Legal
Data Protection
How ModelLaw Ltd (t/a ETSS) protects your data and fulfils its obligations under the UK GDPR and Data Protection Act 2018.
Data Processing Agreement
ETSS acts as a Data Processor on behalf of its users (Data Controllers). Our Data Processing Agreement sets out the terms upon which we process personal data, in compliance with Article 28 UK GDPR.
Data Processor
ModelLaw Limited (Company No. 13064755)
Trading As
ETSS — Employment Tribunal Support System
DPO Contact
dpo@modellawoffice.co.uk
Data Residency
AWS eu-west-2 (London, UK)
Encryption (transit)
TLS 1.3 minimum
Encryption (at rest)
AES-256-GCM (SSE-S3)
Your Rights Under UK GDPR
Right of Access
Request a copy of all personal data we hold about you.
Available in-app: Settings → Privacy → Export My Data
Right to Rectification
Correct any inaccurate personal data.
Edit your profile in Settings, or contact dpo@modellawoffice.co.uk
Right to Erasure
Request permanent deletion of all your data.
Available in-app: Settings → Privacy → Delete Account
Right to Restrict Processing
Request that we limit how we use your data.
Contact dpo@modellawoffice.co.uk
Right to Data Portability
Receive your data in a machine-readable format (JSON).
Available in-app: Settings → Privacy → Export Data
Right to Object
Object to processing based on legitimate interests.
Contact dpo@modellawoffice.co.uk
Authorised Sub-processors
Third parties that process data on our behalf. All have Data Processing Agreements in place.
| Provider | Purpose | Location | DPA |
|---|---|---|---|
| AWS | Infrastructure & storage | UK (eu-west-2) | ✓ |
| Stripe | Payment processing | UK/EU | ✓ |
| SendGrid | Transactional email | UK/EU | ✓ |
| OpenAI | AI drafting (anonymised facts only) | US (UK Addendum) | ✓ |
| Vercel | Frontend hosting | Global CDN | ✓ |
| Sentry | Error monitoring | EU | ✓ |
Security Measures
Data Residency
All data stored exclusively in AWS London (eu-west-2). No data leaves the UK.
Encryption
AES-256 at rest, TLS 1.3 in transit. All documents encrypted server-side.
Access Control
JWT authentication, role-based access, case-level isolation. 15-min token TTL.
Document Access
Pre-signed URLs with 15-minute expiry. No public buckets. No permanent links.
Audit Trail
Immutable audit log of all case actions. Queryable by case owners.
Legal Privilege
Barrister-client documents marked privileged. Not accessible by platform admins.
Backups
Daily automated snapshots. 30-day retention. Point-in-time recovery.
Breach Response
24-hour notification to Data Controller. Documented incident response procedure.
Contact & Complaints
Data Protection Officer: dpo@modellawoffice.co.uk
Company: ModelLaw Limited, Company No. 13064755
Supervisory Authority: Information Commissioner's Office (ICO)
Website: ico.org.uk | Phone: 0303 123 1113
You have the right to lodge a complaint with the ICO if you believe your data protection rights have been infringed.