Privacy policy

1. Definitions

• "Personal data" — any information relating to an identified or identifiable living individual (a data subject).
• "Processing" — any operation performed on personal data: collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, restriction, erasure or destruction.
• "Controller" — the person who determines the purposes and means of processing.
• "Processor" — the person who processes personal data on the controller's instructions.
• "User" — a solicitor, barrister or other person using the Service under the Terms of Service.
• "Client" — a client of the User whose personal data the User puts into the Service.

2. Our role: controller and processor

For account and payment data (the User's own data), Praxis acts as controller and processes it to provide access to the Service, take payment and provide support.

For personal data about Clients and other individuals that the User puts into the Service, Praxis acts as a processor on the User's instructions. The User is the controller of that data: the User decides the purposes and content of the processing, provides the required fair processing information, and answers to the data subjects.

Praxis processes Client data only on the User's documented instructions and only to the extent needed to run the Service. We do not determine the purposes of that processing ourselves and do not use it for our own ends — including advertising or training artificial intelligence models. The processing terms required by Article 28 of the UK GDPR are set out in the Subscription Terms.

3. Categories of data subject and personal data

Praxis processes the following categories of data:

• Users (solicitors and barristers): name, email address, telephone number, professional registration details, firm or chambers details, payment details (handled by the payment provider), and data about use of the Service.
• Clients and other individuals whose data a User uploads: whatever the User records in client records, matters, documents and correspondence (the content is determined by the User as controller).
• Website visitors: technical data (IP address, cookie identifiers, device and browser information) and anything submitted through the contact forms (name, email address).
• Contacts a User imports from a device address book: name, telephone, email address and any other fields the User selects (handled as User content; the User is the controller of that data).

4. Access to data on your device (mobile app)

The Praxis mobile app asks for access to particular device data and features only in order to carry out something the User has asked for, and only after the User has expressly granted permission. Permission can be withdrawn at any time in the device settings.

• Contacts (address book): the app reads the address book only when the User starts a contact import. The list is shown on the device, and only the contacts the User selects and confirms are sent to Praxis servers, so that they can be added to the User's contacts in the Service. The address book is never uploaded in full and is never read in the background.
• Camera and microphone: used for audio and video calls, and to capture photos and video the User attaches to a conversation. Recording happens only while the User is performing that action.
• Photos and media library: the app opens the media library so the User can choose an attachment to send — only the selected files are uploaded. Saving an attachment back to the library happens only on the User's command.
• Location: used only while the User is working with the places map — to centre the map on the current position and to record a check-in. Location is not tracked in the background.
• Calendar: with permission, the app shows calendar events in the day plan and updates an imported event when it changes in the Service.

5. Purposes of processing

• providing access to the Service and performing our contract with you (the Subscription Terms);
• registering and identifying the User and maintaining the account;
• taking payment and issuing receipts and invoices;
• communicating with the User, providing support and sending service notifications;
• keeping the Service secure and preventing misuse;
• complying with our legal obligations;
• improving the Service using aggregated, anonymised usage statistics (never the content of matters or Client data).

6. Lawful bases

We rely on the following lawful bases under Article 6(1) of the UK GDPR: performance of a contract to which you are a party (Article 6(1)(b)); compliance with a legal obligation (Article 6(1)(c)); our legitimate interests in securing and improving the Service, where those interests are not overridden by your rights (Article 6(1)(f)); and your consent, where we have asked for it (Article 6(1)(a)).

For Client data, Praxis processes on the User's instructions under an Article 28 processing arrangement; the lawful basis for that processing is determined by the User as controller.

7. Sharing with third parties

To run the Service we use suppliers who process data on our instructions under written terms meeting Article 28 of the UK GDPR:

• [PAYMENT PROVIDER] — payment processing. Praxis does not store full card details.
• [HOSTING PROVIDER] — hosting and data storage.

8. Storage and data location

Service infrastructure is hosted in the United Kingdom or the European Economic Area. We do not require data to be held in any other jurisdiction.

Personal data is kept no longer than the purposes of processing, the term of the contract and our legal obligations require. Once the purposes are met, or consent is withdrawn, data is erased or anonymised unless the law requires otherwise.

9. International transfers

Where personal data is transferred outside the United Kingdom, we do so only where the receiving country benefits from UK adequacy regulations, or under an appropriate safeguard such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.

10. Cookies

The site uses strictly necessary cookies only — those that make the site work, keep you signed in and remember your settings. Under regulation 6(4) of the Privacy and Electronic Communications Regulations these do not require consent.

We do not use web analytics or advertising trackers on the site. You can disable cookies in your browser, though some features may then not work correctly. If analytics services are added in future, consent for those cookies will be sought separately.

11. Security

We take appropriate technical and organisational measures under Article 32 of the UK GDPR to protect personal data against unauthorised access, destruction, alteration, restriction, copying or disclosure: encryption in transit and at rest, role-based access control, action logging, backups and regular security review.

Where a personal data breach occurs and it is likely to result in a risk to individuals' rights and freedoms, we will notify the Information Commissioner's Office without undue delay and, where required, within 72 hours.

12. Your rights and how to exercise them

You have the right to be informed, to access your data, to have inaccurate data rectified, to erasure, to restriction of processing, to data portability, and to object to processing. Where processing is based on consent, you may withdraw it at any time. You also have rights in relation to automated decision-making, although we do not make decisions about you by solely automated means.

Requests should be sent to support@hqpraxis.com or to our registered address. We respond within one month of receipt, which may be extended by a further two months where a request is complex or numerous — we will tell you within one month if that applies. Where we process data on a User's instructions (Client data), we pass the request to the relevant User as controller.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

13. Changes to this Policy and contact details

We may amend this Policy. A new version takes effect when it is published on the site, unless the version itself says otherwise.

For any question about the processing of personal data: support@hqpraxis.com, telephone [TELEPHONE]. Our details: [COMPANY NAME] Ltd, registered in England and Wales under number [COMPANY NUMBER], registered office: [REGISTERED OFFICE ADDRESS].