Last Updated/Effective: 1 August 2026
‍
This Privacy Statement explains, in plainlanguage, what personal information PLUSnxt collects, why we collect it, how weprotect it, how we use AI responsibly, and the choices and rights you have.

What’s inside
‍
1. Who we are and who is in charge of your information
‍2. The words we use (a quick glossary)
‍3. Our two roles: sometimes we hold information for our customers
‍4. What information we collect
‍5. Why we use your information, and our legal reasons
‍6. How we use artificial intelligence (AI) responsibly
‍7. How we share information (and our Data Protection Addendum)
‍8. Cookies and similar technologies
‍9. How we keep your information safe
‍10. How long we keep your information
11. Sending information to other countries
12. Your privacy rights
13. Children'sprivacy
14. Sensitive information
15. If our business is sold or merged
16. Changes to this Privacy Statement
17. How to contact us and how to complain

About this Privacy Statement

This Privacy Statement (the "Statement") describes how PLUSnxt LLC("PLUSnxt", "we", "us", and "our")handles personal information when you visit our website at www.plusnxt.com,when you contact us, when you buy or use our cloud-based eDiscovery and data management services (the "Services"), and when you receive our marketing.

PLUSnxt provides cloud-based eDiscovery and data management services to organizations such as law firms, corporations, and government bodies. We deliver those Services on RelativityOne, a cloud platform operated by Relativity and hosted in Microsoft Azure. We take privacy seriously because careful handling ofinformation is the core of what we do.

If you have any questions, you can reach us at any time using the contact details in section 17 below. If you do not agree with this Statement, please do not use our website or Services.

1.     Who We Are and Who is in Charge of Your Information

In plain words - When we decide why and how your information is used, we are the"controller." That means we are responsible for looking after it. Below are the people you can contact about your privacy.

For personal information that we control, the responsible organization is:            

PLUSnxt LLC, 11740 San Vicente,Suite 109-650, Los Angeles, CA 90049

WHO TO CONTACT

Details Privacy team
‍Email: privacy@plusnxt.com
Phone: +1 213 349 4440
Privacy lead: Chief Operating Officer
Email: dpo@plusnxt.com

2.     The Words We Use (a quick glossary)

In plain words -  Privacy has some tricky words. Here is what they mean in this Statement.
‍
Personal information: Any information that is about you or can be linked to you,  like your name, email, or account details. Some laws call this "personal  data.

"Sensitive information: Special information that needs extra care, such as health,  race, religion, exact location, biometric data (like a fingerprint), or a  government ID number.

‍Controller: The organization that decides why and how personal  information is used. For our own data, that is us.
‍
‍Processor: An organization that only uses information by following  another organization's instructions. When we handle customer files inside  RelativityOne on a customer’s instructions, we are a processor for that  customer.
‍
Sub-processor: Another company we bring in to help us process information  on a customer’s instructions, such as a contracted document review provider.  Sub-processors are covered by our DPA. See section 7.

RelativityOne: A contract add-on that sets the rules for how we protect  the personal information our customers send us. See section 7.
‍
‍Data Protection Addendum (DPA): A contract add on that sets the rules for how we protect  the personal information our customers send us. See section 7.
‍
‍Cookies: Small files a website stores on your device to help it work  and to remember things. See section 8.

‍AI (artificial intelligence): Computer tools that learn from data to help with tasks like  sorting, searching, or spotting patterns. See section 6.

3.     Our Two Roles: Sometimes We Hold Information for Our Customers

In plain words - Sometimes the information is about you and your relationship with us, sowe are in charge of it. Other times, a customer sends us files to store andsearch, and those files belong to the customer, not to us. We treat these twosituations differently.

When we are the Controller
‍
‍This Privacy Statement mainly covers information where we are the controller. Examples include website visitors, people who create accounts, people we bill, people who contact our support team, people who get our marketing, and people who apply for jobs.
‍
‍When we are the Processor
‍
‍When a customer uses the Services and loads files, documents, or data (for example, material for a legal matter), that content often contains personal information about other people. That content is held in the customer's RelativityOne environment, hosted in Microsoft Azure, and we process it only on the customer's instructions. For that content, the customer is the controller and we are the processor. We do not operate our own hosting infrastructure for customer matter content.How we protect that customer content is set out in the customer's agreement and in our Data Protection Addendum (DPA), not in this Statement. See section 7. If you are an individual whose data appears inside a customer matter and you want to exercise your rights, please contact that customer, who is the controller. We will support our customer in responding.

