This page explains the kind of Data Processing Agreement MyMcKenzieCS uses when a customer is the controller and Lenjordan Ltd acts as a processor for workspace data.

It is a plain-English summary, not a substitute for the signed agreement itself.

A DPA is needed where one party processes personal data on behalf of another party. In MyMcKenzieCS, that can apply when a professional or business uses the platform to store, organise, share, or process client matter data.

A compliant DPA normally sets out the subject matter, duration, nature, and purpose of the processing, plus the type of personal data and categories of data subject involved.

In MyMcKenzieCS that can include uploaded PDFs, scanned letters, Word files, notes, and other client documents if they contain personal data or matter information.

• The processor only acts on the controller’s documented instructions
• People handling the data are subject to confidentiality obligations
• Appropriate technical and organisational security measures are in place
• Rules for approving and controlling subprocessors are defined
• The processor helps with access, correction, deletion, restriction, and other rights requests
• The processor helps with security incidents and other UK GDPR obligations
• At the end of the agreement, data is returned or securely deleted as instructed
• The controller can request evidence of compliance and, where appropriate, audit rights

The platform’s published privacy policy already explains that workspace content may be processed by Lenjordan Ltd as a service provider and that professionals remain responsible for the lawfulness of the data they upload and share.

Operationally, uploaded documents are stored in private object storage, linked to the relevant account or matter, accessed through controlled routes, and removed from storage when a document is deleted. Exports can include the document metadata already held in the account.

For any customer-specific DPA, the signed agreement should sit alongside the main service terms rather than replacing the privacy policy.

• The executed DPA version
• The date it was accepted
• The customer or workspace it applies to
• Any subprocessor list or schedule that forms part of the agreement
• Any later updates or addenda

If you need a copy of the agreement or want to ask whether a specific use case needs one, contact Lenjordan Ltd at jordan@lenjordan.tech.