Free Consultation — No Fees Unless We Win
Legal
Data Processing Agreement
How Simpson & Mena Law processes and safeguards your data in compliance with international privacy regulations.
Last updated: March 20, 2026How Simpson & Mena Law processes and safeguards your data in compliance with international privacy regulations.
Last updated: March 20, 2026This Data Processing Agreement (the "DPA") forms part of and is supplemental to the Simpson & Mena Law, P.A. Terms of Service (the "Terms of Service") and Privacy Policy (the "Privacy Policy") between you ("Client", "you") and Simpson & Mena Law, P.A. ("Simpson & Mena", "we", "us").
This DPA applies to the extent that Simpson & Mena processes Personal Data on behalf of the Client in connection with the provision of legal services and the operation of our website at claimovertime.com.
"Data Protection Law" means (i) the General Data Protection Regulation (EU) 2016/679 ("GDPR"); (ii) the California Consumer Privacy Act ("CCPA"); (iii) any applicable U.S. state or federal privacy law; and (iv) any other applicable data protection or privacy legislation, in each case as may be amended or replaced.
"Personal Data" means any information relating to an identified or identifiable natural person that Simpson & Mena processes on behalf of the Client in the course of providing Services.
"Processing" means any operation performed on Personal Data, including collection, recording, organization, storage, adaptation, retrieval, consultation, use, disclosure, or erasure.
"Security Incident" means any unauthorized or unlawful breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.
"Services" means the legal services and related activities provided by Simpson & Mena to the Client, including but not limited to Labor & Employment Law, Immigration, and Real Estate Law services, as well as the operation of the Website.
"Sub-processor" means any third party engaged by Simpson & Mena to process Personal Data on behalf of the Client.
All capitalized terms not defined herein shall have the meanings set forth in the Terms of Service and Privacy Policy.
2.1 This DPA applies where and only to the extent that Simpson & Mena processes Personal Data on behalf of the Client and such data is subject to applicable Data Protection Laws.
2.2 Roles.The Client acts as the Data Controller, determining the purposes and means of the processing of Personal Data. Simpson & Mena acts as the Data Processor, processing Personal Data only on behalf of and in accordance with the documented instructions of the Client.
2.3 Attorney-Client Relationship. Nothing in this DPA diminishes or modifies the obligations arising from an attorney-client relationship, including the duty of confidentiality under the Florida Rules of Professional Conduct.
3.1 Simpson & Mena shall process Personal Data only for the purposes of: (i) providing the Services in accordance with the Terms of Service; (ii) responding to your inquiries and managing the attorney-client relationship; (iii) complying with legal and professional obligations; and (iv) as otherwise instructed by the Client in writing.
3.2 Simpson & Mena shall ensure that persons authorized to process Personal Data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality.
3.3 Simpson & Mena shall not process Personal Data for any purpose other than those stated above without prior written consent of the Client, except where required by applicable law.
4.1 The Client authorizes Simpson & Mena to engage Sub-processors to assist in providing the Services. Simpson & Mena will maintain a current list of Sub-processors and will notify the Client of any intended changes. Sub-processors may include secure document management platforms, IT infrastructure providers, and communication services necessary for legal operations.
4.2 Simpson & Mena shall enter into a written agreement with each Sub-processor imposing data protection obligations no less protective than those contained in this DPA. Simpson & Mena remains fully liable for the acts and omissions of its Sub-processors.
5.1 Simpson & Mena shall implement and maintain appropriate technical and organizational measures to protect Personal Data, including:
5.2 Security Incident Response.Upon becoming aware of a Security Incident, Simpson & Mena shall notify the Client without undue delay (and within 72 hours where required by law) and shall provide timely information regarding the nature of the incident, the data affected, and the remedial measures taken or proposed.
6.1 Simpson & Mena shall assist the Client in responding to requests from data subjects exercising their rights under applicable Data Protection Law, including rights of access, rectification, erasure, restriction, portability, and objection.
6.2 If Simpson & Mena receives a request directly from a data subject, it shall promptly notify the Client and shall not respond to the request without the Client's prior authorization, unless required to do so by applicable law.
7.1 Personal Data provided to Simpson & Mena is processed in the United States. Where the Client's data originates from the EU/EEA, United Kingdom, or Switzerland, Simpson & Mena shall ensure that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission or other legally recognized transfer mechanisms.
8.1 Upon termination of the Services or upon the Client's written request, Simpson & Mena shall delete or return all Personal Data in its possession, except to the extent that retention is required by applicable law, professional ethical obligations, or Florida Bar rules regarding record retention.
8.2 Personal Data archived on backup systems shall be securely isolated and protected from further processing until deletion is feasible.
9.1 Simpson & Mena shall make available to the Client, upon reasonable request, information necessary to demonstrate compliance with this DPA and applicable Data Protection Laws.
9.2 The Client may conduct or commission an audit of Simpson & Mena's data processing activities, subject to reasonable notice and scope limitations, to verify compliance with the terms of this DPA. Such audits shall not unreasonably interfere with Simpson & Mena's business operations.
10.1 This DPA shall be governed by and interpreted in accordance with the laws of the State of Florida, without regard to principles of conflicts of laws. The parties irrevocably submit to the exclusive jurisdiction of the state and federal courts located in Miami-Dade County, Florida.
10.2 In the event of any conflict between this DPA and the Terms of Service, the provisions of this DPA shall prevail with respect to data protection matters.
10.3 Simpson & Mena may update this DPA from time to time by posting the revised version on our website at claimovertime.com/legal/dpa. Continued use of the Services after the updated DPA is posted constitutes acceptance of the amended terms.
For questions about this Data Processing Agreement or to exercise your data rights, please contact us: