DPA and the use of the Service by Users in accordance with the documentation constitute the Customer's documented instructions. Any additional instruction shall be sent in writing to the address indicated in Article 16.7. Zevra may refuse an instruction that exceeds the scope of the Service or make its performance subject to agreement on its technical and financial terms.

4.3 Zevra shall immediately inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law. It may then suspend performance of the instruction concerned until the Customer confirms or amends it.

4.4 Zevra shall not use the Content, the Pseudonymised Content or the Data for its own purposes, including to train, fine-tune or evaluate an artificial intelligence model, except upon express written instruction from the Customer. The detection quality of Zevra's engine is measured on corpora that do not include customer Content.

Article 5 — Operation of the service and no retention

5.1 Content is transmitted to Zevra's servers over an encrypted channel (TLS). It is processed in volatile memory for the duration of the request only. It is not written to any persistent storage, whether in clear text or encrypted, nor in any backup. Upon completion of the request, the Content and the Pseudonymised Content are erased from the servers' memory. All servers that receive and process Content are located in France.

5.2 Optical character recognition of scanned documents is performed by an engine embedded in Zevra's servers. No Content is entrusted to a third-party OCR service.

5.3 Identity detection is performed by Zevra's own artificial intelligence engine, self-hosted on dedicated GPU servers located in France. No Content is transmitted by Zevra to any Third-Party AI provider whatsoever.

5.4 The Mapping Table is generated and kept on the User's device. It is neither transmitted to Zevra nor stored on its servers. Zevra is technically unable to restore the replaced identities.

5.5 Under the Service, Zevra retains only usage counters (number of documents processed, volume, timestamp, User identifier) necessary to manage credits, consumption caps and invoicing. These counters contain no element of the Content.

5.6 The Parties agree that the pseudonymisation performed by the Service does not amount to anonymisation within the meaning of Applicable Data Protection Law. Pseudonymised Content remains personal data in the hands of the Customer for as long as the Customer holds the Mapping Table.

Article 6 — Browser extension and third-party AI

6.1 The Lexform browser extension intercepts the text that the User is about to send to a Third-Party AI on the declared domains, transmits it to Zevra's servers for pseudonymisation under the conditions of Article 5, and returns the Pseudonymised Content to the User's browser. The extension requests only the permissions strictly necessary for that function and is active only on the domains declared in its documentation.

6.2 The transmission of Pseudonymised Content to the Third-Party AI is carried out from the User's browser, under the Customer's account and responsibility. Zevra is not involved in that transmission, in the processing carried out by the Third-Party AI, or in the retention of its responses.

6.3 It is the Customer's responsibility to verify that the terms of use and data protection commitments of the Third-Party AI providers it selects are consistent with its own obligations, in particular regarding transfers outside the European Union and professional secrecy. Zevra gives no warranty in this respect.

6.4 The Service reduces the risk associated with the use of a Third-Party AI; it does not eliminate it. Identity detection relies on a statistical model whose detection rate, measured and published by Zevra, does not reach one hundred per cent. The Customer retains control over the Pseudonymised Content before it is sent and remains responsible for reviewing it where the sensitivity of the Content so requires.

Article 7 — Confidentiality

7.1 Zevra shall ensure that persons authorised to process the Data are bound by an appropriate contractual or statutory obligation of confidentiality and that they access the Data only to the extent strictly necessary for the performance of the Service.

7.2 Given the architecture of the Service described in Article 5, no member of Zevra's staff accesses Content in the ordinary course of operations. Any exceptional access to Data, for example in connection with an incident, is logged, restricted to authorised persons and justified by a documented technical reason.

7.3 Zevra treats the Content and the Pseudonymised Content as confidential information of the Customer, irrespective of their classification under Applicable Data Protection Law. This obligation survives termination of the Agreement.

Article 8 — Security of processing

8.1 Zevra implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR. These measures are described in Annex 2.

8.2 Zevra may update these measures to reflect the state of the art and evolving threats, provided the overall level of security is not reduced. Any material change shall be brought to the Customer's attention through an update of the Service's security documentation.

8.3 The Customer is responsible for the security of its own environment: workstations, browsers, User account management, safekeeping of Mapping Tables, and configuration of roles and consumption caps within its team space. Zevra recommends centralised deployment of the extension through enterprise browser policies and immediate revocation of access for Users leaving the Customer.

Article 9 — Sub-processing

9.1 The Customer grants Zevra a general authorisation to engage the Sub-processors listed in Annex 3. As at the date of the DPA, the sole Sub-processor is the hosting provider of the Service's infrastructure, whose servers are located in France.

