This Data Processing Agreement ("DPA") forms part of the HRMXGO Terms of Service (the "Agreement") between HRMXGO Inc. ("HRMXGO") and the Customer identified in the Agreement ("Customer"). Capitalized terms not defined in this DPA have the meanings given in the Agreement.
1. Definitions. "Applicable Data Protection Law" means all laws and regulations applicable to the processing of Personal Data under the Agreement, including, where applicable, the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations ("CCPA"), other United States state privacy laws, and, if and when Annex IV is activated, the EU General Data Protection Regulation and the UK GDPR. "Customer Personal Data" means Personal Data contained in Customer Data that HRMXGO processes on Customer's behalf. "Security Incident" has the meaning given in Section 4.6 of the Agreement. "Subprocessor" means any third party engaged by HRMXGO to process Customer Personal Data. "controller", "processor", "data subject", "personal data", "processing", "service provider", "business", "sell" and "share" have the meanings given in Applicable Data Protection Law.
2. Roles and scope. Customer is the controller (or business) and HRMXGO is the processor (or service provider) of Customer Personal Data. The subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of data subjects are described in Annex I. This DPA does not apply to Personal Data that HRMXGO processes as an independent controller under Section 4.7(b) of the Agreement.
3. Instructions. HRMXGO will process Customer Personal Data only on Customer's documented instructions, which consist of the Agreement, each Order, this DPA, and the configuration and use of the HRMXGO AI Platform (LockDocOS) by Customer and its Users, unless required to do otherwise by law, in which case HRMXGO will inform Customer of that requirement before processing unless the law prohibits it. HRMXGO will promptly inform Customer if, in HRMXGO's opinion, an instruction infringes Applicable Data Protection Law. Customer is responsible for the lawfulness of its instructions and for having the rights and consents required under Section 5.6 of the Agreement.
4. Confidentiality. HRMXGO will ensure that the persons it authorizes to process Customer Personal Data (currently HRMXGO's founder and any contractor or employee HRMXGO engages) are bound by written confidentiality obligations and, where applicable, receive appropriate training, and will limit access to those who need it to perform the Services.
5. Security. HRMXGO will implement and maintain the technical and organizational measures described in Annex II, and will not materially reduce the overall level of protection during the Term. Customer is responsible for the security of its own systems, credentials and Users, and for configuring the HRMXGO AI Platform appropriately.
6. Subprocessors.
6.1 Customer authorizes HRMXGO to engage the Subprocessors listed in Annex III, as published and updated at https://lockdocos.com/legal/subprocessors.
6.2 HRMXGO will give Customer at least thirty (30) days' notice before authorizing a new Subprocessor to process Customer Personal Data, by email to the Administrator or by a subscription mechanism on the subprocessor page. Notice is not required for a change of a Subprocessor's name, legal form or corporate group.
6.3 Customer may object in writing within the notice period on reasonable grounds relating to data protection. The Parties will discuss the objection in good faith. HRMXGO may resolve it by not using the new Subprocessor for Customer Personal Data, or by proposing another change.
6.4 If the objection is not resolved within thirty (30) days after it is received, Customer may terminate the affected Order on written notice and Section 3.4(b) of the Agreement will apply to the unexpired term.
6.5 HRMXGO will impose on each Subprocessor written data protection obligations that are no less protective than those in this DPA, to the extent applicable to the services the Subprocessor provides, and remains responsible to Customer for each Subprocessor's performance.
7. Data subject requests. HRMXGO will promptly, and in any event within five (5) business days, forward to Customer any request it receives from a data subject relating to Customer Personal Data, and will not respond to it except to acknowledge receipt or to direct the data subject to Customer, unless required by law. HRMXGO will provide reasonable assistance, through the functions of the HRMXGO AI Platform and, where those are insufficient, on request, to enable Customer to respond to data subject requests.
8. Assistance. Taking into account the nature of the processing and the information available to it, HRMXGO will provide reasonable assistance to Customer with security, Security Incident notification, data protection impact assessments and consultations with regulators, in each case to the extent they concern Customer Personal Data processed by HRMXGO. HRMXGO may charge its then-current professional services rates for assistance that goes beyond what is reasonably necessary to comply with Applicable Data Protection Law.
