Privacy Policy

This policy applies to Personal Information that Donna handles in the course of operating the Platform, providing related services, marketing those services, recruiting personnel, and running our business as a going concern. It applies globally, with sub-sections that address divergences in Australian, European, United Kingdom, Swiss and United States law.

Where the Customer (typically a law firm) is the entity that determines the purposes and means of processing matter information in the Platform, that Customer's own privacy policy will be the primary statement applicable to End Clients invited into a Space. This policy applies to information about End Clients only to the extent that Donna handles it on its own account, for example where Donna communicates directly with an End Client to authenticate them, deliver service notices, or respond to a rights request.

In this policy, capitalised terms have the meanings given in the Donna Platform Agreement and Service Terms. “Personal Information” means information meeting the definition under the Privacy Act 1988 (Cth) (the “Privacy Act”) or “personal data” under the EU General Data Protection Regulation 2016/679 (“GDPR”) and the UK GDPR, as the context requires.

The Donna platform is two-sided. The same data sometimes appears in different legal characters depending on whose perspective you take. We try to be precise about that in this section, because it determines who answers your privacy questions and under what law.

The categories of Personal Information that flow through the Platform fall broadly into four buckets. We describe each below. The exact items in any given case depend on how a firm configures its tenancy and what Customer Data it uploads.

We use Personal Information for the purposes set out below. The table maps each purpose to the categories of Personal Information involved and to the legal basis under Australian Privacy Principle 6 and, where the GDPR or UK GDPR applies, Article 6.

Where we rely on consent, you may withdraw it at any time by contacting privacy@bydonna.ai. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

The Platform uses large language models and related AI systems to assist legal work. We treat AI processing as a privacy-sensitive operation and have engineered the Platform accordingly.

Donna does not sell Personal Information. We disclose Personal Information only in the following circumstances.

• To Subprocessors we engage to host, secure and operate the Platform, including infrastructure, AI inference, email delivery, customer support tooling, payment processing and analytics. Subprocessors act only on our documented instructions, are bound by written contracts with terms no less protective than those we accept under our agreements with Customers, and are listed at /legal/subprocessors.
• To other entities in the Donna corporate group, where applicable, on terms consistent with this policy and the protections required by the Privacy Act and equivalent law.
• To regulators, courts and law-enforcement agencies where required by a law that binds us, by a court or tribunal order, or by an enforceable government request. We assess each request for validity and scope and challenge requests we consider overbroad, unlawful or made under foreign law that does not bind us. Where permitted, we notify the affected Customer before disclosing Customer Data.
• In connection with a corporate transaction, including a financing, merger, acquisition, reorganisation, sale of assets or insolvency event, in which case we will require any successor entity to honour the protections set out in this policy.
• To professional advisers, including external lawyers, accountants, auditors and insurers, under duties of confidence and only as reasonably necessary.
• With your consent or otherwise as we describe to you when collecting the information.

Donna processes and stores Customer Data in Australia only. The Platform runs on Microsoft Azure in Australia East (Sydney), with Australia Southeast (Melbourne) for disaster recovery, and AI inference runs on Azure OpenAI Service in Australia East and on Amazon Bedrock in the AWS Asia Pacific (Sydney) region. Donna does not disclose Customer Data, or the Personal Information within it, to overseas recipients in providing the Platform.

If Donna ever proposed to change this position, it would do so only through the Subprocessor change-notification process described at /legal/subprocessors, and would update this policy and the Data Transfers Addendum before the change took effect.

We take the steps that are reasonable in the circumstances to protect Personal Information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Our technical and organisational measures include:

• encryption of Customer Data in transit using TLS 1.2 or higher and at rest using AES-256, with customer-managed keys available on supported plans;
• tenant isolation and role-based access controls, with least-privilege defaults and mandatory multi-factor authentication for Donna personnel;
• private networking, identity-based service-to-service authentication using managed identities, and a no-stored-secrets posture for the Platform's production infrastructure;
• continuous logging, monitoring, vulnerability management and threat detection, with documented incident response procedures;
• personnel training, background screening to the extent permitted by local law, written confidentiality undertakings, and segregation of duties; and
• regular review and testing, including independent assessments where appropriate, with findings tracked through to remediation.

Further detail is published at /security. No system is impenetrable, and we encourage Authorised Users to choose strong unique passwords, enable multi-factor authentication, and report any suspected compromise to security@bydonna.ai.

We retain Personal Information only for as long as we need it to provide the Platform, to satisfy the purposes described in section 4, or to comply with our legal, regulatory, accounting or audit obligations.

For Customer Data, the relevant retention period is set by the Customer. The firm controls when Spaces are deleted, when accounts are deactivated, and when matters are archived. On termination of the Customer's subscription, Donna will return or delete Customer Data in accordance with the Platform Agreement and the Data Processing Addendum, subject to limited retention required by law.

