Data sharing agreement - Nova Engage for family law professionals

This document shall form part of the Nova Engage User Licence Agreement (“ULA”) and all defined terms in the ULA shall bear the same meanings in this Data Sharing Agreement (“DSA”).

For the purposes of this DSA, Nova shall be the “Disclosing Party” and you shall be the “Receiving Party”.

BACKGROUND
(1) Nova carries on the business of licensing use of the Application to regulated legal services practitioners and and agrees to disclose to the Receiving Party certain personal data in the ordinary course of that business.

(2) The Data Subjects under this DSA are clients and/or prospective clients of the Receiving Party and disclose certain personal data to the Disclosing Party in the course of the use of the Application.

(3) The Receiving Party agrees to use the personal data disclosed to it by the Disclosing Party subject to the terms of this DSA.

(4) This DSA does not incorporate terms established by the Parties under other DSAs with the sole exception of any other DSA that modifies the term of this DSA at Clause 12.

IT IS AGREED as follows:

Definitions and Interpretation
1. In this DSA, unless the context otherwise requires, the following expressions have the following meanings:
  “Data Protection Legislation” means any data protection legislation from time to time in force in the United Kingdom including, but not limited to, the Data Protection Act 2018, any legislation which succeeds that Act, EU Regulation 2016/679 General Data Protection Regulation (“GDPR”), any other directly applicable European Union data protection or privacy regulations (for as long as, and to the extent that, the law of the European Union has legal effect in the United Kingdom), and, where applicable, guidance and codes of practice issued by any relevant data protection supervisory authority or authorities; “controller” “data controller” “data processor” “data subject” “personal data” “processing” “processor” “personal data breach” “special category personal data” “supervisory authority” and “appropriate technical and organisational measures” shall have the meanings ascribed thereto in the Data Protection Legislation; “Representatives” means, in relation to either Party, its officers and employees, professional advisers or consultants engaged to advise that Party, contractors or sub-contractors engaged by that Party; “Shared Personal Data” means the personal data and special category personal data to be shared between the Parties under this DSA; “Stated Purposes” means the purposes set out in Schedule 1 for which the Shared Personal Data is to be shared; “Term” means the term of this DSA, as set out in Clause 12.
2. Unless the context otherwise requires, each reference in this DSA to:
  1. “writing”, and any cognate expression, includes a reference to any communication effected by electronic or facsimile transmission or similar means;
  2. a statute or a provision of a statute is a reference to that statute or provision as amended or re-enacted at the relevant time;
  3. “this DSA” is a reference to this DSA and each of the Schedules as amended or supplemented at the relevant time;
  4. a Schedule is a schedule to this DSA; and
  5. a Clause or paragraph is a reference to a Clause of this DSA (other than the Schedules) or a paragraph of the relevant Schedule.
  6. a “Party” or the “Parties” refer to the parties to this DSA.
3. The headings used in this DSA are for convenience only and shall have no effect upon the interpretation of this DSA.
4. Words imparting the singular number shall include the plural and vice versa.
5. References to any gender shall include the other gender.
6. References to persons shall include corporations.
Stated Purposes
1. This DSA establishes the framework for the sharing of the Shared Personal Data between the Parties as data controllers.
2. The Parties have determined that the sharing of the Shared Personal Data is necessary for the operation of the Application and for the Receiving Party to provide continued services such as legal advice to Data Subjects.
3. The Parties shall not process the Shared Personal Data for any purpose or in any way that is incompatible with the Stated Purposes set out in Schedule 1.
4. The Shared Personal Data shall be disclosed by the Disclosing Party to the Receiving Party only to the extent reasonably necessary for the Stated Purposes, as set out in Schedule 1.
Data Protection Compliance
1. Each Party shall appoint a data protection officer and/or at least one other of its Representatives as a point of contact for all issues relating to the sharing of the Shared Personal Data and the Data Protection Legislation (including, but not limited to, compliance, training, and the handling of personal data breaches). The contact details for the Parties’ appointed points of contact are as follows:
  1. Nova: Alan Larkin, Director, 5 Clifton Mews, Clifton Hill, Brighton, BN1 3HR, email at alan@novalaw.co.uk and telephone number 01273 077126; and
