In pursuance of your claim, by making an enquiry about pursuing a claim, by applying for a position with us or by engaging with us on social media, by telephone or via our websites, personal data about you will be held by Your Lawyers Limited (“YLL”) of 18 Prospect House, Colliery Close, Staveley, Chesterfield, S43 3QE, and we shall determine the purpose and means by which that personal data is processed. We are a data controller within the meaning of the Data Protection Act 2018 (’DPA’), the UK General Data Protection Regulation (‘UK GDPR’) and the General Data Protection Regulation 2018 (’EU GDPR’). The firm has a dedicated Data Protection Officer, Martyn Steele.
Reference in this notice to GDPR refers to both UK GDPR AND EU GDPR unless otherwise stated.
This document explains our role as a data controller and the personal data that will be processed in pursuance of your claim.
The GDPR provides the following rights for individuals:
It is important to note that the rights available to you under the GDPR depend upon the lawful bases for which we process the personal data. As such, not all rights are available to you.
This document explains your rights and explains about the collection and use of your personal data.
We reserve the right to update this Privacy Information Notice periodically. You should check this policy on a regular basis to ensure you are aware of the most recent version. A copy of the policy is available via our website.
What is Personal Data?
The GDPR applies to ‘personal data’ meaning any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier.
This definition provides for a wide range of personal identifiers to constitute personal data, including name, identification number, location data or online identifier, reflecting changes in technology and the way organisations collect information about people.
The GDPR applies to both automated personal data and to manual filing systems where personal data are accessible according to specific criteria. This could include chronologically ordered sets of manual records containing personal data.
Personal data that has been pseudonymised – e.g. key-coded – can fall within the scope of the GDPR depending on how difficult it is to attribute the pseudonym to a particular individual.
The GDPR refers to sensitive personal data as “special categories of personal data”. The special categories specifically include genetic data, and biometric data where processed to uniquely identify an individual.
Consent and your Contractual Obligation to provide the Personal Data
By instructing us to pursue a legal claim on your behalf, it is a term of our agreement with you that you are agreeing for us to collect personal data about you which we shall process in pursuance of your claim. We are unable to meet our contractual obligations to you without collecting and processing your personal data. A failure by you to provide the personal data which we require in order to meet our contractual obligations to you (or withdrawal of your consent for us to collect and process your personal data) will leave you in breach of the agreement you have with us with the effect that you will be liable for, and we will seek payment of, our fees from you as set out within our terms and conditions.
By contacting us/enquiring/instructing/engaging with us on social media, by telephone or via our websites in relation to the legal services that we offer, you are agreeing to us contacting you by post, telephone, email, direct messaging (and any other form of social media messaging) and SMS in relation to your enquiry, your legal claim and in relation to the services that we offer and those of other companies that we work with. You can opt-out of receiving contact from us in relation to the services that we offer and those of other companies that we work with at any time by providing us with notice either verbally or in writing.
Engaging with us on one of our social media platforms, including liking/following our pages may, result in the collection and transmission of your personal data to the social media company. Social media companies will have separate policies on how they collect and use your personal data and you are encouraged to review those policies before engaging with us on our social media platforms, including liking/following our pages.
By applying for a position with YLL, you are providing your consent for us to process your data as part of the recruitment application process.
Purposes for Processing Personal Data
For legal claims/enquiries, the purpose for which your personal data is processed is the pursuance of your legal claim/consideration of the merits of representing you in relation to a legal claim. We are unable to fulfil our contractual obligations to you (providing legal services) without processing your personal data.
In order to pursue a legal claim, we are required to collect and process personal data in order to pursue the claim. The personal data collected is limited to that which is required for us to fulfil our contractual obligations to you. We collect personal data in accordance with the applicable data protection laws and our other statutory obligations. The processing of your personal data is necessary to establish and exercise a legal claim. This may include processing categories of sensitive information, outlined in this document, particularly when pursuing a claim for personal injury as this will often involve the obtaining of certain classes of records- medical records, for example.