9. Security Incidents. HRMXGO will notify Customer of a Security Incident without undue delay and in any event within forty-eight (48) hours after HRMXGO confirms it (as "confirms" is described in Section 4.6(a) of the Agreement), and will provide information and cooperation, as set out in Section 4.6 of the Agreement. The notice will describe, to the extent known at the time, the nature of the Security Incident, the categories and approximate number of data subjects and of Customer Personal Data records affected, the likely consequences, the measures HRMXGO has taken or proposes to take, whether the Security Incident occurred on the systems of a Subprocessor, and the name and contact details of HRMXGO's point of contact (see Section 10 of the Privacy Policy), with further information provided in phases without undue delay as it becomes available.
10. Return and deletion. HRMXGO will make Customer Personal Data available for export and will delete it as set out in Section 4.5 of the Agreement (thirty-day export window, or fifteen days for Customer Personal Data uploaded during a Trial Period that does not become a paid subscription; deletion within sixty days thereafter; backups within a further ninety days), and will confirm deletion in writing on request. HRMXGO retains QA Data for up to ninety (90) days and abuse-monitoring data for up to thirty (30) days under Section 4.1(c) of the Agreement, and may retain operational, security and compliance records under Section 4.5(d)(v) of the Agreement that contain no document, Input or Output content but may contain User identifiers; HRMXGO protects those identifiers as Customer Personal Data under this DPA.
11. Audit and information.
11.1 HRMXGO will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA, including: (a) the current versions of HRMXGO's security documentation published at https://lockdocos.com/legal/data-security; (b) responses to a reasonable written security questionnaire not more than once in any twelve-month period; (c) confirmation of which third-party audit reports or certifications HRMXGO's hosting and AI Subprocessors hold, and the means by which Customer may request those reports directly from the Subprocessor under the Subprocessor's own confidentiality terms; and (d) once obtained, HRMXGO's own third-party audit reports or certifications, under obligations of confidentiality.
11.2 If the information under 11.1 is insufficient to demonstrate compliance, or a regulator with authority over Customer requires it, Customer or an independent auditor appointed by Customer and bound by confidentiality may audit HRMXGO's relevant controls once in any twelve-month period, on at least thirty (30) days' written notice, during business hours, in a manner that does not unreasonably disrupt HRMXGO's operations or compromise the security of other customers' data. Customer bears its own audit costs and will reimburse HRMXGO's reasonable costs where the audit exceeds two (2) business days.
11.3 Audit rights do not extend to Subprocessors' facilities or systems; for those, Customer may request the Subprocessor's most recent audit report or certification directly from the Subprocessor, and HRMXGO will identify the request channel.
12. Location of processing and international transfers.
12.1 HRMXGO hosts Customer Personal Data with the hosting Subprocessors listed in Annex III in data centres located in the United States, and transmits Customer Personal Data to the AI Subprocessors listed in Annex III. AI Subprocessors process Customer Personal Data in the United States, except that where an AI Subprocessor operates multi-region infrastructure and HRMXGO has not yet obtained a written commitment or account configuration confining the processing of HRMXGO's requests to the United States, that AI Subprocessor may also process Customer Personal Data in the additional locations identified for it in Annex III. Customer authorizes the locations stated in Annex III, including for Customer Personal Data originating in Canada. HRMXGO will update Annex III as it obtains United States-only commitments, and will give notice under clause 6.2 before any Subprocessor is permitted to process Customer Personal Data in a location not listed in Annex III.
12.2 HRMXGO will notify Customer in accordance with clause 6.2 before adding a new hosting location.
12.3 Annex IV (EU and UK Transfers) is reserved. HRMXGO does not currently offer the Services to customers established in the European Economic Area or the United Kingdom, and Annex IV must be activated before any Customer Personal Data subject to the EU GDPR or UK GDPR is transferred to HRMXGO. Until Annex IV is activated in writing, no Personal Data subject to the EU GDPR or UK GDPR is to be processed under this DPA, and Customer will not upload such Personal Data to the Services.
