ET
ETSS

Privacy Policy

Privacy Policy

Last updated: July 2026

1. Data Controller

ETSS (Employment Tribunal Support System) is the data controller for personal data processed through this platform. Contact: dpo@modellawoffice.co.uk.

2. Data We Collect

Account data: Name, email address, role, professional registration numbers (SRA/Bar).

Case data: Case details, claim types, tribunal information, deadlines, documents, witness information, issues.

Usage data: Login times, actions performed (audit log), IP addresses.

Payment data: Processed by Stripe. We store only your Stripe customer ID, not card details.

3. Legal Basis for Processing

  • Contract performance (Art. 6(1)(b) UK GDPR) — providing the service you signed up for
  • Legitimate interests (Art. 6(1)(f)) — platform security, improvement, deadline reminders
  • Legal obligation (Art. 6(1)(c)) — tax records, fraud prevention

4. Data Storage & Security

All data is stored in AWS eu-west-2 (London, UK). Documents are encrypted at rest using AES-256. All connections use TLS 1.3. Access to documents is via time-limited pre-signed URLs (15 minutes).

5. Data Retention

  • Account data: duration of account + 30 days after deletion
  • Case data: duration of account + 6 years (limitation period)
  • Payment records: 7 years (HMRC requirement)
  • Audit logs: anonymised on account deletion, retained for compliance

6. Third-Party Data Sharing

  • AWS (eu-west-2) — infrastructure and document storage. DPA in place.
  • Stripe — payment processing. DPA in place.
  • SendGrid — transactional email (deadline reminders). DPA in place.
  • OpenAI — AI document drafting. No personal data sent; case facts only. DPA in place.

We do not sell your data. We do not share data with advertisers.

7. Your Rights (UK GDPR)

  • Access (Art. 15) — request a copy of all your data
  • Rectification (Art. 16) — correct inaccurate data
  • Erasure (Art. 17) — delete your account and all data
  • Portability (Art. 20) — export your data in JSON format
  • Object (Art. 21) — object to processing based on legitimate interests
  • Restrict (Art. 18) — restrict processing in certain circumstances

To exercise any right, email dpo@modellawoffice.co.uk or use the in-app GDPR tools at Settings → Privacy.

8. Legal Professional Privilege

Documents marked as privileged (Barrister-client communications) are not accessible by ETSS platform administrators. Privilege is maintained at the system level.

9. Supervisory Authority

You have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk | 0303 123 1113.