Privacy Statement

Gladstones processes and holds both personal data and special category personal data (also known as sensitive data) for individuals under the General Data Protection Regulations (GDPR) and the Data Protection Act 2018.

Personal Data

Personal data is data/information relating to an individual, who can be identified from that data/information. For example;

• Name
• Address
• Date of Birth

We may also hold personal information about you relating to the matter that we are persuing you for, such as;

• Photographs
• Correspondence
• Telephone call recordings

Special Category Personal Data

Special Category Personal data, also known as sensitive data, relates to;

• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Genetic data
• Biometric data
• Data concerning health
• Data concerning sex life or sexual orientation
• Criminal convictions

Clients

If you are a client of the firm, you will have provided us with various information such as;

• Name
• Address
• Contact details (telephone number/email address)

We need these details so that we can properly represent you, and also for our due diligence checks, including complying with the Money Laundering Regulations 2017, Criminal Finances Act 2017 and other legislation.

Depending on the type of matter we are assisting you with, we are also likely to hold special category (sensitive) data. For example;

• Data concerning your health, by way of medical records
• Data concerning your ethnic origin, when obtaining photographic ID

When in receipt of special category/sensitive data we process this data when necessary for establishing, exercising or defending legal claims and providing legal advice

Non-Clients

If you are involved in proceedings or any case other than as our Client, then we will likely hold personal data about you, in order that we can properly record and carry out the instructions of our client and which may include special category (sensitive) data. For example;

• Name
• Address
• Date of Birth
• Vehicle Registration Number
• Medical conditions (special category/sensitive data)
• Ethnic origin (special category/sensitive data)

When in receipt of special category/sensitive data we process this data when necessary for establishing, exercising or defending legal claims and to provide legal advice to our client(s).

Clients

We process and hold information about you, so that we can properly represent you in the matters for which we are instructed, and also for our own regulatory purposes. Under the GDPR our lawful basis for processing is:

• Performance of a Contract
  • This could be a contract that we are representing you in relation to and/or our contract of services with you
• Compliance with Legal Obligation
  • We are required to hold certain data in order to comply with current legislation such as the Money Laundering Regulations 2017 etc.
• Legitimate Interest
  • Our Regulatory body (The Solicitors Regulation Authority) require us to hold and maintain records for compliance purposes, so that they are available should the Solicitors Regulation Authority, Legal Ombudsman etc, need to have recourse to them. Also, so that should a dispute arise, we can have recourse to our file in order to address the same.

Non-Clients

We process and hold information about you, so that we can properly represent our clients for matters in which are instructed. Under the GDPR our lawful basis for processing is:

• Legitimate Interest
  • We process and hold information about those who are involved in legal or potential legal proceedings with our clients. As a law firm, this information is necessary and lawful, as it is required in furtherance of our clients’ instructions and so that we can properly advise them and act for them on their rights and obligations. For example;
    • When acting on behalf of one party during a separation
    • When recovering monies owed to our client
    
    

Clients

We will only share your information with those necessary in order to comply with our regulatory obligations, in furtherance of your instructions, and in relation to other issues concerning the performance of our contract with you. For example:

• Solicitors acting on the other side
• HM Courts & Tribunal Service
• Contracted suppliers
• Law enforcement

There may be occasions when your data is transferred to a third country (out of the European Economic Area) during the performance of our contract with you, for instance where the other side to a dispute is resident abroad or the case involves another party or witness who is located abroad. Data will only be transferred if necessary for the performance of the contract between yourself and Gladstones, or if the transfer is necessary for the establishment, exercise or defence of legal claims. We will of course, at the relevant time, explain the potential risks of this.

Non-Clients

We will only share your data with other persons, companies, government entities, and others to the extent necessary to reasonably exercise our clients’ rights in furtherance of our contract of services with them. For example;

• Tracing agents
• Enforcement Agents
• Solicitors
• HM Courts & Tribunal Services

In addition, there will be the disclosure of your data, if Gladstones are subject to a Government or Regulatory Audit, for example from HM Revenue & Customs or the Solicitors Regulation Authority, in accordance with our Legal and Regulatory Obligations.

