Data Protection

Legal work runs on confidentiality. This page describes the technical and organisational measures TempusRes uses to protect customer data, and how we handle the responsibilities of a data processor.

1. Our role

For the client, matter and financial data your firm enters into the Service, your firm is the controller and TempusRes is the processor — we process that data only on your documented instructions to provide and support the Service. For account and website data, TempusRes is the controller (see our Privacy Policy).

2. Technical & organisational measures

• Per-firm data isolation — each firm’s data lives in its own dedicated database schema, physically separated from other tenants rather than filtered by an identifier.
• Encryption in transit — all traffic to the Service is served over TLS/HTTPS.
• Access control — role-based permissions restrict what each user can see and do; access is scoped to your firm’s subdomain.
• Authentication — token-based authentication with session management protects each request.
• Audit trail — significant actions are recorded to support accountability.
• Least privilege — internal access to production systems is limited to personnel who need it.

3. Sub-processors

We use a small set of reputable providers to host and support the Service. Each is bound by appropriate data-protection and confidentiality obligations.

We will provide reasonable notice of changes to our sub-processors on request. To be notified, contact info@tempusres.com.

4. Data residency

Service infrastructure may be located in one or more regions. Where we transfer personal data across borders, we apply safeguards consistent with applicable data-protection law.

5. Data subject requests

Where TempusRes acts as processor, we will promptly refer any request we receive from a data subject to the relevant firm, and assist that firm in responding to access, correction, deletion and similar requests as required by law and our agreement.

6. Personal data breach notification

We maintain procedures to detect and respond to security incidents. In the event of a personal data breach affecting customer data, we will notify the affected firm without undue delay and provide information reasonably needed to meet its own notification obligations.

7. Retention & deletion

Customer data is retained for the duration of your firm’s use of the Service and deleted in accordance with your instructions and our agreement. On termination, we make customer data available for export for a reasonable period before deletion. Your data is always yours to export.

8. Data Processing Agreement

Firms that require a Data Processing Agreement (DPA) — for example to meet GDPR obligations — can request one from us. The DPA sets out the subject matter, duration, nature and purpose of processing, and the parties’ respective obligations.

9. Contact

For data-protection questions, DPA requests or to report a concern, contact info@tempusres.com.