Data Processing Agreement

Version 2026-10-22 · Effective October 22, 2026 · Part 2 of the Papeles agreement. It is part of the Terms of Service.

This Data Processing Agreement ("DPA") is part of the Terms of Service between Papeles LLC and the Firm. It governs how Papeles handles Firm Data, which includes highly sensitive personal information of the Firm's clients.

1. Roles and scope

1.1 Roles. The Firm decides what client information to collect and why; it is the owner and controller of Firm Data. Papeles processes Firm Data only on the Firm's behalf, to provide the Service.

1.2 Data covered.

1.3 Duration. This DPA lasts as long as Papeles holds Firm Data, including the deletion period in Part 1, Section 4.6.

2. How Papeles handles Firm Data

2.1 Instructions. Papeles processes Firm Data only to provide, secure and support the Service, and as the Firm directs through the Service or in writing. If an instruction would break the law, Papeles will tell the Firm.

2.2 No other use. Papeles will not sell Firm Data, use it for marketing, combine it with other firms' data, or use it to train any machine-learning model.

2.3 People. Today only Papeles's owner has access to the servers and to Firm Data outside the Firm's own logins. Before anyone else is given that access, they will sign a written confidentiality agreement, and their access will be limited to what their work needs.

2.4 Access by Papeles's owner. Papeles is owned by a practicing immigration attorney whose own firm also uses Papeles. Papeles commits that:

• its owner and personnel will open another firm's data only to fix a problem the Firm reports, or to respond to a security incident;
• each such access is limited to what the task needs and is recorded with the date, the person and the reason; the Firm sees these records on its Activity page, which also states at the top whether Papeles support has accessed the Firm's data in the last 12 months; and
• information seen this way is never used for any other purpose, including the owner's law practice.

3. Security

Papeles maintains reasonable administrative, technical and physical safeguards for Firm Data, at least those listed below. It reviews them at least once a year.

3.1 Separation between firms. Every record belongs to one firm. Every page, form, search, payment and portal screen admits the signed-in user to their own firm's records only. The firm is set from the user's account, never from anything the browser sends.

3.2 Sign-in.

• Firm users sign in with a password and an authenticator-app code.
• Client Portal Users enter a one-time code sent by text message, or by email when no phone is on file or the text cannot be sent. Codes expire after 10 minutes, and five wrong codes end the sign-in.
• Passwords are stored only as salted one-way hashes.
• Invitation and reset links are single-use, stored only as hashes, and expire (7 days and 60 minutes).
• Firms can switch off a login at any time; it is signed out at its next action.

3.3 In transit and at rest. Connections to the Service use HTTPS (TLS). Firm Data is hosted in the United States, in DigitalOcean's New York City data center. The database that holds Firm Data is stored on encrypted storage (encrypted at rest). Backups are encrypted before they leave the server (Section 3.6).

3.4 Payments. Full card numbers are never stored by Papeles; card entry is handled by the payment processor's own secure fields.

3.5 Application safeguards. Every request that changes data needs a per-session security token. Access secrets (database, email and payment keys) are kept out of the public web folder and out of the code. Error details are written to server logs, never shown to users.

3.6 Backups. Firm Data is backed up every night. Each backup is encrypted on the server before it leaves it, with a key that can only be opened by a private key kept off the server, and is stored in a separate DigitalOcean data center in the United States. Backups are kept for 35 days and then deleted. Papeles tests restoring a backup at least once every quarter and keeps a record of each test.

3.7 Logs. Papeles records sign-ins (including failed attempts), each time a Firm user or Papeles personnel opens, adds, saves, prints or deletes a client record, payments, and changes to the Firm's logins and settings, with the time, the person and the IP address. The Firm's admins and attorneys can view and download their own Firm's records on the Activity page. Records are kept for 12 months and then deleted.

4. Subprocessors

4.1 Approved list. The Firm approves the subprocessors in the Annex. Papeles has accepted each subprocessor's data-processing terms, which require it to keep Firm Data confidential and secure and to use it only to provide its service to Papeles.

4.2 Changes. Papeles will give 30 days' notice by email before adding or replacing a subprocessor that handles Firm Data. If the Firm objects on reasonable data-protection grounds and the parties can't resolve it, the Firm may cancel. It then receives a prorated refund of prepaid fees.

4.3 Responsibility. Papeles remains responsible to the Firm for its subprocessors' handling of Firm Data.

5. Security incidents

5.1 Notice. Papeles will notify the Account Owner by email and phone without undue delay, and within 72 hours, after confirming any unauthorized access to, or loss or disclosure of, Firm Data. This is consistent with Papeles's duties to data owners under the Illinois Personal Information Protection Act (815 ILCS 530).

5.2 What the notice says. What happened and when, which data and how many clients are affected, what Papeles has done to contain it, and a contact person. Papeles will update the Firm as it learns more.

5.3 Help with the Firm's duties. Papeles will give the Firm the information it reasonably needs to meet its own duties to clients and regulators, including its professional obligations. The Firm decides whether and how to notify its clients. Papeles will not contact the Firm's clients about an incident without the Firm's approval, unless the law requires it.

6. Government and legal requests

If a court, agency or other third party asks Papeles for Firm Data:

1. Papeles will refer the requester to the Firm, unless the law requires otherwise.
2. Papeles will notify the Firm promptly, unless the law forbids it, so the Firm can protect privilege and confidentiality.
3. Papeles will disclose only the minimum the law requires.

Papeles will not give any government agency direct or ongoing access to Firm Data.

7. Assistance and audits

7.1 Assistance. Papeles will help the Firm answer clients' requests about their information, to the extent the Service doesn't already let the Firm do it.

7.2 Security questions. Once a year, or after an incident, the Firm may send a reasonable security questionnaire, and Papeles will answer it in writing within 30 days.

7.3 Audits. If a regulator or bar authority requires it, or after an incident caused by Papeles, the Firm may audit Papeles's compliance with this DPA, at the Firm's cost. The audit needs 30 days' notice, happens during business hours, and keeps other firms' data confidential.

8. Return and deletion

At the end of the subscription, Papeles will export and then delete Firm Data as set out in Part 1, Sections 4.5 and 4.6, unless the law requires Papeles to keep it. Any copy Papeles must keep remains protected by this DPA until deleted.

Annex — Approved subprocessors

Square and Google Calendar are used only for Papeles's affiliated firm's own consultation booking and payments. They never receive another firm's data, so they are not listed. If a firm chooses card processing through Papeles in the future, its processor would be added here.