Privacy Policy

Olympus Group Holdings, Inc., of 14/2E Docklands Business Center, 10-16 Tiller Road, London, United Kingdom, E14 8PX, is the controller of the personal information described in clauses 2 to 4 as “our own information”: account and billing details of the people who use THEMIS, security and usage logs, website visitors, enquiries and support requests, and the people we market to. Our group also operates from 1111B S Governors Ave, STE 25834, Dover, DE 19904, USA and from Plot 69184, Block 8, Science and Technology Park, Gaborone, Botswana.

When a practice puts information about its own clients, counterparties, staff and matters into THEMIS, the practice decides why and how it is used. The practice is the controller and we are its processor. We handle that information only on the practice's instructions, as the Data Processing Agreement sets out. If you are a client of a practice and want to see, correct or delete your information, please ask the practice first. If you ask us, we will pass the request to the practice.

Our privacy contact is privacy@olympuspay.co. We have not appointed a data protection officer because the law does not currently require us to. THEMIS is offered to professional customers, not to consumers.

• Account information: name, work email, role, job title, phone number if you add one, and a salted one-way hash of your password. We never store your password itself.
• Practice information: practice name, verified email domains, team membership, roles and settings.
• Billing information: plan, seat count, invoices and payment status. Card details are entered with our payment processor and are not stored by us.
• Technical information: IP address, browser and device type, timestamps, error logs and the audit trail of actions taken in the service. This includes the details recorded for signing audit trails.
• Support and enquiries: what you send us through forms, email or the help centre, and our replies.
• Website information: the pages requested and the details you send through the contact, support and demo forms. We do not run advertising or analytics trackers.
• Signing and portal visitors: what a visitor enters or uploads, and the IP address and device details recorded for the signing record and for security. This is held for the practice that sent the request, as its processor, and we keep the security details as our own.

We collect this information from you, from your practice administrator when they invite you, and from your use of the service. We do not buy personal information from data brokers.

• To provide the service you or your practice asked for, including hosting, searching, signing, sending the emails you trigger, and the assistant features you use. Basis: performance of a contract (UK GDPR Article 6(1)(b)).
• To keep the service secure, prevent abuse, detect fraud and maintain the tamper-evident audit trail. Basis: our legitimate interests in running a secure service, and legal obligations (Article 6(1)(f) and (c)).
• To invoice you, manage payments and meet tax, accounting and corporate-record rules. Basis: contract and legal obligation.
• To support you and answer enquiries, complaints and legal requests. Basis: contract and legitimate interests.
• To maintain and improve the service, using technical and aggregate information rather than the content of your matters. Basis: legitimate interests. You can object to this.
• To send service notices about changes, security and these documents. Basis: legal obligation and legitimate interests.
• To send occasional product news to business contacts, with a clear way to opt out in every message. Basis: legitimate interests in marketing to businesses, or consent where the law requires it. You can opt out at any time.

We have weighed our legitimate interests against your rights and expectations. If you would like to see how, ask us. We do not sell personal information, we do not share it for others' advertising, and we do not use the content of your matters to train models.

We do not make decisions about people based solely on automated processing that has legal or similarly significant effects. The assistant features described in the Artificial intelligence terms make suggestions that a person reviews.

We do not ask for special categories of personal information (such as health, ethnicity, religion, biometric identifiers or criminal-offence data) for our own purposes. A practice may, however, put such information into a matter, and identity checks switched on by a practice may involve ID documents and a face match. We handle that only as the practice's processor and only to deliver the check the practice asked for. Practices are responsible for having a lawful basis, and for any consent or notices the law requires, before they put such information into the service.

When you use an assistant feature, the relevant text from your matter, together with your request, is sent to an AI model provider so it can produce a response. Only what is needed for that request is sent, and we do not authorise the provider to use it to train its models. Each request is recorded in the AI activity log with who made it and what it related to. See the Artificial intelligence terms for the limits of these features.

