Legal
Marshall — Personal Information Collection Statement
This statement is given under the Personal Data (Privacy) Ordinance (Cap. 486) of the Hong Kong Special Administrative Region (the “Ordinance”). It explains what personal data Marshall collects, why it is collected, to whom it may be transferred, how long it is kept, and how you may exercise your rights of access and correction. It supplements, and does not replace, Clauses 8 to 11 of the Terms and Conditions of Service (the “Terms”), and capitalised terms used here have the meanings given there.
1. DATA USER
1.1 The data user is Lion Rock Intelligence Limited, a company registered in Hong Kong, which operates the Marshall platform (“Marshall”, “we”).
1.2 Where a Subscriber uploads personal data of its clients, opposing parties, witnesses or other third parties, the Subscriber remains the data user in respect of that material and Marshall processes it on the Subscriber's behalf and on its instructions, for the purpose of providing the Service.
2. PERSONAL DATA WE COLLECT
2.1 Account data. The name, email address, username, organisation and role recorded for each Account; authentication data, including a password stored in hashed form and, where enabled, multi-factor authentication settings and recovery codes.
2.2 Usage and security data. Sign-in events, session records, administrative actions, request timings, credit consumption and audit-log entries. These record actions and bounded metadata, not the content of documents or questions.
2.3 Customer Content. Anything an Authorised User submits: research questions, matter descriptions, client names and references, party and opposing-party names, action numbers, key dates, uploaded documents and their text, notes, and the Output generated from them. Customer Content routinely contains personal data of persons who are not users of the Service, and may be subject to legal professional privilege.
2.4 Support and feedback data. Correspondence with support, and screenshots or descriptions submitted with a feature request.
3. PURPOSES OF COLLECTION
3.1 Personal data is collected and used for the following purposes: (a) creating and administering Accounts and verifying eligibility under Clause 2 of the Terms; (b) authenticating users and securing the Service, including the detection and investigation of abuse and security incidents; (c) providing the Service, including generating Output, retrieving authorities, analysing documents and producing exports; (d) metering credits, billing and account administration; (e) providing support and responding to enquiries and feature requests; (f) maintaining audit and accountability records; and (g) complying with legal, regulatory and professional obligations.
3.2 It is obligatory to supply the data at clause 2.1 above. Without it an Account cannot be created and the Service cannot be provided.
3.3 Marshall does not sell personal data, and does not use Customer Content for direct marketing.
4. CLASSES OF TRANSFEREES
4.1 Personal data may be transferred to the following classes of transferee: (a) the Model Provider engaged to generate Output; (b) the transactional email service used to deliver sign-in and notification messages; (c) the web-search service and the official and institutional legal databases queried when a question calls for live retrieval; (d) the hosting and backup providers on whose infrastructure the Service runs; (e) Marshall's own personnel to whom access is necessary, and its professional advisers; and (f) a court, regulator or authority where disclosure is legally required, subject to Clause 8.4 of the Terms.
4.2 The specific third parties in each class, and exactly what each one receives, are named in the subprocessor notice, which forms part of this statement. Practitioners should read it before submitting confidential or privileged material.
4.3 Questions sent to a search service or a legal database are reduced to derived keyword terms — citations, statutory references, terms of art and dates — before they leave the platform. The subprocessor notice describes this in detail.
5. TRANSFER OUTSIDE HONG KONG
5.1 Generating Output and hosting the Service involve processing personal data outside Hong Kong, as described in Clause 11 of the Terms and in the subprocessor notice. Marshall takes all reasonably practicable steps to ensure that such data is protected to a standard no less protective than that applying under the Terms.
6. RETENTION
6.1 Personal data is kept only for as long as is necessary for the purposes at clause 3. The periods applying to each kind of data — including documents, conversations, derived working data, operational aggregates, audit records and encrypted backups — are set out in the data retention schedule, which states the platform's actual behaviour, including its current limits.
6.2 Deletion removes material from live storage at once. Copies held in encrypted backups persist until those backups expire on the cycle described in that schedule.
7. ACCESS AND CORRECTION
7.1 Under sections 18, 22 and 38(i) of the Ordinance you have the right to request access to, and correction of, your personal data, and to be informed whether Marshall holds personal data of which you are the data subject. Marshall may charge a fee for complying with a data access request, as permitted by section 28 of the Ordinance.
7.2 An access or correction request should be made in writing to the contact at clause 8. Marshall will respond within 40 days of receiving the request, as required by the Ordinance.
7.3 Where the personal data concerned is Customer Content uploaded by a Subscriber, the Subscriber is the data user and Marshall will refer the request to the Subscriber, and will assist the Subscriber in responding to it. Requests about a Subscriber's client, an opposing party or a witness should be addressed to the Subscriber, not to Marshall.
7.4 An Authorised User may also ask their own administrator to correct or delete Account data and matter material directly in the Service.
8. HOW TO CONTACT US
8.1 Data access and correction requests, and any question about this statement, should be addressed to the Privacy Compliance Officer, Lion Rock Intelligence Limited, by email to hello@marshall.com.hk.
8.2 Postal address: Lion Rock Intelligence Limited, 2/F., Tern Centre Tower 1, 237 Queen's Road Central, Hong Kong. Requests may also be sent by email to the address at clause 8.1.
9. CHANGES TO THIS STATEMENT
9.1 Marshall may update this statement from time to time. The version in force is the one published at this address, and material changes are notified in accordance with Clause 23 of the Terms.