Privacy Notice — Yoke Platform

1. Who we are

Yoke ("we", "us", "our") provides Yoke Platform ("the Platform"). We are registered in England and Wales with company number [COMPANY REGISTRATION NUMBER], at [REGISTERED OFFICE ADDRESS]. We are registered with the Information Commissioner's Office under registration number [ICO REGISTRATION NUMBER].

For anything about this notice or about your personal data, contact us at [DATA PROTECTION CONTACT EMAIL].

2. What this notice covers — and what it does not

This notice explains what we do with personal data about you as a user of the Platform: your account, and the record of what you do with it. For that data we are the controller, and this notice is our explanation of it.

It does not cover the personal data that a client firm's own end clients appear in — the people behind the cases and reviews we work on. For that data the client firm is the controller and we act as its processor, on its instructions and under the data processing terms in our services agreement with that firm. If you are one of those end clients, the firm that advises you is the right place to ask, and its own privacy notice is the one that applies.

3. What we collect about you

Account details — your name, work email address, job title, the firm or team you belong to, your role and permissions, and, for our own staff, an internal cost rate.
Authentication data — a one-way cryptographic hash of your password (never the password itself), one-time codes and their expiry, the count of failed sign-in attempts, and whether your account is locked.
Sign-in records — the date, time and IP address of your current and previous sign-in, and how many times you have signed in.
Activity and change history — a record of the changes you make to records in the Platform: what changed, from what to what, when, and that it was you.
Content you create — notes, comments, feedback, suggestions, time entries, calendar entries, tasks and documents you upload, each attributed to you.
Preferences — your saved display settings, such as your dashboard layout and the filters you last used on a table.
Cookies — see our Cookie Notice. We use only cookies that are strictly necessary for the Platform to work.

We do not use the Platform to collect special category data about you, and we do not carry out automated decision-making or profiling that produces legal or similarly significant effects.

4. Where it comes from

Most of it comes from you, or is generated as you use the Platform. Your account is created either by our own administrators, or — if you work for a client firm — from the contact details your firm gave us when it asked for you to be given access.

5. Why we use it, and our lawful basis

To give you an account and run the Platform. Lawful basis: performance of a contract, or our legitimate interests in performing the contract we have with your employer or your firm.
To keep the Platform and its data secure — sign-in records, failed attempt counts, account locking and the change history. Lawful basis: our legitimate interests in protecting the Platform and the confidential information in it, and in some cases our legal obligation to keep personal data secure.
To evidence the work we have done for a client firm, and to answer queries, complaints and audits about it. Lawful basis: our legitimate interests in being able to account for our work, and our legal and regulatory obligations.
To administer the business — allocating work, recording time against it, and reporting on it internally. Lawful basis: our legitimate interests in running the business.
To communicate with you about your account, including invitations, password resets and one-time codes. Lawful basis: performance of a contract, and our legitimate interests.
To meet legal and regulatory obligations, and to establish, exercise or defend legal claims. Lawful basis: legal obligation, and our legitimate interests.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and you can object — see section 9.

6. Who we share it with

We do not sell your personal data, and we do not share it for anyone else's marketing. We share it only with:

the suppliers who help us run the Platform — hosting and infrastructure, email delivery, error monitoring and backup providers — each of whom acts as our processor under a written contract;
your own employer or firm, where the data is about your use of the Platform on its behalf;
our professional advisers, auditors and insurers, where they need it;
a regulator, a court or a law enforcement body, where we are required or permitted by law to provide it.

A current list of the suppliers we use is available on request from [DATA PROTECTION CONTACT EMAIL].

7. Where it is held

We host the Platform and its data in the United Kingdom or the European Economic Area. If any supplier we use processes personal data outside the UK, we put in place a transfer mechanism recognised under UK data protection law — the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses — together with any additional safeguards the transfer requires.

8. How long we keep it

Your account — for as long as you have one. When your account is closed we lock it rather than delete it immediately, so that the work recorded against your name remains attributable, and we then remove or anonymise your contact details in line with our retention schedule.
Change history, sign-in records and work records — for [RETENTION PERIOD — e.g. six years] from the end of the engagement they relate to, so that we can evidence what was done and answer queries, complaints and regulatory enquiries.
Anything we are required by law to keep for longer — for as long as that requirement lasts.

9. Your rights

Over the personal data we hold about you as a controller, you have the right to:

ask for a copy of it;
have inaccurate data corrected;
ask us to delete it, where we no longer have a good reason to keep it;
ask us to restrict how we use it while a concern is resolved;
object to our using it where we rely on legitimate interests;
receive it in a portable form, where we rely on consent or on a contract and process it by automated means;
withdraw consent, where we rely on consent — which does not affect what we did before you withdrew it.

Some of these rights are qualified: our need to keep an accurate, unalterable record of who did what is a reason we may not be able to delete or amend part of the change history. Where that applies we will explain why.

To exercise a right, contact [DATA PROTECTION CONTACT EMAIL]. We will respond within one month. You will not be charged.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or on 0303 123 1113.

10. Security

Access to the Platform requires a password and a one-time code sent to your email address. Passwords are stored only as a one-way hash, and one-time codes only as a keyed digest. Traffic to the Platform is encrypted in transit. Access to records is restricted by role, and a firm's own users can reach only their own firm's records. Repeated failed sign-in attempts lock an account.

No system is perfectly secure. If you believe there is a vulnerability in the Platform, please tell us at [SECURITY CONTACT EMAIL] rather than disclosing it publicly.

11. Changes to this notice

We may update this notice. When the change is significant, the version number changes and you will be asked to confirm you have read the new version the next time you sign in. The version and date of the notice you last acknowledged are recorded.