13. United States and Canadian privacy laws.
13.1 United States. To the extent Customer is a "business" and HRMXGO a "service provider" or "contractor" under the CCPA, or the equivalent under another United States state privacy law, HRMXGO: (a) will process Customer Personal Data only for the business purposes specified in Annex I and the Agreement; (b) will not sell or share Customer Personal Data; (c) will not retain, use or disclose Customer Personal Data outside the direct business relationship between the Parties or for any purpose other than the business purposes specified, except as permitted by the CCPA; (d) will not combine Customer Personal Data with personal data it receives from other sources, except as permitted by the CCPA; (e) will comply with the obligations applicable to service providers under the CCPA and provide the same level of privacy protection as the CCPA requires of businesses; (f) will notify Customer if it determines it can no longer meet its obligations under the CCPA; (g) grants Customer the right to take reasonable and appropriate steps to ensure that HRMXGO uses Customer Personal Data in a manner consistent with Customer's obligations under the CCPA, and to stop and remediate unauthorized use, through the mechanisms in clauses 3 and 11; and (h) will flow down the obligations in this clause 13 to its Subprocessors. HRMXGO certifies that it understands these restrictions and will comply with them.
13.2 Canada. To the extent Customer Personal Data is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25, the Alberta Personal Information Protection Act or the British Columbia Personal Information Protection Act: (a) Customer acknowledges that HRMXGO processes Customer Personal Data in the United States, where it may be accessible to United States authorities under United States law, and Customer is responsible for any notice to individuals that Applicable Data Protection Law requires regarding processing outside Canada or outside Quebec; (b) HRMXGO will provide reasonable assistance, on request, with any privacy impact assessment that Customer is required to conduct before communicating personal information outside Quebec, including by providing the information in Annexes II and III; (c) HRMXGO will notify Customer of Security Incidents under clause 9 so that Customer can assess whether an incident presents a real risk of significant harm or a risk of serious injury to individuals and make any notifications required of it, and HRMXGO will keep a record of Security Incidents involving Customer Personal Data for the period Applicable Data Protection Law requires; (d) HRMXGO will provide a level of protection for Customer Personal Data comparable to that required of Customer under Applicable Data Protection Law, through the measures in this DPA, regardless of the location of processing; (e) the person in charge of the protection of personal information at HRMXGO for the purposes of Quebec's Act is identified, with their title and contact details, in Section 10 of the Privacy Policy at https://lockdocos.com/legal/privacy; and (f) HRMXGO will assist Customer under clause 7 with requests by individuals for access to, rectification of, or cessation of dissemination of their personal information, and with requests for information about the processing of their personal information outside Quebec.
14. Liability. Each Party's liability under this DPA is subject to the limitations and exclusions in Article 10 of the Agreement, including the cap in Section 10.1(b) of the Agreement, which applies to claims under this DPA.
15. Term; precedence; updates. This DPA applies for so long as HRMXGO processes Customer Personal Data. In the event of conflict between this DPA and the Agreement concerning the processing of Customer Personal Data, this DPA prevails; in the event of conflict between this DPA and an activated Annex IV, Annex IV prevails. HRMXGO may update this DPA on thirty (30) days' notice where the update is required by Applicable Data Protection Law or does not materially reduce Customer's protections; other updates require Customer's agreement under Section 13.14 of the Agreement.
Annex I: Description of Processing
Subject matter. Provision of the HRMXGO AI Platform, an AI-assisted contract and document processing service, and related support. Duration. The Term of the Agreement, plus the export and deletion periods in Section 4.5 of the Agreement. Nature and purpose. Storage, organisation, classification, extraction, summarisation, analysis, drafting assistance and retrieval of documents uploaded by Customer and its Users; transmission of document content and prompts to AI Subprocessors to generate Output, including transient caching by AI Subprocessors used solely to serve HRMXGO's requests; hosting; backup; support; quality assurance and abuse monitoring as described in Section 4.1(c) of the Agreement; and, where Customer has agreed under Section 4.1(c)(vi) of the Agreement, development or improvement of models or features for Customer. Types of Personal Data. Any Personal Data contained in documents Customer chooses to upload, which may include names, contact details, job titles, employment terms and compensation, identification numbers, financial information, and any other data present in contracts and related documents; User account data (name, business email, job title) to the extent it appears in Customer Data. Special categories. Not required by the Services. Customer is responsible for not uploading, or for having a lawful basis to upload, health, biometric, or other sensitive data. Categories of data subjects. Customer's employees, contractors and Users; Customer's clients, counterparties, suppliers and their personnel; any other individuals named in uploaded documents. Frequency. Continuous during the Term.
