This Privacy Policy explains how The Vorare Company collects, uses, discloses and protects personal data in connection with the LegalLink service. It is issued in accordance with the Data Protection and Privacy Act Cap 97 and the Data Protection and Privacy Regulations, 2021.
It should be read together with the LegalLink Terms of Service. Clause 6 is particularly important for Advocates, as it concerns material subject to legal professional privilege.
1.1 The Vorare Company ("the Company", "we", "us") is the data controller in respect of personal data processed through LegalLink.
1.2 Registered office: Kampala Uganda .
1.4 We are registered with the Personal Data Protection Office established under the Data Protection and Privacy Act Cap 97.
2.1 This Policy applies to personal data we process about Users of the Service, and to personal data contained in material Users submit to the Service.
2.2 Where you are an Advocate submitting client material, you are the data controller in respect of your client's personal data, and we act as your data processor in respect of that material.
3.1 Account data. Your name, email address, firm name, role, and account status including subscription period and activation history.
3.2 Content you submit. Queries, instructions and documents you upload, including plaints, written statements of defence, judgments, contracts, correspondence and case files. This material may contain personal data relating to your clients and to third parties.
3.3 Case records. Matter names, party names, court references, case notes, deadlines and calendar entries you create within the Service.
3.4 Conversation history. The record of your exchanges with the Service, retained so that you may return to earlier work.
3.5 Usage data. Records of your use of the Service, including the number of queries made, the feature used, timestamps and processing volumes. This is used for billing, capacity planning and service monitoring.
3.6 Technical data. Authentication tokens, session information, and server logs generated in the ordinary operation of the Service.
3.7 We do not knowingly collect special categories of personal data except insofar as such data is contained in material you choose to submit.
4.1 We process personal data on the following bases under the Data Protection and Privacy Act Cap 97:
(a) Contract. Processing necessary to provide the Service to you under the Terms of Service.
(b) Consent. Where you submit material to the Service, you consent to its processing for the purpose of generating a response.
(c) Legitimate interest. Service monitoring, security, fraud prevention and improvement of the Service, balanced against your rights and interests.
(d) Legal obligation. Where processing is required by law.
5.1 We use personal data to:
(a) authenticate you and administer your account and subscription;
(b) process your queries and generate Output;
(c) store and retrieve your case records, documents and conversation history;
(d) monitor usage for billing, capacity and abuse prevention;
(e) maintain the security and integrity of the Service;
(f) communicate with you about the Service; and
(g) comply with legal obligations.
5.2 We do not use your content to train artificial intelligence models, and we do not sell, rent or trade personal data.
6.1 We recognise that material you submit may be subject to legal professional privilege and to your duty of confidence to your client.
6.2 We treat all submitted material as confidential. Access within the Company is restricted to personnel who require it to operate or support the Service, and is subject to contractual confidentiality obligations.
6.3 You should be aware that in order to generate Output, the content you submit is transmitted to third party processors, including artificial intelligence providers located outside Uganda. Clause 7 identifies them. Privilege is a matter for you to assess in light of your professional obligations.
6.4 Before submitting material relating to a particularly sensitive matter, you may wish to consider redacting identifying details, or obtaining your client's informed consent to the use of a cloud-based tool.
6.5 We will not voluntarily disclose submitted material to any third party. Where we receive a lawful demand for disclosure, we will, unless prohibited by law, notify you before responding so that you may take such steps as you consider appropriate, including asserting privilege on behalf of your client.
7.1 The Service depends on the following third party processors:
(a) Anthropic PBC (United States) --- provides the artificial intelligence models that generate Output. Queries and submitted documents are transmitted to Anthropic for processing.
(b) Supabase (infrastructure hosted in Ireland, European Union) --- provides database and file storage for account data, case records, conversation history and uploaded documents.
(c) Vercel Inc. (United States) --- provides application hosting and content delivery.
(d) Laws.Africa (South Africa) --- provides access to Ugandan legislation and case law. Search terms derived from your query are transmitted to this provider; documents you upload are not.
7.2 International transfers. Personal data is stored and processed outside Uganda, principally in Ireland and the United States. Section 19 of the Data Protection and Privacy Act Cap 97 permits such transfer where the receiving jurisdiction affords protection at least equivalent to that provided by the Act, or where the data subject consents.
7.3 Data stored in Ireland is subject to the General Data Protection Regulation (EU) 2016/679, which affords a standard of protection at least equivalent to that of the Act. In respect of processors in other jurisdictions, we rely on contractual protections and, where applicable, your consent given on acceptance of the Terms of Service.
7.4 We keep the list at clause 7.1 current and will notify Users of any material change.
8.1 Uploaded documents. Files uploaded for processing are held in temporary storage and deleted once processing is complete.
8.2 Case records and conversation history. Retained for as long as your account remains active, so that you may return to earlier work.
8.3 Account and billing data. Retained for the duration of the account and thereafter for such period as is required for accounting, tax and limitation purposes.
8.4 Usage logs. Retained in aggregate for service monitoring. Records identifying an individual User are retained for 3 months.
8.5 On termination of your account, you may request deletion of your case records and conversation history. We will comply within thirty (30) days save where retention is required by law.
9.1 We implement technical and organisational measures appropriate to the risk, including:
(a) encryption of data in transit using industry standard transport layer security;
(b) row-level access controls in the database, so that a User can access only their own records;
(c) authenticated access to all application programming interfaces;
(d) role-based restriction of administrative functions;
(e) restriction of file storage to authenticated, per-User paths; and
(f) logging of access and administrative action.
9.2 No system is entirely secure. We do not warrant absolute security, and you should assess the sensitivity of material before submission.
9.3 In the event of a personal data breach we will notify the Personal Data Protection Office and affected data subjects in accordance with the Act and Regulations.
10.1 Under the Data Protection and Privacy Act Cap 97 you have the right to:
(a) be informed of the personal data we hold about you and the purpose of processing;
(b) access that personal data;
(c) require correction of inaccurate or incomplete data;
(d) require deletion of data that is misleading, out of date, or held without lawful basis;
(e) object to processing, including processing for direct marketing; and
(f) withdraw consent, without affecting the lawfulness of processing carried out before withdrawal.
10.2 To exercise any right, contact our Data Protection Officer at legallink256@gmail.com. We will respond within thirty (30) days.
10.3 Where a request concerns personal data of your client contained in material you submitted, we will direct the request to you as the controller of that data.
11.1 If you are dissatisfied with how we have handled your personal data, please contact our Data Protection Officer in the first instance.
11.2 You may also complain to the Personal Data Protection Office, an independent office established under the National Information Technology Authority, Uganda. Details are published at pdpo.go.ug.
12.1 The Service uses browser storage strictly necessary for its operation, including to maintain your authenticated session and to record whether you have completed initial onboarding.
12.2 We do not use advertising cookies or third party tracking for marketing purposes.
13.1 The Service is offered to legal practitioners and is not directed at children. We do not knowingly collect personal data from any person under eighteen years of age other than as contained in material a User submits.
14.1 We may amend this Policy from time to time. Material changes will be notified by electronic communication or by notice within the Service not less than thirty (30) days before taking effect.
14.2 The version and effective date at the head of this document indicate the current version.
15.1 The Vorare Company, Kampala, Uganda.
15.2 General enquiries: legallink256@gmail.com.