Data Processing Addendum
How CaseFetch handles your firm’s client information, as its service provider
Effective October 26, 2026
This Data Processing Addendum (the “DPA”) forms part of the Terms of Service between Carson Junker, a sole proprietor doing business as CaseFetch (“CaseFetch”) and the Firm, and takes effect when the Firm accepts the Terms. Capitalized words not defined here have the meanings given in the Terms.
1. Definitions
- “CCPA” means the California Consumer Privacy Act, California Civil Code section 1798.100 and following, and its regulations, California Code of Regulations, title 11, section 7000 and following, each as amended.
- “Data Protection Laws” means the CCPA and every other United States privacy, data security and breach notification law that applies to the processing of Firm Personal Information under the Terms.
- “Firm Personal Information” means personal information within Firm Data.
- “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Firm Personal Information.
- “Subprocessor” means a company CaseFetch engages that processes Firm Personal Information.
“Business”, “business purpose”, “consumer”, “personal information”, “sell”, “share” and “service provider” have the meanings given in the CCPA.
2. Roles and instructions
2.1 Roles. The Firm determines the purposes and means of processing Firm Personal Information. CaseFetch processes it on the Firm’s behalf as its service provider and processor.
2.2 Instructions. CaseFetch processes Firm Personal Information only on the Firm’s documented instructions. The Terms, this DPA and the Firm’s and its Authorized Users’ use of the Service’s features are the Firm’s complete instructions. CaseFetch will tell the Firm if it believes an instruction violates Data Protection Laws.
2.3 The Firm’s obligations. The Firm is responsible for the lawfulness of the Firm Personal Information it provides and of its instructions, including giving any notices and obtaining any consents that Data Protection Laws or its professional obligations require.
3. Details of the processing
| Subject | Details |
|---|---|
| Business purposes | Providing the Service to the Firm: reading matters, tasks and calendar entries from the Firm’s Clio Account; storing the notes its Authorized Users write; writing tasks, calendar entries and time entries to the Clio Account on an Authorized User’s instruction; and securing, supporting and maintaining the Service |
| Consumers concerned | The Firm’s clients, opposing parties and other people named in its matters; the Firm’s personnel |
| Personal information | Client names, case numbers, counties, case types and statuses; Clio tasks and calendar entries; review notes; time entries. It may include sensitive personal information, such as health, financial, criminal history or children’s information, depending on the Firm’s practice |
| Duration | The Subscription Term, and afterwards the export and deletion periods in section 12 |
4. Service provider commitments
4.1 CCPA commitments. CaseFetch will:
- not sell or share Firm Personal Information;
- process Firm Personal Information only for the limited and specified business purposes in section 3;
- not retain, use or disclose Firm Personal Information for any purpose, including any commercial purpose, other than those business purposes, or outside the direct business relationship between CaseFetch and the Firm, except as the CCPA permits;
- not combine Firm Personal Information with personal information it receives from or on behalf of anyone else, or collects from its own interactions with consumers, except as the CCPA permits a service provider to do;
- comply with its obligations under the CCPA and provide the same level of privacy protection the CCPA requires of businesses;
- notify the Firm within five business days if it determines that it can no longer meet its obligations under the CCPA or this DPA;
- help the Firm respond to consumer requests as section 9 describes; and
- bind each Subprocessor as section 5 describes.
4.2 The Firm’s rights. The Firm may take reasonable and appropriate steps to ensure that CaseFetch uses Firm Personal Information consistently with the Firm’s obligations under the CCPA, including through section 10. On notice, the Firm may take reasonable and appropriate steps to stop and remediate any unauthorized use of Firm Personal Information.
4.3 Certification. CaseFetch certifies that it understands the restrictions in this section 4 and will comply with them.
4.4 No AI training or profiling. CaseFetch does not use Firm Personal Information to train artificial intelligence models, does not process it with artificial intelligence services, and does not use it to profile anyone.
5. Subprocessors
5.1 Authorization. The Firm authorizes CaseFetch to use the Subprocessors in the Subprocessor List. CaseFetch will have a written contract with each that restricts its processing of Firm Personal Information to providing its services to CaseFetch and imposes data protection obligations at least as protective as this DPA. CaseFetch remains responsible for each Subprocessor’s performance.
5.2 Changes. CaseFetch will update the Subprocessor List and email the owner of each Team at least 30 days before a new Subprocessor begins processing Firm Personal Information. The Firm may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Firm may end its subscription before the change takes effect and CaseFetch will refund prepaid Fees for the unused part of the Subscription Term.
6. Confidentiality and privilege
6.1 Confidentiality. CaseFetch treats all Firm Data as the Firm’s Confidential Information under the Terms. Anyone CaseFetch allows to process Firm Personal Information is bound by written confidentiality obligations.