9.2 Zevra shall inform the Customer of any intended addition or replacement of a Sub-processor at least thirty (30) days before it takes effect, by e-mail to the account owner's address or by notification within the Service. The Customer may object in writing within that period on legitimate data protection grounds. In the event of an objection, the Parties shall seek a solution in good faith. Failing agreement within thirty (30) days of the objection, the Customer may terminate the Agreement without penalty for the affected part of the Service, and any prepaid amounts shall be refunded pro rata.

9.3 Zevra shall enter into a written contract with each Sub-processor imposing data protection obligations at least equivalent to those of the DPA, in particular as regards security, confidentiality and data location. Zevra remains fully liable to the Customer for the performance by its Sub-processors of their obligations.

Article 10 — Assistance to the customer

10.1 Data subject rights. Zevra shall forward to the Customer, without undue delay and at the latest within five (5) business days, any request to exercise rights (access, rectification, erasure, restriction, portability, objection) it receives directly from a data subject in relation to the Data. Zevra shall not respond to such requests itself unless instructed by the Customer. As Content is not retained, Zevra's assistance relates in practice to User account data, which the Customer may view, amend and delete autonomously through the Service's administration features.

10.2 Security, breaches, impact assessment. Taking into account the nature of the processing and the information available to it, Zevra shall assist the Customer in complying with its obligations under Articles 32 to 36 GDPR. It shall make available its security documentation, its hosting provider's certifications and, upon reasoned request, the information necessary to carry out a data protection impact assessment or a prior consultation of the supervisory authority.

10.3 The assistance provided under this Article is free of charge to the extent that it remains reasonable in view of the nature of the Service. Beyond that, or where the request results from a breach by the Customer, Zevra may charge for its intervention at the agreed rate or, failing that, at its then-current hourly rate, after informing the Customer.

Article 11 — Personal data breach

11.1 Zevra shall notify the Customer of any breach affecting the Data without undue delay and at the latest forty-eight (48) hours after becoming aware of it, by e-mail to the account owner's address and to any contact designated by the Customer for that purpose.

11.2 The notification shall describe, to the extent the information is available: the nature of the breach; the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach and mitigate its effects; the point of contact at Zevra. Where all information is not available at the same time, it shall be provided in phases without undue further delay.

11.3 Zevra shall document any breach affecting the Data and cooperate with the Customer to enable it to comply with its obligations to notify the supervisory authority and, where applicable, to communicate with data subjects. Zevra shall not itself notify the supervisory authority or data subjects on behalf of the Customer, except upon the Customer's written instruction or under its own legal obligation.

11.4 The Parties acknowledge that, since Content is not retained on Zevra's servers, a breach affecting Zevra's infrastructure can in principle only concern account data and usage counters. This circumstance is taken into account in the risk assessment, without relieving Zevra of the notification required under this Article.

Article 12 — Data location and transfers

12.1 Hosting and the processing operations carried out by Zevra are located in France: the application servers, the artificial intelligence engine, the account databases and their backups are hosted in the data centres of the hosting provider referred to in Annex 3, located in Gravelines and Strasbourg. The Content and the Pseudonymised Content never leave France: Zevra neither carries out nor authorises any transfer thereof, whether to another Member State of the European Union or to a third country. The only Data leaving France are the account data strictly necessary to send transactional e-mails and to process payments, disclosed to the providers named in Annex 3 under the conditions described in Annex 4. This commitment covers the processing means operated by Zevra; it does not extend to the location from which Users access the Service, which is a matter for the Customer.

12.2 Any future transfer to a third country requires the Customer's prior written consent and the implementation of a valid transfer mechanism under Chapter V GDPR (adequacy decision, European Commission standard contractual clauses supplemented, where appropriate, by documented supplementary measures). The terms of such transfer would be described in Annex 4.

12.3 This Article does not apply to transfers carried out by the Customer itself when submitting Pseudonymised Content to a Third-Party AI, which remain its sole responsibility in accordance with Article 6.

Article 13 — Audits and demonstration of compliance

13.1 Zevra shall make available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR: this DPA, its security documentation, the list of its Sub-processors, its hosting provider's certificates (ISO/IEC 27001, 27017, 27018, 27701, SOC 1, 2 and 3, HDS) and responses to a reasonable security questionnaire once a year.

13.2 The Customer may, once in any twelve (12) month period, have an audit of Zevra's compliance with the DPA carried out, either by itself or by an independent auditor bound by confidentiality and not a competitor of Zevra. The audit shall be notified with thirty (30) days' notice, take place during business hours, not disrupt the operation of the Service and respect the confidentiality of Zevra's other customers. The costs of the audit shall be borne by the Customer, unless it reveals a material breach by Zevra.

13.3 In the event of a breach affecting the Data or a request from a supervisory authority, the Customer may request an additional audit without waiting for the twelve-month period to elapse, with notice reduced to ten (10) days.

