This Data Processing Agreement ("DPA") forms part of the Terms of Service between the subscribing firm (the "Customer", acting as controller) and The Casebook ("we", "us", acting as processor). It applies where we process personal data on the Customer's behalf in providing The Casebook (the "Service"), and reflects the requirements of the UK GDPR and the Data Protection Act 2018 ("Data Protection Laws").
1.Roles of the parties
The Customer is the controller and we are the processor in respect of the personal data we process on the Customer's behalf ("Customer Personal Data"). The Customer is responsible for establishing a lawful basis for the processing, for providing any required privacy notices to data subjects, and for the accuracy of the data and its instructions.
2.Scope and instructions
We will process Customer Personal Data only on the Customer's documented instructions — which include the Terms, this DPA, and the Customer's configuration and use of the Service — and as otherwise required by law (in which case we will inform the Customer, unless the law prohibits it). The details of the processing are set out in Annex 1.
3.Confidentiality of personnel
We ensure that personnel authorised to process Customer Personal Data are bound by appropriate confidentiality obligations and are made aware of the confidential nature of the data.
4.Security
We implement appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, having regard to the state of the art and the risks involved. A summary of those measures is set out in Annex 2.
5.Sub-processors
The Customer gives general authorisation for us to engage sub-processors to support the Service. Our current sub-processors are listed in Annex 3. We impose data-protection obligations on each sub-processor no less protective than those in this DPA, and remain responsible for their performance. We will give the Customer reasonable notice of any intended addition or replacement of a sub-processor, giving the Customer the opportunity to object on reasonable data-protection grounds.
6.International transfers
We will not transfer Customer Personal Data outside the UK unless appropriate safeguards under Data Protection Laws are in place (such as the UK International Data Transfer Agreement/Addendum or an adequacy decision).
7.Assistance to the Customer
Taking into account the nature of the processing, we will provide reasonable assistance to the Customer, by appropriate technical and organisational measures, to help it:
- respond to requests from data subjects exercising their rights;
- meet its obligations regarding security, breach notification, and data protection impact assessments and prior consultation with the ICO.
8.Personal data breach
We will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide the information reasonably available to help the Customer meet its own notification obligations.
9.Return or deletion
On termination or expiry of the Service, and at the Customer's choice, we will delete or return Customer Personal Data within a reasonable period, and delete existing copies unless we are required by law to retain them. For a limited period after termination the Customer may export its data before deletion.
10.Audit
We will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates, on reasonable prior notice, during business hours, and subject to appropriate confidentiality.
11.Liability
Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms.
12.Governing law
This DPA is governed by the laws of England and Wales, consistent with the Terms.
13.Annex 1 — Details of processing
| Subject matter | Provision of the The Casebook matter-management and billing Service. |
| Duration | For the term of the Customer's subscription, plus any limited post-termination export period. |
| Nature and purpose | Hosting, storage and processing of data the Customer enters, to operate matters, key dates, workflows, billing and invoicing on the Customer's behalf. |
| Types of personal data | Contact and identification details of the Customer's clients and contacts, fee-earner and staff details, and matter-related details the Customer chooses to record. The Service is not intended for special-category data or client case files. |
| Categories of data subjects | The Customer's clients and contacts, and its own personnel and Authorised Users. |
14.Annex 2 — Security measures
- Encryption of data in transit (TLS);
- Passwords stored only as secure hashes, in line with recognised (NCSC) guidance;
- Role-based access controls within each firm's workspace, and tenant isolation between firms;
- Least-privilege database access for the application;
- Restricted administrative access and activity logging;
- Regular application maintenance and updates.
15.Annex 3 — Sub-processors
| Stripe | Payment processing |
| IONOS | Transactional email delivery, and application & database hosting (UK data centre) |