Data Processing Agreement

Version: 3 November 2026

Our standard terms. This agreement is not individually negotiated, and we haven't had it reviewed by a lawyer. If your organisation needs changes, email support@mtgtechnical.com.

This Data Processing Agreement ("DPA") is between MTG Technical Consulting Ltd ("we", "us"), a company registered in England and Wales (company number 17342687), registered office Office 1665, 60 Tottenham Court Road, London W1T 2EW, the operator of Evidence Board, and the customer who uses Evidence Board to process personal data on behalf of others ("you"), for example a firm handling a client's matter.

It forms part of our Terms of Service and applies whenever you use Evidence Board to process personal data as a controller, or as a processor for your own client. You agree to it when you accept the Terms, and a Team plan's buyer agrees to it on behalf of their organisation at checkout. Where this DPA and the Terms differ on personal data, this DPA wins.

1. Roles

For the personal data in your cases ("case content"), you are the controller (or a processor acting for your client, who is the controller) and we are your processor, under Article 28 of the UK GDPR. We are the controller of your account data (your email address, sign-in and billing records), which our Privacy Policy covers.

2. Subject matter and duration

3. Instructions

We process case content only on your documented instructions: these terms, and what you do in the app (uploading, sharing, connecting an assistant, deleting, exporting). If the law requires us to process it otherwise, we'll tell you first unless the law forbids that. We'll tell you if we think an instruction breaks data protection law.

You're responsible for having a lawful basis for the case content, and for special category or criminal offence data, an appropriate condition under the Data Protection Act 2018.

4. Confidentiality

Anyone we allow to process case content is bound by confidentiality. We look at case content only when you ask us to (for example in a support request) or when the law or the security of the service requires it.

5. Security

We keep the technical and organisational measures described on our Security page in place, and may improve them. We won't make them materially weaker during the term.

6. Subprocessors

You give us general authorisation to use the subprocessors listed in our Privacy Policy ("Who we share data with"). Each is bound by data protection terms that give at least the same protection as this DPA. We'll tell you, by email or on that page, at least 14 days before we add or replace a subprocessor of case content. If you object on reasonable data protection grounds, tell us; if we can't resolve it, you may end your subscription and we'll refund the unused part of the period you paid for. We remain responsible to you for our subprocessors.

7. Helping you with data subjects' rights

Evidence Board lets you find, export, correct and delete case content yourself. If a data subject contacts us about your case content, we'll pass the request to you without undue delay and won't answer it ourselves unless you ask. As far as the nature of the processing allows, we'll help you respond, and help with your security, breach notification, impact assessment and consultation obligations.

8. Personal data breaches

We'll tell you without undue delay after becoming aware of a personal data breach affecting your case content, with what we know: what happened, the data and people likely affected, the likely consequences, and what we've done or propose to do. We'll add details as we learn them, and take reasonable steps to contain it. Notifying the regulator and data subjects about your case content is your decision as controller; we'll help.

9. International transfers

Case content is stored in the UK (London). Where a subprocessor processes it outside the UK, the transfer relies on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum, as listed per provider in our Privacy Policy.

10. Deletion or return at the end

You can export your case content at any time from the account page, and delete any case or your whole account. When you delete a case or your account, we delete its content from our live systems at once. Encrypted nightly backup copies are deleted within seven days. If you end your subscription without deleting your account, your content stays until you delete it. We keep nothing after that unless the law requires us to.

11. Audits and information

We'll make available the information you reasonably need to show that we meet Article 28: on request, we'll answer written security and data protection questions, and describe our measures and subprocessors. If that isn't enough, or a regulator requires it, you may audit us on at least 30 days' written notice, at your cost, during business hours, no more than once a year, under confidentiality, in a way that doesn't expose other customers' data.

12. Liability and general

Liability under this DPA is subject to the limits in the Terms, except where the law doesn't allow that. This DPA is governed by the law of England and Wales, as the Terms are. We may update it; the version you agreed to stays in force for you until you accept a new one, except for changes the law requires.