Who we are
Privacy notice: the use of Personal Data
We are regulated by the UK General Data Protection Regulation alongside the Data Protection Act 2018 (UK-GDPR) and we are responsible as controller of personal data for the purposes of UK-GDPR. Please read this privacy notice carefully as it contains important information on how and why we collect, store, use and share your personal information, your rights in relation to it, and on how to contact us and our supervisory authorities in the event you have a complaint. In this notice the following terms are used;
- “Personal Data”: means any information relating to an identified or identifiable individual; and
- “Special Category Personal Data”; information relating to your racial or ethnic origin, political opinions, religious beliefs, philosophical beliefs or trade union membership, genetic and biometric data, and data that concerns your health, sex life or sexual orientation.
The personal information we may collect from you
We may require certain data from you to enable us to act for you. If you do not provide it, it may delay or prevent us from providing services to you. That data may include:
- Your personal information (name, address, telephone number, date of birth, passport and driving licence details);
- Information relating to the matter in which you are seeking our advice or representation;
- Information to enable us to undertake a credit or other financial checks on you;
- Your financial details (e.g. the source of your funds if you are instructing on a purchase transaction your National Insurance and tax details, your bank or building society details, pension details).
- Details of your family (e.g. spouse/partner and dependants or other family members if you instruct us on a probate matter or a will);
- Your employment details (including for example salary and benefits, records of sickness and attendance, performance, disciplinary, conduct and grievances if you instruct us on an employment matter);
- Information about your use of our IT, communication and other systems;
- Your personal details (racial or ethnic origin, gender and sexual orientation, religious or similar beliefs and trade union membership if you instruct us on a discrimination claim for instance).
How your personal data is collected
We collect most of this information from you, directly or indirectly. However, we may also collect information from other sources, such as:
- publicly accessible sources such as Companies House or HM Land Registry;
- directly from a third party, e.g. credit reference agencies;
- from a third party with your consent, e.g. your bank or building society, or other financial institution or adviser;
- other professionals we may engage in relation to your matter;
- your employer and/or trade union, professional body or pension administrator;
- your doctor, and other medical and occupational health professionals;
- from our website and via our information technology systems (e.g. our case management, time recording and email systems, and telephone recordings by us.
How and why we use your personal data
We can only use your personal data if we have a valid reason for doing so. Those reasons include:
- to comply with our legal and regulatory obligations;
- to facilitate the performance of our contract with you, to deal with your enquiry or to take steps at your request before entering into a contract;
- where you have given consent;
- for our legitimate interests or those of a third party (a legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests).
We may use your data in the following ways, and for the following reasons;
- to conduct checks to identify you and verify your identity (to comply with professional, legal and regulatory obligations that apply to our business, or rules issued by our professional regulator and providing information relating to audits, enquiries or investigations by regulatory bodies).
- to deal with your initial enquiry and provide legal services to you, to process your request to be subscribed to our mailings, ensuring business policies are adhered to, e.g. policies covering security and internet use ensuring the confidentiality of commercially sensitive information (for our legitimate interests or those of a third party, and to comply with our legal and regulatory obligations).
- To prevent unauthorised access and modifications to systems (for our legitimate interests or those of a third party, i.e. to prevent and detect criminal activity that could be damaging for us and for you, and to comply with our legal and regulatory obligations).
- To update and enhance client records (for the performance of our contract with you or to take steps at your request before entering into a contract, and to comply with our legal and regulatory obligations, and for our legitimate interests making sure that we can keep in touch with our clients about existing and new services).
- To ensure safe working practices, staff administration and assessments (to comply with our legal and regulatory obligations, and for our legitimate interests or those of a third party to make sure we are following our own internal procedures and working efficiently so we can deliver the best service to you).
- To undertake credit reference checks via external credit reference agencies (for our legitimate interests or those of a third party, for credit control and to ensure our clients are likely to be able to pay for our services).
- To undertake external audits and quality checks for quality accreditations such as Lexcel and the audit of our client and office accounts (for our legitimate interests or those of a third party to maintain our accreditations, and to comply with our legal and regulatory obligations).
- We may use your special category personal data in certain circumstances, for example where processing is necessary for the establishment, exercise or defence of legal claims in order to comply with our legal and regulatory obligations and for our legitimate interests in the performance of our contract with you.
We may use your personal data to send you updates (by email or post) about legal developments that might be of interest to you or information about our services. We have a legitimate interest in processing your personal data for promotional purposes. Where consent is needed, we will ask for this separately and clearly. We will never share it with other organisations for marketing purposes unless you have specifically consented to this. You have the right to opt out of receiving promotional communications at any time by emailing us using the ‘unsubscribe’ link in emails you receive from us. We may ask you to confirm or update your marketing preferences if you instruct us to provide further services in the future.
Who we share your personal data with
We routinely share personal data with:
- professional advisers who we instruct on your behalf or refer you to, e.g. barristers or other experts;
- other third parties where necessary to carry out your instructions e.g. your mortgage provider, HM Land Registry transaction or Companies House;
- credit reference agencies;
- our insurers and brokers, external auditors and our bank;
- external service suppliers (Note that we only allow our service providers to handle your personal data if we are satisfied they take appropriate measures to protect your personal data. We also impose contractual obligations on service providers to ensure they can only use your personal data to provide services to us and to you).
We may disclose and exchange information with law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations.
Where your personal data is held
Information may be held at our offices and third party agencies, service providers, representatives and agents as described above. None of these third parties are based outside the European Economic Area (EEA).
How long your personal data will be kept
We will keep your personal data after we have finished dealing with your enquiry, advising or acting for you. We will do so to respond to any questions, complaints or claims made by you or on your behalf, and to keep records required by law. When it is no longer necessary to retain your personal data, we will delete or anonymise it.
You have the following rights, which you can exercise free of charge:
- The right to be provided with a copy of your personal data;
- The right to require us to correct any mistakes in your personal data;
- The right to require us to delete your personal data, in certain situations;
- The right to require us to restrict processing of your personal data, in certain circumstances, e.g. if you contest the accuracy of the data;
- The right to receive the personal data you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party, in certain situations;
- The right to object at any time to your personal data being processed for direct marketing (including profiling). In certain other situations you have the right to object to our continued processing of your personal data, e.g. processing carried out for the purpose of our legitimate interests;
- The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you.
For further information on each of those rights, including the circumstances in which they apply, please contact us. If you would like to exercise any of those rights, please make a written data subject request by email, call or write to us.
Keeping your personal information secure
We have appropriate security measures in place to prevent personal information from being accidentally lost, or used or accessed in an unauthorised way. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality. We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.
Organisation Diversity Data
We are required by the Solicitors Regulation Authority (SRA) to collect, report and publish data annually on the diversity make-up of our workforce. All our staff completed an Equality and Diversity Questionnaire in December 2016. An anonymised summary report of the data collated is available free of charge upon request.
How to complain
Our Data Privacy Manager is David Vaughan-Birch, who can be contacted at firstname.lastname@example.org or by telephone: 01782 525014.
The General Data Protection Regulation also gives you right to lodge a complaint with a supervisory authority, in particular in the European Union (or European Economic Area) state where you work, normally live or where any alleged infringement of data protection laws occurred. The supervisory authoring in the UK is the Information Commissioner who may be contacted at https://ico.org.uk/concerns/ or telephone: 0303 123 1113.
Changes to this privacy notice
This privacy notice was published on 23 January 2020.
How to contact us
Please email us at email@example.com if you have any questions about this privacy notice or the information we hold about you.