Effective Date: 01/05/2025

Between: Client (“Data Controller”) and Maverick Costs Ltd (“Data Processor”) Company Number: 15989729. Registered Office: Egale 1, 80 St Albans Road, Watford, Herts, United Kingdom, WD17 1DL.

1. Purpose

This Addendum governs the processing of personal data by Maverick Costs Ltd on behalf of the Client under the terms of the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018.

2. Roles

• The Client is the Data Controller, determining the purposes and means of processing personal data.

• Maverick Costs Ltd is the Data Processor, acting only on documented instructions from the Client.

3. Scope of Processing

• Nature and Purpose: Storage, analysis, and management of legal documents uploaded to the Maverick Costs software.

• Categories of Data Subjects: Client’s customers, employees, or any other individuals referenced in documents.

• Types of Personal Data: May include names, contact information, case details, and other data contained in legal documents. May also include Special Category Data.

4. Obligations of the Data Processor

Maverick Costs Ltd shall:

• Process personal data only on documented instructions from the Client.

• Ensure that persons authorised to process personal data are subject to confidentiality obligations.

• Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

• Assist the Client in responding to data subject rights requests, data breaches, and impact assessments, where applicable.

• Delete or return all personal data to the Client upon termination of services unless otherwise required by law.

• Provide the Client with information necessary to demonstrate compliance and allow for audits (subject to reasonable notice).

5. Sub-Processors

The Client authorises Maverick Costs Ltd to engage the following sub-processors:

• Google Gemini AI for document analysis (UK-based processing).

• Amazon Web Services (AWS UK) for secure data storage.

Maverick Costs Ltd shall ensure that sub-processors are subject to the same data protection obligations as set out in this Addendum.

6. International Transfers

Maverick Costs Ltd will ensure that personal data remains stored and processed exclusively within the United Kingdom or the EEC.

7. Liability

Each party shall be liable for its respective breaches of this Addendum and applicable data protection laws.

8. Termination

Upon termination of services, Maverick Costs Ltd will delete personal data, unless retention is required by law.

9. Governing Law

This Addendum is governed by the laws of England and Wales.