Privacy notice

1. Who we are

Bundivo is an online service for organising documents and producing electronic legal and court bundles. The service is operated by Bundivo Ltd, company number 00000000, whose registered office is 1 Bundivo Square, London, EC1A 1AA, United Kingdom.

This country edition is intended for users in United Kingdom and should be read in accordance with the UK GDPR, the Data Protection Act 2018 and other applicable UK privacy and electronic-communications laws.

For the personal information described in this notice, Bundivo Ltd may act either as a data controller or as a processor acting on a customer's instructions. The distinction is explained below.

2. When we are controller and when we are processor

Information we control

We are normally the controller of information used to operate our website and business, including registration details, account administration, billing records, customer enquiries, marketing preferences, security logs and service analytics. This means we decide why and how that information is used.

Documents uploaded by customers

When an organisation, lawyer, litigant or other customer uploads documents to create a bundle, that customer will normally be the controller and Bundivo Ltd will normally act as its processor. We use uploaded material to provide, secure, maintain and support the service, and otherwise only as permitted by our agreement or required by law.

If you are mentioned in a customer-uploaded document, requests about that document should usually be directed first to the customer who uploaded it.

3. Information we may process

Customer content may contain information about people who do not have a Bundivo account. Depending on the underlying proceedings, it may include children’s information, health information, racial or ethnic origin, religious beliefs, sexual-life data, allegations, criminal-offence information, financial information or other confidential material.

4. Why we use personal information

Where we rely on legitimate interests, we consider the necessity of the processing and its impact on individuals. Where consent is the basis, it may be withdrawn at any time without affecting processing already carried out lawfully.

5. Court documents and sensitive information

Bundivo is designed to process legal documents supplied by its customers. Customers are responsible for ensuring they have a lawful basis and, where required, an additional condition for uploading and otherwise processing special-category or criminal-offence information.

Customers should avoid uploading information that is unnecessary for their purpose, restrict access to authorised users, apply appropriate redactions and comply with applicable court orders, procedural rules, professional obligations and confidentiality duties. Bundivo does not determine what evidence should be placed before a court and does not provide legal advice.

6. Who we share information with

We may disclose information to:

• authorised members of the relevant customer organisation;
• hosting, storage, conversion, OCR, communications, monitoring and support providers;
• payment, accounting and fraud-prevention providers;
• professional advisers, auditors, insurers and potential purchasers of our business;
• courts, regulators, law-enforcement bodies or other recipients where disclosure is lawful and necessary; and
• other recipients selected or authorised by the customer, including recipients of a secure bundle-sharing link.

Configured service-provider categories

• Cloud hosting and encrypted file storage provider — replace with actual provider
• Stripe — subscription and payment processing
• Twilio — SMS and account-verification communications
• Transactional email provider — replace with actual provider
• Document conversion, PDF and OCR technology providers — specify actual providers
• Website analytics provider — remove if analytics are not used

We do not sell personal information.

7. International transfers

Some providers or support operations may process information outside United Kingdom or the country in which a user is located. Where UK law requires safeguards, we use an applicable adequacy regulation, approved contractual clauses together with the UK Addendum or International Data Transfer Agreement, or another lawful transfer mechanism.

8. How long we keep information

We keep information only for as long as reasonably necessary for the purpose for which it was collected, including contractual, security, legal, regulatory, accounting and dispute-resolution requirements. Current operational periods configured for this notice are:

• account, subscription and transaction records: up to 7 years where required for business, tax or legal records;
• security and authentication logs: normally up to 12 months;
• general enquiries where no account is opened: normally up to 24 months; and
• deleted information may remain in protected backups for up to 90 days before routine expiry.

Customer documents are retained according to the subscription, workspace settings, customer instructions and our contractual terms. Information may be retained longer when necessary to preserve evidence, comply with law, resolve a dispute, prevent abuse or establish, exercise or defend legal claims. Data may be anonymised for statistics where it can no longer identify anyone.

9. How we protect information

We use administrative, technical and organisational measures designed to protect information against accidental or unlawful loss, alteration, disclosure, destruction or unauthorised access. Measures may include access controls, authentication, encryption in transit, protected storage, logging, backups, vulnerability management, supplier controls and incident-response procedures.

No online service can guarantee absolute security. Customers must protect their credentials, use appropriate access permissions and notify us promptly if they suspect unauthorised access.

10. Your data-protection rights

Depending on the circumstances and applicable law, you may have the right to:

• request access to your personal information;
• ask us to correct inaccurate or incomplete information;
• request erasure;
• request restriction of processing;
• object to processing, including direct marketing;
• receive certain information in a portable format;
• withdraw consent where processing relies on consent; and
• raise concerns about significant solely automated decisions, if any apply.

These rights are not absolute. We may need to verify your identity and may retain or continue using information where permitted or required by law. We do not ordinarily charge for a request, but the law permits fees or refusal in limited circumstances.

11. Cookies and similar technologies

We use necessary cookies for functions such as authentication, security, session continuity, country selection and user preferences. With any consent required by law, we may also use optional analytics or marketing technologies. Further details, including how to change your choices, should be provided in our cookie notice and consent tool.

12. Children

Bundivo is a professional legal-document service and is not directed at children creating their own accounts. Legal documents uploaded by customers may nevertheless concern children. In those circumstances the customer is responsible for establishing the lawful basis, limiting disclosure and applying appropriate protections. A parent or guardian with concerns should normally contact the organisation or person who uploaded the document.

13. Changes to this notice

We may update this notice when our services, providers or legal obligations change. The latest version will appear on this page. Where a change materially affects how we use information, we will take reasonable steps to provide additional notice before the change takes effect where appropriate.