13.4 Zevra shall provide the Customer with a copy of the audit report together with its comments, if any, and shall implement the necessary corrective measures within a reasonable time.

Article 14 — Data upon termination

14.1 Content and Pseudonymised Content are erased upon completion of each request in accordance with Article 5. Accordingly, upon termination of the Agreement, there is no Content to be returned or deleted from Zevra's servers.

14.2 Within thirty (30) days following termination of the Agreement for any reason, Zevra shall delete User account data and identifiable usage counters. Upon the Customer's written request made before the expiry of that period, Zevra shall first provide the Customer with an export of such data in a structured, commonly used and machine-readable format.

14.3 Beyond that period, Zevra may retain only such data as it is legally required to retain (in particular for accounting and tax purposes), for the duration of that obligation and in a form restricting its accessibility. Zevra shall certify deletion in writing upon the Customer's request.

Article 15 — Liability

15.1 Each Party is liable for damage caused by processing that infringes Applicable Data Protection Law under the conditions of Article 82 GDPR. Zevra is liable only for damage resulting from a breach of the obligations specifically imposed on processors or from processing carried out outside the Customer's lawful instructions.

15.2 Zevra's liability under the DPA is subject to the limitations and exclusions set out in the Agreement. However, the liability cap provided for in the Agreement shall not apply to damage resulting from Zevra's deliberate breach of Article 4.4 (use of Data for its own purposes) or Article 12.1 (Data location), without prejudice to the rules of French law on gross negligence and wilful misconduct.

15.3 The Customer shall indemnify Zevra against any claim, fine or judgment resulting from the Customer's failure to comply with its own obligations as controller, in particular regarding the lawfulness of the Content submitted to the Service and its use of the Pseudonymised Content.

Article 16 — Term, precedence and general provisions

16.1 The DPA takes effect on the date of acceptance of the Agreement and remains applicable for as long as Zevra processes Data on behalf of the Customer, including during the period provided for in Article 14.

16.2 In the event of any conflict between the DPA and the Agreement on a matter relating to the protection of personal data, the DPA shall prevail. On any other matter, the Agreement shall prevail.

16.3 Zevra may amend the DPA to reflect a change in Applicable Data Protection Law, a position taken by a supervisory authority or a change to the Service, subject to thirty (30) days' notice to the Customer. If the amendment reduces the level of protection of the Data, the Customer may terminate the Agreement without penalty before the amendment takes effect.

16.4 If any provision of the DPA is held invalid or unenforceable, the remaining provisions shall remain in force and the Parties agree to replace the affected provision with a valid provision having an equivalent effect.

16.5 The DPA is governed by French law. Any dispute relating to its interpretation or performance shall be submitted to the court designated in the Agreement, to the extent that such designation is enforceable against the Customer, and otherwise to the courts having jurisdiction under the ordinary rules of French law.

16.6 The DPA is drawn up in French and in English. In the event of any discrepancy between the two versions, the French version shall prevail.

16.7 Any notice under the DPA shall be given in writing: for Zevra, to 47 rue Vivienne, 75002 Paris, France, or to the e-mail address contact@zevra.tech; for the Customer, to the account owner's address or to any other address designated by the Customer within the Service.

Executed in two original copies, or accepted electronically under the terms of the Agreement.

For Zevra

Name: Pierre-Louis ROQUET

Title: Chief Legal Officer

Date:

Signature:

For the Customer

Name:

Title:

Date:

Signature:

Annex 1 — Description of the processing

Annex 2 — Technical and organisational measures

Annex 3 — Authorised sub-processors

The current list is made available to the Customer at https://lexform.zevra.tech/dpa and notified under the conditions of Article 9.

Annex 4 — Transfers outside the European Union

Content: none. The means used by Zevra to process Content and Pseudonymised Content are located in France (Article 12.1); no Content is transferred outside France, let alone outside the European Union or the European Economic Area. Account data: two transfers, limited to the User's e-mail address and, for payment, to the amount invoiced. Destination country: United States. Importers: Resend, Inc. (transactional e-mails) and Stripe, Inc. together with Stripe Payments Europe, Ltd. (payment). Mechanism relied upon: European Commission standard contractual clauses, Implementing Decision (EU) 2021/914, controller-to-processor modules, supplemented by each provider's data processing agreement. Supplementary measures: encryption in transit, minimisation of the data disclosed, exclusion of any Content, Pseudonymised Content and Mapping Table.

Any future transfer shall be subject to the Customer's prior written consent and documented in this Annex: destination country, importer, transfer mechanism relied upon (adequacy decision or European Commission standard contractual clauses, Implementing Decision (EU) 2021/914), outcome of the transfer impact assessment and supplementary measures implemented.