Data Processing Agreement

Version 2026-11-15 · In force from 2026-11-15

This agreement is between the law firm that uses Bamboo Tech Law (the "Firm", the responsible party) and Bamboo Media ("we", the operator). It forms part of the Terms of Service and is accepted when the Firm's owner accepts them. It is the written contract that sections 20 and 21 of the Protection of Personal Information Act 4 of 2013 ("POPIA") require.

1. Scope

1.1 This agreement applies to personal information in Firm Data: what the Firm and its users put into Bamboo Tech Law about clients, opposing parties, witnesses, employees and anyone else, including special personal information and information about children where the Firm's work involves them.

1.2 Purpose and duration. We process Firm Data only to provide the service described in the Terms, for as long as the Firm's account exists and for the period after it ends set out in clause 9.

1.3 Processing. Storing, organising, retrieving, displaying, transmitting (including to the Firm's clients through the portal and signing links), indexing, extracting text, backing up and deleting.

1.4 Firms outside South Africa. If the Firm is subject to another country's data protection law (for example the UK GDPR or the EU GDPR), this agreement is also the processor contract that law requires. "Responsible party" then means "controller", and "operator" means "processor". We will process Firm Data in line with that law's requirements for processors, as far as they apply to us.

2. Instructions

2.1 We process Firm Data only on the Firm's documented instructions. The Terms, this agreement, the Firm's settings, and the actions its users take in the app are the Firm's instructions. The exception is where the law requires otherwise. If it does, we will tell the Firm first unless the law forbids it.

2.2 We will tell the Firm if we believe an instruction breaks POPIA.

2.3 We do not use Firm Data for our own purposes. We do not sell it, use it for advertising, or use it to train AI models.

3. Confidentiality (section 20)

We treat Firm Data as confidential and do not disclose it, except as this agreement allows or the law requires. Everyone we authorise to process it is bound by confidentiality.

4. Security measures (section 19)

We maintain appropriate, reasonable technical and organisational measures, including:

1. Encryption: HTTPS (TLS) for all connections; encryption at rest by our hosting and storage providers; payment keys that firms save are additionally encrypted by us.
2. Separation of firms: database row-level security on every table, so that each request sees only its own firm's data. It is covered by an automated test suite that is run before every release.
3. Access control: the Firm sets roles and permissions. Two-step sign-in is available and can be required. It is always required for our platform administration area. Sign-in attempts are rate-limited.
4. Least privilege: secret keys exist only on the server. Browsers never receive storage credentials, only short-lived links to single files.
5. Audit trail: sign-ins and changes to records are logged in the Firm's audit log.
6. Application security: a strict content security policy and security headers; protection against cross-site scripting, clickjacking and open redirects; signed and verified webhooks; dependency vulnerability checks.
7. Resilience: managed infrastructure with backups by our providers, and a document bin with restore.
8. People: access to production systems only for people who need it for their role, using two-step sign-in.

We review these measures regularly and update them as risks and good practice change. We may change them, as long as the overall level of protection does not go down.

5. Sub-operators

5.1 The Firm authorises us to use these sub-operators:

5.2 We impose data protection obligations on each sub-operator that are no less protective than this agreement, and we remain responsible to the Firm for their performance.

5.3 We will give at least 30 days' notice (by email to the Firm's owner, or in the app) before adding or replacing a sub-operator. If the Firm objects on reasonable data-protection grounds and we cannot accommodate the objection, the Firm may cancel and receive a pro-rata refund of fees paid in advance.

6. Transfers outside South Africa (section 72)

Some sub-operators process Firm Data outside South Africa. We ensure each transfer meets section 72, through the recipient's law or binding agreements that give substantially similar protection to POPIA.

7. Helping the Firm

7.1 Data subject requests. If someone asks us about information in Firm Data, we will pass the request to the Firm and not answer it ourselves, unless the Firm instructs us to. The app lets the Firm find, export, correct and delete records to answer requests.

7.2 We will give reasonable help with the Firm's security obligations, breach notifications, and any enquiry by the Information Regulator or the Legal Practice Council about the service.

8. Security compromises (sections 21(2) and 22)

8.1 If we have reasonable grounds to believe that Firm Data has been accessed or acquired by an unauthorised person, we will notify the Firm's owner without undue delay, and in any event within 72 hours of becoming aware of it.

8.2 The notice will contain what we know at the time:

• what happened;
• which data and people are likely to be affected;
• what we have done to contain it; and
• what the Firm can do.

We will update it as we learn more.

8.3 The Firm, as the responsible party, decides on notifying the Information Regulator and data subjects. We will help.

9. Return and deletion

9.1 During the account, the Firm can export its records and documents at any time.

9.2 After the account ends, Firm Data stays available read-only for at least 90 days, as the Terms provide. Within 30 days of the Firm's owner asking us to close the account (or 30 days after the notice in clause 11.4 of the Terms ends), we delete Firm Data from the live systems. Backup copies are overwritten in the normal backup cycle and are not used in the meantime.

9.3 We may keep information the law requires us to keep, and only for that purpose.

10. Audits

We will make available the information reasonably needed to show compliance with this agreement. This includes answering a reasonable security questionnaire once a year, and our sub-operators' published security reports. Any on-site audit must be agreed in advance, at the Firm's cost, with reasonable notice and confidentiality.

11. Legal professional privilege

Our processing of Firm Data is not intended to waive privilege. We will not disclose privileged material, except under a court order or a law that compels us. If that happens, we will tell the Firm promptly (where the law allows), so that it can claim privilege.

12. Liability and precedence

Liability under this agreement is subject to the limits in the Terms. If this agreement conflicts with the Terms on the processing of personal information, this agreement wins.