Privacy Notice

1.1 We are required to explain why we are asking for information about you, how we intend to use the information you provide and whether we will share this with anyone else, and how we will keep it safe

1.2 This statement applies to

1.2.1 all individual clients and prospective clients; and

1.2.2 all current and former employees, workers and contractors of corporate clients or prospective corporate clients and other organisations we work for.

2.1 We are Nash & Co Solicitors LLP, a law firm authorised and regulated by the Solicitors Regulation Authority our address is Beaumont House, Beaumont Park, Plymouth, Devon, PL4 9BD. Our company registration number is OC326240

3.1 If you have any concerns or questions about our use of your personal data, you can contact our Managing Partner in writing at the above address or by email at jloney@nash.co.uk

4.1 Some of the information that you provide to us is required for us to provide you with our legal services under your contractual agreement with us. Without this information, we will not be able to enter into a contract with you or work on a legal matter for you.

4.2 We will also hold your information in our marketing database to allow us to provide and offer further services to you. This is not required by us in order for us to work on your legal matters and you may request to be removed from our marketing database at any time. If you would like your personal details to be removed from our marketing database, please email dbriggs@nash.co.uk

4.3 Finally, we hold a small amount of your information in our practice management systems which we use to hold details of our contacts generally and more specifically for regulatory compliance, financial and conflict searching purposes.

5.1 We are collecting information about you in order to achieve the purposes set out in clause 4 above. This includes:

Personal details of any of our instructing contacts

5.1.1 personal details (such as name, gender and date of birth);

5.1.2 contact details (such as your address, telephone number and email address);

5.1.3 personal information such as details of allergies or food preferences;

5.1.4 payment information (such as bank account details or information about any other payment method);

Personal details relevant to a legal matter

5.1.5 personal details of any person involved in a legal matter (such as name, gender and date of birth);

5.1.6 contact details of any such person (such as address, telephone number and email address);

5.1.7 other personal details, including the following special categories of information where this is relevant to a legal matter: race, ethnic origin, politics, religion, trade union membership, genetics, biometrics (where used for ID purposes), health, sex life and sexual orientation;

Marketing contact details

5.1.8 details held in our marketing database which include the following standard categories: name, organisation, job title, postal address, email address, phone number and subscriptions to newsletters;

Marketing and survey information

5.1.9 your responses to our surveys;

5.1.10 details of any agreement or objection to receiving marketing information from us;

6.1 We may receive personal data from you for the purposes of our money laundering checks such as a copy of your passport. These will be processed only for the purpose of preventing money laundering and/or terrorist financing or as permitted by law or with your express consent. You consent to us retaining such data for longer than the five year statutory period unless you tell us otherwise.

7.1 The information which we collect about you will be obtained through a variety of sources which may include:

7.1.1 information provided by you;

7.1.2 from any communication you have with us in relation to any legal matter or potential instruction;

7.1.3 in relation to attendance at any of our training or marketing events;

7.1.4 when you sign up for a newsletter;

7.1.5 when you complete surveys that we use for research purposes;

7.1.6 Automatically collected information. We may automatically collect certain information about your computer or devices that are used to access our online services, including mobile devices, through commonly-used information-gathering tools, such as cookies and web beacons. This includes standard information from your browser or device (such as browser/device type and language), your Internet Protocol (“IP”) address, and the actions you take on our website, such as the pages viewed and the links clicked.

We may also collect and analyse information such as: (i) location information, unique device identifiers and other information about your mobile phone or other mobile device(s), browser types, browser language, operating system, the state or country from which you accessed our website; and (ii) information related to the ways in which you interact with our online services, such as referring and exit pages and URLs, platform type, the number of clicks, domain names, landing pages, pages viewed and the order of those pages, the amount of time spent on particular pages, the date and time you used our online services, error logs, and other similar information. We use Google as an analytics provider and technologies, including cookies and similar tools, to assist in collecting this information.

Any information collected by automated means will only be used by us for analytical purposes. For more detailed information on our use of cookies, please see our Cookie Policy.

7.1.7 information collected from third parties;

7.1.8 we may collect information about you from third parties where we carry out identity verification credit or anti-fraud checks against your name using third party databases.

8.1 The information which you provide to us will be used for the following purposes:

8.1.1 it will be stored and used by us in accordance with this privacy statement and also in accordance with your rights under the data protection laws;

8.1.2 it will be collected and used by us for the purpose of providing our legal services to you;

8.1.3 it will be used to improve the services you receive from us; and

8.1.4 it will allow us to offer you further information and services which may be useful to you.

8.2 Some of the information which we collect will be special categories of personal data such as information about your ethnic background or any disability you may have. We will use this for the purposes of working on your legal matter(s) and as needed to provide better services to you (for example when hosting an event to take account of your needs).

9.1 In accordance with the data protection laws, we need a “legal basis” for collecting and using information about you. There are a variety of different legal basis for processing personal data which are set out in the data protection laws.

