Data processing agreement (DPA)

This DPA is part of the terms when the operator processes personal data of clients or matters for the firm. The firm is controller; the operator is processor. Processing means storing, transmitting and displaying that data for the software features.

The operator processes data only on the firm's documented instructions (normal use of LegalTrack) and applicable law. The firm warrants it is allowed to upload the data. The operator is not required to review the substance of matters.

The operator applies reasonable security measures: user authentication, encryption in transit, storage quotas, access logs and periodic backups.

If you enable subscription payments or Google Calendar, those providers process only the data needed for that function. Material changes will be announced in the product. When the service ends the firm may export what the interface allows; the operator will then delete or anonymise the firm's data within a reasonable time, except backups or legal retention.