The Federal Trade Commission (the “FTC”) has jurisdiction over Purpose Legal’s compliance with the Data Privacy Framework program. Accordingly, Purpose Legal is subject to the investigatory and enforcement powers of the FTC.
This Policy applies to the processing of Customer Personal Data that Purpose Legal receives in the United States concerning Customers who reside in the European Union, UK, or Switzerland. Purpose Legal provides professional legal and technology support services to law firms, business organizations, and corporates who are parties to various types of legal and commercial proceedings.
This Policy does not cover data from which individual persons cannot be identified or situations in which pseudonyms are used. (The use of pseudonyms involves the replacement of names or other identifiers with substitutes so that identification of individual persons is not possible.)
Purpose Legal has designated the Legal Department to manage compliance with the Data Privacy Framework program. Any inquiries or complaints regarding this Policy may be directed to Purpose Legal at:
Attn: Legal Department
8131 LBJ Freeway
Dallas, TX 75251
Effective date: May 15, 2023
IN HOUSE VERIFICATION
COLLECTION OF PERSONAL DATA
Purpose Legal provides eDiscovery and managed review to M&A due diligence to a range of legal, business and government entities across the globe (our clients).
Under most circumstances, Purpose Legal does not collect personal data for processing directly from the party in possession, but receives the data for processing from counsel under an agreement to hold such data under strict rules of confidentiality and privacy. Therefore, when Purpose Legal receives personal data from the EU, UK, or Switzerland for processing purposes, we do so in the capacity of a data processor and do not control the collection of the personal data. As a result, the responsibility for the potential notification of individuals remains with our client and Purpose Legal does not, typically, provide notification to the individuals to which such personal data relates (but, again, is mandated by the client to hold the data in the strictest confidence). In such event, Purpose Legal reserves the right to process personal data in the course of providing services to its clients without the knowledge of the individuals involved.
USE OF PERSONAL DATA
Purpose Legal never uses data for a purpose other than the purpose for which it was provided to Purpose Legal. Neither does Purpose Legal share information with third parties other than when lawfully directed by the client law firm or originating organization (that is, the controller of the data.) When specifically authorized by counsel or client to do so, Purpose Legal will inform effected individuals about the purposes for which it collects and uses personal information about them, how to contact the organization with any inquires or complaints, the types of third parties to which it may disclose the information and any choices and means that Purpose Legal may offer individuals for limiting the data’s use and disclosure.
Much of the data processed and hosted by Purpose Legal does not constitute “personal data”. However, personal data will, on occasion, enter into the possession of Purpose Legal. All Purpose Legal employees who handle Personal Data from European Union, UK and Switzerland are required to comply with the Principles stated in this Policy. Personal data that we collect may vary according to the engagement with our Clients. Purpose Legal collects the following types of Personal Data from its’ Clients: contact information, including name, address, and email address, telephone number, title, and company name, as well as payment information (which might include credit card/and or back account information).
The information that is collected from our clients is used in the capacity of providing services, managing the Client’s account (invoicing, reporting) and related activities for business purposes (complying with its contractual obligations, operations in providing services, storing and processing data).
Since Purpose Legal does not share personal information with third parties, unless required by law or lawfully directed by the client to do so, nor does it ever use the data for a purpose incompatible with the purpose for which it was originally collected, there is no need to offer individuals the opportunity to opt out from having data disclosed. However, should the need ever arise, Purpose Legal will provide individuals with reasonable notice and mechanisms to exercise their choice to opt-out from having personal data so disclose. Individuals may contact Purpose Legal at https://www.purposelegal.io/. Note that due to our role as a data processor, we may have to refer individual requests to our specific client who collected the data.
