Juro's compliance with the CCPA

At Juro, we take our responsibility to protect the data we handle on behalf of our customers extremely seriously.

The California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA) applies to for-profit businesses that do business in California and meet certain thresholds. Since 2023, “consumer” covers any California resident, including employees, job applicants and business contacts. Most personal information in contracts falls into those categories, which is why CCPA matters to Juro’s customers.

The CCPA also imposes requirements on service providers like Juro, which process personal information on behalf of another business.

We work every day with businesses subject to the California consumer privacy regime, and we’re here to support you as a reliable, trustworthy service provider if you use Juro to process personal information about consumers in California.

Keep reading to find out more about our CCPA compliance.

Consumer rights

Right to know / access

Under the CCPA (§ 1798.110), consumers have rights to know certain information about how your business is using their personal information. This includes:

• The kind of information your business has and why
• The sources of that information
• The categories of third parties to whom your business discloses that information

Additionally, consumers have the right to access information that your business holds about them.

With Juro, you can use features in the platform for most routine requests. Juro’s search and Operator, including OCR on scanned documents, helps you locate personal information in contracts - an essential step when responding to a request from a consumer exercising the right to know or right to access.

For more complex requests that you can’t serve using existing functionality in the platform, just contact support@juro.com and we’ll be happy to help.

Right to delete

Consumers in California also have the right to request that your business delete any personal information you've collected about them - § 1798.105.

You can find and remove a consumer’s information using Operator or Juro’s search and document controls.

For any complex request that you can’t serve using existing functionality in the platform, just contact support@juro.com and we’ll be happy to help.

Right to opt out of sale

California consumers have a right to opt out of the sale or sharing of their personal information - § 1798.120.

Juro doesn’t sell or share your consumer personal information.

Right to correct

California consumers can ask your business to correct inaccurate personal information it holds about them (§ 1798.106).

You can handle most correction requests in Juro yourself. Personal information in templates, draft contracts, and contract data fields can be edited directly. Signed contracts are locked to protect the integrity of the executed document. If a signed contract contains inaccurate personal information, you can agree an amendment with the other party if the error affects the contract itself, and then link that amendment to the original document in Juro using a parent-child relationship.

For any complex requests that you can’t handle using existing functionality in the platform, contact support@juro.com and we’ll do our best to help.

Right to limit use of sensitive personal information (§ 1798.121)

Juro uses sensitive information only to provide, secure and analyze the services, so no additional limitation steps are needed on Juro’s side.

General duties

Information

At Juro, we’re experienced in helping customers who are subject to California privacy laws. We’re clear about our status as a service provider, and we’re clear that we don’t sell any consumer personal information you put in Juro.

This clarity means that you can confidently inform your California consumers about whether their personal information will be sold or shared.

Service provider written agreement

Our data processing agreement contains all of the mandatory provisions required for service providers under the CCPA. You can read more about this below.

Security procedures and practices

When you collect consumer personal information in California, you have a duty to implement reasonable security procedures and practices to protect personal information from unauthorized or illegal access, destruction, use, modification, or disclosure.

Juro holds a SOC 2 Type II report, available on request under NDA. Alongside this, Juro has implemented a comprehensive security programme designed to protect personal information in our custody.

You can find out more about the specific measures we have in place in our article on application security.

We update these measures from time to time to reflect updated security practices and to respond to emerging threats.

Juro as a service provider under the CCPA

If your business uses Juro to process personal information about California consumers, then Juro is a service provider under the CCPA.

Juro has this status because it meets the following conditions set out in the CCPA - § 1798.140(ag)(1):

• Juro processes personal information on behalf of your business for a business purpose
• Juro does so under a written contract with your business

Juro’s written contract with your business prohibits Juro from:

• Selling or sharing the personal information
• Retaining, using or disclosing the personal information for any purpose other than the purpose set out in Juro’s contract with your business
• Retaining, using or disclosing the personal information outside of the direct relationship between Juro and your business
• Combining the personal information with personal information received from or on behalf of another person, or collected from Juro’s own interactions with the consumer (subject to the CCPA’s exceptions)

Additionally, Juro notifies customers of its subprocessors (a full list is available in our privacy policy) and binds them to equivalent terms.

No sale

As a Juro customer, your data is your data. Juro does not sell or share consumer personal information contained in your contracts to anyone, including in the way that “sell” is defined in the CCPA - § 1798.140(ad) - and the way that “share” is defined in the CCPA - § 1798140(ad).

If you use our AI features, you can also rest assured that consumer personal information isn’t used to train any foundation models for anyone else. We've made deliberate choices to prioritize privacy in our platform and ensure that this information stays confidential to your business.

Juro’s approach to privacy

Juro was founded in London, and we built our platform to UK and EU data protection standards from the start. We work with US counsel to keep track of changes in US privacy laws. Privacy shapes how we design features, write our contracts and run our security program.

Health information and HIPAA

The CCPA doesn’t apply to protected health information (PHI) collected by a covered entity or business associate under HIPAA (§ 1798146). HIPAA governs that information instead.

Juro is a contract management platform, not a system for patient records. It isn’t designed to store or process PHI, and Juro does not enter into business associate agreements for that reason. If you’re a covered entity or business associate, you must not upload PHI to Juro.

This doesn’t stop healthcare organizations using Juro for their contracts. Customer and vendor agreements, including BAAs themselves, don’t normally contain PHI. Employment records you hold as an employer aren’t PHI under HIPAA either. 

Risk assessments, cybersecurity audits and automated decision-making

New CCPA regulations took effect on January 1, 2026. They require some businesses to carry out privacy risk assessments, complete annual cybersecurity audits and meet new requirements when they use automated decision-making technology (ADMT) to make significant decisions about consumers. The requirements are being phased in. Risk assessment duties started on January 1, 2026, ADMT requirements apply from January 1, 2027, and first audit certifications and risk assessment attestations are due from April 1, 2028.

If your business is subject to these requirements and uses Juro, we’ll support your assessments and audits. We’ll give you our SOC 2 Type II report and other security documentation, information about how Juro processes personal information, and further reasonable cooperation if you need it.

Juro’s AI features help your team review and manage contracts. They aren’t designed to make significant decisions about consumers.

Juro’s data processing agreement

Juro offers customers a data processing agreement (DPA) that supplements the master services agreement. Our DPA includes the provisions required by the CCPA.

Below we detail how Juro’s DPA meets the requirements of the CCPA. Click on each collapsible menu to read more.

‍

Disclaimer: this article is for general information only - it is not legal advice, so you should not rely on it.

Want to find out more? Contact your sales representative, or get in touch below.