# Data Processing Agreement (DPA)

**Between:** [Law Firm Name] ("Customer", "Controller")  
**And:** AdvocatesConnect (U) Limited ("Processor", "AdvocatesConnect")  
**DPA version:** 1.0  
**Effective:** upon acceptance by the Customer's account administrator  
**Legal basis:** Data Protection and Privacy Act, 2019 (Act 9 of 2019), ss. 18, 19; Data Protection and Privacy Regulations, 2021 (SI 61 of 2021)

---

## 1. Roles

The Customer is the **Data Controller** of the client and matter data it processes through the Suites platform. AdvocatesConnect is the **Data Processor**, processing that data on the Customer's documented instructions. For its own subscriber account data (firm name, administrator details, billing), AdvocatesConnect acts as **Data Controller**.

## 2. Subject matter and duration

This DPA applies to the Customer's use of the Suites platform for the duration of the subscription, and survives until all personal data has been deleted or returned in accordance with Section 9.

## 3. Categories of data and data subjects

Client names, contact details, identification documents, case and matter records, legal documents, financial records, and — where the Customer uses the HR module — employee payroll data. Data subjects are the Customer's clients, employees, and related parties.

## 4. Customer instructions

AdvocatesConnect processes personal data only on the Customer's documented instructions, including with regard to transfers of personal data outside Uganda, unless required to do so by Ugandan law. The platform's configuration options (role-based access, confidentiality flags, retention settings) constitute part of those instructions.

## 5. Processor obligations

AdvocatesConnect shall:

- process personal data only on the Customer's instructions and as described in this DPA;
- ensure that personnel authorised to process personal data are bound by confidentiality;
- implement the technical and organisational measures described in Section 8;
- not engage a sub-processor without the Customer's prior authorisation. A list of current sub-processors is published on the platform. AdvocatesConnect gives at least **14 days' notice** of any addition or replacement of a sub-processor, during which the Customer may object;
- assist the Customer in responding to data subject requests, taking into account the nature of the processing;
- assist the Customer in meeting its obligations under ss. 23 and 24 of the Act in relation to data security, breach notification, and data protection impact assessments;
- notify the Customer without undue delay, and in any event within 72 hours, of becoming aware of a personal data breach;
- at the Customer's choice, delete or return all personal data after the end of the services, and delete existing copies unless Ugandan law requires storage.

## 6. Sub-processors

The current sub-processor list is published in the platform footer and is maintained in the VendorRegister. It identifies each processor, its role, the hosting region, and the status of the data processing agreement with that processor. AdvocatesConnect remains liable for the acts of its sub-processors to the same extent as for its own.

## 7. Cross-border transfers

Cross-border transfers are made under Regulation 19 of the Data Protection and Privacy Regulations, 2021. The safeguards applied are described in the DPIA for cross-border hosting (`DPIA-CrossBorder-v1.md`): contractual clauses, encryption in transit and at rest, and a published sub-processor list with change notice.

## 8. Technical and organisational measures

- Encryption of personal data in transit (TLS 1.2+) and at rest (AES-256).
- Multi-tenant data isolation through row-level security; one firm cannot access another firm's data.
- Role-based access control on the principle of least privilege.
- Multi-factor authentication available for administrator and advocate accounts.
- Comprehensive audit logging of data access and modifications.
- Regular security review and staff data-protection training.

## 9. Deletion and return

Upon termination of the subscription, the Customer may export its data. After the retention period applicable to each data class (account data 90 days post-closure; case data 7 years; financial records 7 years; payroll 10 years; logs 12 months), AdvocatesConnect deletes or irreversibly anonymises the data, evidenced in the RetentionRunLog.

## 10. Audit

AdvocatesConnect maintains the RoPA and DPIAs referenced in this DPA and makes them available to the Customer on reasonable request. The Customer may audit AdvocatesConnect's compliance with this DPA, subject to confidentiality, not more than once per calendar year.

## 11. Liability

Each party's liability under this DPA is governed by the Terms of Service, except that nothing in this DPA limits either party's liability to the extent that Ugandan law does not permit such limitation.

---

*Acceptance of this DPA is recorded separately from acceptance of the subscription contract, pursuant to s.7 of the Data Protection and Privacy Act, 2019. Acceptance is logged against the Customer's firm account with a version, timestamp, and the identity of the accepting administrator.*