Data Processing Addendum

This Data Processing Addendum ("DPA") supplements the MeraMunshi Terms of Service between the customer (the advocate or law firm, acting as the data Controller) and MeraMunshi (LegalLink Pakistan) (acting as the data Processor) in respect of personal data processed on the Controller's instructions through the Platform.

1. Scope

This DPA applies whenever the Processor processes personal data on behalf of the Controller, including client contact details, case facts, time entries, billing information, trust ledger records, and uploaded documents. The Controller determines the purposes and means of processing; the Processor processes only as instructed.

2. Processor obligations

• Process personal data only on documented instructions from the Controller and as required by Pakistani law.
• Ensure persons authorised to process personal data are bound by confidentiality.
• Implement and maintain appropriate technical and organisational measures (see clause 4).
• Assist the Controller in responding to data subject requests and security incidents.
• Make available all information reasonably necessary to demonstrate compliance.

3. Sub-processors

The Controller authorises the Processor to engage the following categories of sub-processors. A current list is maintained on the Privacy Policy page; the Processor will give reasonable notice of material changes:

• Hosting / infrastructure provider (IONOS Pakistan VPS) — placeholder
• Payment processors (JazzCash, Easypaisa, partner banks) regulated by SBP — placeholder
• Email / WhatsApp / SMS delivery providers — placeholder
• Backup and observability tooling — placeholder

The Processor remains liable for the acts and omissions of its sub-processors as if they were its own.

4. Security measures

• TLS in transit; encryption at rest for backups.
• Postgres Row-Level Security on all tenant-scoped tables.
• Hashed credentials and API tokens (SHA-256 + per-record salt where applicable).
• Least-privilege application roles; SECURITY DEFINER functions for sensitive operations.
• Audit logging of authentication events and privileged actions.
• Periodic backups with documented restore procedures.
• Personnel access controls and onboarding / offboarding procedures.

5. Incident notification

The Processor shall notify the Controller without undue delay, and in any case within seventy-two (72) hours of becoming aware of a personal-data breach affecting the Controller's data. Notification shall include the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed. Where required, the Processor will assist the Controller in escalating cybercrime incidents to the Federal Investigation Agency (FIA) Cyber Crime Wing.

6. Data subject rights

The Processor shall, taking into account the nature of processing, assist the Controller by appropriate technical and organisational measures to fulfil obligations to respond to data subject requests (access, correction, deletion, portability) under applicable law.

7. Audit

The Processor shall make available to the Controller information necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits, including inspections, conducted by the Controller or an independent auditor mandated by the Controller, on reasonable prior written notice and during normal business hours, subject to confidentiality undertakings.

8. Deletion at termination

On termination of the underlying agreement, and at the Controller's choice, the Processor shall delete or return all personal data and delete existing copies, unless retention is required by Pakistani law. The Processor shall provide written confirmation of deletion on request.

9. Governing law

This DPA is governed by the laws of the Islamic Republic of Pakistan and is subject to the jurisdiction and dispute-resolution clauses of the Terms of Service.