  2. Your Data Protection Officer with contact details as specified in your Nova Engage account creation form.
2. Both Parties shall at all times during the Term of this DSA comply with their obligations as data controllers, the rights of data subjects, and all other applicable requirements under the Data Protection Legislation. This DSA is in addition to, and does not relieve, remove, or replace either Party’s obligations under the Data Protection Legislation. Any material breach of the Data Protection Legislation by either Party shall, if not remedied within 30 days of written notice from the other Party, give the other Party grounds to terminate this DSA with immediate effect.
The Shared Personal Data
1. The Shared Personal Data, including any applicable restrictions relating to it agreed by the Parties is described fully in Schedule 1.
2. The Shared Personal Data also consists of the special category personal data set out in Schedule 1.
3. The Disclosing Party shall ensure that the Shared Personal Data is accurate and up-to-date prior to its disclosure to the Receiving Party.
4. The Parties shall use compatible technology for the processing of the Shared Personal Data in order to preserve accuracy.
Shared Personal Data – Fair and Lawful Processing
1. Both Parties shall at all times during the Term of this DSA process the Shared Personal Data fairly and lawfully.
2. Both Parties shall ensure that they have legitimate grounds for processing the Shared Personal Data under the Data Protection Legislation.
3. The Disclosing Party shall ensure that it has in place all required notices and consents in order to enable the sharing of the Shared Personal Data under this DSA. In particular, the Disclosing Party shall ensure that data subjects are provided with clear and sufficient information about the following:
  1. the purposes for which their personal data is to be processed;
  2. the legal basis upon which it is relying for such purposes;
  3. the fact that their personal data is to be transferred to a third party and sufficient detail about the transfer to enable the data subject to understand the purpose of the transfer and any risks associated therewith;
  4. in the event that their personal data is to be transferred outside of the European Economic Area under sub-Clause 8.3, the fact that such a transfer is to take place and sufficient detail about the transfer to enable the data subject to understand the purpose of the transfer and any risks associated therewith; and
  5. all other information required under Article 13 of the GDPR.
4. The Receiving Party shall ensure that it has in place all required notices and consents in order to enable the sharing of the Shared Personal Data under this DSA. In particular, the Receiving Party shall ensure that data subjects are provided with clear and sufficient information about the following:
  1. the purposes for which their personal data is to be processed;
  2. the legal basis upon which it is relying for such purposes;
  3. in the event that their personal data is to be transferred to a third party under Clause 8, the fact that such a transfer is to take place and sufficient detail about the transfer to enable the data subject to understand the purpose of the transfer and any risks associated therewith;
  4. in the event that their personal data is to be transferred outside of the European Economic Area under sub-Clause 8.3, the fact that such a transfer is to take place and sufficient detail about the transfer to enable the data subject to understand the purpose of the transfer and any risks associated therewith; and
  5. all other information required under Article 14 of the GDPR.
The Rights of Data Subjects
1. The Parties shall assist one another in complying with their respective obligations and the rights of data subjects under the Data Protection Legislation. Such assistance shall include, but not be limited to:
  1. consulting with the other Party with respect to information and notices provided to data subjects relating to the Shared Personal Data;
  2. informing the other Party about the receipt of data subject access requests and providing reasonable assistance in complying with the same;
  3. assisting the other Party at its own cost in responding to any other data subject request.
2. Each Party shall maintain records of all data subject requests received, the decisions made in response, and any information provided to the data subject(s) concerned. Such records shall include copies of the request, details of any data accessed and shared, and, if applicable, details of any further correspondence, telephone conversations, or meetings relating to the request.
Data Retention and Deletion and/or Disposal
1. Subject to sub-Clause 7.2, the Receiving Party shall hold and process the Shared Personal Data only for so long as is necessary for the fulfilment of the Stated Purposes.
2. In the event that any statutory or similar retention periods apply to any of the Shared Personal Data, the relevant personal data shall be retained by the Receiving Party in accordance therewith.
