# Record of Processing Activities (RoPA)

**Controller / Processor:** AdvocatesConnect (U) Limited  
**Platform:** Suites by AdvocatesConnect  
**Document version:** 1.0  
**Date prepared:** 5 November 2026  
**Legal basis:** Data Protection and Privacy Act, 2019 (Act 9 of 2019); Data Protection and Privacy Regulations, 2021 (SI 61 of 2021), Regulation 6  
**Data Protection Officer:** suites.support@advocates-connect.com

---

## 1. Purpose of this Record

This Record of Processing Activities (RoPA) is maintained pursuant to Regulation 6 of the Data Protection and Privacy Regulations, 2021. It describes the processing of personal data carried out by AdvocatesConnect (U) Limited ("AdvocatesConnect", "we") in connection with the Suites legal practice management platform. AdvocatesConnect acts as **Data Controller** for its own subscriber account data and as **Data Processor** for the client and matter data that law firms process through the platform.

## 2. Processing Activity: Payroll

| Item | Detail |
|---|---|
| **Activity name** | Payroll processing (HR Module) |
| **Purpose** | Compute salaries, statutory deductions (PAYE, NSSF, LST), generate payslips, maintain payroll records for law firms using the HR module |
| **Controller** | The subscribing law firm (employer) |
| **Processor** | AdvocatesConnect (U) Limited |
| **Categories of data subjects** | Employees of subscribing firms |
| **Categories of personal data** | Full name, NIN, NSSF number, TIN, bank account / mobile money number, salary, allowances, deductions, next of kin, emergency contacts, leave records |
| **Sensitive data** | None inherently; financial data of employees |
| **Lawful basis** | Contractual necessity (employment), legal obligation (PAYE/NSSF) |
| **Recipients** | Uganda Revenue Authority (statutory returns), NSSF, the employer firm, hosting provider, payment provider where payslips are distributed |
| **Cross-border transfers** | Hosting in EU/US regions under Regulation 19 safeguards (see DPIA-CrossBorder) |
| **Retention** | Duration of employment + 10 years |
| **Technical & organisational measures** | TLS 1.2+ in transit, AES-256 at rest, RBAC, multi-tenant isolation, audit logging, MFA for administrator accounts |
| **DPIA** | Required and completed — see `DPIA-Payroll-v1.md` |

## 3. Processing Activity: Matter / Case Records

| Item | Detail |
|---|---|
| **Activity name** | Case and matter management |
| **Purpose** | Enable law firms to record, manage, and retrieve client and matter data, generate pleadings and documents, track court deadlines, and prepare ECCMIS filings |
| **Controller** | The subscribing law firm |
| **Processor** | AdvocatesConnect (U) Limited |
| **Categories of data subjects** | Clients of subscribing firms, opposing parties, witnesses |
| **Categories of personal data** | Client names, contact details, identification documents, case details, court information, legal documents, financial records (invoices, payments) |
| **Sensitive data** | May include health records (personal injury), financial data (commercial disputes), children's data (family law) — processed under s.5 of the Regulations only where explicit consent, legal necessity, or legal claims require it |
| **Lawful basis** | Contractual necessity (legal services), legitimate interest (service delivery) |
| **Recipients** | Courts (via ECCMIS filings), the firm's clients, hosting provider, email provider (for document distribution) |
| **Cross-border transfers** | Hosting in EU/US regions under Regulation 19 safeguards |
| **Retention** | Duration of account + 7 years (per Advocates Act records requirements) |
| **Technical & organisational measures** | TLS 1.2+ in transit, AES-256 at rest, firm-level data isolation (RLS), matter-level access logging, RBAC, MFA for advocate accounts, audit trail |
| **DPIA** | Not separately required; covered by platform-wide controls. Sensitive data handling assessed under s.5 compliance |

## 4. Processing Activity: Client Portal

| Item | Detail |
|---|---|
| **Activity name** | Client portal access and document exchange |
| **Purpose** | Allow law firms to grant clients secure access to case updates, documents, invoices, and a communication channel |
| **Controller** | The subscribing law firm |
| **Processor** | AdvocatesConnect (U) Limited |
| **Categories of data subjects** | Clients of subscribing firms |
| **Categories of personal data** | Client email, contact details, uploaded documents (identification, evidence, correspondence, contracts, court documents), portal messages |
| **Sensitive data** | Uploaded documents may contain sensitive personal data; access restricted to the client and authorised firm members |
| **Lawful basis** | Contractual necessity (legal services), consent (portal access) |
| **Recipients** | The firm's authorised staff, the client, hosting provider, email provider (portal notifications) |
| **Cross-border transfers** | Hosting in EU/US regions under Regulation 19 safeguards |
| **Retention** | Aligned to case data retention (duration of account + 7 years); documents are removed when the firm archives the case |
| **Technical & organisational measures** | Verification by email link or login, document status review workflow, confidentiality flag, firm-scoped access, audit trail of uploads/downloads |

## 5. Joint Controller Information

Where a law firm processes client data through the platform, the firm is the Data Controller and AdvocatesConnect is the Data Processor. The respective responsibilities are set out in the Data Processing Agreement (`DPA-Suites-v1.md`), which firms accept separately from their subscription contract.

## 6. Review

This RoPA is reviewed at least annually, and whenever a new processing activity or sub-processor is introduced.

*End of Record.*