Data protection

What we process

The personal data of the firm's clients, the parties to its matters, its staff and anyone else in its records, of every kind the firm chooses to keep, for as long as the subscription lasts, solely to provide the service.

Our commitments

• We process the firm's data only on its documented instructions, which are the Terms of Service and the firm's use of the service, unless the law requires otherwise, in which case we tell the firm first where the law allows.
• Everyone at our end who can reach the firm's data is bound to confidentiality, and reaches it only where support, security or the law requires; each access is logged.
• We keep the security measures described in the Trust Centre.
• We use only the subprocessors listed on the Subprocessors page, each under terms at least as protective as these. We give 30 days' notice of a new one, and a firm that objects on reasonable grounds may end its subscription with a refund of the unused period.
• We help the firm answer requests from the people its records are about, and with its own assessments and consultations, as far as the service allows.
• We tell the firm without undue delay, and within 72 hours, after we learn of a breach affecting its data, with what we know and what we are doing, so it can meet its own duties to notify.
• At the end of the subscription we let the firm export everything, then delete its data as the Terms of Service describe and certify the deletion.
• We give the firm the information it reasonably needs to show these commitments are kept, including summaries of our security reviews.

Clients outside Ghana

A firm's clients may live anywhere. Where the law of a client's country, such as the GDPR in the European Union or the United Kingdom, asks for particular terms on processing or transfer, we agree those terms with the firm on request.

The firm's part

The firm decides what personal data it keeps and why, has a lawful ground for each, tells the people concerned what the law requires, and keeps its own registration with the Data Protection Commission current.