4.     What Information We Collect

In plain words - We only collect what we need. Most of it yougive us directly. Some is collected automatically when you use our website. Alittle may come from other trusted sources.

Information You Give Us

In some instances, we may process and/or receive personal information from third parties or third-party sources, such as:

• Account and contact details: Your name,username, password, email, phone number, and business details such as company name and address.
• Payment details: Billing information when you buy PLUSnxt Services. We use a reputable payment provider and do not store full payment card numbers.
• Support and messages: What you tell us when you contact us, fill out a form, answer a survey, or send feedback.
• Job applications: Your resume, work history, and related details if you apply to work with us. We use application materials only to assess your application and to administer our recruiting process, and we retain them on the basis setout in section 10.

Information We Collect Automatically

• Device and usage data: your IP address, browsertype, pages you visit, and how you use our website and Services.
• Cookies and similar technologies: see section 8.

Information From Other Sources

• Single sign-on providers (for example, if you log in with a work account) and other service providers who help us run our business.
• Publicly available business information, where allowed by law.

5.     Why We Use Your Information, and Our Legal Reasons

In plain words -We use your information to run our Services, keep them safe, follow the law, and stay in touch. Under laws like the GDPR, we also need a "legal reason" for each use. Here they are.

Where we rely on your consent (for example, for some marketing or cookies), you can withdraw it at any time. Withdrawing consent does not undo anything we did before you withdrew it.

6.     How We Use Artificial Intelligence (AI) Responsibly

In plain words -We use AI to help sort, search, and review very large amounts of information quickly. A trained person always stays in charge. We do not let AI make important decisions about you on its own, and we tell you when you are dealing with AI.

‍The Services include AI features built into the RelativityOne platform, and we use AI in some of our own internal tools. In a legal matter, AI is typically used to group similar documents, surface material that is likely to be relevant, translate text, or flag information that may need protection. PLUSnxt is a user of these AI features rather than their developer. The AI capabilities in RelativityOne are built and operated by Relativity and run on Microsoft Azure. Our role is to design the workflow, set the controls, and keep qualified people accountable for the result.

Our AI promises to You

• A person stays in charge. We use AI to support people, not to replace their judgment. We do not use AI alone to make decisions that have legal or similarly significant effects about you.
• We tell you when it is AI. If you interact with an AI system, such as a chat assistant, or view content that AI generated or materially altered, we will make that clear, in line with Article 50 of the EU AI Act.
• We validate results. We test AI outputfor accuracy and reliability before we rely on it in a matter, we use sampling and human review to check how it is performing, and we document how AI was usedso that the result can be defended.
• Our people are trained. Everyone who usesAI on our behalf is trained on how these tools work, what they are suited to, and where their limits are.
• We protect customer content. We do not use personal information inside a customer matter to train AI models. The AI services used in RelativityOne run inside the platform boundary on Microsoft Azure, and customer content is not used to train the underlying foundation models.
• You can ask about AI. You can ask us how AI is used in a way that affects you, and where the law gives you the right,you can ask for a human to review a decision. See section 12.

We manage AI risk within our information security and privacy management system, through documented workflow controls, validation, and human oversight. Our AI governance policies are aligned to ISO/IEC 42001:2023, the international standard for AI management systems. Where the EU AI Act applies to us, we actas a deployer of AI systems rather than a provider. We meet the transparency duties in Article 50, which apply from 2 August 2026, together with the AI literacy duty in Article 4. We track further obligations as they take effect and prepare for them in advance.

7.     How We Share Information(and our Data Protection Addendum)

In plain words - We do not sell your personal information. We share it only with trusted helpers who follow our rules, or when the law requires it.

We may share personal information with:

• Service providers, platform providers, and sub-processors who work for us under contract. These include Relativity and Microsoft for the platform and cloud infrastructure that host the Services, contracted document review providers where a client has approved their use on its matter, and providers of payment, security, analytics, and customer support, as well as professional advisers such as auditors, lawyers, and accountants. They may use the information only to do the job we hired them for.
• Authorities and others, when the law requires it, to respond to lawful requests, or to protect people's safety and our legal rights.
• A buyer or partner, if our business is sold or merged, as described in section 15.

We do not sellyour personal information, and we do not share it for cross-context behavioral advertising, as those terms are used in California law.