When your information is shared with third parties under a contract of services, we will ensure that they have provided us with the necessary assurances that they will comply with their obligations under the GDPR and do not use your data, other than in accordance with our instructions.

Clients

Information will be provided to us about you from yourself, others involved in any legal process, those referring work to us (for example banks/buildings societies) and those providing us with instructions on your behalf (if they have the appropriate authority to do so).

Non-Clients

The majority of data is likely to come from instructions from our clients. It may also come from third parties whilst we carry out our clients’ instructions (or act on their behalf).

Clients

As we are acting under a contract of services, we need to retain all data for a minimum of 6 years so that we can have recourse to it should any issues arise, under the performance or otherwise of that contract, but will not retain data any longer than 7 years save as mentioned below.

We also have to comply with various legislation, such as Money Laundering Regulations 2017, which require us to hold data for a specific period of time, namely at least 5 years.

In some circumstances, data may be held longer than as indicated above, for example:

1. When we have been instructed to store a will
2. When we have been instructed to store deeds to a property
3. Where there is any on-going dispute/claim/complaint
4. For the duration of a trust

In circumstances where we will hold your data for longer than the standard retention period as indicated above, this will be on the basis of your express consent. Should you withdraw that consent, the standard retention period will apply. Your consent is provided within our Terms and Conditions provided at the outset of engaging into a contract with us.

Non-Clients

Your data is likely to form a record of our performance of a contract for services with our client, we therefore need to retain this for a minimum period of 6 years, but no longer than 7 years, from the date that the matter in which you were involved comes to an end.

At the expiration of the aforementioned periods we will securely dispose of all your data, in all formats.

All data subjects, with regards to personal data have the following rights;

• The right to information and access to personal data
• The right to rectification
• The right to erasure also known as “the right to be forgotten”
• The right to the restriction of processing
• The right to data portability
• The right to object to processing
• Rights in relation to automated decision making and profiling

(Further information on rights available to data subjects can be found on the Information Commissioners Website; www.ico.org.uk)

Any request for access to personal information we are processing is to be made to our Data Protection Officer, John Davies, whose contact details are;

Gladstones Solicitors Limited
Unit B, 1st Floor, 210 Cygnet Court
Centre Park
Warrington
dataprotectionofficer@gladstonessolicitors.co.uk

We will provide all information you are entitled to, under the subject access provisions, to you, promptly, and within one month from the date of receipt, and there is no charge for this information.

Any request to rectify inaccurate or incomplete data we hold is to be made to the firm’s Data Protection Officer (contact details as above).

We will inform you within one month of any rectification made, or any objection to the request. If rectification is made, we will always inform any third parties of that rectification.

When the accuracy of information is contested, you have the right to restrict the processing of your information whilst we verify whether the information is accurate.

Any request to have your information erased is to be made to the firm’s Data Protection Officer (contact details as above).

Clients

Any request to have to receive your information to re-use it for a third party, is to be made to the firm’s Data Protection Officer (contact details as above).

We will provide this information (information that has been received from you) in a commonly used format, promptly, within one month of receipt of the request, and there is no charge for providing this information

Non-Clients

We are not able to make information available under data portability provisions, as we are not providing a service to you (the service we are providing is to our client).

Any request to object to your information being processed is to be made to the firm’s Data Protection Officer (contact details as above).

Gladstones safeguards your personal and/or special category data, in a number of ways, namely;

• Access Controls
• Encryption
• Password protection
• Electronic controls
• Managerial procedures

All data will be held securely and not sold to any third parties.

Gladstones take the security of data seriously.

Should you wish to make any complaint regarding the processing of your personal and/or special category data, you can make a complaint to the Supervisory Authority; the Information Commissioner’s Office (ICO). The ICO can be contacted via their website; www.ico.org.uk.

We keep our Privacy Statement under regular review.

This Statement was last updated 23 May 2018.