Your personal data will also be held when you contact us in contemplation of pursuing a legal claim, whether or not the claim proceeds. For all enquiries where we do not subsequently represent you, your personal data will be retained by us in accordance with our retention policy. Our reason for retaining such information is in order to defend any legal claim pursued against us.
Your personal data will also be held by us when you engage with us on one of our social media platforms. Engaging with us on one of our social media platforms, including liking/following our pages may result in the collection and transmission of your personal data to the social media company. Social media companies will have separate policies on how they collect and use your personal data and you are encouraged to review those policies before engaging with us on our social media platforms, including liking/following our pages. If you follow, like or comment on any of our social media pages or posts, we may contact you via direct messaging (or another form of messaging as that platform allows) about the services that we offer. Unless you contact us further, our processing of your data in such a situation will be limited to sending you a direct message (or other form of message as available on that platform). You have the right to opt out of receiving such messages as explained below.
In accordance with The Privacy and Electronic Communications (EC Directive) Regulations 2033 we may contact you by electronic means with regards to the services that we offer. You have the right to withdraw your consent and opt out of receiving electronic communications from us pertaining to our services. Further, we have a legitimate interest in retaining your data in order to contact you, by non-electronic means, with regards to the services that we offer and those of that we work with. You have the right to opt out of receiving non-electronic marketing communications from us pertaining to our services and/or those of other companies that we work with.
For applicants, the purpose of our processing your data is to further your application for employment with YLL.
Lawful Basis for Processing Personal Data
For legal claims, there are two main lawful bases for which we shall process personal data: contract and legitimate interest.
Contract
By providing instructions for us to act and represent you in relation to your claim, you have entered into a contract with us for legal services. We need to process your personal data in order to fulfil our contractual obligations to you; that is in order to represent you in pursuance of your claim. The processing of personal data in pursuance of a claim is necessary and the contract cannot be fulfilled in absence of processing personal data. It is a term of the agreement that we have with you that you agree for us to collect personal data about you which we shall process in pursuance of your claim.
Legitimate Interest
We have a legitimate interest in processing your personal data in pursuance of your claim. A claim cannot be pursued without the processing of personal data, as identified above. The personal data which we will process shall be confined to what is reasonably required in pursuance of your claim. The necessity to process personal data in pursuance of a claim is one which cannot be achieved in any other way so as to avoid the need to process personal data.
We have a legitimate interest in retaining your personal data following the settlement of your claim or where a claim does not proceed, in accordance with our retention policy, in order to defend any legal claim that is pursued against us.
In certain circumstances, it may be appropriate to apply to the Court for an anonymity order, but that in itself would not circumvent the need to process your personal data as part of the claims process.
For direct marketing there are two main lawful bases for which we shall process personal data: consent and legitimate interest.
We have a legitimate interest in retaining your personal data in order to contact you, by non-electronic means, with regard to the services that we offer and those of other companies that we work with. You have the right to opt out of receiving, non-electronic, communications from us pertaining to our services and those of other companies that we work with.
We may contact you by electronic means with regards to the services that we offer. Consent is our lawful basis for such contact. You have the right to withdraw your consent and opt out of receiving electronic communications from us pertaining to our services.
For applicants, we rely on your consent in order to enable us to process your application for employment.
The Categories of Personal Data obtained
For legal claims, the personal data that we shall process will vary dependent upon the individual claim that you instruct us to pursue on your behalf. In most cases there will be a standard list of personal data that we will be required to be processed, which includes:
Certain claims will require the processing of additional personal data which may include the obtaining/processing of:
In pursuance of your claim, we may need to process more sensitive personal data, such as medical records. This is known as Special category data. As this personal data is more sensitive, it needs more protection. For example, information about an individual’s:
In order to lawfully process special category data, we must identify both a lawful basis and a separate condition for processing special category data. These do not have to be linked. Our lawful bases are set out above. Our separate condition for processing special category data is for the establishment, exercise or defence of legal claims.
The processing of personal data will be restricted to what is reasonably necessary in pursuance of the claim. We take extra safety measures when processing sensitive data, which includes using recorded/special delivery mail and using password-protected electronic documents and links.
