Data protection policy

Who is who

Your firm is the controller of the personal data in its matters. It determines the purposes and the means of the processing, it keeps control of that data, and it remains responsible for the lawfulness of what it puts into the system, for the notices it gives to the people concerned, for any consent it relies on and for the instructions it gives.

Bracton Ltd is the processor of that data. It processes only on your firm's documented instructions, which at the outset are the software agreement, the data processing agreement and the schedule that records the subject matter, duration, nature and purpose of the processing as Article 28 of the UK GDPR requires. Where Bracton Ltd considers that an instruction infringes data protection law, it says so in writing with its reasons and is entitled to suspend that part of the processing until the point is resolved. Suspension on that ground never extends to withholding your firm's access to its own data.

Bracton Ltd is a controller in its own right of a separate and limited set of data, being your firm's account and billing records, the names and work contact details of your users held so that their accounts can be administered, and the security and system logs kept in order to run and protect the platform. That set is handled under the company's own privacy notice. Bracton Ltd is not a controller of matter content in any circumstance.

Privilege and confidence

Matter content includes privileged material. The privilege belongs to your client and not to your firm, your firm is unable to waive it except on the client's instructions, and Bracton Ltd is unable to waive it at all.

Your firm discloses that material to Bracton Ltd for the purpose of providing legal services to its clients and on terms of strict confidence. Bracton Ltd holds it as a confidential agent of your firm and for no purpose of its own.

Where a third party demands privileged material from Bracton Ltd, whether by court order, by a regulator's notice or otherwise, the company tells your firm at once unless the law forbids it, informs the party making the demand in writing that the material is or is likely to be privileged and subject to a duty of confidence owed to people who are not party to the demand and that Bracton Ltd holds it as a processor with no authority to waive either, and takes every step reasonably available to have the demand redirected to your firm and to resist or narrow it. Your firm gets a reasonable opportunity to intervene, to assert privilege and to seek a protective order. Where disclosure is compelled despite that, Bracton Ltd discloses the minimum the demand requires, under protest, on the express footing that privilege is asserted and not waived, and gives your firm a record of what was disclosed, to whom, when and under what compulsion.

The people who handle it

Everyone Bracton Ltd authorises to process a firm's personal data is under an enforceable obligation of confidentiality that continues after their engagement ends. They are told what they are handling, trained on data protection law as it applies to their duties, and made aware of the particular sensitivity of a law firm's client files and of the duty of confidence the firm owes its clients.

Identity, right to work and employment history checks are carried out on every person with any access to production systems before appointment, and the checks are recorded. The number of people with any access is kept to the minimum the service requires, reviewed at least every six months, and a person's access is withdrawn when their role no longer requires it or their engagement ends.

Bracton Ltd has one director and no employees at the date of this policy, so the population described in this section is one person. The obligations above are written to bind whoever holds access, and they take effect on the first engagement of anybody else.

Who else touches the data

Your firm gives general written authorisation for Bracton Ltd to appoint sub processors, subject to conditions that matter. Each one is named in a schedule you can see, with the service performed, the country of processing and the contact responsible for data protection, and no sub processor touches your data until it appears there. You get not less than thirty days written notice before an addition or a replacement, stating the name, the country, the service, the categories of data that will reach it and the safeguards that will apply.

Your firm is entitled to object within fourteen days on reasonable grounds relating to data protection or to its own professional obligations. If the objection is not resolved, Bracton Ltd either refrains from making the appointment as regards your data or your firm terminates the affected part of the service without penalty and with a refund of charges paid in advance. Each sub processor is contracted on terms no less protective than the agreement with your firm, no sub processor uses matter content for any purpose of its own, and Bracton Ltd remains fully liable for their acts and omissions as if they were its own.

The provider of any language model that receives matter content is a sub processor and is treated as one rather than as a component. No matter content reaches a provider that has not been appointed through this route, and that restriction applies to the evaluation of a new model during development as much as to live use. The company's policy on artificial intelligence deals with what leaves the firm and what is recorded.

Requests from the people in the file

Bracton Ltd provides within the product the means for your firm to locate, extract, correct, restrict, export and delete personal data relating to an individual, so that your firm answers a request without applying for help. Where more is needed, the help is given at no additional charge for a reasonable volume of requests.

Where a request or a complaint reaches Bracton Ltd directly it tells your firm within two business days and does not answer substantively beyond confirming that it holds the data as a processor and directing the person to your firm. Your firm answers the request and decides what is disclosed.

A request for access to a matter file raises questions of privilege, of the personal data of third parties and of the exemptions in Schedule 2 to the Data Protection Act 2018. Each of those is for your firm to determine. Bracton Ltd does not apply an exemption, does not redact and does not advise your firm on either.

Where the data goes, and where it does not

All of your firm's personal data is stored and processed in the United Kingdom, covering the database, document storage, backups, the search index, the audit log and every queue and cache that carries matter content at any point. Bracton Ltd does not transfer it outside the United Kingdom, and does not permit a sub processor to do so, without your firm's prior written authorisation.

