Privacy Policy and Data Processing Agreement (DPA) – Lawyers’ Dashboard (LegalCRM.co)

1. Introduction, Legal Status and Definitions

1.1. The Company respects the privacy and professional confidentiality of solicitors who use the System’s management and CRM portal (hereinafter: the "Solicitor" or the "User").

1.2. Distinction in legal status (Data Controller vs. Data Processor):

• The Company as controller (Data Controller): In relation to the personal, professional and financial information of the Solicitor themselves (such as registration details, email address, purchase history and firm CRM data), the Company acts as controller and is responsible for its processing.
• The Company as processor (Data Processor): In relation to end-customer data, correspondence, documents and PDF files produced for legal matters, the Solicitor (or the end customer) is the controller (Data Controller), and the Company acts solely as a data processor (Data Processor / Mere Conduit) on their behalf and in accordance with their instructions.

2. Information Collected about the Solicitor

Upon registration, account opening and use of the CRM portal, the Company collects the following types of information:

2.1. Professional identification and contact details: A professional email address used to open the account and for secure sign-in (via Google / Microsoft OAuth), and the name and account identifiers displayed after sign-in.

2.2. Account and activity data: Account opening date, login data (Logs), and profile-update history.

2.3. Financial and voucher data: Details of vouchers purchased (type, serial number, secret code, quotas total / used / sent / remaining), purchase history and tax-invoice history.

• Clarification regarding payments: Payment is made directly via authorised providers (Airwallex / Stripe) under the PCI-DSS standard. The Company does not store or retain on its servers full credit-card details or full bank details.

2.4. CRM matter-management data: The list of invitations sent to end customers, invitees’ email addresses, invitation status (open/completed), internal matter identifiers (where entered), and expiry dates of invitation links.

3. Purposes for which the Information is Collected

The Company uses the information collected about the Solicitor for the following purposes only:

3.1. Service provision and CRM operation: Account management, allocation of purchased vouchers, monitoring of quota utilisation, and sending of secure invitations to end customers.

3.2. Identity verification and legal compliance: Verifying that the user is an authorised solicitor and preventing misuse or unauthorised access to the System.

3.3. Financial and accounting management: Issuing tax invoices/receipts as required by law and managing financial reports.

3.4. Communication and technical support: Sending operational notices, purchase confirmations, responding to support requests, and sending system alerts (such as advance notices 60 and 30 days before account expiry due to 24 months of inactivity).

4. Information Security and Account Protection

4.1. Security standards: The Company implements advanced physical, technological and organisational information-security measures (including TLS 1.3 communication encryption and Encryption at Rest).

4.2. Access responsibility: Access to the CRM portal is protected by Google/Microsoft OAuth authentication. The account is managed and uniquely identified by a single email address. The Solicitor bears exclusive responsibility for maintaining the confidentiality of access permissions and for every action performed in their account (including actions performed by firm staff authorised by them).

5. Sharing of Information with Third Parties

The Company shall not sell, lease or transfer the Solicitor’s details to third parties, except in the following cases:

5.1. Infrastructure service providers: Authorised payment providers (Airwallex / Stripe) for payment processing, and secure cloud infrastructure providers for storage and operation of the portal.

5.2. Legal requirement: If the Company is required to do so by court order, a binding legal provision, or in the framework of legal proceedings between the Company and the Solicitor.

5.3. Corporate restructuring: In the framework of a merger, acquisition or sale of the Company’s assets, provided that the acquiring party assumes the provisions of this Privacy Policy.

6. Data Retention and Account Deletion (Data Retention)

6.1. Retention period for account details: The Solicitor’s identification details, purchase history and invoices shall be retained in the System for as long as the account is active, and for the period required by law for tax, accounting and legal backup purposes.

6.2. Inactivity (24 months): An account in which no login activity or invitation sending is recorded for 24 consecutive months shall be blocked automatically, and balances therein shall expire in accordance with the Terms of Service.

6.3. Initiated account deletion: The Solicitor may perform a full deletion of their account independently in the Dashboard at any time, subject to retention of information that the Company is obliged to retain by law.

7. The Solicitor’s Rights in relation to their Personal Data

In accordance with the UK GDPR and the Data Protection Act 2018, the Solicitor is entitled to access the personal data collected about them and held in the Company’s records, to request its rectification where it is inaccurate or incomplete, or to request its erasure (subject to the Company’s financial retention obligations under law).

1. Definitions and Nature of Processing

1.1. Status of the parties: The Solicitor is the controller of the information (Data Controller) or an authorised conduit on behalf of the end customer. The Company acts solely as a technical data processor (Data Processor) performing extraction, transcription, arrangement and processing of correspondence and files on behalf of the Solicitor.

1.2. Scope of processing: Processing is limited solely to texts, messages (Email, WhatsApp), audio files and media uploaded or extracted pursuant to the instruction of the end customer/Solicitor for the purpose of producing a consolidated PDF report.

2. Information Security and Permanent Deletion (Zero Data Retention)

2.1. Temporary processing only: The Company undertakes that all processed information, including source correspondence, transcripts, media files and produced reports, shall be automatically and fully deleted from the System servers within 24 hours at most from completion of processing, or immediately upon deletion of the action at the user’s initiative (whichever is earlier).

2.2. Non-retention of backups: The Company undertakes that no copies, backups or cache files of the source correspondence or produced documents shall be retained after the processing window has elapsed.

2.3. End-to-end encryption: All communication and data transfer in the System is performed via encrypted channels (TLS 1.3) and files are encrypted on the server during processing (Encryption at Rest & In-Transit).

3. Sub-Processors and AI Requirements

3.1. Approval of sub-processors: The controller authorises the data processor to engage cloud infrastructure providers and language models (such as OpenAI / Azure API) for the performance of transcription and textual processing.

3.2. Strict API protection: The Company undertakes that work with sub-processors is performed solely via business API channels (Enterprise API) ensuring an express zero-data-retention policy and an absolute prohibition on use of data for training artificial-intelligence models (No AI Model Training).

4. Limits of Derivation and Absence of Liability for Outputs

4.1. Technological conduit only: The Company places at the Solicitor’s disposal an automatic processing conduit only (Mere Conduit). The Company takes no legal position, does not examine the reliability of transferred content, and does not alter the content of source messages.

4.2. Ownership of data: The Company asserts no ownership, intellectual property or usage rights in the transferred information or in the produced reports. All information and outputs are in the exclusive ownership of the end customer and the Solicitor.

4.3. Responsibility for use of the output: The Company bears no liability for the manner in which the Solicitor or the end customer uses a produced document, including its presentation, publication, submission to legal proceedings or reliance upon it in the course of legal advice.