Privacy Policy — CrestDex

This Privacy Policy describes how Swancrest Limited ("CrestDex", "we", "us", or "our") handles information in connection with the CrestDex platform ("the Platform"). We are committed to protecting the privacy and confidentiality of the law firms and individuals who use our services. Please read this policy carefully. If you have questions, contact us at privacy@crestdex.com.

Who This Policy Applies To

This policy applies to:

Administrators and staff members of law firms and legal practices that subscribe to CrestDex ("Subscriber Users").
Visitors to the CrestDex website (crestdex.com and its subdomains).
Individuals whose personal data may appear in the Platform in the course of legal matter management — for example, clients, counterparties, and witnesses whose details are recorded by a subscribing firm. Swancrest is not the primary data controller for these individuals; the subscribing firm is. Please contact your law firm directly if you wish to exercise rights in respect of data they hold about you.

How We Handle Your Information

CrestDex helps subscribing firms manage client and matter information using Microsoft cloud services. Documents and templates connect with the firm’s SharePoint environment. The storage arrangements for other practice records depend on the edition and services agreed with the firm.

We also process information needed to operate the service, including firm settings, sign-in and activity records, support information and security logs. Your device may retain information needed to run the application. Where AI is enabled, selected information is processed to answer your queries.

The subscribing firm determines how its practice records are used. Swancrest processes information to provide and support the service under the applicable subscription and data-processing arrangements. These arrangements identify responsibilities, authorised service access and the firm’s instructions.

Information We Collect

The information processed depends on your edition and enabled services:

Practice records: client and KYC details, matters, staff and roles, teams, tasks, workflows, fees, litigation and transaction records, and information about documents and correspondence.
Microsoft 365 content: documents, templates, correspondence and calendar information accessed for the requested workflow under configured permissions.
Firm settings: firm name, website address, Microsoft organisation details, administrator contacts and settings needed to connect your workspace.
Sign-in and service records: information that verifies your identity and firm, sign-in activity, setup and access history, and information needed to investigate service problems.
AI queries: prompts and selected practice or Microsoft 365 evidence supplied to configured Enterprise AI services, together with resulting answers and citations.

We do not receive your Microsoft account password. Website hosting may generate standard access logs such as IP address, browser type, pages visited and referrer. We do not sell personal information or use advertising trackers.

Authentication and Microsoft 365

You sign in using your work Microsoft account. Microsoft verifies your identity and provides the information needed for CrestDex to recognise you and your firm. We do not receive or store your Microsoft account password.

Your use of Microsoft services in connection with the Platform is also governed by Microsoft's privacy policy, available at privacy.microsoft.com. The applicable Microsoft service terms and data-protection arrangements govern its role for those services.

How We Use Information

Information is processed to operate your configured edition: authenticate users, connect the correct firm workspace, manage practice workflows, enforce application access, maintain sessions, generate documents and support requested queries.

Where Enterprise AI is enabled, your query and selected relevant records, documents or correspondence may be processed by Microsoft’s AI services to generate an answer. The information available depends on your permissions and the services connected by your firm.

We also use necessary information for onboarding, support, security and service notices. We do not sell personal information. The AI services used, processing locations and retention arrangements are explained for the firm’s subscription. We do not make a blanket promise that AI processing involves no retention.

Legal Basis for Processing

Under the Kenya Data Protection Act, 2019, the legal basis for processing depends on the information, purpose and our role. For our own service administration, the relevant bases include:

LEGAL BASISEXPLANATION

Performance of a contractProcessing is necessary to provide the Platform under the subscription agreement with your firm.

Legitimate interestsProcessing to operate and secure the Platform, communicate service notices, and maintain records of our contractual relationships, where those interests are not overridden by your fundamental rights and freedoms.

Legal obligationProcessing that may be required to comply with applicable laws and regulatory requirements.

Disclosure of Information

Information may be disclosed or processed through the following service arrangements and circumstances:

CIRCUMSTANCEDETAIL

Service providersWe use Microsoft cloud services to host and operate CrestDex, connect Microsoft 365 information and, where enabled, provide AI assistance. Applicable data-processing terms govern these services. We identify any additional service providers used for the firm’s subscription.

Legal requirementsWe may disclose data where required by law, court order, or the lawful direction of a regulatory authority. Where permitted, we will notify you before complying with such a requirement.

Business transfersIf Swancrest is acquired or merges with another entity, configuration data may be transferred to the successor entity, subject to equivalent privacy protections. We will notify affected Subscribers in advance where practicable.

Protection of rightsWe may disclose data where reasonably necessary to protect the rights, property, or safety of Swancrest, our users, or the public, including to prevent fraud or security incidents.

Data Storage and Security

CrestDex uses Microsoft cloud services to store and process practice information. Documents and templates connect with SharePoint. The arrangements for practice records, operational information and enabled AI services depend on your edition and agreed setup.

Access depends on staff roles, matter permissions and the firm’s connected services. Your administrator should review access across CrestDex and those services, including when staff join, change roles or leave.

Swancrest’s service and support access is limited by the permissions and support arrangements agreed with the firm. We handle security incidents affecting information processed through the service under applicable law and those arrangements.

Data Retention

Firm configuration is retained for the subscription and, under the existing service policy, for up to twelve months after termination for administrative, audit and legal purposes, subject to applicable obligations and deletion requests.

The firm’s Microsoft 365 settings govern retention of its SharePoint records and documents. Retention of other practice records, backups, sign-in and audit records, service logs and AI information is addressed separately in the applicable service arrangements, together with export or deletion assistance.

Ending a subscription does not itself delete the firm’s records. Some information may also remain on users’ devices until cleared. Website logs follow the hosting provider’s retention practices.

Cookies and Tracking

The marketing website does not use advertising or behavioural tracking cookies. Hosting services may generate operational access logs.

The application uses cookies and device storage to support sign-in, remember necessary settings and run the workspace. Enterprise also uses a CrestDex sign-in cookie and activity records to lock inactive sessions.

Browser caches can persist after a session ends; clear site data when retiring a device or using a shared device. The marketing site loads fonts from Google Fonts, which causes requests from your browser to that provider.

Your Rights

Under the Kenya Data Protection Act, 2019, you have the following rights in relation to personal data Swancrest holds about you:

RIGHTWHAT IT MEANS

AccessRequest a copy of the personal data we hold about you.

RectificationRequest correction of inaccurate or incomplete data.

ErasureRequest deletion of your data, subject to our legal obligations and legitimate interests.

RestrictionRequest that we restrict processing of your data in certain circumstances.

ObjectionObject to processing based on our legitimate interests.

PortabilityReceive your data in a structured, machine-readable format where processing is based on contract and carried out by automated means.

ComplaintLodge a complaint with the Office of the Data Protection Commissioner of Kenya.

To exercise any of these rights, please contact us at privacy@crestdex.com. We will respond within the timeframes required by applicable law. We may need to verify your identity before acting on a request.

For requests concerning your firm's practice records, contact the firm's administrator first. Swancrest will handle requests concerning its own processing and assist the firm as required by the applicable arrangements.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the Platform, our data practices, or applicable law. We will notify Subscriber administrators of material changes by email. The effective date at the top of this page will be updated to reflect the date of the most recent revision. We encourage you to review this policy periodically.

Contact

For privacy-related enquiries, requests to exercise your rights, or to report a concern, please contact our privacy team at:

Swancrest Limited — Privacy
Email: privacy@crestdex.com
Nairobi, Kenya

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya if you believe we have not handled your data in accordance with applicable law.