In cases involving children or patients, where a Litigation Friend is appointed, the collection and processing of personal data will include that of the Litigation Friend in addition to the child/patient. Similarly, in cases being pursued on behalf of an Estate or where a Personal/Authorised Representative is instructed, the collection and processing of personal data will include that of the Estate, the deceased and the Personal/Authorised Representative.
For applicants, the level of data generally required to enable us to process your application will be limited to:
It may be that, as part of the application process, you disclose further information to us, such as a medical condition.
We recognise and actively promote the benefits of a diverse workforce. We are committed to treating all employees with dignity and respect regardless of race, gender, disability, age, sexual orientation, religion or belief. We may request data on race, religion, gender and sexual orientation as part of our equal opportunity monitoring. You may refuse to provide such information as part of the application process.
Sending Personal Data To Us
We use Transport Layer Security (TLS) to encrypt and protect email traffic. If your mail server does not support TLS, you should be aware that any emails you send to us may not be protected in transit.
When you send emails, information, documents or any other form of personal data to us, it is your responsibility to ensure that the communication has sufficient protection so as to ensure security of the data. We recommend the use of secure email and file transfer platforms which encrypts the data/message or, alternatively, password protection of the data. We accept no responsibility for emails, information, documents or any other form of personal data being lost or intercepted when in transit to us.
We do not recommend the sending of personal data by post. If you do send personal data by post, we would recommend that the same be sent by Special Delivery. We accept no responsibility for personal data being lost or intercepted when in transit to us.
The Sources of Personal Data
The majority of personal data that we collect is likely to be provided by you. However, in some cases, there will be a requirement for us to collect personal data from other sources in order to pursue your legal claim. For example, in a claim for personal injury, medical records will often be required. Those records are usually held by medical establishments such as your GP surgery, local health authority or hospital. Those records may be obtained by us directly or via the use of a medical agency whom we will hold a contract with in relation to their services. In such circumstances, the medical agency acts as a data processor and is subject to the obligations laid out in the DPA and GDPR for data processors. There may be various other sources of personal data from which we collect personal data in pursuance of a legal claim. Common examples are:
The obtaining of personal data from other sources is limited to that which is reasonably required for us to pursue your legal claim/process your employment application.
The Categories of Recipients of the Personal Data
In pursuance of a legal claim, it will be necessary for various categories of recipients to receive the personal data. The may include, but not be limited to:
The personal data that is processed by us in pursuance of your claim will be limited to that which is reasonably required.
We use an electronic case management system (CMS) for the storage of case information. The CMS stores all of the above personal data in an individual case file and on our servers. The CMS is the product of a third-party company (the CMS provider (CMSP)), not YLL. From time to time, there may be a requirement for the CMSP to access our servers at our, or their, request for the purpose of system upgrades, patches or to perform general maintenance. Further, there may be occasions when personal data is transferred to the CMSP secure servers. Such an occasion will be rare but may, for example, arise as part of a data transfer exercise if we were to transfer claims to another firm of solicitors who use the same CMS. The CMSP has its own obligations under the DPA and GDPR.
We store some personal data on servers owned, operated and maintained by third-party providers. Those providers have their own duties under the DPA and GDPR as data processors. By providing instructions for us to act and represent you in relation to your claim, you are agreeing that we may store and process your personal data in accordance with the lawful bases identified above and in accordance with this notice.
If your claim requires online submission via the Ministry of Justice’s online portal, your personal data will be uploaded and communicated by the electronic portal as prescribed by the relevant pre-action protocols/rules. By providing instructions for us to act and represent you in relation to your claim, you are agreeing that we may process your personal data via the online portal submission in accordance with the lawful bases identified above and in accordance with this notice.
Our offices operate Closed Circuit Television Cameras (CCTV), installed for the purpose of preventing criminal activity and in order to protect our staff and visitors. As such, if you visit our offices, you may be captured on CCTV footage. We operate an audio recording system for telephone calls into and from the office.
