Data Protection

A law firm or other customer normally controls the personal data held in its practice management system and decides why it is processed. dashboardWISE processes Customer Data on that customer’s instructions to synchronise authorised records, calculate reporting measures, display operational insights and support the service. In that context, the customer is normally the controller and dashboardWISE is its processor or service provider.

dashboardWISE acts separately as a controller for account, website, billing, security, service administration and business relationship information. Our Privacy Policy explains that processing, its lawful bases and the rights available to individuals.

Customers remain responsible for:

• establishing a lawful basis and satisfying applicable transparency duties for Customer Data;
• deciding which systems, records, users and reporting configurations are made available to dashboardWISE;
• meeting professional secrecy, legal privilege, confidentiality, retention and regulatory duties;
• configuring user access and reviewing permissions as personnel and responsibilities change;
• responding to individuals and regulators as controller; and
• assessing whether its use of dashboardWISE requires a data protection impact assessment or other local compliance step.

dashboardWISE provides technical and contractual support but does not replace a customer’s legal assessment or professional obligations.

We process Customer Data to provide, secure and support the contracted service, comply with the customer’s documented instructions and meet applicable legal requirements. The customer’s configuration and use of product features form part of those instructions. If we believe an instruction infringes applicable data protection law, we may notify the customer and pause the affected processing where appropriate.

We do not sell Customer Data, use it for third-party advertising or use dashboardWISE reports to make solely automated decisions about individuals that produce legal or similarly significant effects. Product reports are designed to support review and decisions by authorised people.

Customer Data is hosted in the regional service cell assigned to the customer. The United States cell uses AWS us-west-1(Oregon), and the United Kingdom cell uses AWS eu-west-2 (London). The selected cell governs the primary application, database, queue, object-storage, email, and operational-log routing described on our Subprocessors page.

Authorised dashboardWISE personnel may access personal data from Pakistan for service operation, support and security. Material service providers may process personal data in the United States and the other locations described on our Subprocessors page. Access is limited by role, confidentiality duties and security measures appropriate to the work performed.

Where EU or UK law restricts a transfer, the parties must use an applicable mechanism. Depending on the transfer route, this may include an adequacy decision, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum or International Data Transfer Agreement, and supplementary measures identified through the relevant transfer assessment. Customers can request available transfer documentation from support@dashboardwise.com.

• Customers select a supported practice management system and authorise the connection.
• Firm and source access is checked by the server rather than trusted from a browser-supplied firm identifier.
• Administrators manage firm users, roles and detailed permissions.
• Integration credentials are encrypted, and access is limited to the service paths and authorised personnel that require them.
• Integrations can be disconnected, which queues removal of related credentials and synchronised records.
• Operational records support monitoring, troubleshooting, audit and reliable synchronisation.

Because customers control their source systems, Customer Data may include privileged or confidential material, special category data, information concerning criminal allegations or proceedings, financial information, trust records or information about children. Customers must determine whether they have authority to process and disclose those records and whether additional safeguards or restrictions are required.

dashboardWISE does not require special category or criminal-offence data for ordinary account administration or browser analytics. When such data appears in Customer Data, we process it only for the customer under the applicable agreement and instructions.

Depending on applicable law, individuals may have rights to access, correct, delete, restrict, object to or obtain a portable copy of their personal data, withdraw consent, or opt out of certain sales, sharing, targeted advertising or profiling. Some United States laws also provide appeal and authorised-agent rights. The exact rights and exemptions depend on location and context.

If the information came from a customer, the request should normally be made to that customer. dashboardWISE will provide the assistance required by the Data Processing Addendum and applicable law. Requests about information controlled by dashboardWISE can be sent to support@dashboardwise.com. Our Privacy Policy explains complaint routes and identity verification.

dashboardWISE ingests authorised source records, stores provider-shaped and normalised records, calculates reporting snapshots and retains operational history needed for reliable synchronisation, security and audit. Operational sync records covered by the product retention process are normally retained for up to 90 days.

Active Customer Data is removed through integration cleanup or account offboarding. Deleted information may remain temporarily in protected, access-restricted backups until the applicable backup expires, or where legal preservation is required. Other records are retained using criteria based on purpose, sensitivity, security risk, customer instructions and legal obligations rather than an unsupported single period for every data type.

We use technical and organisational measures designed for the nature and risk of the processing, including encrypted transport, encrypted storage, isolated database networking, encrypted integration credentials, access controls, monitoring and protected backups. No service can eliminate all security risk. Our Security page describes current controls without claiming a certification that we do not hold.

If we become aware of a personal data breach affecting Customer Data, we will notify and assist the relevant customer as required by the Data Processing Addendum and applicable law. The customer remains responsible for notifications it must make as controller. Where dashboardWISE is the controller, we will assess and make required notifications to authorities and affected individuals.

Our Data Processing Addendum addresses documented instructions, confidentiality, appropriate security, subprocessors, individual-rights assistance, breach cooperation, deletion or return, audit information and restricted transfers. We provide information reasonably necessary for customers to assess the processing, subject to appropriate confidentiality, security and proportionality limits.

dashboardWISE is established in the United States and does not claim an establishment in the European Economic Area or United Kingdom. Any appointed EU or UK representative will be identified in our Privacy Policy. Customers should not treat this page as evidence of an unlisted certification, regulatory approval or data residency commitment.

• Privacy Policy for processing controlled by dashboardWISE.
• Data Processing Addendum for customer-directed processing.
• Subprocessors for material providers and current processing locations.
• Security for current technical and organisational controls.
• Cookie Policy for browser storage and analytics choices.