Data Processing
Agreement.

Who is controller, and who is processor

The split matters more in a practice than in most businesses, because almost everything you dictate is somebody else’s personal data.

• You are the controller for the material you dictate, photograph, paste or upload — your clients, the other side, witnesses, figures, correspondence. You decide what goes in and why. We process it only to give the service back to you.
• We are the controller for your own account: your name and email, your professional role and practice name, billing records, and consent-gated analytics. That is our relationship with you, not your relationship with your client.

Nothing on this page changes the first line of that split. If we ever start processing your matter material for our own purposes, we would be a controller for it, and we would have to tell you and give you a basis to object. We do not, and the architecture is built so that we would have to change the product to start.

What the agreement commits us to

These are the Article 28(3) obligations, in the order the Regulation sets them out, and what each one means in practice here.

(a) We process only on your documented instructions

Your use of the service is the instruction. We do not mine your documents for our own purposes, we do not use them to train models — ours or anyone else’s — and if a law ever required us to process your material for some other reason, we would tell you before doing it unless that law forbids it.

(b) Everyone with access is under confidentiality

Access to production is limited to the people who run the service, all of whom are bound by confidentiality obligations that survive the engagement.

(c) We keep Article 32 security measures

Set out in full below, and we will describe any of them in more detail on request rather than hand you a certificate and call it an answer.

(d) Subprocessors, with notice and a right to object

You give general written authorisation for the subprocessors listed on our subprocessors page — six of them, of which two ever see matter content. We will give you advance notice of any addition or replacement, and you may object; if we cannot resolve the objection you may terminate without penalty for the remaining term. Every subprocessor is bound by data protection obligations no weaker than these, and we stay liable to you for what they do.

(e) We help you answer your clients

If a client of yours makes an access, rectification, erasure, restriction, portability or objection request, we help you answer it. Most of it you can do yourself inside the app; for anything you cannot, email us and we will do it within the time your own one-month deadline leaves you.

(f) We help with security, breaches and impact assessments

We notify you without undue delay after becoming aware of a personal data breach affecting your material, with what we know and what we are doing, so that you can meet your own Article 33 deadline. Where we are the controller, we notify the Data Protection Commission within 72 hours. We also help with a data protection impact assessment or prior consultation where the processing calls for one.

(g) We delete or return it when you are done

You can export at any time. On account deletion, all of it — audio recordings, scanned pages, transcripts, documents, workspace data — is permanently deleted within 30 days, unless EU or Irish law requires us to keep something (billing records, for seven years, which contain no matter content).

(h) We show our work

We make available the information needed to demonstrate compliance with these obligations: this page, the subprocessor register, our privacy policy, a transfer impact assessment, and completed security questionnaires. We will accommodate an audit or inspection at reasonable notice, once a year or whenever a supervisory authority requires one.

What we will not do is imply a certification we do not hold. Leeside Labs Limited is not ISO 27001 certified and holds no SOC 2 report today. We would rather tell you that plainly than let a badge on a page answer a question it does not answer.

International transfers

All processing happens in the European Economic Area, with one disclosed exception: the recipient-address lookup, which sends a solicitor’s name — and nothing else — to a Google service that is not contractually EEA-resident. You can turn it off for your whole workspace.

Where a transfer to a third country does occur, it is governed by the 2021 Standard Contractual Clauses in the module appropriate to our role in that transfer, together with the supplementary measures in Annex II above. Several of our subprocessors are US-incorporated even though they process in the EEA; the CLOUD Act consequences of that, including the one we cannot mitigate, are set out honestly on the subprocessors page. A transfer impact assessment is available on request.

How this fits with our other terms

This page describes the agreement we offer and work to; the signed counterpart is the instrument. It sits alongside the terms of service, which govern the commercial relationship, and the privacy policy, which explains what we do with your own account data as controller. Where the signed agreement and this page differ, the signed agreement governs.

Questions, objections, and requests all go to the same place: hello@clerkand.com. Our supervisory authority is the Data Protection Commission in Ireland.