Data processing agreement. The firm’s data under the firm’s control.

1. Parties and conclusion of the agreement

The controller is the Customer of the Consilaris service, i.e. the law firm that has registered a Firm Account, hereinafter the “Law Firm” or the “Controller”.

The processor is MIVARE GROUP PROSTA SPÓŁKA AKCYJNA, with its registered office in Krasnobród, KRS 0001268091, NIP 9223092251, REGON 545767254, operating under the Consilaris brand, hereinafter the “Processor” or “Mivare”.

This data processing agreement, hereinafter the “DPA”, is an agreement within the meaning of Article 28(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR). It is concluded in electronic form upon acceptance of the Consilaris Terms of Service (CNS-LEG-001) when registering the Firm Account and remains in force for the duration of the Contract and until the activities described in section 13 are completed; the obligations concerning professional secrecy continue for an unlimited period.

Capitalised terms have the meanings given to them in the Terms of Service. In matters of personal data protection and professional secrecy, the DPA takes precedence over the Terms of Service.

2. Subject matter, nature and purpose of processing

The Law Firm entrusts the Processor with processing personal data entered into the Application by the Law Firm and the Users or transferred to the Application on their behalf, solely for the purpose of providing the Consilaris service.

Processing comprises the operations necessary to provide the service: storing, organising, structuring, searching, viewing, modifying and deleting data on the Law Firm's instructions, displaying it to Users in accordance with the permissions granted, generating documents, summaries and exports, sending e-mail messages triggered by Users or by the Application's settings, preparing summaries by means of the Mivi assistant, where the Account Administrator and the User have enabled it, making backups, and access as part of technical support and failure remediation on the terms of section 7.

The Processor does not process the entrusted data for its own purposes, does not become acquainted with the content of cases and documents except in the situations described in section 7, does not combine the data with data of other customers, does not sell it and does not use it for analysis, profiling or training artificial intelligence models.

On the Law Firm's instruction, where the Account Administrator enters the Law Firm's token for the National e-Invoicing System (KSeF) in the Application, the Processor sends to KSeF the invoices issued by the Law Firm in the Application (together with the seller's and buyer's data, line items and amounts contained in them) on behalf of the Law Firm and under its authorisation, and then records in the Application the KSeF number assigned and the official acknowledgement of receipt (UPO). In this way the Law Firm performs its obligation under the provisions on value added tax. The Minister of Finance, who operates KSeF, processes the data received as a public authority on the basis of those provisions; the Processor acts solely as a sending tool and does not determine the purposes of the transfer. The Law Firm may at any time remove the token from the Application and revoke it in KSeF. If the Account Administrator uploads the Law Firm's offline-mode certificate and the Law Firm chooses an offline mode when issuing an invoice, the Processor signs the invoice's verification code with that certificate and sends the invoice to KSeF once this is possible; only the signature is transmitted to KSeF, never the certificate's private key.

3. Categories of data subjects and data

Categories of data subjects:

• the Law Firm's clients: natural persons, including those conducting business activity, and representatives, attorneys, beneficial owners and contact persons of clients that are not natural persons;
• prospective clients of the Law Firm and persons in respect of whom the Law Firm checks for conflicts of interest;
• opposing parties, their representatives, participants in proceedings, witnesses, experts, guardians and other persons appearing in matters handled by the Law Firm;
• judges, prosecutors, officers and employees of courts, authorities and offices, to the extent arising from the matters handled;
• partners, advocates, attorneys-at-law, trainees, employees and co-workers of the Law Firm, including Users of the Application;
• contact persons of the Law Firm's business partners;
• other persons whose data the Law Firm enters into the Application in line with its intended use.

Categories of personal data:

• identification and contact data: first and last name, name, address, correspondence address, telephone number, e-mail address, preferred contact channel and language;
• identifiers: PESEL number, identity document number and series, NIP, REGON, KRS, EU VAT number and other data entered by the Law Firm as part of client identification;
• case and engagement data: subject matter of the case, case reference numbers, courts and authorities, deadlines, course of proceedings and the documents of the case file together with their content, including pleadings, correspondence (including e-mail messages saved as EML and MSG files), powers of attorney, contracts, evidence, judgments and decisions, notes of the Law Firm's team and other documents;
• billing data: rates, working time, budgets, costs, advances, receivables and invoices issued by the Law Firm;
• time records of the Law Firm's team: person, day, duration, type and description of the activity, case and proceeding, rate and amount, whether the time is billable, approval and billing status (with the approving person and the invoice) and running time trackers; activity descriptions may contain data from cases and engagements;
• data of Users and the Law Firm's team: contact details, position, specialisation, permissions, team membership, working time;
• consents and communication preferences and contact history;
• case file documents and other files attached by Users, together with their subsequent versions, stored in the file store (Object Storage);
• technical data: IP address and timestamps of actions performed in the Application.