We use a small number of service providers (sub-processors) to run the service: cloud hosting, a database provider, email delivery, an AI model provider, a payments processor and, where your practice turns it on, an identity verification provider. Each is bound by a written contract that limits its use of the information, requires appropriate security and confidentiality, and, where relevant, includes the transfer safeguards in clause 7. The Sub-processors page lists the categories and we give the named list to any customer who asks.

We also disclose information where the law requires it, to respond to a lawful request from a court or authority (after the checks described in the Terms of Service), to establish or defend legal claims, or to protect people's safety and the security of the service. If we are involved in a merger, acquisition or sale of assets, information may transfer to the successor, which must honour this policy, and we will tell you.

Our primary hosting and database are located in Ireland. The United Kingdom treats the European Economic Area as adequate for transfers from the UK, so sending information there needs no further safeguard. Some providers, including the AI model provider, our email provider and our payments and identity providers, may process information in other countries, including the United States and Botswana.

Where UK personal data goes to a country that the UK has not found adequate, we use the International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, together with an assessment of the destination's laws and supplementary measures where needed. For the United States we rely on the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, and otherwise on those agreements. Botswana is not covered by UK adequacy regulations, so any transfer there is made under an agreement of that kind. You can ask us for a copy of the safeguards that apply.

Your practice may have its own duties about moving client information across borders, including under its regulator's rules. Consider them when choosing what to put into the service.

We keep information only as long as needed for the purposes above and as the Data retention schedule sets out. In short: account and content information while your subscription is active and for 30 days after it ends for export, then it is deleted from the live service and removed from backups on their normal cycle; billing records for the period tax and accounting law requires; security logs for up to 24 months; support requests for three years after closure; and website enquiries for 24 months. A matter's audit trail is kept with the matter so that its history stays verifiable, and cannot be edited. Practices decide how long to keep client records and are bound by their own professional retention rules.

We protect information with encryption in transit, isolation of each practice's data in the database, role-based access, hashed passwords, one-time codes for signing, sign-in throttling and an append-only audit trail. The Security page describes these measures and what we do not claim: we do not currently hold SOC 2 or ISO 27001 certification. No system is perfectly secure. If a breach affects personal information, we will tell the affected practice without undue delay, and tell the ICO and affected individuals where the law requires us to as controller.

Under the UK GDPR and the Data Protection Act 2018, you may:

• ask whether we hold information about you and get a copy (access);
• have inaccurate information corrected and incomplete information completed (rectification);
• have information deleted where there is no good reason for us to keep it (erasure);
• restrict our use of it while a question is resolved;
• object to uses based on our legitimate interests, and to direct marketing, at any time;
• receive information you gave us in a portable form, where we use it by automated means on the basis of contract or consent (portability);
• withdraw consent where we rely on it, without affecting what we did before;
• not be subject to a decision based solely on automated processing that has legal or similar effects on you.

To use a right, write to us at privacy@olympuspay.co. We may ask you to prove who you are. We aim to answer within one month, and if a request is complex we will tell you why we need longer. There is no fee unless a request is manifestly unfounded or excessive. Some rights have exceptions, for example where we must keep information by law. Where we hold information as a practice's processor, we will pass your request to the practice.

You may complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk. We would like the chance to put things right first, so please contact us. You can reach us at privacy@olympuspay.co for data protection matters, legal@olympuspay.co for legal notices, and support@olympuspay.co for help. Our address for notices is 1111B S Governors Ave, STE 25834, Dover, DE 19904, USA. A written notice sent to that address, or an email to legal@olympuspay.co, is treated as delivered when received.

The service is for professionals and is not directed at children. We do not knowingly collect information from anyone under 18 for our own purposes. The UK GDPR gives children's personal data specific protection. A practice may put information about a minor into a matter. The practice is responsible for that information and for obtaining any consent the law requires from a parent or guardian.

We use only the cookies and browser storage the service needs to work. See the Cookie Policy.

Where we need information to create your account, bill you or keep the service secure, we cannot provide the service without it. Information you enter into forms for other purposes is optional.

We will update this policy when our practices change and give notice of material changes by email to account holders or in the service. The version and effective date are at the top of the page, and earlier versions are available on request.