Data Processing Agreement

For the personal data described in this DPA, Customer acts as controller and Hartwell acts as processor. If Customer lawfully acts as processor for another controller, Hartwell acts as Customer's subprocessor and the same obligations apply as appropriate.

This DPA applies only to personal data that Hartwell processes on Customer's documented instructions through CourtSync ("Customer Personal Data"). Personal data that Hartwell processes for its own purposes, such as account administration, security, billing, support, optional product analytics and session replay, and advertising measurement, is governed by the Privacy Policy.

If this DPA conflicts with the Terms on a matter concerning processing of Customer Personal Data, this DPA prevails.

Customer's documented instructions consist of the Terms, this DPA, Customer's CourtSync configuration, the cases and identifiers selected by Customer, actions submitted through the Service, enabled features, and written support instructions.

For the current judicial-portal monitoring feature, processing works as follows:

• Customer provides credentials for a supported judicial portal and selects or identifies the cases to be monitored;
• CourtSync encrypts the credentials before storage and uses them only to authenticate to the supported portal on Customer's behalf;
• at the monitoring frequency available under Customer's plan, or when Customer requests an immediate check, CourtSync authenticates to the portal, retrieves the information required for the selected cases, and records the relevant results;
• CourtSync compares current results with earlier results, detects changes, displays available information and history to authorised users, and sends service notifications where enabled; and
• Hartwell does not use the credentials to access unrelated cases, act independently of Customer, or pursue a purpose unrelated to the enabled feature.

Where a future CourtSync feature supports transmitting, submitting, or filing information through a connected system, the action will occur only when Customer explicitly enables or instructs it. Monitoring a case does not by itself authorise CourtSync to make a filing or procedural submission.

Hartwell processes Customer Personal Data only on documented instructions, unless Union or Member State law requires the processing. Where legally permitted, Hartwell will inform Customer before such mandatory processing. Hartwell will also inform Customer if it reasonably believes an instruction infringes applicable data-protection law.

Hartwell processes Customer Personal Data only to:

• provide the CourtSync features selected by Customer;
• authenticate to supported judicial portals on Customer's behalf;
• retrieve, record, organise, compare, monitor, display, transmit, submit where instructed, return, or delete case-related information as required by the enabled feature;
• detect changes and provide notifications;
• secure, maintain, troubleshoot, and support the Service;
• comply with Customer's lawful instructions; and
• comply with applicable law.

Hartwell will not sell Customer Personal Data or use it for advertising, independent profiling, unrelated analytics, or training general-purpose artificial intelligence models. Hartwell may use technical service telemetry that does not reveal portal credentials, case content, files, or other sensitive Customer Personal Data, and data that has been irreversibly anonymised or aggregated, to secure and improve CourtSync.

With a user's consent, Hartwell may separately process product-usage, heatmap, and session-replay data as controller under the Privacy Policy. Those technologies are configured to mask or exclude Customer Personal Data before transmission. If an analytics, support, communications, or other provider is permitted to receive Customer Personal Data in order to provide the Service on Customer's behalf, that provider will be treated as a subprocessor under Section 8.

Customer is responsible for:

• determining the purposes and essential means of processing and ensuring that its instructions are lawful;
• having an appropriate legal basis and providing any required notices to data subjects;
• ensuring that processing of personal data relating to criminal convictions, offences, allegations, investigations, or proceedings is authorised under applicable Union or Member State law and subject to appropriate safeguards;
• having the authority and permission to provide portal credentials, case identifiers, instructions, and Customer Personal Data to CourtSync;
• selecting only cases and information that Customer is authorised to access;
• keeping account and portal access rights current and secure;
• responding to data-subject requests and meeting Customer's own legal and professional obligations; and
• not instructing Hartwell to process data unlawfully.

Customer remains responsible for the accuracy, legality, relevance, and minimisation of Customer Personal Data submitted to the Service.

Hartwell will:

• ensure that persons authorised to process Customer Personal Data are subject to confidentiality obligations;
• implement appropriate technical and organisational measures as described in Annex 2;
• process Customer Personal Data only on documented instructions;
• make available information reasonably necessary to demonstrate compliance with this DPA;
• assist Customer, taking into account the nature of processing and information available to Hartwell, with data-subject requests and Customer's obligations under Articles 32 to 36 GDPR;
• maintain records required of a processor under applicable data-protection law;
• notify Customer where Hartwell receives a binding disclosure request, unless prohibited by law;
• forward a data-subject request concerning Customer Personal Data to Customer and not respond substantively unless authorised or required by law; and
• limit processing to authorised systems, personnel, and subprocessors.

