HoufidaArticle 1 — Introduction and Purpose
Dad Afzar Houshmand Pars Gostar, the provider of Houfida legal software, undertakes to process and protect user information within the framework of applicable laws and regulations, contractual obligations, and this policy.
Houfida is designed to facilitate and bring intelligent tools to the professional work of lawyers, trainee lawyers, and other authorized users. It may process users' identity and professional information, legal documents, court case information, and client-related data. Given the nature of this information, the Company considers confidentiality, restricted access, and prevention of unauthorized data use to be fundamental principles of its services.
This document explains how information is collected, used, processed, retained, transferred, and deleted, and supplements the Houfida Terms of Use.
Article 2 — Definitions
2-1. Company: Dad Afzar Houshmand Pars Gostar, the provider of Houfida software.
2-2. Software: Houfida and its related services.
2-3. User: Any authorized natural or legal person using the software's services.
2-4. User Information: Identity, professional, and account information, and other data related to the user's use of the software.
2-5. Case Information: Information relating to clients, parties to proceedings, court cases, judicial notices, claims, written submissions, court decisions, contracts, and other legal documents and data.
2-6. Processing: Any operation relating to information, including collection, recording, storage, viewing, analysis, transfer, modification, deletion, and anonymization.
2-7. Artificial Intelligence: Software capabilities and modules used in Houfida to analyze data, process documents, extract information, and generate suggestions and legal texts.
2-8. Third-Party Service Providers: Natural or legal persons outside the Company providing services such as hosting, infrastructure, AI processing, security, messaging, or other required technical services.
Article 3 — Types of Information Processed
Depending on the software's enabled features, the services requested, and operational needs, the Company may process the following information:
3-1. Identity and professional information: First and last name, mobile telephone number, email address, information needed for identity verification, lawyer's professional registration number, and related professional information, within what is necessary and the platform's capabilities.
3-2. Account and subscription information: Login information, account settings, subscription type, renewal history, transaction and payment information, and support correspondence.
3-3. Case information and legal documents: Court case information, details of clients and parties to proceedings, judicial notices, claims, written submissions, court decisions, contracts, supporting documents, hearing dates, statutory deadlines, notes, and other content recorded or uploaded by the user in the software.
3-4. Technical and security information: Information necessary to maintain security, detect errors, investigate disruptions, and prevent unauthorized access, including error reports and security events, to the extent actually collected by the platform.
3-5. Information processed by AI: Questions, instructions, documents, and texts that the user supplies to AI features for analysis, summarization, information extraction, or drafting legal texts, and the outputs of that processing.
The Company endeavors to limit information processing to data proportionate to the stated purposes and to avoid collecting unnecessary information, except where a valid legal basis exists.
Article 4 — Purposes of Collecting and Using Information
User information is processed, as applicable and within what is necessary and the relevant permissions, for the following purposes:
1-4. Creating, managing, and securing user accounts;
2-4. Verifying users' identities and professional status within available capabilities and legal authorizations;
3-4. Providing case management, document archiving, judicial notice management, calendar, and deadline reminder services;
4-4. Providing AI features and processing legal documents and texts;
5-4. Providing technical support, correcting errors, and handling user requests;
6-4. Managing subscriptions, payments, and contractual obligations;
7-4. Securing the platform and preventing fraud, misuse, and unauthorized access;
8-4. Evaluating and improving the software's performance within permitted limits and in compliance with this policy;
9-4. Fulfilling legal duties and responding to valid requests from competent authorities.
Article 5 — Ownership of Information and Limits on the Company's Use
Information and documents that users record or upload in the software do not become the Company's property merely because they are entered into the platform. Rights in that information remain with the user or other entitled persons under the relevant laws and agreements.
The Company may use this information only to the extent necessary to provide services, carry out technical processing, offer support, maintain security, and fulfill legal obligations.
This article does not prejudice the Company's intellectual property rights in the software, code, infrastructure, design, or other proprietary software components.
Article 6 — Confidentiality of Professional Information and Court Cases
Information concerning clients, court cases, documents, correspondence, and other legal data made available to Houfida requires protection and restricted access because of its nature.
Within its control and responsibilities, the Company undertakes to:
1-6. Limit employees', contractors', and service providers' access to information to what is necessary to perform their assigned duties.
2-6. Take proportionate measures to ensure confidentiality is observed by persons with access.
3-6. Refrain from selling user information or using confidential case content for advertising.
4-6. Refrain from disclosing case information beyond the authorized purposes of service provision without a legal basis or the necessary permission.
5-6. Take proportionate measures to prevent unauthorized access, disclosure, modification, or deletion of information.
The Company's obligations under this article are independent of the user's legal and professional responsibilities concerning the confidentiality of client information.
Article 7 — Processing Information Using AI
7-1. Houfida may use a combination of in-house AI capabilities and AI processing services supplied by third parties to provide its services.
7-2. Depending on the feature used, the type of request, and the platform's technical architecture, some information submitted by the user may be transferred to third-party infrastructure or services for processing. The types of data transferred, the processing destination, and retention conditions depend on each service's technical structure and the relevant agreements.
7-4. Where a third-party service receives or processes information, that service's terms of use, retention policies, and processing practices may also be relevant within the applicable contractual relationship. Before relying on any service, the Company must review its confidentiality and data-use conditions in a manner proportionate to the sensitivity of the information.
