Data Processing Terms

Roles

When a professional stores client data in the portal (clients, matters, documents, messages, invoices), the professional is the Data Fiduciary: they decide why and how that data is used. Govt License is the Data Processor: it stores and handles that data only on the professional's instructions and for no purpose of its own. Before a professional receives an enquiry, Govt License collects the enquirer's details for the one purpose of passing the request on, and is responsible for that stage under the Privacy notice for the professionals portal.

What the professional must do

Collect only what is needed. Tell clients what you collect and why. Get consent where the law needs it. Answer client requests to see, correct or erase data. Delete data when it is no longer needed, using the retention period you set. Do not upload data you have no right to hold.

What Govt License does

We process client data only to run the portal for the professional. We do not sell it, use it for advertising or share it with anyone except processors who help us run the service (such as our database and email providers) under written terms. We keep client data with our database provider under written terms and will tell professionals if that changes.

Security measures

• Row level security: a professional can read only their own clients, matters and documents, and a client only their own.
• Private storage with short-lived signed links for documents; files never have public addresses.
• Two-step login for every professional and admin account.
• An audit log of admin actions and of every proof file opened.
• Rate limits and a bot check on public forms.
• Encryption in transit (HTTPS) and at rest (our database provider encrypts stored data by default).
• No client data in analytics or logs.

Breach notification

If we learn of a personal data breach affecting client data, we tell the affected professional without delay, with what happened, what data is involved and what we are doing. The professional, as Data Fiduciary, decides who else to notify. We also follow our own breach plan and notify the Data Protection Board where the law requires.

Deletion

On request, or when a professional deletes their profile or account, we delete their client data and files from the portal. Backups are removed on their normal cycle. Data we must keep by law is kept only for that purpose.

Contact

Piyush Chawla, Grievance Officer, [email protected].