3. The Receiving Party shall delete (or otherwise dispose of) the Shared Personal Data (or the relevant part thereof) and any and all copies thereof subject to any legal requirement including but not limited to the requirements of the relevant legal services regulator to which either party is subject, to retain any applicable personal data, in the following circumstances:
  1. upon the termination or expiry of this DSA; or
  2. once the Stated Purposes have been fulfilled and it is no longer necessary to retain the Shared Personal Data (or the relevant part thereof) in light of the Stated Purposes;
    whichever is earlier.
4. All Shared Personal Data to be deleted or disposed of under this DSA shall be deleted or disposed of using the following method(s): shredding of printed materials or deletion of electronic files.
5. Following the deletion and/or disposal of the Shared Personal Data (as applicable), the Receiving Party shall notify the Disclosing Party of the same in writing, confirming that the Shared Personal Data has been deleted or disposed of using the method(s) set out above in sub-Clause 7.4.
Shared Personal Data Transfers
1. For the purposes of this Clause 8, the transfer of Shared Personal Data shall refer to any sharing of the Shared Personal Data by the Receiving Party with a third party. Such sharing shall include, but not be limited to, the appointment of a third-party data processor and sharing the Shared Personal Data with a third-party data controller.
2. In the event that the Receiving Party wishes to appoint a third-party data processor, it shall remain liable to the Disclosing Party for any acts and/or omissions of the third-party processor and it shall comply with Articles 28 and 30 of the GDPR.
3. The Receiving Party shall not transfer any of the Shared Personal Data outside of the European Economic Area unless:
  1. the Receiving Party complies with the provisions of Article 26 of the GDPR (where the third party is a joint controller); and
  2. the Receiving Party ensures that the transfer is to a country that the European Commission has determined (by means of an adequacy decision) offers an adequate level of data protection, pursuant to Article 45 of the GDPR; there are appropriate safeguards in place pursuant to Article 46 of the GDPR; or one of the derogations for specific situations set out in Article 49 of the GDPR applies.
Shared Personal Data Security
1. The Disclosing Party shall transfer the Shared Personal Data to the Receiving Party using the following secure method: email transmission to an email address or addresses supplied by the Receiving Party .
2. Both Parties shall ensure that they have in place appropriate technical and organisational measures (as set out in Schedule 2) to protect against the unauthorised or unlawful processing of, and against the accidental loss or destruction of, or damage to, the Shared Personal Data, having regard to the state of technological development and the cost of implementing any such measures.
3. When putting appropriate technical and organisational measures in place, both Parties shall ensure a level of security appropriate to the nature of the Shared Personal Data which is to be protected, and to the potential harm resulting from the unauthorised or unlawful processing of, the accidental loss or destruction of, or damage to, the Shared Personal Data.
4. All technical and organisational measures put in place by both Parties shall be reviewed regularly by the respective Party, updating such measures upon the DSA of the other Party as appropriate throughout the Term of this DSA.
Training
1. Both Parties shall ensure that any and all of their Representatives by whom the Shared Personal Data is to be handled and processed are appropriately trained to do so in accordance with the Data Protection Legislation and with the technical and organisational measures set out in Schedule 2.
2. The Receiving Party shall further ensure that any of its Representatives to whom the Shared Personal Data is to be disclosed are subject to contractual obligations in relation to confidentiality and data protection that bind those Representatives and that are same as the obligations imposed upon the Receiving Party by this DSA.
Personal Data Breaches
1. In the event of a personal data breach, each Party shall comply with its obligations to report such a breach to the supervisory authority and, if applicable, to the affected data subjects in accordance with Article 33 of the GDPR. Furthermore, each Party shall inform the other Party of any such breach without undue delay, irrespective of whether it is required to be reported to the supervisory authority or to data subjects.
2. Each Party shall provide reasonable assistance to the other Party at its own cost in the handling of personal data breaches.
Term, Review, and Termination