Our Data Protection Addendum (DPA)

‍If you are our customer, our Data Protection Addendum (DPA) is part of your agreement with us. The DPA sets the rules for how we protect the personal information you send us when you use the Services, including our duties as a processor, the security measures we use, how we handle sub-processors, how we help with data subject requests, and how we support international data transfers. You can request a copy of our current DPA at privacy@plusnxt.com or download it at www.plusnxt.com/dpa.

8.     Cookies and Similar Technologies

In plain words - Cookies are small files that help our website work and help us understand how it is used. You are in control: where the lawr equires it, we ask before using non-essential cookies.

We use a few types of cookies and similar technologies:

• Strictly necessary cookies, which make the website work. These are always on.
• Preference cookies, which remember your choices.
• Analytics cookies, which help us see how the website is used so we can improve it.

Where the law requires it (for example, in the EU, the UK, and other regions), we ask for your consent before using non-essential cookies. You can change your choices at any time using our cookie settings link, and you can also manage cookies in your browser.

9.     How We Keep Your Information Safe

In plain words - We protect your information with layered, modern security. Our own security program is independently certified, and so is the platform we use to deliver the Services.

Customer matter content is held in RelativityOne on Microsoft Azure, so security is delivered in layers. Microsoft secures the cloud infrastructure, Relativity secures the RelativityOne platform, and PLUSnxt controls how that platform is configured and used on each matter. Our own technical and organizational measures include:

• Encryption of information in transit and at rest, using current Transport Layer Security (TLS) and platform encryption at rest.
• Access controls, so that only authorized people can reach information, using role-based, least-privilege access and multi-factor authentication, including for our own personnel and for contracted personnel working remotely.
• Audit logging, monitoring, alerting, testing,and periodic security review of the systems and workspaces we control.
• Careful selection and ongoing oversight of the vendors and platform providers who work for us.

Our information security management system is independently certified to ISO/IEC 27001:2022 by Accedere Inc, an accredited certification body, and is subject to annual surveillance audits. The certification covers our eDiscovery, managed review,and cloud SaaS services, together with the executive management, operations,and human resources functions that support them. We also maintain a SOC 2 attestation covering the Security, Availability, and Confidentiality trust services criteria, and a formal Written Information Security Program. Our certificate and attestation reports are available on request. Relativity andMicrosoft hold their own independent certifications and attestations for theplatform and infrastructure layers. If a personal data breach occurs that puts your rights at risk, we will notify the relevant individuals and authorities as required by law, and we will support our customers in meeting their own notification duties.

10.     How Long We Keep Your Information

In plain words - We keep information only for as long as we truly need it. After that, we delete it or make it anonymous.

We decide how long to keep personal information based on:

• How long we need it to provide the Services and support you.
• Legal, tax, and accounting rules that require us to keep certain records.
• The need to resolve disputes and enforce our agreements.

Customer content inside the Services is retained and deleted according to the customer's contract and our DPA. Unless the contract provides otherwise, we dispose of customer information from in-scope systems on the customer's written instruction, or within 90 days after termination of service takes effect. When information is no longer needed, we securely delete it or make it anonymous. Our internal retention schedule is available on request.

11.     Sending Information to Other Countries

In plain words - We deliver the Services from the cloud, and our clients and their matters sit in different countries. Some matters are reviewed by contracted reviewers based outside the United States, and only when the client has approved it. When information crosses a border, or when someone reaches it from another country, we use approved legal protections so that it stays protected.

Because we deliver the Services from the cloud, your personal information may be stored or processed in a country other than your own. Our corporate operations are based in the United States. RelativityOne offers regional data centers, and the region used for a given customer matter is set by that customer's agreement. Where personal information moves across borders, we rely on one or more approved safeguards:

• Adequacy decisions. Where a country ortransfer mechanism is officially recognized as providing an adequate level ofprotection, we may rely on that recognition.
• Standard Contractual Clauses (SCCs). For transfers out of the EEA, we use the European Commission's Standard Contractual Clauses. For transfers out of the UK, we use the UK International Data Transfer Addendum to those Clauses. We apply additional measures where a transfer risk assessment shows they are needed.
• Regional hosting. Where a customer requires matter data to remain in a particular region, we can configure the matter in a RelativityOne instance in that region.