Access to that data from outside the United Kingdom is a transfer even where the data itself stays where it is. Support and engineering are in the United Kingdom, and any exception, including a contractor working from abroad, is recorded and disclosed to your firm before it happens.

Where a transfer becomes necessary, your firm gets not less than thirty days written notice identifying the country, the recipient, the categories of data, the purpose and the mechanism to be relied on, together with a transfer risk assessment, and nothing moves until your firm authorises it in writing. Withholding that authorisation does not put your firm in breach of anything, and the service continues without the transfer.

Error tracking, application monitoring, log aggregation, support tooling and analytics are the ordinary route by which content leaves the United Kingdom without anyone intending it, because their payloads carry fragments of whatever caused the event. Each such service is configured to a United Kingdom region, excluded outright, or configured to strip content before transmission, and the position for each is recorded and made available so that your firm reads the working rather than the conclusion.

When something goes wrong

Bracton Ltd notifies your firm in writing without undue delay and in any event within twenty four hours of becoming aware of a personal data breach affecting your firm's personal data. The period is fixed at twenty four hours rather than left as a general standard because your firm has seventy two hours from becoming aware to notify the Information Commissioner where the breach is likely to result in a risk to the rights and freedoms of individuals.

The notification states the nature of the breach, the categories and approximate number of people and records concerned, which of your matters and clients are affected so far as is then known, when it began and when it was detected, the likely consequences, what has been done to contain it, what remains at risk, what Bracton Ltd recommends your firm does next, and a named contact reachable at any hour. Where the whole of that is not available inside the period, the notification goes out with what is known, says what is not, and is updated at least every twelve hours until the position is stable.

Your firm decides whether to notify the Commissioner and whether to communicate the breach to the people affected. Bracton Ltd makes neither notification on your firm's behalf, because the obligation belongs to the controller and the judgement of risk is your firm's to make. Bracton Ltd bears its own costs of dealing with a breach and reimburses your firm's reasonable costs of responding to the extent the breach is attributable to it.

Getting the data back, and having it deleted

Your firm's matters, documents, correspondence and ledgers belong to your firm. Bracton Ltd asserts no lien, right of retention or other interest over them, and does not withhold data as a means of enforcing payment or any other obligation.

Throughout the agreement and for ninety days after it ends, your firm takes an export at no charge, in a usable and documented format. Documents come out in their original file formats with matter reference, dates and authorship preserved. Structured records come out with a field list and a description of the schema, so the export can be loaded into another system. The audit log comes out on the same terms. Your firm's administrator takes it without a support request, without giving a reason and without limit of number, and the right survives any dispute, any suspension for non payment and termination for any reason.

Within the ninety day period your firm elects in writing whether Bracton Ltd returns or deletes the data, with written reminders thirty days and seven days before the period ends, and nothing is deleted before that election is received and your firm has confirmed it holds a complete export. Where your firm elects deletion, the data goes from live systems within thirty days by destroying the encryption keys held for your firm together with erasure of the underlying records, and the deletion is certified in writing within a further fourteen days.

Copies in backups are not deleted at the same moment, because backups are immutable for a defined period as a protection against ransomware and a backup that can be deleted on demand is not a backup. Those copies expire on the ordinary backup cycle, remain encrypted until they do, are processed for no purpose other than storage and disaster recovery, and your firm is told in writing when the last one has expired.

Your firm's own retention obligations remain your firm's. A law firm keeps matter files, accounting records and anti money laundering records for periods running to years after a file closes, set by the SRA Accounts Rules, by the Money Laundering Regulations, by the limitation periods that apply to its work and by the requirements of its insurers. Nothing here cuts across those obligations or shortens them, and the mechanism by which your firm meets them after the agreement ends is the export.

What Bracton Ltd does not do

Bracton Ltd is not authorised or regulated by the Solicitors Regulation Authority. It does not provide legal services, does not give legal advice, does not carry on a reserved legal activity and does not supervise your firm's work. Output produced by the assistant is material for a fee earner to check and adopt, and the fee earner remains responsible for it.

The accounting records the SRA Accounts Rules require are your firm's records. Bracton Ltd supplies the system in which some of them are kept and does not become the keeper of them. Your firm remains responsible for the reconciliations the Rules require, for the accuracy of its client and office ledgers, for retaining its accounting records for the period the Rules require, and for the delivery of an accountant's report where one is due.

Bracton Ltd does not certify, and is not able to certify, that your firm complies with data protection law, with the Accounts Rules or with any other regulatory requirement. What it does supply, on request and at no charge, is the material your firm needs to demonstrate its own compliance, being a description of the processing, the current list of sub processors, the position on international transfers, the retention position and the summary letter of the most recent independent test.

Ownership and review

This policy is owned by the director of Bracton Ltd. It is reviewed at least once a year, on any change in data protection law or in regulatory guidance that affects the company, and whenever the product changes in a way that alters what is processed or where.

Questions go to hello@bractonlegal.co.uk. A firm carrying out due diligence is entitled to the data processing agreement itself rather than this summary of it, and it is provided on request.