1. This DSA shall come into force on the date the Receiving Party receives a first submission from the Application. The Parties shall review the sharing of the Shared Personal Data under this DSA on a annual basis provided that the Disclosing Party is still operating its Application, in light of the reasons, aims, and benefits described in sub-Clause 2.2 and, based upon the outcome of such a review, the Parties shall continue, amend, or (in the event the Disclosing Party has not earlier terminated the Application) terminate this DSA.
2. Reviews under this Clause 12 shall address the following:
  1. evaluating the purposes for which the Shared Personal Data is being processed in order to determine whether those purposes are still limited to the Stated Purposes;
  2. evaluating whether the Parties are complying with the Data Protection Legislation and with the provisions of this DSA governing fair and lawful processing (Clause 5), the rights of data subjects (Clause 6), data retention (Clause 7), and data security (Clause 9); and
  3. evaluating whether any personal data breaches affecting the Shared Personal Data have been handled in accordance with this DSA and the Data Protection Legislation.
3. Each Party shall have the right to inspect the other Party’s arrangements for holding and processing the Shared Personal Data and to terminate this DSA if it considers that the other Party is not processing that Shared Personal Data in accordance with the Data Protection Legislation or this DSA.
Resolution of Disputes with Data Subjects or the Supervisory Authority
1. In the event of a dispute or claim brought by a data subject or the supervisory authority concerning the processing of Shared Personal Data against either or both Parties, the Parties will inform each other about any such disputes or claims, and will cooperate with a view to settling them amicably in a timely fashion.
2. The Parties agree to respond to any generally available non-binding mediation procedure initiated by a data subject or by the supervisory authority. If they do participate in the proceedings, the Parties may elect to do so remotely (such as by telephone or other electronic means). The Parties also agree to consider participating in any other arbitration, mediation, or other dispute resolution proceedings developed for data protection disputes.
3. Each Party shall abide by a decision of a competent court of the Disclosing Party’s country of establishment or of the supervisory authority.
Warranties
1. Each Party hereby warrants and undertakes that it shall:
  1. hold and process the Shared Personal Data in compliance with the Data Protection Legislation and all other applicable laws, enactments, regulations, orders, standards, and similar applicable instruments;
  2. respond without undue delay and as far as reasonably possible to any enquiries from the supervisory authority relating to the Shared Personal Data;
  3. respond to data subject access requests in accordance with the Data Protection Legislation;
  4. if applicable, pay the appropriate fees to the supervisory authority; and
  5. take all appropriate steps to ensure compliance with the security measures set out in Clause 9 of this DSA.
2. The Disclosing Party hereby warrants and undertakes that it is authorised to share the Shared Personal Data with the Receiving Party and that the Shared Personal Data will be accurate and up-to-date.
3. The Receiving Party hereby warrants and undertakes that it shall not transfer any of the Shared Personal Data outside of the European Economic Area unless it complies with the requirements of sub-Clause 8.3.
4. Except as expressly stated in this DSA, all other warranties, conditions, and terms, whether express or implied by statute, common law, or otherwise, are hereby excluded to the fullest extent permissible by law.
Indemnity
Subject to the provisions of sub-Clause 16.1, each Party shall indemnify the other against any cost, charge, damages, expense, or loss, suffered or incurred by the indemnified Party arising out of or in connection with the indemnifying Party’s (or its Representatives’) breach of the Data Protection Legislation or this DSA, provided that the indemnified Party provides the indemnifying Party with prompt notice of any such claim, full information about the circumstances giving rise to the claim, reasonable assistance in dealing with the claim, and the sole authority to manage, defend, and/or settle the claim.
Communication
1. All notices under this DSA shall be in writing and be deemed duly given if signed by the Party giving the notice or by a duly authorised officer thereof, as appropriate.
2. Notices shall be deemed to have been duly given:
  1. when delivered, if delivered by courier or other messenger (including registered mail) during the normal business hours of the recipient; or
  2. when sent, if transmitted by facsimile or email and a successful transmission report or return receipt is generated; or
  3. on the fifth business day following mailing, if mailed by national ordinary mail, postage prepaid; or
  4. on the tenth business day following mailing, if mailed by airmail, postage prepaid.
3. All notices under this DSA shall be addressed to the most recent address, facsimile number, or email address notified to the other Party.