ACCOUNTABILITY OF ONWARD TRANSFERS
Purpose Legal will not disclose an individual’s personal information to third parties, except when one or more of the following conditions is true:
- We are specifically required to do so by our client who remains the data controller;
- The disclosure is required by law or professional standards;
- The disclosure is reasonably related to the sale or disposition of all or part of our business;
- The information in question is publicly available;
- The disclosure is reasonably necessary for the establishment or defense of legal claims; or
- The disclosure is to another Purpose Legal entity or to persons or entities providing services on our or the individual’s behalf (each a “transferee”), consistent with the purpose for which the information was obtained, if the transferee, with respect to the information in question;
- Agree to provide an adequate level of privacy protections for the Personal Data that are no less protective than those set out in this Policy.
Purpose Legal may provide Personal Data to Third Parties that act as agents, consultants, and contractors, pursuant to a contract, to perform tasks on behalf of and under our instructions. Third Parties must agree to use such Personal Data only for the purposes for which they have been engaged by Purpose Legal.
All data collected in the course of Purpose Legal activities are kept under strict privacy and confidentiality protocols since much of this information may constitute evidence in litigation and other sensitive proceedings. Indeed, it is the practice of Purpose Legal (and the customary business practice in the industry in which Purpose Legal conducts business) to enter into, with each client, a comprehensive confidentiality agreement that meets or exceeds DPF standards as to data received in every engagement undertaken.
We may be required to disclose an individual’s personal information in response to a lawful request by public authorities, including to meet national security or law enforcement requirements.
In cases of onward transfer to third parties of data of EU, UK and/or Swiss individuals received pursuant to the EU-U.S. DPF, the UK Extension, and the SWISS-U.S. DPF, Purpose Legal is liable unless we can prove we were not a party to the events giving rise to the damages.
To prevent unauthorized access or disclosure, maintain data accuracy, and ensure the appropriate use and confidentiality of information, either for its own purposes or on behalf of our clients, Purpose Legal has put in place appropriate physical, electronic, and managerial procedures to safeguard and secure the information we possess. However, we cannot guarantee the security of information on or transmitted via the Internet or online Review tool.
DATA INTEGRITY AND PURPOSE LIMITATION
Purpose Legal processes personal information only in ways compatible with the purpose for which it was collected or subsequently authorized by the individual. To the extent necessary for such purposes, we take reasonable steps to make sure that personal information is accurate, complete, current, and otherwise reliable with regard to its intended use.
EU, UK, or Swiss individuals have the right to access their Personal Data that we hold about them and to ensure that the Personal Data is accurate and relevant for the purpose for which collected. Pursuant to the binding contracts with our clients, who remain the data controllers, we may be required to refer any requests to the appropriate controlling entity. Upon reasonable request and as required by the DPF principles, Purpose Legal will take reasonable steps to permit individuals to correct, or block data that is demonstrated to be inaccurate, as permitted by applicable law. Individuals may edit their Personal Data by phone or by using the contact information below. Furthermore, EU, UK, or Swiss individuals can demand erasure of personal data that has been handled in violation of the DPF Principles. Purpose Legal will endeavor to respond in a timely manner to all reasonable written requests to view, modify or inactivate Personal Data. The individual will need to provide sufficient identifying information, such as name, address, and birth date. We may request additional identifying information as a security precaution. In addition, we may limit or deny access to personal information where providing such access would be unreasonably burdensome or expensive in the circumstances, or as otherwise permitted by the DPF Agreement.
RECOURSE, ENFORCEMENT AND LIABILITY
In compliance with the EU-US Data Privacy Framework Principles, Purpose Legal commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to the DPF Principles. European Union, Swiss and United Kingdom individuals with DPF inquiries or complaints should first contact Purpose Legal at:
Attn: Legal Department
8131 LBJ Freeway
Dallas, TX 75251
Effective date: May 15, 2023
Purpose Legal has further committed to refer unresolved privacy complaints under the DPF Principles to an independent dispute resolution mechanism, Data Privacy Framework Services, operated by BBB National Programs. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://bbbprograms.org/programs/all-programs/dpf-consumers/ProcessForConsumers for more information and to file a complaint. This service is provided free of charge to you.
If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See