GDPR

1. Data controller

my family court is the data controller for personal data submitted through the Service. Data protection contact: support@myfamilycourt.com.

2. Our GDPR principles

• Lawfulness, fairness and transparency — we tell you what we do with your data.
• Purpose limitation — we only use data for the purposes described in the Privacy Policy.
• Data minimisation — we only collect what we need.
• Accuracy — you can correct data at any time from your account.
• Storage limitation — we delete or anonymise data when it is no longer needed.
• Integrity and confidentiality — data is encrypted in transit and at rest.
• Accountability — we keep records of processing and review our practices regularly.

3. Your rights

• Right of access — request a copy of your personal data.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure — ask us to delete your data ("right to be forgotten").
• Right to restrict processing — ask us to pause processing while we resolve a query.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests.
• Rights around automated decision-making — the Service does not make automated decisions that produce legal or similarly significant effects. AI drafts are always subject to your review.
• Right to withdraw consent — where processing is based on consent, you can withdraw it at any time.
• Right to complain to a supervisory authority (ICO in the UK, or your local EU authority).

4. How to make a data request

Email support@myfamilycourt.com with:

• The email address on your account.
• What you want us to do (access, correct, delete, export, etc.).
• Enough information for us to verify your identity.

We aim to respond within 30 days. Where a request is complex we may extend by a further 60 days and will tell you why. Requests are free unless they are manifestly unfounded or excessive.

5. Special-category data

Family court cases often involve sensitive information — health, family relationships, allegations of abuse, information about children. You choose what to upload. We process this data only to provide the Service to you, on the basis of your explicit consent under Article 9(2)(a) of the UK/EU GDPR. You can withdraw that consent by deleting the content or your account.

6. Sub-processors

We use a small number of vetted sub-processors for hosting, database, storage, email and AI inference. All are bound by data protection contracts and appropriate safeguards for any transfers outside the UK/EEA (adequacy decisions, IDTA, or Standard Contractual Clauses).

7. Data breach notification

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and notify affected users without undue delay, in line with Articles 33 and 34 GDPR.

8. International transfers

Where personal data leaves the UK or EEA, we rely on adequacy decisions where available, and otherwise on UK International Data Transfer Agreements or Standard Contractual Clauses with supplementary measures.

9. Supervisory authority

UK: Information Commissioner's Office — ico.org.uk, 0303 123 1113.

EU: your local supervisory authority — list of national authorities.