The Retention Periods for Personal Data
Personal data may be retained by us for a minimum period of fifteen years following settlement of your claim (including costs). Settlement of your legal claim means that the claim has been finally decided in your favour and your opponent has not appealed, has lost the right to appeal or has exhausted all avenues of appeal. If your claim is lost or discontinued, the retention period will run from the date of the finalisation of the claim, which will include any appeal up to the point where all avenues of appeal have been exhausted and settlement of any costs entitlement to the opponent.
Personal data may be removed from our case management system after case settlement. Such case data will remain secure for at least fifteen years prior to being securely erased, save for the retention of suppressed data as explained below.
These retention periods above apply to any claim/proposed claim which, for whatever reason, we do not pursue on your behalf. Your personal data is retained in these circumstances in order to defend any legal claim which may be pursued against us. The fifteen-year period will commence from the time at which you contact us.
For claims on behalf of minors, the retention period will be fifteen years from the date of majority.
The retention periods for personal data are reasonable based upon the nature of our business. Any claim pursued against us carries with it a six-year limitation period. However, such a claim may be pursued on a date of knowledge basis which may extend beyond the normal limitation period and has a fifteen-year longstop. As such, we have conducted a balancing act between the rights of the individual and our interests in retaining the data. We consider fifteen years to be a reasonable retention period to ensure that our position is not prejudiced in relation to the defence of a legal claim and that, as the impact on the individual will be minimal, the retention periods that we have in place are suitable for all Parties.
Personal data may be retained by us beyond this retention period for the purpose of contacting you in relation to the services that we offer; such contact may be made by us or by agents acting on our behalf. . Your data will be suppressed at the fifteen-year point so that only your contact information remains for the purpose of such contact. You have the right to opt out of receiving such communications, but choosing to opt out of communications relating to the services that we offer, and those of other companies that we work with, does not prevent us from retaining your personal data for fifteen years in accordance with our retention policy.
For applicants who are unsuccessful, your data will be held for a period of fifteen years in order to monitor any future applications that you make to YLL.
The Right of Access
You have the right to access your personal data. This is known as a “subject access request”. You can make a subject access request verbally or in writing.
You have the right to obtain the following from us:
All of the information that forms the “supplementary information” category is contained within this privacy information notice.
You are only entitled to your own personal data, and not to information relating to other people (unless the information is also about you or you are acting on behalf of someone).
In most cases, we will provide a copy of the information to you free of charge if you request the information. However, we can charge a reasonable fee when a request is manifestly unfounded or excessive, particularly if it is repetitive. We may also charge a reasonable fee to comply with requests for further copies of the same information. The fee will be based on the administrative cost of providing the information to you.
If you make a request, the information shall be provided without delay and, at the latest, within one month of receipt. However, we are able to extend the period of compliance by a further two months where requests are complex or numerous. If this is the case, we will inform you within one month of the receipt of the request and explain why the extension is necessary.
Where requests are manifestly unfounded or excessive, in particular because they are repetitive, we can:
Where we refuse to respond to a request, we shall write to you without undue delay, and at the latest within one month, in order to explain why we are refusing your request and informing you of your right to complain to the supervisory authority (the ICO), and of your ability to seek to enforce this right through a judicial remedy.
If we have doubts about the identity of the person making the request, we can ask for more information. We will let you know without undue delay, and within one month, that we need more information from you to confirm your identity. We do not need to comply with the request until we have received the additional information.
The Right to Rectification
You have a right to have inaccurate personal data rectified or completed if it is incomplete.
You can make a request for rectification verbally or in writing and we have one calendar month thereafter to respond to a request.
We can refuse to comply with a request for rectification if the request is manifestly unfounded or excessive, taking into account whether the request is repetitive in nature.
If we consider that a request is manifestly unfounded or excessive we can:
In either case we will write to you in order to justify our decision. The reasonable fee charged will be based on the administrative costs of complying with the request. In circumstances where we consider a reasonable fee is required, we will not comply with the request until we have received the fee.
