Data Processing Agreement (DPA)
How Descardes Legal Services Inc. handles personal data when providing legal services.
1. Scope
This DPA applies when Descardes Legal Services Inc. processes personal data on behalf of a client in connection with legal advisory, contract review, privacy guidance, the client portal, and related services.
2. Processing details
We process only the data required to deliver the requested services. Categories may include business contact details, the content of questions and messages you submit through the portal, documents you upload (and the text within them), and other communications shared by the client.
3. Security measures
We apply technical and organizational measures appropriate to the sensitivity of the data, including encryption in transit and at rest, passwordless authentication, database-level access isolation so each client accesses only their own data, private document storage with short-lived access links, and lawyer review of any AI-assisted draft before delivery.
4. Sub-processors
We use vetted providers under confidentiality and data-protection obligations, and remain responsible for them: Supabase (hosting, database, storage) in Canada; Vercel (application hosting) in the United States; Anthropic (AI assistance, which does not train on our data) in the United States; Resend (email) in the United States; and Stripe (payments) in the United States.
5. AI assistance
AI is used only to help prepare draft responses and organize documents, always under lawyer review. No legal advice is delivered by AI alone, and no automated decision with legal or similarly significant effect is made without that review. The AI provider does not use the data to train its models.
6. International transfers
Portal data (database and uploaded files) is hosted in Canada (Montréal). Certain processing occurs in the United States (application hosting, AI assistance, email), and the firm may securely access the data remotely from outside Québec under access controls and confidentiality obligations. For processing outside Québec we rely on data-processing agreements, encryption, and a privacy impact assessment as required by Law 25.
7. Data subject requests
We provide reasonable assistance to clients responding to access, correction, deletion, or portability requests where legally required and operationally feasible.
8. Retention and deletion
Data is retained as needed for service delivery and to meet the firm’s professional obligations. As a member of the Barreau du Québec, our lawyer must keep closed client files for at least 7 years from closing; after the applicable period, files are securely destroyed or anonymized where appropriate.
9. Contact
Questions about this DPA can be sent to dimitri@descardeslegal.com.