7-5. Using user information to train, evaluate, or improve AI models is distinct from the processing necessary to respond to the user's current request and is governed by Article 8 of this policy.
7-6. AI outputs may be incomplete or incorrect and do not replace the user's professional review.
Article 8 — Use of Information to Train or Improve AI Models
8-1. Information, data, requests, feedback, and outputs recorded on the Houfida platform are used to evaluate, train, improve, and develop AI models and capabilities and to increase their accuracy and quality.
Article 9 — Information Storage Locations and Cross-Border Transfers
9-1. The infrastructure used by Houfida may include servers, hosting services, backups, and processing services belonging to the Company or third-party service providers.
9-2. Because the final storage locations for all categories of information and the infrastructure used have not yet been definitively determined, this policy does not commit the Company to storing information exclusively in Germany or in any other particular country.
9-3. Depending on the technical architecture and services used, some information may be processed or stored on infrastructure outside Germany. Before activating or using such infrastructure, the Company will examine the legal requirements relating to data transfer and processing, confidentiality obligations, and risks associated with third-party access.
9-4. The Company endeavors to identify and document the locations where information is stored and processed, the service providers involved, and the conditions for data transfers, to an extent appropriate to the type of service.
Article 10 — Connections to Official Source Systems
If a connection to authorized official judicial systems or other official source systems is enabled, information will be received and processed only within the available technical capabilities.
The Company takes proportionate measures to restrict access to and protect information received from official source systems.
Users' login and authentication information must be managed in accordance with the security requirements and access conditions of the official source system and must not be made available to unauthorized persons.
The inclusion of this article does not confirm the existence of an official connection or actual or permanent access to judicial systems. The extent of access and processing is subject to the relevant authorizations and technical conditions.
Article 11 — Sharing Information with Third Parties
The Company does not sell user information. Transfers of information to, or access by, third parties are possible only in the following circumstances, within what is necessary and the required permissions.
a) Hosting, infrastructure, security, AI processing, and technical support providers, to deliver the relevant services;
b) Payment service providers or providers of other necessary services, to the extent of the information required;
c) Competent judicial and legal authorities, where there is a valid request and a legal obligation;
d) Persons whom the user has validly authorized to access or receive the information;
e) Other circumstances in which transfer of information is permitted or required by law.
The Company endeavors to limit transfers of information to third parties to the minimum necessary and, where appropriate, to include confidentiality and information protection obligations in the relevant agreements.
Article 12 — Information Retention and Deletion
Information is retained for as long as necessary to provide services, manage the account, maintain security, fulfill contractual obligations, or comply with legal requirements.
When retention is no longer necessary, information will, as applicable, be deleted, anonymized, or removed from operational access, unless retention is required by law or to address disputes and valid claims.
If a subscription ends or account deletion is requested, the Company will determine how the information is to be handled in accordance with its operational procedures and legal requirements.
Deleting an account does not necessarily mean that all backups, transaction records, or information retained on a valid legal basis will be deleted immediately. Retention periods for these categories depend on their nature, the platform's technical structure, and the relevant requirements.
Article 13 — Information Security and Incident Response
The Company takes appropriate technical and organizational measures to protect data in proportion to the nature of the services and the sensitivity of the information. Depending on the platform's actual structure, these measures may include access-level management, protection of login information, encryption, security event logging, backups, and assessment of technical vulnerabilities.
If the Company becomes aware of a security incident affecting user information, it will, within legal requirements and operational capabilities, take the customary measures necessary to contain the incident, reduce its effects, and provide notice through appropriate communication channels.
No system is completely immune to every security threat. However, this does not remove the Company's obligation to take proportionate measures and fulfill its legal and contractual responsibilities.
Article 14 — User Rights
Within the law and subject to third-party rights, users may make the following requests:
1. Information about the main categories of information processed and the purposes of processing;
2. Access to information relating to themselves, to the extent permitted;
3. Correction of inaccurate or incomplete information;
4. Deletion of information or restriction of its processing, where permitted;
5. Closure of their account and determination of how the associated information is to be handled;
6. Withdrawal of consent where processing is based on consent and withdrawal is legally possible.
Requests relating to information about clients or other third parties may require verification of the necessary authority and legal permissions.
The Company will review user requests and, where a justified legal or technical limitation exists, explain, to the extent permitted, why the request cannot be fulfilled in full.
Article 15 — Users' Responsibilities for Third-Party Information
Before recording or uploading information about clients or other third parties, users must have the necessary authority and permissions under the law and their professional obligations.
Users must refrain from uploading information they are not authorized to disclose or process and must observe confidentiality considerations when using AI features, sharing documents, or granting access to others.
The user's responsibility in this regard does not remove the Company's independent responsibility to protect information in its possession or under its control.
Article 16 — Changes to the Privacy Policy
The Company may update this policy because of legal changes, service development, or revisions to technical processes.
The updated version will be published on the Houfida website or user interface, together with its revision date.
If changes materially alter the purposes or methods of information processing, the Company will, as appropriate, provide the necessary notices or obtain consent and legal permissions.
Article 17 — Contact Information
Company name: Dad Afzar Houshmand Pars Gostar
Trade name: Dahoup
Software name: Houfida
Official website: houfida.com
Article 18 — Governing Law
This policy is interpreted and applied within the framework of the applicable laws and regulations of Germany. The competent German courts have jurisdiction over disputes arising from a breach of this document.
Dad Afzar Houshmand Pars Gostar
Houfida Legal Software