SCHEDULE 1

Shared Personal Data and Stated Purposes

Category of Personal Data	Category of Data Subject	Stated Purposes	Restrictions (If Applicable)
General data that identifies individuals such as names, ages, addresses, children and financial details.		For the Disclosing Party to make it easier for members of the public to obtain advice from legally trained family law specialists such as the Receiving Party by mitigating the initial cost barrier of essential information gathering. It is not possible to provide tailored legal advice without the specific facts of each potential client’s circumstances.
General data as above		For the Receiving Party to provide initial advice to members of the public and then thereafter if appropriate and subject to the creation of a legal retainer to provide ongoing advice
Special category data: health information		For the establishment, exercise or defence of legal claims or remedies open to the public. Health is a significant consideration for family lawyers who will be compelled by s.25 MCA 1973 to assess its potential relevance in financial remedy proceedings.

SCHEDULE 2

Technical and Organisational Data Protection Measures

The following are the technical and organisational data protection measures referred to in Clause 9:

Each Party shall ensure that, in respect of all Shared Personal Data, it maintains security measures to a standard appropriate to:
1. the nature of the Shared Personal Data which is to be protected; and
2. the potential harm resulting from the unauthorised or unlawful processing of, the accidental loss or destruction of, or damage to, the Shared Personal Data.
In particular, each Party shall:
1. have in place, and comply with, a security policy which:
  1. defines security needs based on a risk assessment;
  2. allocates responsibility for implementing the policy to a specific individual (such as a data protection officer) or personnel;
  3. is provided to the other Party if so requested on or before the commencement of this DSA;
  4. is disseminated to all relevant Representatives (and other staff, if applicable); and
  5. provides a mechanism for feedback and review.
2. ensure that appropriate security safeguards and virus protection are in place to protect the hardware and software which is used in processing the Shared Personal Data in accordance with best industry practice;
3. prevent unauthorised access to the Shared Personal Data;
4. protect the Shared Personal Data using pseudonymisation, where it is practical to do so;
5. ensure that its storage of Shared Personal Data conforms with best industry practice such that the media on which Shared Personal Data is recorded (including paper records and records stored electronically) are stored in secure locations and access by personnel to Shared Personal Data is strictly monitored and controlled;
6. have secure methods in place for the transfer of Shared Personal Data whether in physical form or electronic form;
7. password protect all computers and other devices on which Shared Personal Data is stored, ensuring that all passwords are secure and that passwords are not shared under any circumstances;
8. take reasonable steps to ensure the reliability of personnel who have access to the Shared Personal Data;
9. have in place methods for detecting and dealing with breaches of security (including loss, damage, or destruction of Shared Personal Data) including:
  1. the ability to identify which individuals have worked with specific Shared Personal Data;
  2. having a proper procedure in place for investigating and remedying breaches of the Data Protection Legislation; and
  3. notifying the other Party as soon as any such security breach occurs.
10. have a secure procedure for backing up all electronic Shared Personal Data and storing back-ups separately from originals;
11. have a secure method of disposal of unwanted Shared Personal Data including for back-ups, disks, print-outs, and redundant equipment; and
12. adopt such organisational, operational, and technological processes and procedures as are required to comply with the requirements of ISO/IEC 27001:2013, as appropriate to the Stated Purposes and the nature of the Shared Personal Data.