Given the nature of legal assistance, the entrusted data may include special categories of personal data (Article 9 GDPR), in particular health data, and data relating to criminal convictions and offences (Article 10 GDPR). The Law Firm is responsible for the existence of a legal basis for processing them, and the Processor processes them on the terms of the DPA, with the same protective measures as the other data.

4. Professional secrecy

The Processor acknowledges that the entrusted data and other Firm Data may be covered by advocates' professional secrecy (Article 6 of the Polish Law on the Bar of 26 May 1982), attorneys-at-law's professional secrecy (Article 3 of the Polish Act of 6 July 1982 on Attorneys-at-Law) or other legally protected secrecy, and treats all Firm Data as covered by secrecy, regardless of how it is marked.

The Processor ensures that every person granted access to Firm Data (the staff of the Processor and of any sub-processor) has undertaken in writing, for an unlimited period, to keep secret everything they learn in connection with that access, including after their cooperation with the Processor ends; in the case of Mistral AI, the confidentiality obligations of its staff arise from the data processing agreement concluded by the Processor with Mistral AI.

If a court, prosecutor or other authority demands that the Processor hand over Firm Data or grant access to it, the Processor: promptly notifies the Law Firm, unless prohibited by law; declares to the authority that the data may contain information covered by professional secrecy and requests that the procedure provided for such information be applied, in particular Article 225 § 1 of the Polish Code of Criminal Procedure of 6 June 1997; hands over data only to the extent that the obligation to do so arises from a provision of law or a final decision; documents the course of the matter and, at the Law Firm's request, provides it with that documentation to the extent permitted by law. The Processor does not disclose Firm Data voluntarily or on the basis of a mere request from an authority.

The Processor does not contact the Law Firm's clients or other data subjects regarding the entrusted data and does not confirm to third parties whether the Law Firm processes the data of a given person.

5. Obligations of the Law Firm

The Law Firm is responsible for having a legal basis for processing, for the accuracy of the data entered, for fulfilling the information obligations towards data subjects to the extent the law does not provide for exemptions, and for assessing whether entrusting data to the Processor on the terms of the DPA meets its obligations under the rules governing the profession and the rules of professional ethics.

The Law Firm configures the Application, including User permissions, the retention period of the event log and the requirement of two-factor authentication, appropriately to the risk of its processing, and determines the retention periods of case files and documentation.

6. Instructions of the Law Firm

The Processor processes data only on documented instructions from the Law Firm. Instructions are: the Terms of Service and the DPA, the configuration of the Application made by the Law Firm and the actions of Users in the Application, as well as instructions sent from the Account Administrator's e-mail address to biuro@consilaris.pl.

The Processor may process data without the Law Firm's instructions only where required by Union or Member State law; in such a case, before processing begins, it informs the Law Firm of that obligation, unless the law prohibits such information. The rules of section 4 apply accordingly.

If, in the Processor's opinion, an instruction infringes the GDPR or other data protection provisions, the Processor promptly informs the Law Firm and may suspend its execution until it is clarified.

7. Access by the Processor's staff

The Processor grants access to data only to authorised persons who need access to provide the service, technical support or failure remediation and who have given the undertaking referred to in section 4.

The Processor's staff become acquainted with the content of Firm Data only:

• at the request of the Account Administrator or of a User authorised by the Law Firm, to the extent and for the time necessary to fulfil the request;
• where necessary to remedy a failure, restore data or avert a security threat that cannot be eliminated without such access; in such a case the Processor notifies the Law Firm of the access, its reason and scope without delay, no later than within 3 working days.

The Processor documents each such access (person, date, reason, scope) and, at the Law Firm's request, provides it with a list of accesses to Firm Data. Administrative activities that do not require becoming acquainted with the content of the data, in particular server maintenance, updates and backups, do not constitute access within the meaning of this section.

8. Security of processing

The Processor applies the technical and organisational measures referred to in Article 32 GDPR, appropriate to the risk and taking professional secrecy into account. Their implementation status as at the effective date of the DPA:

