Data Processing Agreement (DPA)

This Data Processing Agreement forms part of the Terms of Service between LAW AGENT BRASIL LTDA (the "Data Processor" or "Processor") and the User (the "Data Controller" or "Controller"), and governs the processing of personal data carried out on behalf of the Controller. AI BRAINS LABS LLC acts as Sub-processor (technical execution of the processing and support).

1. Definitions

The definitions set out in Art. 5º of the LGPD and in the International Transfer Regulation (Res. CD/ANPD 19/2024) apply.

2. Purpose and roles

2.1. The Processor (and, under its responsibility, the Sub-processor) processes the personal data contained in the Input Data exclusively in accordance with the Controller's documented instructions, in order to generate the results requested through the SYSTEM.

2.2. The Controller is responsible for defining the purposes and the legal basis (typically Art. 7º, V and VI; Art. 11, II, "d", for sensitive data processed in the exercise of rights).

3. Obligations of the Processor (and of the Sub-processor)

(i) process the data only in accordance with the Controller's instructions; (ii) not use the data to train AI models; (iii) ensure the confidentiality of authorized personnel; (iv) adopt the security measures set out in Clause 6; (v) assist the Controller with Data Subject rights (Art. 18) and with the Data Protection Impact Report (Art. 38); (vi) notify incidents (Clause 7); (vii) delete/return the data upon termination (Clause 8). The Processor is liable for the Sub-processor's conduct.

4. Sub-processors

4.1. The Controller authorizes the Processor to engage AI Brains Labs LLC as Sub-processor and, through it, the following personal-data sub-processors:

4.1.1 The current list is maintained and versioned at lawagent-ai.com/subprocessadores, and the version published there shall prevail.

4.1.2 Services outside the personal-data perimeter. The SYSTEM integrates third-party services intended exclusively for querying public sources, identified by function rather than by provider; the provider of each function may be replaced without altering this DPA:

4.1.3 The services referred to in Clause 4.1.2 do not receive personal data — no party names, case numbers, contents of the User's documents, or information identifying the User's clients are transmitted to them — and, for that reason, they do not constitute sub-processors for the purposes of this DPA.

4.1.4 Should the architecture come to require the transmission of personal data to any of the services referred to in Clause 4.1.2, the corresponding provider will be reclassified as a sub-processor and included in the list under Clause 4.1, subject to the prior notice required by Clause 4.3.

4.2. The Processor imposes on the Sub-processor and other sub-processors obligations equivalent to those set out in this DPA.

4.3. The addition or replacement of a sub-processor will be communicated to the Controller at least 30 (thirty) days in advance, and the Controller may object for a legitimate and substantiated reason within 15 (fifteen) days of that communication. If no consensual solution is reached within 30 (thirty) days of the objection, the Controller may terminate, at no cost, with respect to the affected functionality.

5. International data transfer

5.1. AI processing takes place abroad, on an ephemeral basis, owing to technical necessity (the unavailability of advanced models in a Brazilian region); storage remains in Brazil (São Paulo).

5.2. The international transfer of personal data from the Processor to the Sub-processor is governed by the Standard Contractual Clauses approved by the ANPD (Resolução CD/ANPD nº 19, de 23 de agosto de 2024, Anexo II), adopted in their entirety and without alteration, and executed between the Processor and the Sub-processor under a separate instrument, available to the Controller upon reasoned request.

For the purposes of Clause 4 of Anexo II, Option B applies — a transfer conducted exclusively between processors, with the Processor (Law Agent Brasil) as the exporting party and the Sub-processor (AI Brains Labs) as the importing party, the United States of America being the country of destination.

Any onward transfer to infrastructure and processing providers is governed by an instrument executed between the Sub-processor and each provider, with equivalent safeguards.

5.3. Safeguards: storage in Brazil; zero retention (ZDR); encryption in transit and at rest; no training.

6. Information security

Isolation via Row Level Security (RLS); encryption; access control and privilege segregation; private signed URLs; access logs. Measures reviewed in accordance with the state of the art.

