Data Privacy Framework Privacy Policy ("DPF Privacy Policy")

Last Updated: November 12, 2024

Relativity ODA LLC and its subsidiary, Relativity Global LLC (as referred to herein, collectively, “Relativity”) comply with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce with regards to personal data that Relativity processes on behalf of its customers as a data processor in relation to Relativity’s software-as-a-service products (“Personal Data”). This policy applies only to residents of the EEA, the UK and Switzerland whose Personal Data is processed by Relativity on behalf of one of its customers at such customer’s direction.

Relativity has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to (i) the processing of Personal Data received from the European Union in reliance on the EU-U.S. DPF; and (ii) from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF, as well as the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of Personal Data received from Switzerland in reliance on the Swiss-U.S. DPF.

If there is any conflict between this DPF Privacy Policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the respective Principles govern.

To learn more about the Data Privacy Framework (“DPF”) program, and to view Relativity’s certification, please visit https://www.dataprivacyframework.gov/.

Personal Data Collected

Personal Data may be provided to Relativity by its customers through their access and use of Relativity’s software-as-a-service products (collectively, “the Cloud Product”). The content and categories of the Personal Data are determined by the customer in their sole discretion. Relativity is solely a data processor of the Personal Data. For more information as to how a Relativity customer obtains or manages your Personal Data, you should contact the relevant data controller or review their privacy notice.

Purpose of Collection

Relativity processes the Personal Data in order to: (i) provide its customers with services related to the Cloud Product; and (ii) to meet Relativity’s legal, regulatory and contractual obligations. Relativity retains Personal Data in accordance with customer contracts or other legal or regulatory obligations.

Third Party Transfers

Relativity may use certain third-party service providers. These third parties assist Relativity in providing services related to the Cloud Product, including data hosting and additional product functionality. In the context of such an onward transfer, Relativity is responsible for the processing of Personal Data that it receives under the Data Privacy Framework and subsequently transfers to a third-party service provider acting on Relativity’s behalf. As required by the DPF, Relativity remains liable if such third parties do not process Personal Data in compliance with the DPF Principles, unless we are not responsible for the event giving rise to the damage.

Your Data Rights

You have certain rights to access Personal Data and to limit use and/or disclosure of your Personal Data. If you would like to exercise your rights, please contact the applicable data controller of your Personal Data (i.e., Relativity’s customer on whose behalf Relativity processes your Personal Data). Where applicable, Relativity provides assistance to and follows the directions of Relativity’s applicable customer in responding to such requests.

Dispute Resolution

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Relativity has committed to resolve DPF Principles-related complaints about Relativity’s collection and use of your Personal Data. EU and UK and Swiss individuals with inquiries or complaints regarding Relativity’s handling of Personal Data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, respectively, should first contact Relativity via privacy.inquiries@relativity.com.

In some situations under the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, you may have the possibility to invoke binding arbitration. Please visit this link for more information: https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction. As such and in compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Relativity commits to refer unresolved complaints concerning Relativity’s handling of Personal Data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from Relativity, or if Relativity has not addressed your DPF Principles-related complaint to your satisfaction, please visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you.

Enforcement

The Federal Trade Commission has jurisdiction over Relativity’s compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.

Public Authorities

Relativity may be required to disclose Personal Data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.