• encryption of data in transit using the TLS protocol (status: implemented);
• passwords stored solely in hashed form using the Argon2id algorithm, password strength requirements and checking against commonly known passwords (status: implemented);
• two-factor authentication (TOTP) available to all Users, with the option for the Account Administrator to require it; two-factor authentication for the Processor's administrative accounts (status: implemented);
• limiting of login attempts, account lockout after failed attempts and automatic expiry of inactive sessions (status: implemented);
• logical separation of the data of each Firm Account at application and database level (status: implemented);
• User permissions granted by the Law Firm and the principle of least privilege for the Processor's staff (status: implemented);
• a User's access to cases, their case files and files only within the scope of cases granted to that User by the Law Firm (view or edit) (status: implemented);
• files stored in a private file store (Object Storage) in the European Union, encrypted by the Application before being sent to the store, kept separately for each customer account and made available only through the Application after authorisation, with the Application decrypting the file at the moment of download (status: implemented);
• scanning of every uploaded file with anti-virus software before it is stored (status: implemented);
• the Law Firm's KSeF token stored only in encrypted form (AES-256-GCM, with the key kept outside the database), displayed only in abbreviated form and used solely for sending invoices (status: implemented);
• the Law Firm's KSeF offline-mode certificate: private key stored only in encrypted form (AES-256-GCM, with the key kept outside the database), never displayed or downloadable, excluded from the data export and the event log, used solely to sign the verification code of an invoice issued in an offline mode; it can be uploaded only by the Account Administrator after confirmation with the password, and the Application shows only its serial number, validity, algorithm and upload date (status: implemented);
• event logging in the Application (event log) (status: implemented);
• automatic backups: a database backup every hour, kept for 7 days, and a daily full backup of the database, kept for 3 days, and a continuous backup of files, in which a deleted file remains for no more than 30 days; backups are encrypted before being written, the key needed to read them is kept outside the server and outside the backup storage, and the backups themselves are stored in the European Union, in a separate Object Storage container, kept apart from the Application server and from the file store; periodic restore testing (status: implemented);
• installation of updates and security patches (status: implemented);
• security incident handling procedure (status: implemented);
• encryption of the database on the server's disk (status: not implemented, planned); until it is implemented, data in the database is protected by access control, the principle of least privilege, the undertakings under section 4 and event logging; files and backups are encrypted as described in the points above.

The Processor does not claim ISO or SOC certification. The Processor may change the security measures, provided the change does not lower the overall level of protection; it informs the Law Firm of the implementation of a measure marked as planned in the next update of the DPA.

9. Sub-processing

The Law Firm gives the Processor general authorisation to engage sub-processors on the terms of this section. As at the effective date of the DPA, the Processor uses the following sub-processors:

• Contabo GmbH (Germany, Munich): the server on which the Application and its database run, the file store and the backup store (Object Storage); data centres in the European Union; access to all categories of data solely to the extent of providing infrastructure services, without becoming acquainted with their content; files in the file store and backups are encrypted by the Processor before being written; no transfer outside the European Economic Area.
• OVH Sp. z o.o. (OVHcloud group): sending e-mail from the Application, as well as Mivare's domains and websites; data centres in the European Union; access to the data contained in e-mail messages sent from the Application, solely for their delivery; no transfer outside the European Economic Area.
• Mistral AI SAS (France, Paris): preparing summaries, answers and document drafts by means of the Mivi assistant, only in Firm Accounts in which the Account Administrator has enabled it, and for Users who have enabled it; processing and storage in the European Union, without using the data to train models; queries and responses are stored for no more than 30 days solely for the purpose of detecting abuse, after which they are deleted; access to the data transferred in the query; no transfer of data outside the European Economic Area.

The Mivi assistant is disabled by default. By enabling it for the Firm Account, the Account Administrator acts on behalf of the Law Firm and gives the Law Firm's consent to the involvement of Mistral AI as a sub-processor with respect to that function; each User then enables or disables it for their own account. The Processor transfers to Mistral AI only the data needed to prepare a summary or answer for the User who has enabled the assistant (event log entries and extracts from records to which that User has access in the Application) and does not transfer passwords, authentication data, payment card data, PESEL numbers or identity document numbers. In the Mivi+ module, that scope also includes the content of the documents and records on which the User works with the assistant, as well as the history of the User's conversations with the assistant, which the Processor stores in the Application for 90 days unless the User deletes it earlier; the exclusions set out in the preceding sentence continue to apply. Disabling of the assistant by the Account Administrator or by the User immediately stops the transfer of data to that extent.

The Processor informs the Account Administrator by e-mail of any intended addition or replacement of a sub-processor at least 30 days before the change, indicating the sub-processor and the scope and place of processing, and publishes the current list in the DPA. The Law Firm may raise a reasoned objection within 14 days of receiving the information. If the parties do not agree on a solution, the Law Firm may terminate the Contract with effect from the day preceding the change and receives a refund of the fee for the unused, prepaid period.

A sub-processor supporting a function that the Law Firm enables itself (in particular artificial intelligence, text or speech recognition) receives data only if the Account Administrator enables that function, and only from the Firm Accounts that have enabled it, and, in the case of the Mivi assistant, additionally only for Users who have enabled it for their own account.