Annex II: Technical and Organisational Measures
HRMXGO maintains the following measures, described in more detail at https://lockdocos.com/legal/data-security:
1. Encryption of Customer Data at rest using AES-256 or stronger, and in transit over public networks using TLS 1.2 or stronger (Agreement, Section 4.1(b)(i)).
2. Logical separation of each Customer's data from that of other customers.
3. Role-based access control; multi-factor authentication for HRMXGO personnel with access to production systems; least-privilege and periodic access reviews.
4. Hosting on the hosting Subprocessors listed in Annex III, each of which holds a SOC 2 Type II report, in the regions stated in clause 12. Certifications held by AI Subprocessors are confirmed under clause 11.1(c). Reports are available from each provider on request under that provider's own confidentiality terms.
5. Contractual no-training commitments from all AI Subprocessors. Zero retention of inputs and outputs where the AI Subprocessor has committed to it in HRMXGO's written agreement with it (including in security documentation incorporated by reference into that agreement) or it has been enabled for HRMXGO's account; HRMXGO uses each such AI Subprocessor only in configurations to which zero retention applies and does not enable optional features (such as asynchronous or queued inference) that would store inputs. Where zero retention is stated only in an AI Subprocessor's published documentation and not in HRMXGO's written agreement with it, HRMXGO identifies that AI Subprocessor as such. In all other cases retention is limited to transient caching used solely to serve HRMXGO's requests, abuse-monitoring and legal-compliance purposes, and does not exceed 30 days. The position for each AI Subprocessor, and whether it is contractual, enabled for HRMXGO's account or stated in documentation only, is published at https://lockdocos.com/legal/data-security (Agreement, Section 4.1(b)).
6. Logging and monitoring of production access and security events; vulnerability management; patching.
7. Backups with defined rotation; tested restoration.
8. Documented incident response procedure supporting the 48-hour notification in Section 4.6 of the Agreement.
9. Written confidentiality obligations for any person with access to Customer Data. Where HRMXGO engages contractors or employees, access is granted on a least-privilege basis for the duration of the engagement and removed on its conclusion.
10. Secure development practices, including automated dependency and secret scanning in the build pipeline, and documented change management for production releases.
11. Retention limits for QA Data (90 days) and abuse-monitoring data (30 days); deletion at end of service under Section 4.5.
Annex III: Subprocessors
Current list published and maintained at https://lockdocos.com/legal/subprocessors. Customer Personal Data is hosted in the United States. AI Subprocessors process it in the United States.
A. Subprocessors of Customer Personal Data
| Subprocessor | Purpose | Location of processing |
|---|---|---|
| Railway Corporation | Cloud hosting | USA |
| SpaceXAI LLC | AI model services (Third Party LLM) | USA |
| Together Computer, Inc. | AI model inference services (Third Party LLM) | USA |
| Fireworks AI, Inc. | AI model inference services (Third Party LLM) | USA |
| Microsoft Corporation | AI model services (Third Party LLM), if used | USA |
| Google LLC | Business email and support (Google Workspace) | USA |
B. Vendors processing account, billing and website data only (not Customer Personal Data)
| Vendor | Purpose | Location |
|---|---|---|
| Stripe LLC | Payment processing and billing | USA |
| Google LLC | Website analytics (Google Analytics) | USA |
Annex IV: EU and UK Transfers
Reserved. To be activated, with the EU Standard Contractual Clauses (Module 2, controller to processor) and the UK International Data Transfer Addendum attached, before HRMXGO offers the Services to customers established in the EEA or the UK.