DATA PRIVACY
Peters May LLP Data Privacy Notice
We ask that you read this privacy notice carefully as it contains important information on who we are, how and why we collect, store, use and share personal information from clients and other members of the public. It also sets out your rights in relation to your personal information and on how to contact us and supervisory authorities in the event you have a complaint.
1
WHO WE ARE
1.1
PETERS MAY LLP (trading as Peters May) collects, uses and is responsible for certain personal data about clients and members of the public. We are regulated under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 and we are a controller of that personal information for the purposes of those laws. We are registered with the Information Commissioner’s Office with registration number ZA451402.
1.2
We have opted to appoint Juliette Peters, Partner, as our Data Protection Officer (DPO). If you have any questions about this notice or if you want to exercise any of your rights under data protection laws you should contact Juliette by email at juliette.peters@petersmay.com.
2
THE PERSONAL INFORMATION WE COLLECT AND USE FROM OUR CLIENTS
2.1
In the course of the provision of legal services (the Services) we collect some or all of the following personal data from our clients:
2.1.1
name;
2.1.2
the names of children (if any);
2.1.3
residential and address and business address;
2.1.4
contact details, for example telephone number and email address;
2.1.5
date of birth;
2.1.6
gender;
2.1.7
marital status;
2.1.8
copies of passport, national identity card, driving licence, utility bills, bank statements and similar documents;
2.1.9
business and professional qualifications and experience;
2.1.10
immigration status and work permits;
2.1.11
data from our building access controls; and
2.1.12
data from our IT and communications monitoring system.
3
THE PERSONAL INFORMATION WE COLLECT FROM VISITORS TO OUR WEBSITE
3.1
We will collect information that you voluntarily provide to us if you fill in a form in our website or apply for a vacancy through the website. This information may include the following personal data:
3.1.1
name;
3.1.2
residential and business address;
3.1.3
contact details, for example email and telephone number;
3.1.4
and, where you provide it, some categories of personal data, for example ethnic origin and gender.
3.2
We do not use cookies currently on our website.
4
REASONS WE COLLECT AND USE PERSONAL DATA
4.1
We will only process personal data for the following purposes:
4.1.1
responding to your queries, requests and other communications;
4.1.2
providing legal services;
4.1.3
enabling suppliers and service providers to carry out certain functions on our behalf in order to provide legal services, including webhosting, data storage, identity verification, technical, logistical, courier or other functions, as applicable;
4.1.4
allowing you to use features on our website, when you choose to do so;
4.1.5
sending you personalised marketing communications requested by you;
4.1.6
ensuring security and preventing or detecting fraud;
4.1.7
administration, including complaints’ resolution, troubleshooting of our website, data analysis, testing of new features, research, statistical and survey purposes;
4.1.8
developing and improving the legal services we offer; and
4.1.9
complying with applicable law, including anti-money laundering legislation, guidelines and regulations or in response to a lawful request from a court or regulatory body.
4.2
The legal basis for our processing of personal data for the purposes described above will typically include:
4.2.1
processing necessary to fulfil a contract that we have in place with you or other data subjects, such as processing for the purposes set out in paragraphs
4.1.1, 4.1.2 and 4.1.4;
4.2.2
your consent, such as processing for the purposes set out in paragraph
4.1.5;
4.2.3
processing necessary for our or a third party’s legitimate interests, such as processing for the purposes set out in paragraphs 4.1.1, 4.1.2, 4.1.3, 4.1.6, 4.1.7 and 4.1.8, which is carried out on the basis of our legitimate interests to ensure that legal services are properly provided, our security and our clients security and our proper administration;
4.2.4
processing necessary for compliance with a legal obligation to which we are subject, such as processing for the purposes set out in paragraph 4.1.9; and
4.2.5
any other applicable legal grounds for processing from time to time.
5
SPECIAL CATEGORIES OF (SENSITIVE) PERSONAL DATA
5.1
You may also supply us with, or we may receive, special categories of (or sensitive) personal data. This is defined by data protection laws to include personal data revealing a person’s racial or ethnic origin, religious or philosophical beliefs, or data concerning health. We process these special categories of personal data on the basis of one or more of the following:
5.1.1
where you have given explicit consent to the processing of the personal data for one or more specified purpose(s);
5.1.2
where the processing relates to personal data which is manifestly made public by you;
5.1.3
where the processing is necessary for the establishment, exercise or defence of legal claims;
5.1.4
where the processing is necessary for reasons of substantial public interest, in accordance with applicable law. Such reasons include where the processing is necessary:
(a) for the purposes of the prevention or detection of an unlawful act or for preventing a fraud;
(b) for the provision of confidential advice.
6
DATA RELATING TO CRIMINAL CONVICTIONS AND OFFENCES
6.1
We collect and store personal data relating to criminal convictions and offences (including the alleged commission of offences) only where necessary for the purposes of:
6.1.1
the prevention or detection of an unlawful act and it is necessary for reasons of substantial public interest;
6.1.2
providing or obtaining legal advice; or
6.1.3
establishing, exercising or defending legal rights.