Where we refuse to respond to a request, we shall write to you without undue delay and at the latest within one month in order to explain why we are refusing your request and informing you of your right to complain to the supervisory authority (the ICO) and of your ability to seek to enforce this right through a judicial remedy.
We can extend the time to respond by a further two months if the request is complex or we have received a number of requests from you. In those circumstances we will let you know without undue delay and within one month of receiving your request and explain why the extension is necessary.
If we have doubts about the identity of the person making the request, we can ask for more information. We will let you know without undue delay and within one month that we need more information from you to confirm your identity. We do not need to comply with the request until we have received the additional information.
The Right to Erasure
The right to erasure is also known as ‘the right to be forgotten’. This right is not absolute and is not available where processing is necessary for the establishment, exercise or defence of legal claims.
Personal data will be erased in accordance with our retention policy.
The Right to Restrict Processing
You have the right to request the restriction or suppression of your personal data. You can make a request for restriction verbally or in writing. It may be that your request prevents us from fulfilling our contractual obligations to you. If we consider that to be the case, we shall contact you to explain the position.
You have the right to request we restrict the processing of your personal data in the following circumstances:
In most cases, we will not be required to restrict your personal data indefinitely, but will need to have the restriction in place for a certain period of time. Further, it may not be possible for us to fulfil our contractual obligations to you in performing legal services on your behalf, if we are subject to a restriction of our processing activities. If we consider this to be the case, we shall write to you explaining our position.
When processing is restricted, we are permitted to store the personal data, but not use it. We must not process the restricted data in any way except to store it unless:
If we have disclosed the personal data in question to others, we will contact each recipient and inform them of the restriction of the personal data - unless this proves impossible or involves disproportionate effort. If asked to, we will also inform you about these recipients.
The GDPR defines a recipient as a natural or legal person, public authority, agency or other body to which the personal data are disclosed. The definition includes controllers, processors and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
In many cases the restriction of processing will only be temporary, specifically when the restriction is on the grounds that:
Once we have made a decision on the accuracy of the data, or whether or not our legitimate grounds override yours, we may decide to lift the restriction. If we do this, we will inform you before we lift the restriction.
We can refuse to comply with a request for restriction if the request is manifestly unfounded or excessive, taking into account whether the request is repetitive in nature. If we consider that a request is manifestly unfounded or excessive we can:
In either case we will write to you in order to justify our decision. The reasonable fee charged will be based on the administrative costs of complying with the request. In circumstances where we consider a reasonable fee is required, we will not comply with the request until we have received the fee.
Where we refuse to respond to a request, we shall write to you without undue delay and, at the latest, within one month in order to explain why we are refusing your request and informing you of your right to complain to the supervisory authority (the ICO) and of your ability to seek to enforce this right through a judicial remedy.
We have one calendar month to respond to a request. However, we can extend the time to respond by a further two months if the request is complex or we have received a number of requests from you. We will let you know within one month of receiving your request and explain why the extension is necessary.
If we have doubts about the identity of the person making the request, we can ask for more information. We will let you know without undue delay and within one month that we need more information from you to confirm your identity. We do not need to comply with the request until we have received the additional information.
The Right to Data Portability
The right to data portability allows you to obtain and reuse your personal data for your own purposes across different services. It allows you to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without affecting its usability.
The right only applies to information you have provided to us.
The right to data portability gives you the right to receive personal data that you have provided to us in a structured, commonly used and machine-readable format. It also gives you the right to request that we transmit this data directly to another data controller.
The right to data portability only applies to personal data. This means that it does not apply to genuinely anonymous data. However, pseudonymous data that can be clearly linked back to you is within scope of the right.
If the requested information includes information about others (e.g. third-party data) we will need to consider whether transmitting that data would adversely affect the rights and freedoms of those third parties.
Providing third party data to you may not be a problem if you provided this data to us within the information that you provided to us in the first place. However, we will need to give careful consideration as to whether there will be an adverse effect on the rights and freedoms of third parties, in particular when we are transmitting data directly to another controller.
If the requested data has been provided to us by multiple data subjects (e.g. a joint bank account) we need to be satisfied that all parties agree to the portability request. This means that we may have to seek agreement from all the parties involved.
