This summary forms part of the terms of service. It sets out how Korevra Limited processes personal data on behalf of a customer that uses DeLaw, in line with the Nigeria Data Protection Act 2023. A signed data processing agreement on these terms is available for Enterprise and Judiciary customers.
For personal data inside a workspace (clients, parties, witnesses, counterparties, staff records the firm keeps), the customer is the controller and Korevra is the processor. For account, billing and website data, Korevra is the controller under its privacy policy.
Hosting, storing, backing up, displaying, searching and transmitting the data the customer and its users enter into DeLaw, so the customer can run its legal practice; generating AI assistance from it only within the limits the customer enables.
Korevra processes workspace data only on the customer's documented instructions, which are the service as configured by the customer's administrators (roles, sharing, AI settings) and any written instruction from an owner or administrator. We will inform the customer if an instruction appears to breach the NDPA.
Google Cloud / Firebase (hosting, authentication, database, storage; European multi-region), Anthropic (DeLaw AI cloud answers and live drafting, only when enabled), Flutterwave, Stripe and Paystack (payments), Google Workspace (transactional email), Meta (WhatsApp notices where opted in). We will give 30 days' notice of a new sub-processor to workspace owners; the customer may object and end the service without penalty if the objection cannot be resolved.
DeLaw gives the customer a DSAR register, export tools and deletion controls so it can answer requests itself. Where a data subject writes to Korevra about workspace data, we pass the request to the customer within five business days. We assist with data protection impact assessments and NDPC inquiries on reasonable request.
Korevra notifies the customer's workspace owner without undue delay, and in any event within 48 hours of becoming aware, of a personal data breach affecting workspace data, with the information the customer needs for its own notification to the NDPC within 72 hours.
Workspace data is stored in the European multi-region on Google Cloud. Transfers to sub-processors outside Nigeria are made under the NDPA's conditions for cross-border transfer, including contractual safeguards. The customer should assess residency against its own obligations under NDPA Part VIII before onboarding clients.
The customer can export its data at any time. On termination Korevra deletes workspace data within 90 days, except what the law requires us to keep (financial records, seven years).
On request, no more than once a year, Korevra provides the information reasonably needed to demonstrate compliance, including its security summary and sub-processor list.