The Processor imposes on each sub-processor data protection obligations no less protective than those arising from the DPA, including an obligation of confidentiality and a prohibition on using the data for its own purposes, and is liable to the Law Firm for the performance of the sub-processor's obligations.

The payment operator Stripe (Stripe Payments Europe, Limited) is not a processor: it handles only the Law Firm's payments for the service and has no access to the entrusted data. The Minister of Finance, who operates the National e-Invoicing System and receives the Law Firm's invoices in the manner described in section 2, is not a sub-processor either.

10. Data location and transfers outside the European Economic Area

The Processor stores the entrusted data, including its backups, exclusively in data centres within the territory of the European Union and processes it there. This also applies to the Mivi assistant: where the Account Administrator has enabled it for the Firm Account and the User has enabled it for their own account, the data transferred in the query is processed in the European Union by Mistral AI SAS (France), which retains it there for no more than 30 days solely for the purpose of detecting abuse, after which it deletes it; that data is not used to train models. Before enabling the assistant, the Law Firm assesses whether such processing is consistent with its obligations relating to professional secrecy, and may specify in its internal rules which Users use it. A transfer of data to a third country or an international organisation requires prior information to the Law Firm in accordance with section 9, the right to object and the use of a mechanism compliant with Chapter V GDPR.

11. Assistance to the Law Firm

The Processor assists the Law Firm in fulfilling its obligation to respond to requests from data subjects. The Application allows the Law Firm to view, correct, export and delete data on its own. If a data subject's request reaches the Processor directly, the Processor forwards it to the Law Firm without undue delay and does not respond to it on its own.

Taking into account the nature of processing and the information available, the Processor assists the Law Firm in fulfilling its obligations under Articles 32–36 GDPR, including data protection impact assessments and prior consultations, by providing the information it holds about the Application and the measures applied.

12. Personal data breach

The Processor notifies the Law Firm of a personal data breach and of any event that may have resulted in the disclosure of information covered by professional secrecy without undue delay, no later than within 24 hours of becoming aware of it, to the Account Administrator's e-mail address.

The notification contains, as far as information is available: a description of the nature of the breach, including the categories and approximate number of data subjects and records, the likely consequences, the remedial measures taken or proposed and the contact details of the person providing information. Information not available at the time of notification is provided by the Processor in phases.

The Processor documents breaches and takes action to mitigate their effects. Notifying the supervisory authority, communicating with data subjects and obligations towards the professional self-governing body rest with the Law Firm; the Processor assists it in doing so.

13. End of processing, return and deletion of data

The Law Firm may at any time download a copy of the data using the export function in the Application (a ZIP archive with CSV files and attached files). After the Contract ends, the Processor retains the data for 30 days to allow its export or resumption of the service and, at the Law Firm's request, provides the export electronically during that time.

The Processor then deletes the entrusted data, no later than 60 days after the Contract ends. Copies of data in backups are deleted in the rotation cycle, no later than 30 days after the data is deleted from the Application. At the Law Firm's request, the Processor confirms deletion electronically.

The event log is retained for the period set by the Law Firm, from 30 to 180 days. Copies of deleted records, kept in order to restore data deleted by mistake, are kept for no longer than 180 days and deleted together with the Firm Account.

The Processor may retain the entrusted data for longer only where required by Union or Member State law, and only to the extent arising from that obligation; the rules of section 4 apply to such data without time limit.

14. Information and audit

The Processor makes available to the Law Firm the information necessary to demonstrate compliance with the obligations under Article 28 GDPR and section 4, in particular answers to questions concerning the Application, security measures, sub-processors and the list of accesses under section 7, sent to hello@mivaregroup.com, within 14 days.

If the information provided is insufficient, the Law Firm or an independent auditor bound by confidentiality may carry out an audit no more than once every 12 months, except for an audit following a personal data breach or at the request of a supervisory authority. An audit requires at least 30 days' prior notice, takes place on working days, must not disrupt the provision of the service or breach the confidentiality of data and the professional secrecy of other customers, and is carried out at the Law Firm's expense.

15. Liability and final provisions

The liability of the parties under the DPA is governed by Article 82 GDPR and the Terms of Service, provided that the limitations of liability do not apply to a breach of section 4 or to cases where exclusion or limitation is not permitted by law.

Amendments to the DPA, including updates to the list of sub-processors, are made in accordance with the procedure provided for in the Terms of Service for amendments to documents, subject to section 9.

The DPA is governed by Polish law. It is made available in Polish and English; in the event of any discrepancy, the Polish version prevails. The current version is available at https://mivaregroup.com/en/legal/consilaris/dpa/

The DPA is effective from 29 October 2026.