The right to data portability entitles you to:
You have the right to receive your personal data and store it for further personal use.
We can achieve this by either:
This does not create an obligation on us to allow you more general and routine access to our systems – only for the extraction of their data following a portability request.
If your personal data is transported, the data will be retained by us in accordance with our retention policy.
You have the right to ask us to transmit your personal data directly to another controller without hindrance. Without hindrance means that we should not put in place any legal, technical or financial obstacles which slow down or prevent the transmission of the personal data to you, or to another organisation. However, there may be legitimate reasons why we cannot undertake the transmission. For example, if the transmission would adversely affect the rights and freedoms of others. It is however our responsibility to justify to you why these reasons are legitimate and why they are not a ‘hindrance’ to the transmission.
If we provide information directly to you or to another organisation in response to a data portability request, we are not responsible for any subsequent processing carried out by you or the other organisation. We are responsible for the transmission of the data and will take appropriate measures to ensure that it is transmitted securely and to the right destination. If we provide data to you, it is possible that you will store the information in a system with less security than ours. You should ensure that any system that you store information on has adequate security.
When we receive personal data that has been transmitted as part of a data portability request, we will process this data in line with data protection requirements.
In deciding whether to accept and retain personal data, we will consider whether the data is relevant and not excessive in relation to the purposes for which we will process it. We shall also consider whether the data contains any third-party information.
We can refuse to comply with a request for restriction if the request is manifestly unfounded or excessive, taking into account whether the request is repetitive in nature. If we consider that a request is manifestly unfounded or excessive we can:
In either case we will write to you in order to justify our decision. The reasonable fee charged will be based on the administrative costs of complying with the request. In circumstances where we consider a reasonable fee is required, we will not comply with the request until we have received the fee.
Where we refuse to respond to a request, we shall write to you without undue delay and at the latest within one month in order to explain why we are refusing your request and informing you of your right to complain to the supervisory authority (the ICO) and of your ability to seek to enforce this right through a judicial remedy.
We have one calendar month to respond to a request. However, we can extend the time to respond by a further two months if the request is complex or we have received a number of requests from you. We will let you know within one month of receiving your request and explain why the extension is necessary.
If we have doubts about the identity of the person making the request we can ask for more information. We will let you know without undue delay and within one month that we need more information from you to confirm your identity. We do not need to comply with the request until we have received the additional information.
The Right to Object
Under the GDPR, you have the right to object to the processing of your personal data. This effectively allows you to ask us to stop processing your personal data.
However, the right to object only applies in certain circumstances. Whether it applies depends on our purposes for processing and our lawful bases for processing.
You can object if the processing is for:
In these circumstances, the right to object is not absolute and you must give specific reasons why you are objecting to the processing of your data. These reasons should be based upon your particular situation. In these circumstances, we can continue processing if:
If we are satisfied that we do not need to stop processing the personal data in question, we will write to you in order to let you know. We will explain our decision and inform you of your right to make a complaint to the ICO, or another supervisory authority, and of your ability to seek to enforce your rights through a judicial remedy.
Where we have received an objection to the processing of personal data and we have no grounds to refuse, we will stop processing the data. This may mean that we need to erase personal data as the definition of processing under the GDPR is broad, and includes storing data. However, this will not always be the most appropriate action to take. Erasure may not be appropriate if we process the data for other purposes as we need to retain the data for those purposes.
If we are processing data for scientific or historical research, or statistical purposes, the right to object is more limited.
You have the absolute right to object to the processing of your personal data if it is for direct marketing purposes. However, this does not automatically mean that we need to erase your personal data and in most cases it will be preferable to suppress your details. Suppression involves retaining just enough information about you to ensure that your preference not to receive direct marketing is respected in future.
We can refuse to comply with a request for restriction if the request is manifestly unfounded or excessive, taking into account whether the request is repetitive in nature. If we consider that a request is manifestly unfounded or excessive we can:
In either case we will write to you in order to justify our decision. The reasonable fee charged will be based on the administrative costs of complying with the request. In circumstances where we consider a reasonable fee is required, we will not comply with the request until we have received the fee.
