Data processing agreement (Dua eAvokat)

Version 2026-10-30

Each studio reads and accepts this agreement inside Dua eAvokat (Settings › Subscription), filled in with its own name, NIPT and address, and downloads a copy. This page shows the same text for reference.

This agreement is between the law firm or lawyer that subscribes to Dua eAvokat, "the Studio", which is the controller of the personal data it keeps in Dua eAvokat, and DM Consulting Services SHPK (NUIS M61810052H, Rr. "Luigj Gurakuqi", Pallati 4, Kati 1, Ap. 7, Tiranë, Albania), "DM Consulting Services", which provides Dua eAvokat and is the processor of that data. It forms part of the Studio's Dua eAvokat subscription and follows the law of the Republic of Albania on the protection of personal data and, where it applies, the EU General Data Protection Regulation.

1. What DM Consulting Services processes, and why

• Purpose: only to provide Dua eAvokat to the Studio: keeping, showing, searching, printing and sending the Studio's data as the Studio uses the software, backing it up and keeping it secure.
• Data subjects: the Studio's clients and their contacts, the other parties and their representatives, witnesses and experts, people who book consultations or write through the Studio's website, the Studio's staff.
• Kinds of data: names, ID and NIPT numbers, contact details, case files and their documents, hearings, deadlines, notes, messages, consultations, invoices and payments, and the Studio's staff accounts. Case files may contain special categories of data and data about criminal proceedings: DM Consulting Services treats all of it as confidential.
• Duration: as long as the subscription lasts, and afterwards as described in section 9.

2. Only on the Studio's instructions

DM Consulting Services processes the data only on the Studio's documented instructions: this agreement, the settings the Studio chooses in Dua eAvokat and what the Studio's staff do in it. DM Consulting Services never uses the data for its own purposes, never sells it and never uses it to train artificial intelligence. If the law requires DM Consulting Services to do otherwise, it tells the Studio first, unless the law forbids that.

3. Confidentiality and lawyers' secrecy

DM Consulting Services knows that lawyers are bound by professional secrecy. Only the few DM Consulting Services people who need it to run, secure or support Dua eAvokat can reach the data, and each of them is bound to confidentiality. DM Consulting Services staff open a Studio's admin only to help it, through a "support sign-in" that the Studio sees on screen and that is written to the Studio's activity log with the person's email.

4. Security

DM Consulting Services keeps appropriate technical and organisational measures, including:

• encrypted connections (HTTPS) everywhere, and passwords, keys and secrets stored encrypted;
• each studio's data kept apart from every other studio's;
• a second sign-in step (an emailed code, or an authenticator app) for staff, and roles that limit who sees what, down to restricted cases;
• an activity log of who did what;
• regular backups, kept apart from the main server, and restore tests;
• updates and security fixes applied promptly.

5. Sub-processors

The Studio allows DM Consulting Services to use the sub-processors listed below. DM Consulting Services binds each one to data protection duties at least as strict as these, and stays responsible for them. DM Consulting Services tells the Studio about a new or replaced sub-processor at least 30 days before, by email and in Dua eAvokat, and the Studio may object for a reasonable cause; if no solution is found, the Studio may end its subscription and is refunded for the unused period. Services marked "only if switched on" receive data only when the Studio switches them on in Settings › Integrations.

6. Helping the Studio

DM Consulting Services helps the Studio, as far as it can, to answer requests from data subjects (access, correction, deletion, restriction, portability), to keep its data secure, to assess data protection risks and to deal with the supervisory authority (the Commissioner for the Right to Information and the Protection of Personal Data). Most of this the Studio can do itself in Dua eAvokat.

7. Personal data breaches

If DM Consulting Services becomes aware of a breach affecting the Studio's data, it tells the Studio without undue delay and at the latest within 48 hours, with what is known (what happened, which data, likely consequences, what is being done), and keeps it informed. Notifying the authority and the people affected remains the Studio's decision as controller; DM Consulting Services helps.

8. Where the data is kept

The data is kept on servers in the European Union and in Albania. If DM Consulting Services ever transfers data elsewhere, it does so only with safeguards the law accepts, and it tells the Studio first.

9. At the end of the subscription

• If a payment is missed, Dua eAvokat first keeps working, then becomes read-only for the period shown on Settings › Subscription: the Studio can still sign in, see, print and download everything.
• During that period, and on request, DM Consulting Services gives the Studio a copy of its data in a common format.
• After that period, DM Consulting Services deletes the Studio's data, including from backups as they cycle (within 30 days), unless the law requires DM Consulting Services to keep some of it. Invoices DM Consulting Services issued to the Studio are kept as tax law requires.

10. Audits

DM Consulting Services gives the Studio the information needed to show it keeps to this agreement. The Studio, or an auditor bound to confidentiality, may audit it once a year with 30 days' notice, at the Studio's cost, without seeing other studios' data.

11. Liability, changes and law

Liability follows the Studio's subscription terms. DM Consulting Services may update this agreement, for example for a change in the law; the Studio is told 30 days before, and the new version is shown in Dua eAvokat to be accepted. This agreement is governed by the law of the Republic of Albania, and the courts of Tirana decide disputes.

Contact for data protection: [email protected]