Access by contracted review personnel outside the hosting region. On some matters, document review is staffed with legally trained reviewers located outside the United States, including in India. We use review personnel outside the United States only where the client has approved it for that matter. These reviewers are not PLUSnxt employees.They are engaged through a third-party staffing provider that contracts with us and acts as our sub-processor. They work remotely inside the same RelativityOne environment in the United States or Canada where the matter is hosted, so review is performed in that environment rather than by moving data to another country. Their access is governed by role-based, least-privilege permissions, multi-factor authentication, and audit logging, and their permissions restrict download, export, and printing. Because access from another country is treated as a transfer under EEA and UK law, we put the safeguards described above in place with the staffing provider and apply them to that access.

You can ask for a copy of the safeguards we use by contacting us. See section 17.

12.     Your Privacy Rights

In plain words - You have rights over your personal information.The exact rights depend on where you live, but here are the main ones. We will never treat you unfairly for using them.

Rights Most People Have

• Ask what information we hold about you and get acopy (access).

• Fix information that is wrong or incomplete (correction).

• Ask us to delete your information (deletion), in certain cases.

• Ask us to limit or stop certain uses, or objectto them.

• Get a copy of certain information in a portable format (portability).

• Withdraw consent at any time, where we relied on consent.

• Complain to a privacy regulator.

If you are in the European Economic Area or the United Kingdom (GDPR / UK GDPR)

‍You have all the rights above. You also have the right not to be subject to a decision based only on automated processing that produces legal or similarly significant effects, except as allowed by law. You can complain to your local Data Protection Authority. In the UK, that is the Information Commissioner's Office(ICO).

‍If you are in California (CCPA, as amended by the CPRA)

‍You have the right to know, delete, and correct your personal information, and the right to opt out of the "sale" or "sharing" of personal information and to limit the use of sensitive personal information. As stated in section 7, we do not sell or share your personal information. You may use an authorized agent to make a request, and we will verify your identity before we act. You have the right not to be discriminated against for using your rights.

‍How to use your rights

‍To exercise any of these rights, contact us using the details in section 17. We will confirm your identity in order to protect your information, and we will reply within the time the law allows. Exercising your rights is free in most cases.

13.     Children's Privacy

In plain words - Our Services are made for organizations, not for children. We do not want to collect children's information, and we give children extra protection where the law requires it.

Our website and Services are meant for businesses and adults, not for children. We do not knowingly collect personal information from children.

• In the United States, we follow the Children's Online Privacy Protection Act (COPPA) and do not knowingly collect personal information from children under 13.
• In the EEA, we treat users below the age set by their country (between 13 and 16) as children, and we rely on a parent's permission where required.

If you believe a child has given us personal information, please contact us (see section 17) and we will delete it.

14.     Sensitive Information

In plain words - Some information needs extra care. We try not to collect it, and when we do, we protect it and only use it when the law allows.

We do not ask you to give us sensitive information (such as race, religion, health, exact location, biometric data, or a government ID number) to use our Services. If we ever need to handle sensitive information, we do so only when:

• You have given clear consent, where consent isthe basis;
• It is needed for a contract with you;
• It is required or allowed by privacy law, or needed to make or defend legal claims; or
• It is needed to protect someone's life or safety.

This section is about information we collect as a controller. Customer matter content may contain sensitive information about other people. That content is handled on the customer's instructions under the customer's agreement and our DPA, as described in section 3.

15.     If Our Business is Sold or Merged

In plain words - If our company is bought or joins with another company, your information may move too, but it stays protected.

If PLUSnxt isinvolved in a merger, acquisition, financing, or sale of assets, personal information may be shared or transferred as part of that deal. We will requirethe other party to protect your information in a way consistent with this Statement, and we will let you know if your choices change.

16.     Changes to this Privacy Statement

In plain words - We may update this Statement. If we make an important change, we will tell you.

We may updatethis Statement from time to time. When we make material changes, we will post a clear notice on our website and, where we have your email address, send you a message. The "Last Updated/Effective" date at the top shows when we last changed it. Please review it from time to time so that you stay informed.

17.     How to Contact Us and How to Complain

In plain words - Questions or worries? Please reach out. We are happy to help. You can also complain to a privacy regulator if you are not satisfied.

If you have questions about this Statement, want to use your privacy rights, or want a copy of our safeguards or our DPA, contact us:

You also havethe right to complain to a privacy regulator, for example your EU or EEA Data Protection Authority, the UK Information Commissioner’s Office (ICO), or theCalifornia Privacy Protection Agency (CPPA). We would appreciate the chance to address your concern first.