Data Processing Agreement

This Data Processing Agreement ("Agreement") forms part of the terms under which the operator of Mattersimple ("Provider", "we") provides its practice management service to the subscribing law firm ("Firm", "you"). It applies to personal information about the Firm's clients, contacts and other individuals that the Firm stores in the service ("Client Data").

1. Roles

The Firm controls Client Data and decides why and how it is collected and used. The Provider processes Client Data only on the Firm's behalf, to provide the service. Nothing in this Agreement makes the Provider responsible for the Firm's own professional obligations, including confidentiality, privilege, client identification and trust accounting.

2. Processing only on instructions

The Provider processes Client Data only to provide, secure and support the service, as the Firm instructs through its use of the service, and as required by law. The Provider does not sell Client Data, use it for advertising, or use it to train models or for any purpose of its own.

3. Confidentiality

Everyone the Provider authorizes to access Client Data is bound by confidentiality obligations. Access is limited to what is needed to operate and support the service. Where the Provider's staff sign in as a Firm user to give support, the session is time-limited, the Firm's owner is notified, and the start and end are logged.

4. Security

The Provider maintains reasonable administrative, technical and physical safeguards appropriate to the sensitivity of legal client information, including encryption in transit, encrypted storage of secrets, access controls, two-factor authentication options, separation of each Firm's data, and audit logging. Files uploaded to the service are never publicly reachable.

5. Sub-processors

The Firm authorizes the Provider to use the sub-processors listed on the Sub-processors page, which the Provider keeps current. Each sub-processor is bound by data protection obligations no less protective than this Agreement. The Provider remains responsible for its sub-processors.

6. Location of data

Client Data is stored in the location stated on the Sub-processors page. Data is in Beauharnois (BHS), Montreal Canada.

7. Breaches

The Provider will notify the Firm without undue delay after becoming aware of a breach of security safeguards involving Client Data, and will give the Firm the information it reasonably needs to assess the breach and meet its own reporting obligations, for example to the Office of the Privacy Commissioner of Canada, a provincial commissioner, a state regulator, its law society or state bar, or affected individuals.

8. Individuals' requests

The service lets the Firm export, correct and erase Client Data. The Provider will reasonably help the Firm respond to requests from individuals to access, correct or delete their personal information, and will pass on to the Firm any such request it receives directly.

9. Return and deletion

The Firm may export its data from the service at any time. When the Firm's account is deleted, the Provider deletes Client Data after the grace period shown in the service, except where the law requires the Provider to keep it, and from backups on their normal rotation.

10. Audits and information

On reasonable request, the Provider will give the Firm information reasonably needed to show compliance with this Agreement, such as a description of its security practices.

11. Applicable law

Each party will comply with the privacy laws that apply to it, which may include Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), substantially similar provincial laws, and United States federal and state privacy and data security laws. This Agreement is governed by the law named in the Provider's terms of service.

12. Changes

The Provider may update this Agreement. A new version is shown to the Firm's owner for acceptance, and the date of each acceptance is recorded.

Create an account