Data Processing Agreement

ClerkMind processes personal data only to provide the service: storing, organising, displaying, searching, exporting, sending notifications and reminders, and making backups. Processing lasts for as long as the service is used and the deletion period after it ends (section 12).

• Data subjects: the firm's users, the firm's clients, opposing parties, witnesses and other persons named in matters and documents.
• Types of data: identification and contact data, data on matters and proceedings, documents and their content, notes and communications, records of time, expenses and invoices, and user account and sign-in data.
• Depending on the firm's matters, processing may include special categories of personal data (for example, health data) and data on criminal offences and convictions.

ClerkMind processes the data only on the firm's instructions: this agreement, the Terms of Service and what the firm does in the app. The only exception is processing the law requires, of which we inform the firm in advance unless the law forbids it. If we believe an instruction breaks the law, we tell the firm at once.

The people working on ClerkMind are bound to confidentiality, respecting lawyer–client privilege. The app has no function through which our staff could view the firm's matters, clients or documents. The administration console shows only the firm's name and status, its users (name, email, role, status and time of last sign-in) and record counts.

Only authorised persons have technical access to the servers: to operate and secure the service, for backups, for support the firm asked for, or when the law requires it.

ClerkMind applies the technical and organisational measures described on the Security and data location page, which is an annex to this agreement. We maintain and improve them without lowering the level of protection.

The firm gives general authorisation for the subprocessors listed on the Subprocessors page. We notify the firm's administrators by email at least 30 days before adding or changing a subprocessor. The firm may object; if we find no solution, it may end the agreement before the change takes effect.

We impose the same data protection obligations on each subprocessor and remain responsible for its work.

The database, documents and backups are in Germany (EU). Traffic passes through Cloudflare's network. When data is transferred outside North Macedonia and the EU, the transfer is protected by the safeguards the law requires, such as standard contractual clauses.

The app lets the firm correct, delete and export data, so it can answer data subjects' requests. A request that reaches us is forwarded to the firm without our answering it ourselves, and we help as far as needed.

We assist the firm with the information needed for a data protection impact assessment, for prior consultation with the Personal Data Protection Agency and for meeting its other legal obligations.

We notify the firm of a personal data breach without undue delay and no later than 48 hours after becoming aware of it. The notice states the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Information not yet known is provided later.

On request we give the firm all information needed to demonstrate compliance with this agreement. The firm, or an auditor bound to confidentiality, may carry out an audit once a year with 30 days' notice, during business hours and without access to other firms' data, at the firm's cost. A further audit is possible after a breach or at the request of a competent authority.

The administrator can export all of the firm's data at any time. After the service ends the data is kept for 90 days, for a possible export, and is then automatically and permanently deleted from the database and the document storage. Copies in backups and earlier versions of documents are gone within a further 30 days. On request we confirm the deletion in writing. The only exception is what the law requires to be kept.

On matters of personal data protection, this agreement takes precedence over the Terms of Service. Liability is governed by the Terms. The Macedonian version is binding.