Privacy Policy

Two roles

For the records a firm keeps in the service (its matters, clients, documents and accounts) the firm decides what is collected and why. The firm is the controller and we are its processor, acting only on its instructions as the Data protection page sets out. A firm's client with a question about those records should ask the firm.

For our own records (people who visit this site or ask for a demo, a subscribing firm's contacts and billing, the accounts of people who sign in, and support) we are the controller, and this policy describes what we do.

What we collect

• Enquiries: name, email, phone, firm, role and message from the demo, trial and contact forms.
• Subscriptions: the firm's details, its contacts, its plan and its invoices and payments. Card details go to Paystack and never reach us.
• User accounts: name, email, phone, role, sign-in records, and the device and network address used, to keep accounts secure.
• Support: what is written to us and our replies.
• Site use: which pages are read and which buttons pressed, measured without advertising profiles or cookies.

Why we use it

We use personal data to answer enquiries, provide and bill for the service, keep it secure, give support, meet legal and tax duties, and improve the site and the service. Each use rests on a ground Act 843 allows: the contract with the firm, a legal obligation, our legitimate interest in running a secure business where that does not override the person's interests, or consent, which may be withdrawn at any time.

We send product news only to people who agreed to receive it, and every message carries a way to stop.

Who we share it with

We share personal data only with the providers that help us run the service, listed on the Subprocessors page and bound by contract to protect it; with authorities where the law requires it; and with a business that takes over the service, under this policy. We never sell personal data.

Transfers outside Ghana

Some of our providers store or handle data outside Ghana, including in the European Union. We use providers bound by contract to protect it to a standard no lower than Act 843 requires, and, where a firm's clients live in a country with its own transfer rules, we put the terms that law asks for in place on request.

How long we keep it

• Enquiries that lead nowhere: two years from the last contact.
• Subscription and billing records: for as long as tax law requires, currently six years after the year they relate to.
• User accounts: while the firm's subscription lasts, then as the end of a subscription is described in the Terms of Service.
• Security logs: twelve months, longer where an incident is being investigated.

Your rights

Anyone may ask us whether we hold data about them and for a copy; ask us to correct, complete or delete it; object to a use of it; or withdraw consent. Write to [email protected]. We answer within 21 days and may ask for proof of identity first. Requests about a firm's own records are passed to that firm.

Anyone unhappy with how we handle their data may complain to the Data Protection Commission of Ghana, or to the authority where they live.

Security

We protect personal data with the measures described in the Trust Centre. If a breach puts personal data at risk we tell the Data Protection Commission and the people affected as the law requires, and the firm concerned without delay.

Children

The site and the service are for law firms and their staff. We do not knowingly collect children's data for our own purposes; where a firm's matters concern a child, the firm decides how that data is handled.

Changes and contact

We update this policy when what we do changes, and show the date at the top. Questions go to Afatech Enterprise, trading as Docavra, Tamale, Ghana, at [email protected].