Data processing terms

These terms form part of the terms of service between your law firm ("the firm") and [Company legal name], a company registered in Nepal (registration no. [—], PAN [—]), [registered address] ("we"). They cover the personal information the firm puts into its Law Automator workspace about its clients, parties, witnesses, staff and others ("firm data").

1. Roles

The firm decides why and how firm data is processed and is responsible for having a lawful basis and for its duties of confidentiality to clients. We process firm data only on the firm's documented instructions, which are given by its use of the service and its settings, and not for our own purposes.

2. Confidentiality and privilege

We treat all firm data as confidential and recognise that much of it is subject to lawyer–client confidentiality. Our personnel with access are bound by confidentiality obligations, and access is limited to keeping the service running and secure, support the firm requests, and what the law requires. Access to production systems is logged.

3. Security measures

  • Encryption in transit (HTTPS) and, for case facts, client identity numbers, file notes, enquiry and advice notes and client messages, at rest.
  • Isolation of each firm's records; requests for another firm's records return "not found".
  • Two-step verification for staff, least-privilege roles, rate limits and audit logs.
  • Uploaded files are stored privately and served only to authorised users through expiring links; optional virus scanning.
  • Encrypted backups with restore verification, kept for 14 days.

4. Sub-processors

We use: [hosting provider, location], [email delivery provider], and, only for payments the firm or its clients choose to make, eSewa, Khalti and banks. We will give at least 30 days' notice of a new sub-processor; the firm may object and, if we cannot address the objection, cancel.

5. Personal data breaches

We will notify the firm without undue delay, and in any case within 72 hours of becoming aware of a breach affecting firm data, with the information we have, and help the firm meet its own obligations.

6. Requests from individuals and authorities

Requests from the firm's clients or other individuals are passed to the firm. Requests from authorities are handled only as Nepali law requires; we will tell the firm first where the law allows and will challenge requests that are not lawful.

7. Return and deletion

The firm can export all firm data at any time. After its subscription ends, firm data is deleted at the end of the retention period (currently 60 days) and from backups within 14 days after that.

8. Information

We will answer the firm's reasonable questions about our security measures and provide information needed to show compliance with these terms.