For information that Donna controls in its own right, we apply retention schedules calibrated to purpose. Account and contractual records are typically retained for the duration of the relationship and for a further seven years to satisfy Australian taxation, corporations and limitation-period requirements. Marketing contact information is retained until the contact unsubscribes or objects, and is reviewed periodically for ongoing relevance. Recruitment records are retained for up to two years after a decision unless the candidate consents to a longer hold.

Where Personal Information is no longer needed for any permitted purpose, we destroy it or de-identify it by reasonable means, in line with APP 11.2 and any equivalent obligation under foreign law.

Your rights depend on where you are and which law applies. The sub-sections below set out the principal rights available to you and how to exercise them. To make a request, contact privacy@bydonna.ai. We will verify your identity, route your request to the right place if a Customer is the controller, and respond within the period required by the applicable law.

Where Donna processes Personal Information on behalf of a Customer (typically all Customer Data within a Space), we will refer your request to that Customer and assist them in responding. Where Donna is the controller, we will respond directly.

We send marketing communications to business contacts about the Donna platform, our events, and product updates. We rely on consent or, where permitted, on the business-to-business basis applicable in the relevant jurisdiction.

Every commercial electronic message we send to an Australian recipient complies with the Spam Act 2003 (Cth) by including clear sender identification, a functional unsubscribe facility, and (where required) consent or an inferred-consent basis. Recipients in the European Union and United Kingdom may rely on the rights set out in Article 21 GDPR and the Privacy and Electronic Communications Regulations. Recipients in the United States may rely on the rights set out in the CAN-SPAM Act and applicable state laws.

You can unsubscribe at any time by using the link in any marketing email or by contacting privacy@bydonna.ai. Unsubscribing from marketing does not stop us from sending operational messages relating to your account, your Customer's subscription, security incidents, or changes to this policy.

We use cookies and similar technologies (such as pixels, software development kits and local storage) on bydonna.ai and within parts of the Platform. Cookies are small data files placed on your device that allow us to recognise your browser. First-party cookies are set by Donna; third-party cookies are set by other providers we engage.

The Platform is a business tool designed for legal professionals and their clients. It is not directed at children, and we do not knowingly collect Personal Information from children under 18 as Authorised Users. The minimum age for registering as an Authorised User is 18.

End Clients who are minors may, occasionally, be invited into a Space by a Customer (for example a parent or guardian acting in a family-law matter on behalf of a child). The Customer is responsible for determining whether to do so, for obtaining any required consent, and for ensuring that the involvement is appropriate. If you believe a child has been added to a Space without proper authority, please contact privacy@bydonna.ai and we will work with the Customer to investigate and remediate.

Donna operates an incident response programme designed to detect, contain, assess and report security incidents promptly. The programme is described in our security documentation at /security and is supported by contractual commitments in our agreements with Customers and Subprocessors.

If we suspect that an incident may amount to an “eligible data breach” under Part IIIC of the Privacy Act, we conduct an expeditious assessment, completing it within 30 days as required by the Notifiable Data Breaches scheme. If the assessment confirms an eligible data breach, we notify the Office of the Australian Information Commissioner and affected individuals as soon as practicable, providing the information required by the Act.

Where we act as processor and the controller is a Customer, our practical commitment is tighter than the statutory floor. We will notify the affected Customer without undue delay and, in any event, no later than 48 hours after we become aware of a personal data breach affecting Customer Data. Our notification will provide the information needed for the Customer to comply with its own obligations, including under Article 33 GDPR. Further detail is set out in the Data Processing Addendum.

Where Donna is the controller and the GDPR or UK GDPR applies, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, except where the breach is unlikely to result in a risk to the rights and freedoms of individuals. We will notify affected individuals where the breach is likely to result in a high risk to those rights and freedoms.

Donna does not use Personal Information to make solely-automated decisions that produce legal effects concerning individuals or that similarly significantly affect them. The Platform produces drafts and analytical Outputs that are reviewed by qualified lawyers before any external use. The lawyer is the principal; the Platform is the silent hand.

From December 2026, APP 1.7 will require APP entities that use Personal Information in substantially automated decisions of a kind covered by the rule to disclose specified information in their privacy policies. We will keep this section under review, and where our practices change so that APP 1.7 applies, we will update this policy before the rule commences.

Under Article 22 GDPR and Article 22 UK GDPR, individuals have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them. Donna does not engage in such processing on its own account. Where a Customer configures the Platform to support a decision of that kind, the Customer is the controller responsible for compliance with Article 22 and for ensuring meaningful human involvement.

We may update this policy from time to time to reflect changes in our practices, in the law, or in the Platform. When we do, we will revise the “Last updated” date at the top. Where the change is material, we will give prior notice through the Platform or by email to Customers, and we will record an archive of prior versions on request.

Continued use of the Platform after a change becomes effective constitutes acceptance of the updated policy, to the extent that acceptance is required and permitted by law.

If you have a question, concern or complaint about this policy or about our handling of Personal Information, please contact us first. We take complaints seriously and will investigate promptly. We aim to acknowledge complaints within five business days and to respond substantively within 30 days, or sooner where required by law.