Where we refuse to respond to a request, we shall write to you without undue delay and at the latest within one month in order to explain why we are refusing your request and informing you of your right to complain to the supervisory authority (the ICO) and of your ability to seek to enforce this right through a judicial remedy.
We have one calendar month to respond to a request. However, we can extend the time to respond by a further two months if the request is complex or we have received a number of requests from you. We will let you know within one month of receiving your request and explain why the extension is necessary.
If we have doubts about the identity of the person making the request we can ask for more information. We will let you know without undue delay and within one month that we need more information from you to confirm your identity. We do not need to comply with the request until we have received the additional information.
Rights in relation to automated decision making and profiling.
The GDPR has provisions on:
The nature of our business activities does not involve either of the above. If we intended to process your personal data in relation to either automated decision making or profiling, we would write to you in advance of the same to explain our position.
The Right to lodge a complaint with a Supervisory Authority
You have the right to lodge a complaint with the Information Commissioner’s Office (“ICO”). The ICO is the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
Rights in relation to Transfers of the Personal Data to any Third Countries or International Organisations
From time to time, we may engage with the services of a US company named MailChimp which provides email services. Your personal data may be shared with MailChimp in progression of your claim. MailChimp has its own duties and responsibilities under the UK and EU GDPR and, as a US company, is subject to stringent levels of data protection. Its user agreements have Standard Contractual Clauses contained within which ensures that the level of protection afforded to personal data is of a high standard as to be expected by the DPA and GDPR. By instructing us you are agreeing for us to use the services of MailChimp if we consider it appropriate to do so. You may contact us to tell us that you do not wish for us to use MailChimp at any time.
We offer a LiveChat facility on our websites. LiveChat is a US-based company which has its own duties and responsibilities under the GDPR and, as a US company, is subject to stringent levels of data protection. Information provided by you via the LiveChat facility will be collected and processed by us under our lawful bases for processing personal data. If you do not wish for your data to be collected via LiveChat, please do not use the LiveChat facility.
We use an internal application named Basecamp to store information relevant to the firm. The firm’s Basecamp profile is only accessible to employees of the firm. It may be that some personal data is stored on Basecamp. Basecamp’s user agreements have Standard Contractual Clauses contained within which ensures that the level of protection afforded to personal data is of a high standard as to be expected by the DPA and GDPR.
We utilise social media platforms in the course of our business. Engaging with us on one of our social media platforms, including liking/following our pages, may result in the collection and transmission of your personal data to the social media company. Social media companies will have separate policies on how they collect and use your personal data and you are encouraged to review those policies before engaging with us on our social media platforms, including liking/following our pages.
The Internet is a global medium and your information may therefore be transferred outside the European Economic Area (EEA) en route. Your information may be transferred to any country, including countries outside the EEA where the transfer is necessary for the purposes of establishing, exercising or defending legal rights, obtaining legal advice, or in connection with any legal proceedings.
Accountability and Governance
We take data protection and protecting your data extremely seriously. Our contact details together with details of our Data Protection Officer are contained within this document. Should you feel the need to make a complaint in relation to any aspect related to the processing of your personal data, you can do so via the firm’s Complaint Handling Procedure. Any complaint will be investigated by our Complaints Manager and Data Protection Officer and a full response will be provided within the timescales set out in our Complaints Handling Policy.
You can contact us with any concerns about matters relating to personal data at the following email address: dataprotection@yourlawyers.co.uk.
We have in place and implement comprehensive but proportionate processes, policies, records and logs for handling personal data, including keeping records of what we do and why. Our combined approach ensures compliance with the DPA and GDPR in accordance with our duties as a data controller. We ensure that our staff are fully aware and comply with the processes, policies, records and logs when processing data.
We implement technical and organisational measures to ensure, and demonstrate, compliance with the DPA and GDPR in accordance with our duties as data controller. Those measures are risk-based and proportionate and are reviewed and updated as necessary.