Data processing addendum
This addendum is part of the Terms of service between [Company legal name] ("Firmviz", the processor) and the Firm (the controller). It sets out how Firmviz handles the personal information the Firm puts into the service, including information about the Firm's clients and the other parties to its matters.
1. Roles and instructions
- The Firm decides what information enters the service and why; Firmviz processes it only to provide the service, on the Firm's documented instructions, which are the Terms, this addendum and the settings the Firm's administrators choose in the service.
- If Firmviz believes an instruction breaks the law it tells the Firm before acting.
- The Firm confirms that it has the right to put the information into the service and to instruct its processing.
2. The lawyer's duties, acknowledged
Firmviz recognises that the Firm holds client information under duties of confidentiality and privilege, and that bar guidance (for example ABA Formal Opinion 477R on securing communication of protected client information, and Opinion 483 on data breaches) requires the Firm to make reasonable efforts to ensure a vendor's conduct is compatible with those duties. Firmviz's measures in section 5 and on the Security and technology page are offered to support those efforts, and Firmviz will not assert any right to the Firm's client information beyond what is needed to provide the service.
3. Confidentiality of people
Everyone Firmviz allows to process the Firm's information is bound by a written duty of confidentiality and receives training appropriate to their role. Access to a firm's data by Firmviz's operator is possible only through a support grant the Firm approves, limited in time and written to the Firm's audit log.
4. Sub-processors
- Current sub-processors: [hosting provider, region, purpose]; [email provider for notices, purpose]; [AI provider, purpose, only if the Firm turns the feature on].
- Firmviz tells the Firm at least [30] days before adding or replacing a sub-processor; the Firm may object on reasonable grounds and, if the objection cannot be resolved, end the affected service with a refund of prepaid fees for the unused term.
- Each sub-processor is bound by written terms at least as protective as this addendum, and Firmviz remains responsible for their performance.
5. Security measures
Firmviz maintains, at least: per-firm isolation enforced by the application and by database row-level security; scrypt password hashing and passkeys; Tier 2 approvals on money, access, holds and anything leaving the Firm; an append-only hash-chained audit log anchored outside the database; encryption of uploads, memos and backups at rest with a key per firm and TLS in transit; malware scanning of uploads; a strict Content Security Policy; rate limits; encrypted backups with restore drills; and the retention and legal-hold controls described on the Security and technology page. Firmviz may improve these measures but will not reduce the overall level of protection during the term.
6. Help with requests from people
If someone asks the Firm to access, correct, delete or receive their information, Firmviz helps the Firm answer within the time the law allows, using the service's own export and correction tools first. If such a request reaches Firmviz directly, Firmviz passes it to the Firm without answering, unless the law requires otherwise.
7. Breaches
Firmviz tells the Firm of a personal-data breach affecting the Firm's information without undue delay and within [72 hours] of confirming it, with what is known at the time: what happened, which records and how many, the likely consequences, what Firmviz has done and a contact. Firmviz keeps the Firm informed as more is known and helps the Firm with any notice it must give. Firmviz does not tell a Firm's clients or a regulator about a breach of the Firm's data on its own unless the law requires.
8. Audits
Once a year, or after a breach, the Firm may ask for written answers to a reasonable security questionnaire and copies of any independent reports Firmviz holds (under confidentiality). If those do not reasonably satisfy a legal requirement of the Firm, the Firm or an auditor it chooses (not a competitor of Firmviz) may audit the relevant parts of Firmviz's operations on [30] days' notice, during business hours, at the Firm's cost, without access to other firms' data.
9. Where the information goes
The Firm's information is processed in [country / region], or on a server the Firm controls. Firmviz does not transfer it elsewhere without the Firm's written agreement and a lawful transfer mechanism ([standard contractual clauses / other]).
10. Return and deletion
During the term and for [60] days after it ends the Firm can export its information in the formats the service provides. After that Firmviz deletes its copies within [90] days and confirms in writing on request, except for backups that expire on their schedule (and are not used except to restore the Firm's own data), legal holds the Firm placed and records the law requires Firmviz to keep.
11. Liability and the rest
The limits of liability in the Terms apply to this addendum. Where the law gives people direct rights against a processor, nothing here limits those rights. If this addendum conflicts with the Terms, this addendum prevails for the processing of personal information. [If the GDPR or UK GDPR applies: the standard contractual clauses or UK addendum are attached as Schedule 1. If the CCPA applies: Firmviz is a service provider, does not sell or share the information, uses it only for the business purposes in the Terms, and certifies that it understands these restrictions.]
Schedule: what is processed
- Subject matter and purpose: running the Firm's practice management in the Firmviz service.
- Duration: the term of the Terms plus the export and deletion periods above.
- Categories of people: the Firm's staff; the Firm's clients; parties, witnesses, courts and other contacts recorded in matters; people who correspond with the Firm.
- Categories of information: identification and contact details; roles and sign-in records; matter records including deadlines, time, documents, memos, communications and the Court Map; trust and billing records; the audit log; and, where the Firm records them, special categories of information that matters can involve (health, criminal proceedings and the like), for which the Firm is responsible for the lawful basis.