Data Processing Agreement

The subscribing court is the controller. The platform operator is the processor and processes personal data only on the court's documented instructions, being the licence, these terms and the court's use of the platform's features.

• Subject matter: personal data contained in cause lists, case bundles, participant records and the written record of sittings.
• Duration: the subscription term, plus the retention or export period agreed on exit.
• Nature and purpose: hosting, access control, delivery of individually issued sitting invitations, recording of proceedings in writing, certification and archiving.
• Data subjects: judges, registrars, clerks, counsel, parties, witnesses and court staff.

• Process only on instruction, and inform the court if an instruction appears to infringe applicable data protection law.
• Impose confidentiality on all personnel with access, on a strict need-to-know basis.
• Apply the technical and organisational measures described in the Security & Trust page.
• Assist the court with data subject requests, impact assessments and regulator engagement.
• Delete or return personal data on termination, subject to legal retention duties.

The operator engages a small number of infrastructure sub-processors for managed database hosting, application hosting and transactional email delivery. Each is bound by written terms no less protective than this agreement. The current list is provided to the court on request, and the court receives prior notice of any intended change with a right to object on reasonable data protection grounds.

The operator notifies the court without undue delay and in any event within seventy-two hours of becoming aware of a personal data breach affecting the court's data, with the nature of the breach, categories and approximate numbers affected, likely consequences and remedial measures — so the court can meet its own notification duties, including to the Nigeria Data Protection Commission where applicable.

The operator makes available the information necessary to demonstrate compliance and permits the court, or an independent auditor it appoints, to audit the processing once in any twelve-month period on reasonable notice, subject to confidentiality and to the security of other courts' data.

Personal data is processed in the region agreed with the court. Any transfer outside that region relies on a lawful transfer mechanism under the controller's applicable law and is recorded in the licence.