This Privacy Policy describes how Swancrest Limited ("CrestDex", "we", "us", or "our") handles information in connection with the CrestDex platform ("the Platform"). We are committed to protecting the privacy and confidentiality of the law firms and individuals who use our services. Please read this policy carefully. If you have questions, contact us at privacy@crestdex.com.
Who This Policy Applies To
This policy applies to:
- Administrators and staff members of law firms and legal practices that subscribe to CrestDex ("Subscriber Users").
- Visitors to the CrestDex website (crestdex.com and its subdomains).
- Individuals whose personal data may appear in the Platform in the course of legal matter management — for example, clients, counterparties, and witnesses whose details are recorded by a subscribing firm. Swancrest is not the primary data controller for these individuals; the subscribing firm is. Please contact your law firm directly if you wish to exercise rights in respect of data they hold about you.
Our Data Architecture
The most important thing to understand about CrestDex: your firm's matter data, client records, and documents are stored exclusively in your own Microsoft 365 SharePoint environment. Swancrest has no access to this data — not during your subscription and not after it ends. We are not a data processor in respect of your client or matter data.
What Swancrest does hold is a minimal set of configuration data — the technical settings needed to route your users to the right instance and connect the Platform to your SharePoint environment. This is described in detail in section 3 below.
This architecture means that the Kenya Data Protection Act, 2019, obligations for client data sit with you as the subscribing firm, not with Swancrest. We are the data controller only for the configuration data we hold about your firm.
Information We Collect
Swancrest collects and holds only the minimum data necessary to operate the Platform.
Firm configuration data — what we hold:
Website visitors — when you visit crestdex.com, we may collect standard web server logs (IP address, browser type, pages visited, referrer) through our hosting provider. We do not use advertising trackers or sell this data.
What we do not collect or hold:
- Client records, matter data, or documents created or uploaded through the Platform.
- Email correspondence routed through the Platform.
- Any personal data entered into SharePoint lists by Platform users.
- User passwords or authentication credentials.
Authentication and Microsoft 365
The Platform uses the Microsoft Identity Platform (Azure Active Directory) for authentication. When you sign in, your identity is verified by Microsoft using your organisation's Microsoft 365 credentials. Swancrest receives a standard authentication token from Microsoft confirming your identity and organisational membership. We do not receive, process, or store your password at any point.
Your use of Microsoft services in connection with the Platform is also governed by Microsoft's privacy policy, available at privacy.microsoft.com. Microsoft is an independent data controller in respect of its own services.
How We Use Information
The configuration data we hold is used solely to:
- Route your firm's users to the correct isolated instance of the Platform.
- Direct the authentication flow to your firm's Microsoft 365 tenant.
- Connect the Platform's interface to your firm's SharePoint environment to read and write data on behalf of the authenticated user.
- Communicate with your firm's administrator regarding onboarding, support, and service notices.
- Investigate and respond to security incidents or reported issues.
We do not use Subscriber data for marketing, analytics, product improvement (beyond aggregated, non-identifying operational metrics), or any purpose not directly necessary to provide the Platform. We do not sell, rent, or share your information with third parties for their own purposes.
Legal Basis for Processing
Under the Kenya Data Protection Act, 2019, Swancrest processes firm configuration data on the following legal bases:
Disclosure of Information
Swancrest does not disclose your configuration data to third parties except in the following circumstances:
Data Storage and Security
Firm configuration data is stored in Microsoft Azure Table Storage, hosted on Microsoft's cloud infrastructure. All data in transit between your browser and the Platform, and between Platform components, is encrypted using TLS 1.2 or higher. Access to configuration data is restricted to Swancrest's operational systems and authorised personnel, on a need-to-know basis.
Swancrest follows Microsoft's security best practices for Azure-hosted applications and applies appropriate technical and organisational measures to protect configuration data against unauthorised access, disclosure, alteration, or destruction.
Your firm's matter data and client records in SharePoint are protected by Microsoft's security infrastructure and by your firm's own Microsoft 365 security and access controls. Swancrest has no ability to access, modify, or delete that data.
In the event of a data security incident affecting configuration data we hold, we will notify affected Subscribers as required by applicable law, including the Kenya Data Protection Act, 2019.
Data Retention
Firm configuration data is retained for the duration of the active subscription and for a period of up to twelve (12) months following termination, for administrative, audit, and legal purposes. Following that period, or upon written request from a former Subscriber, we will delete configuration data from our systems within a reasonable time.
Matter and client data stored in your firm's SharePoint environment is entirely within your firm's control. Swancrest has no role in its retention or deletion. On termination of your subscription, your SharePoint data is unaffected.
Website server logs are retained for a period consistent with our hosting provider's standard practices, and are used solely for security and operational purposes.
Cookies and Tracking
The CrestDex marketing website (crestdex.com) may use a small number of functional cookies necessary for the site to operate (for example, to remember preferences or maintain session state). We do not use advertising or behavioural tracking cookies on the marketing site.
The Platform application itself (yourfirm.crestdex.com) uses session cookies issued by the Microsoft Identity Platform as part of the authentication flow. These are technically necessary for the authenticated session to function and are governed by Microsoft's cookie and privacy practices.
We do not use third-party analytics platforms (such as Google Analytics) that would transmit your usage data to third-party advertising networks.
Your Rights
Under the Kenya Data Protection Act, 2019, you have the following rights in relation to personal data Swancrest holds about you:
To exercise any of these rights, please contact us at privacy@crestdex.com. We will respond within the timeframes required by applicable law. We may need to verify your identity before acting on a request.
For personal data held in your firm's SharePoint environment, please contact your firm's administrator, as that data is under your firm's control and Swancrest cannot access, modify, or delete it.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in the Platform, our data practices, or applicable law. We will notify Subscriber administrators of material changes by email. The effective date at the top of this page will be updated to reflect the date of the most recent revision. We encourage you to review this policy periodically.
Contact
For privacy-related enquiries, requests to exercise your rights, or to report a concern, please contact our privacy team at:
Swancrest Limited — Privacy
Email: privacy@crestdex.com
Nairobi, Kenya
You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya if you believe we have not handled your data in accordance with applicable law.