9.2 The lawful basis on which we rely in order to use the information which we collect about you for the purposes set out in this notice will be:

9.2.1 using your information in this way is necessary for us to perform the contract between us and in order to take steps at your request prior to entering into the contract; and

9.2.2 using your information is necessary for us to comply with legal and regulatory obligations to which we are subject, for example our obligations to comply with the requirements of the Money Laundering Regulations 2017 and the Solicitors Regulation Authority Code of Conduct; and

9.2.3 using your information pursuant to our legitimate interests, namely to hold your data for marketing purposes.

9.3 The lawful basis on which we normally rely in order to use your sensitive personal data/special categories of personal data which we collect about you will be that this is needed in order to work on our legal matter for you pursuant to the contract between us, or to comply with a legal obligation, or with your consent.

9.4 We may also use your sensitive personal data for the purposes of your comfort when hosting a marketing event or for facilitating marketing communications with you (for example using large type). We will do this only with your express consent.

10.1 We may share information about you with our contractors and sub-contractors. The contractors and sub-contractors shall be contractually required to ensure that they adhere to the security requirements imposed by the data protection laws.

10.2 Our contractors and sub-contractors will only be able to use the information when completing work on behalf of us. Examples of subcontractors we use regularly are:

10.2.1 Outsourced information technology service providers,

10.2.2 Outsourced document production services;

10.2.3 Hosted web services, (e.g. Bluestone 360 Limited but also others) who may access your information for the purposes of maintenance of their service; and.

10.2.4 Barristers and/or Solicitor Agents;

10.2.5 Private investigators;

10.2.6 Expert witnesses and/or other professional advisors including advisors appointed by another party;

10.2.7 Accountants

10.2.8 Costs Lawyers

Regulators and other legal oblications

10.3 We may also be required to share your information with our regulators, the Solicitors Regulation Authority, who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.

Insurers

10.4 We may need to share your information with our Insurers in certain circumstances, to ensure protection of the firm and of you.

Auditors

10.5 Nash & Co Solicitors LLP is Lexcel accredited. Lexcel is an accreditation indicating quality in relation to legal practice management standards. To maintain this and other accreditations we are regularly audited by external auditors such as the Legal Aid Agency and Legal Expenses Insurers. We will ensure that any auditors access your information solely for the purposes of carrying out the audit in question and that they are subject to the security requirements imposed by the data protection laws.

Other organisations

10.6 We may from time to time share your information with other organisations but only to the extent required to allow them to maintain services provided to us and always subject to appropriate confidentiality provisions.

11.1 We may transfer the information which you provide to us to the US because the organisations may use to organise events (Eventbrite) and to carry out client surveys (Surveymonkey) are located in that country.

11.2 These organisations are subject to the US/EU Privacy Shield. This means that both organisations are part of a scheme which is designed adequately to protect your personal information. Further details are available on the websites of each of these organisations.

12.1 The information that you provide will be stored securely on our electronic and hard copy filing systems. We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

13.1 In limited circumstances we may use your information for a purpose other than those set out in this policy. If we intend to do so, we will provide you with information relating to that other purpose before using it for the new purpose.

14.1 We will store personal data which you provide to us on your matter file in accordance with our file destruction policy. Full details can be accessed by CLICKING HERE.

14.1.1 we have a formal written agreement with you to retain a file or category of files for a specified period of time, in which case the agreed period of time will prevail;

14.1.2 we write to you proposing a different date for document and data retention, normally either in the matter engagement or a file closing letter; or

14.1.3 a party to the matter does not have capacity or is a minor, in which case we will hold the file for 25 years;

14.2 This means that we will hold your file for the relevant time period after which we will delete, destroy or encrypt it. If you wish to retain copies of any documents or data beyond that time period you must contact us before the expiry of the relevant time period. Charges may apply to any extended retention period or if you would like us to provide a copy of your file.

14.3 In addition, we will store some of your personal data including name, date of birth, job title, organisation, email address:

14.3.1 in our firm’s practice management system for a minimum of six years, primarily for conflict checking purposes after which it will be encrypted

14.3.2 in our marketing database for marketing purposes for so long as we consider it to be useful. You may ask us to remove your details from our marketing database at any time. In addition whenever we contact you we will provide you with the option to unsubscribe.

15.1 If you have any questions about our use of your personal data, you are welcome to contact us. You will find our contact details in clause 3.1. If you notice any errors in your personal data, you have the right to have them corrected.

15.2 Under certain circumstances, by law you have the right to:

15.2.1 Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it;

15.2.2 Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected;

15.2.3 Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below);

15.2.4 Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes;

15.2.5 Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it;

15.2.6 Request the transfer of your personal information to another party.

16.1 In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact the contact details set out in clause 3.1. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

17.1 If you send us personal data about anyone other than yourself, you will ensure you have any appropriate consents or other lawful basis and notices in place to enable us to transfer that personal data to us so that we may use it for the purposes for which you provide it to us.

18.1 You also have the right to complain to the Information Commissioner’s Office (the “ICO”) if you are not satisfied with the way we use your information. You can contact the ICO by writing to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

19.1 We may amend this privacy statement at any time so please review it frequently and at least each time you submit personal information to us. Our current privacy statement applies to all information that we have about you and your matters.