7. Incident notification

7.1 A security incident that may give rise to relevant risk or harm will be notified to the Controller within no more than 3 (three) days of the Processor becoming aware of it, together with the information necessary to comply with the notification obligations to the ANPD and to Data Subjects (art. 48 of the LGPD).

7.2 The notification will contain, to the extent known: the nature of the incident; the categories and approximate number of Data Subjects and records affected; the likely consequences; the measures adopted and proposed; and a contact channel. Information not available at the time of the initial notification will be provided incrementally, and its absence will not justify delay.

7.3 The Sub-processor undertakes to notify the Processor within no more than 24 (twenty-four) hours of becoming aware of the incident, so as to enable compliance with the deadline set out in Clause 7.1.

7.4 Notification to Data Subjects and to the ANPD is the Controller's responsibility. The Processor and the Sub-processor will not communicate directly with Data Subjects about the incident without the Controller's prior consent, except where required by law or by order of an authority.

8. Termination, deletion, and return

8.1 Upon termination of the agreement, the Processor will keep available to the Controller, for 30 (thirty) days, a mechanism for exporting the data in a structured, commonly used format.

8.2 After that period has elapsed, personal data will be deleted from production environments within 30 (thirty) days and from backup copies according to the rotation cycle, which will not exceed 90 (ninety) days, remaining isolated and inaccessible during that interval.

8.3 The Processor will issue the Controller a statement of deletion, indicating the date and scope.

8.4 Retention required by law is permitted, limited to the minimum necessary, with a record of the legal basis and the security and confidentiality obligations remaining in force for as long as it lasts.

9. Audit

Upon reasonable notice and subject to confidentiality, the Processor will make available information/reports to demonstrate compliance; verification may be satisfied by third-party reports/certifications.

10. Liability and governing law

The LGPD (Arts. 42-45) applies, with a right of recourse between the parties. This DPA is governed by Brazilian law; any dispute follows the venue set out in the Terms of Service.

11. Data Protection Officer (DPO)

11.1 Under art. 41 of the LGPD, the Processor's Data Protection Officer is Lahire Faria, and the contact channel for Data Subjects and for the ANPD is adm@lawagentapp.com.

11.2 The Sub-processor's Data Protection Officer is André Estrella; contact: support@aibrainslabsapp.com.

11.3 Any change of Data Protection Officer will be published on this page.

12. Description of the processing

12.1 Categories of Data Subjects: lawyers and other professionals who are users of the User; clients and opposing parties identified in documents submitted to the SYSTEM; third parties mentioned in those documents.

12.2 Categories of personal data: identification and contact data of users; the content of pleadings, documents, and communications submitted to the SYSTEM; identification data of parties and third parties contained therein; access and usage logs.

12.3 Sensitive data: the SYSTEM may process sensitive personal data (art. 5º, II, of the LGPD) present in documents submitted by the User, notably in labor, social security, family, and criminal matters. The User, in its capacity as Controller, defines the applicable legal basis, typically art. 11, II, "d" (the regular exercise of rights in proceedings).

12.4 Purpose: generating the results requested by the User in the SYSTEM, technical support, and security.

12.5 Nature and duration: automated processing, for the term of the agreement and the deletion periods set out in Section 8.

12.6 Frequency of international transfer: continuous, occurring with each operation that depends on processing by artificial intelligence models.

13. Requests from foreign authorities

13.1 If the Sub-processor receives an order from a foreign governmental authority to access personal data processed under this DPA, it undertakes to: (i) notify the Processor and, through it, the Controller, immediately, unless expressly prohibited by law; (ii) challenge the order through the appropriate means; (iii) limit disclosure to the minimum required; and (iv) keep a record of the request and of the response.

13.2 If there is a legal prohibition on notification, the Sub-processor will notify as soon as the prohibition ceases.

13.3 The Sub-processor has not granted, and will not grant, direct, general, or unrestricted access to personal data processed under this DPA to any authority.