(for individual clients and prospective clients)
This notice explains how we will collect, store and process your personal
information and data in accordance with data protection legislation
(including the Data Protection Act 1998, as amended and, with effect from
25th May, 2018, the General Data Protection Regulation [GDPR]).
Under the data protection legislation we are the 'data controller' of such
of your personal data as you provide to us.
We are authorised and regulated by the Solicitors Regulation Authority (SRA
Number 348954) and we are registered with the Information Commissioner's
Office under registration reference Z1210962
YOUR INFORMATION / DATA COLLECTED, STORED AND PROCESSED
The extent of this will depend upon what you ask us to do for you, but will
or may normally include your full names, address, date of birth, contact
details (telephone and mobile numbers and e-mail address(s)), banking
details, photographic identification (passport / driving licence) and other
identification documentation, such as a utility or council tax bill or bank
statement. Additionally, we may ask for and hold your national insurance
number, VAT number, unique tax reference number and the names and
registration numbers of any companies that you are connected with, and
details (such as listed above) with regard to your family members.
In certain circumstances, having regard to your instructions to us, we may
have need to ask you for more sensitive information about you, such as, or
including, details about your health or medical conditions, financial
circumstances, tax and / or citizen status and other personal or domestic
circumstances, which may include your sexual orientation, racial or ethnic
origin, political, religious and / or philosophical beliefs / opinions,
genetic and / or biometric information. We will only ask for this sensitive
information if necessary to the instructions that you have given us, and if
you provide such to us as asked, or voluntarily, we will collect and
process that data sensitively and on the basis that we have your express
consent to do so.
HOW YOUR PERSONAL DATA WILL BE USED
We will use your personal data for the purpose of complying with our
mandatory obligations under the law, including client verification checks
as required, but also, and primarily, to enable us to provide to you the
legal services that you have instructed us to undertake for you.
All personal data that you provide to us, subject to any restrictions which
you ask us to accept in exercise of your rights (see below), we will
collect and process upon the basis of your having provided your express
consent under article 6 (1) (a) of the GDPR.
In this connection, we will, or may, use your personal data to assist us in
communicating with you and advising you in relation to your requirements,
in the preparation of documents relating to your instructions to us and in
seeking advice from third parties to assist us / you (such as other
professional advisers, which may include such as barristers, accountants,
surveyors, doctors or other medical professionals, social services and the
We will NOT sell or share your personal data with third parties for
marketing purposes at all, and will only disclose your personal data with
third parties where required to enable us to carry out your instructions,
to comply with the law / regulation or in emergency (see below).
We may therefore need to share some at least of your personal data
(depending upon your instructions to us) with the Courts, HMRC, the Land
Registry, solicitors acting for another party in relation to the matter
that you have instructed us about, contracted suppliers or agents
(including, where relevant, such as estate agents, lenders, mortgage
brokers, financial advisers, insurers, etc.).
In accordance with our legal and regulatory obligations we may also be
required to disclose some or all of your personal data with the Solicitors
Regulation Authority, the Information Commissioner, the Legal and any other
Ombudsman relevant to your instructions, our auditors and as the law
demands we should. We may also be required, in the course of fulfilling
your instructions, to disclose some at least of your personal information
or data with financial institutions and / or, if relevant with your
attorney(s), trustee(s), family members or connected company officers.
In emergency, where information provided to us suggests that you, or others
connected to you, may be in danger or that there is a palpable risk of
danger, we may provide some at least of your personal data to emergency
services or like external agencies.
PROTECTION OF YOUR PERSONAL DATA
Regulation aside, client confidentiality has always been of the utmost
concern to us. Accordingly, unless, such as described above, the situation
demands, we will look to keep your personal information / data within our
firm, and then only to those who need to know.
As part of that confidentiality, and as data protection legislation has
spelt out, we are required to put in place reasonable measures to protect
your personal data whilst we have care of it. To this end we use computer
protection measures such as firewalls and virus protection software to
prevent, so far as feasible, or at least minimise the risk of the 'hacking'
(theft) of your (and our) data contained in our software, and we have
internal processes in place to limit the opportunity for the theft or loss
of computer hardware and paper records.
HOW LONG WE RETAIN YOUR PERSONAL DATA
We will retain your personal data for so long as is reasonable, but
normally for a minimum period of six years from the conclusion of your
instructions to us or otherwise for the minimum period required by law or
professional regulation, but this may be for a significantly longer period
in relation to probate and trust matters and where such relates to a child
in accordance with good professional practice. Deeds to properties that are
not registered at the Land Registry and Wills and powers of attorney which
you have asked us to store for you may be kept indefinitely.
WHAT YOU CAN ASK US TO DO WITH YOUR PERSONAL DATA
You can ask us to update it, so, if your address or contact details change,
or otherwise you feel that your data as held by us may be wrong or
incomplete, please contact us accordingly.
You can ask us to provide you with a copy of the personal data that we hold
for you, and this will be provided to you free of charge upon written
request. Please note that this will be limited to personal data such as we
have described above (names, address, contact details etc.) and will not
include all files / records relating to instructions that have been
received from you prior to that request.
Under the GDPR you have the rights to object to specific types of
processing or to restrict processing (i.e. how or with whom we use your
data) and the right to be forgotten. If you exercise any such rights then
we will comply with your request as best we can, but, in doing so, this may
mean that we can no longer act for you or accept any further instructions,
whilst you will remain liable for such costs and expenses as have been
incurred up to that point.
If your request is to place a restriction on your data, then this will mean
that we will continue to store your data but we will either not be able to
do anything with it or we will only be able to use it in a limited way,
depending upon the nature of your request.
A right to be forgotten will ordinarily arise if your data is misused, or
processed unlawfully, or there is otherwise a breach of the requirements of
Data relating to persons under the age of 18 will be treated in the same
way as an adult's sensitive information (see above), and will be disclosed
to third parties only to the extent necessary for the implementation of
instructions lawfully received or otherwise to official or regulatory
bodies who have the right to demand such data, or where we are required to
do so to protect a child from significant harm or in connection with any
COMPLAINING ABOUT THE USE OF YOUR PERSONAL DATA
In the event of complaint, please contact Robin Atherden in the first
instance. In the unlikely event that your concern remains unresolved, you
should then please address such in writing to our office manager, Michele
Ellis. She will acknowledge your letter, and advise as to the likely
time-scale within which you may expect a substantive response.
If not then satisfied with our substantive response you may refer matters
to the Information Commissioner's office at www.ico.org.uk or telephone 01303
COMMUNICATING WITH US
If you wish to contact us in relation to your personal data please write to
us by mail at Hardmans & Co., 49-51, High Street, Deal CT14 6EL, by
e-mail at firstname.lastname@example.org or
by calling +44 (0) 1304 373922.