6.2 Privilege. CaseFetch acknowledges that Firm Data may be protected by the attorney-client privilege, the work-product doctrine and the Firm’s duty of confidentiality under California Business and Professions Code section 6068(e)(1) and Rule 1.6 of the California Rules of Professional Conduct. CaseFetch will not knowingly do anything that would waive that protection, and will support the Firm in asserting it.
6.3 Access by CaseFetch personnel. CaseFetch personnel may access Firm Data only to provide support the Firm asks for, to keep the Service secure and running, or when the law requires. Access to production systems is limited to the owner of CaseFetch. Any sign-in by an administrator as a Firm’s user is recorded automatically.
6.4 Supervision. CaseFetch will give the Firm the information about its security practices that the Firm reasonably needs to meet its duty to supervise its vendors under Rule 5.3 of the California Rules of Professional Conduct or the equivalent rules where it practices.
7. Security
7.1 Safeguards. CaseFetch maintains reasonable security procedures and practices appropriate to the nature of Firm Personal Information, as California Civil Code section 1798.81.5 requires, including:
- encryption in transit using HTTPS with HSTS, and encryption at rest, with Clio access tokens additionally encrypted using AES-256-GCM;
- separation of each Firm’s data in the database, with access limited to Team members who are verified users of the Firm’s Clio Account, re-checked at least every 24 hours;
- two-factor authentication for every user who enables it, enforced by the database;
- a bot check on sign-in, sign-up and password reset, and a strict content security policy;
- access to production systems limited to the owner of CaseFetch, and an automatic record of every administrator sign-in as a user;
- application logs that identify records by id rather than by name, with email addresses, phone numbers and tokens removed; and
- daily encrypted database backups kept for 7 days.
7.2 Changes. CaseFetch may update these measures, but will not materially reduce the overall security of the Service during the Subscription Term.
8. Security Incidents
8.1 Notice. CaseFetch will notify the Team’s owner by email promptly, and in any event within 72 hours, after becoming aware of a Security Incident. The notice will describe, as far as then known, what happened, the categories and approximate number of people and records affected, the likely consequences, what CaseFetch has done and will do, and a contact. CaseFetch will provide further information as it becomes available.
8.2 Cooperation. CaseFetch will take reasonable steps to contain and remedy a Security Incident and will cooperate with the Firm’s own notification obligations, including under California Civil Code section 1798.82. CaseFetch will not notify the Firm’s clients or regulators about a Security Incident on the Firm’s behalf unless the Firm asks it to or the law requires it.
8.3 No admission. A notice under this section is not an admission of fault or liability.
9. Consumer requests
If CaseFetch receives a request from a consumer about Firm Personal Information, it will refer the consumer to the Firm and forward the request to the Firm within 10 business days, and will not respond to it except as the Firm instructs or the law requires. CaseFetch will help the Firm respond to requests to know, delete or correct, within 10 business days of the Firm’s written request, to the extent the Firm cannot do so itself in the Service.
10. Information and audits
10.1 Questionnaires. Once a year, and after any Security Incident, CaseFetch will answer the Firm’s reasonable written security questionnaire and give it the information reasonably needed to show compliance with this DPA.
10.2 Audits. If the Firm reasonably believes, after reviewing that information, that CaseFetch is not complying with this DPA, or if a regulator requires it, the Firm or an independent auditor bound by confidentiality may audit CaseFetch’s compliance on at least 30 days’ written notice, during business hours, no more than once in any 12 months except after a Security Incident, and in a way that does not disrupt the Service or expose other customers’ data. The Firm bears its own costs of any audit.
10.3 Assessments. CaseFetch will give the Firm reasonable information it needs to carry out any risk assessment or cybersecurity audit that the CCPA requires of the Firm with respect to the Service.
11. Legal requests
If a court, government authority or other third party demands Firm Data from CaseFetch, CaseFetch will refer it to the Firm and notify the Firm promptly, unless the law forbids it, so that the Firm can assert privilege or seek a protective order. If CaseFetch is compelled to disclose Firm Data, it will disclose only what is legally required.
12. Return and deletion
When the Firm’s subscription ends, CaseFetch will return and delete Firm Data as section 6.10 of the Terms provides, and will confirm the deletion in writing on request. CaseFetch may keep Firm Data only to the extent the law requires, and then keeps it confidential and processes it only for the purpose the law requires.
13. Data location
Firm Data is stored and processed in the United States, with its database and application servers in the western United States (Northern California). CaseFetch will give the owner of each Team at least 30 days’ notice by email before moving where Firm Data is stored.
14. General
14.1 Term. This DPA lasts as long as CaseFetch processes Firm Personal Information under the Terms.
14.2 Liability. Each party’s liability under this DPA is subject to the limitations in section 10 of the Terms.
14.3 Precedence. If this DPA conflicts with the Terms, this DPA controls as to Firm Data.
14.4 Contact. Questions about this DPA, and security questionnaires, can be sent to carson@casefetch.io.