Hartwell maintains technical and organisational measures appropriate to the risk of processing, taking into account the state of the art, implementation costs, and the nature, scope, context, and purposes of processing. The current categories of measures are described in Annex 2.

Hartwell may update the measures to reflect technical development, operational changes, and risk, provided that the overall level of protection is not materially reduced.

Customer acknowledges that no system can be guaranteed completely secure. Any customer-specific security requirement, recovery objective, or service-level commitment must be agreed separately in writing.

Hartwell will notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data.

The notification will include information reasonably available to Hartwell concerning the nature of the breach, affected data and data subjects, likely consequences, and measures taken or proposed. Where all information is not initially available, it may be provided in phases.

Hartwell will take reasonable steps to contain, investigate, and mitigate the breach and will reasonably assist Customer with legally required notifications. Customer remains responsible for determining whether notice to a supervisory authority or data subjects is required.

Customer gives Hartwell general written authorisation to engage subprocessors to process Customer Personal Data for the purpose of providing CourtSync. The categories of current core subprocessors and their general processing locations are listed in Annex 3; the named list is available to Customer on request.

Hartwell will:

• impose data-protection obligations on each subprocessor that are no less protective than the relevant obligations in this DPA;
• remain responsible for the subprocessor's performance of those obligations to the extent required by applicable law; and
• give Customer reasonable advance notice of a material addition or replacement of a subprocessor where practicable.

Customer may object to a new subprocessor on reasonable, documented data-protection grounds. The parties will try in good faith to resolve the objection. If no reasonable resolution is available, Hartwell may discontinue the affected feature or Customer may terminate the affected Service without penalty.

Hartwell primarily processes Customer Personal Data within the European Economic Area. Hartwell will not transfer such data outside the EEA unless the transfer is made in accordance with applicable data-protection law, including through an adequacy decision, approved contractual safeguards, or another valid mechanism.

Where transfer-specific standard contractual clauses are required, they apply in addition to this DPA. This DPA is an Article 28 processor agreement and is not itself a set of third-country transfer clauses.

Taking into account the nature of processing, Hartwell will assist Customer through appropriate technical and organisational measures, insofar as possible, with requests for access, rectification, erasure, restriction, portability, or objection.

Hartwell will also reasonably assist Customer with risk assessments, data-protection impact assessments, prior consultation with supervisory authorities, and documentation of security measures, taking into account the information available to Hartwell and the nature of the Service.

Where a request requires disproportionate or bespoke work beyond normal CourtSync operation, the parties may agree a reasonable fee before the work begins, unless the assistance is required because of Hartwell's breach.

During the relationship, Customer may delete cases or disconnect judicial portals through available functionality. Disconnecting removes the active credential from CourtSync's operational data store.

After termination of the Service or expiry of the retrieval or export period under the Terms, Hartwell will, at Customer's choice where available and lawful, return or delete Customer Personal Data from active systems, unless retention is required by law.

Limited residual copies may remain temporarily within recovery or backup mechanisms until the normal lifecycle expires. During that period they remain protected, are not restored to the active Service except for legitimate recovery, and are not used for another purpose.

Hartwell may retain limited security, audit, billing, or legal-compliance records where it has an independent legal basis or obligation, in which case it acts as controller for those records.

Hartwell will make available information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA. Compliance will ordinarily be demonstrated first through this DPA, the public Security Architecture and Judicial-Portal Integration page, responses to reasonable questionnaires, and available documentation.

If that information is insufficient and Customer has a reasonable basis for additional audit, Customer may conduct an audit no more than once in any 12-month period, unless a material incident has occurred or a competent authority requires a more frequent audit. An audit must be conducted on reasonable advance notice, during normal business hours, without compromising security or other customers' rights, and subject to confidentiality.

Customer bears reasonable audit costs unless the audit identifies a material breach of this DPA by Hartwell.

This DPA remains effective while Hartwell processes Customer Personal Data. Obligations that by their nature should survive termination, including confidentiality, deletion, and incident cooperation, remain effective.

The parties' liability under this DPA is subject to the liability provisions in the Terms, without limiting data-subject rights or liability that cannot legally be limited.

Hartwell may update this DPA to reflect changes in law, the Service, security, or subprocessors. Reasonable advance notice will be provided for material changes. A change that materially reduces protection will not apply retrospectively without a valid legal basis.

Questions or notices concerning this DPA may be sent to support@courtsync.gr.