7
MARKETING
7.1
We use your personal data to notify you by email, telephone, post or SMS about important legal developments and services which we think you may find valuable, for sending you newsletters, invitations to seminars and similar marketing.
7.2
In this connection we may disclose personal data to third parties providing marketing services to us, or with whom we are conducting joint marketing exercises.
7.3
You have the right to opt out of receiving direct marketing communications from us at any time by contacting our DPO, Juliette Peters, using the contact details set out above, or using the unsubscribe link in emails.
8
EMAIL MONITORING
8.1
Email which you sent to us or which we send to you may be monitored by us to ensure compliance with professional standards and our internal compliance policies. Monitoring is not continuous or routine, but may be undertaken on the instruction of a partner where there are reasonable grounds for doing so.
9
WHO WE SHARE YOUR PERSONAL INFORMATION WITH
9.1
We routinely share personal data from our clients with third party experts, barristers engaged on a case, the court and the other party’s legal representatives. This data sharing enables us to provide legal services to our clients and to manage the case. We will share personal information with law enforcement or other authorities if required by applicable law. We will not share personal information with any other party.
10
WHETHER INFORMATION HAS TO BE PROVIDED BY YOU, AND IF SO WHY
10.1
If clients do not provide the personal data that we ask for and that we need to enable us to carry out their instructions, it may delay or prevent us from providing legal services to them.
10.2
The provision of name and address and information on identity documents is required from clients to enable us to comply with our obligations under anti-money laundering legislation.
11
HOW LONG PERSONAL INFORMATION WILL BE KEPT
11.1
We will hold the information we hold for our anti-money laundering checks on our clients for five years from the end of our relationship with the client. We will hold all other personal information on clients for six years from the conclusion of their case. We hold the information visitors to our website give us for six months.
12
TRANSFER OF YOUR INFORMATION OUT OF THE EUROPEAN ECONOMIC AREA (EEA)
12.1
We will not routinely transfer personal data outside of the EEA or to any organisation governed by public international law or which is set up under any agreement between two or more countries. If we do propose to transfer personal data outside of the EEA, we will check that the data subject’s privacy rights are adequately protected by appropriate technical, organisational, contractual or other lawful means.
13
YOUR RIGHTS
13.1
Under the GDPR data subjects have a number of important rights. Those include rights to:
13.1.1
fair processing of information and transparency over how we use your personal information;
13.1.2
access your personal information;
13.1.3
require us to correct any mistakes in your information;
13.1.4
require the erasure of personal information concerning you in certain situations;
13.1.5
receive the personal information concerning you which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to a third party in certain situations;
13.1.6
object at any time to processing of personal information concerning you for direct marketing;
13.1.7
object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you;
13.1.8
object in certain other situations to our continued processing of your personal information;
13.1.9
otherwise restrict our processing of your personal information in certain circumstances.
13.2
If you would like to exercise any of those rights, please:
13.2.1
Email, call or write to our DPO, Juliette Peters, at juliette.peters@petersmay.com or 020 3036 0058;
13.2.2
Let us have proof of your identity and address (a copy of your driving licence or passport and a recent utility or credit card bill); and
13.2.3
Let us know the information to which your request relates.
14
KEEPING YOUR PERSONAL INFORMATION SECURE
14.1
We have appropriate security measures in place to prevent personal information from being accidentally lost or used or accessed in an unauthorised way. We limit access to personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.
14.2
We also have procedures in place to deal with any suspected data security breach. We will notify the data subject and any applicable regulator of a suspected data security breach where we are legally required to do so.
15
HOW TO COMPLAIN
15.1
We hope that our DPO, Juliette Peters, can resolve any query or concern raised about our use of personal information.
15.2
The General Data Protection Regulation also gives a right to lodge a complaint with a supervisory authority, in particular in the European Union (or EEA) state where you work, normally live or where any alleged infringement of data protection laws has occurred. The supervisory authority in the UK is the Information Commissioner who may be contacted at https://ico.org.uk/concerns/ or telephone 0303 1231113.
16
CHANGES TO THIS PRIVACY NOTICE
16.1
This privacy notice was published on 24th September 2018.
16.2
We may change this privacy notice from time to time, and when we do we will update the copy on our website.
WHO WE ARE
1.1
PETERS MAY LLP (trading as Peters May) collects, uses and is responsible for certain personal data about clients and members of the public. We are regulated under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 and we are a controller of that personal information for the purposes of those laws. We are registered with the Information Commissioner’s Office with registration number ZA451402.
1.2
We have opted to appoint Juliette Peters, Partner, as our Data Protection Officer (DPO). If you have any questions about this notice or if you want to exercise any of your rights under data protection laws you should contact Juliette by email at juliette.peters@petersmay.com.
2
THE PERSONAL INFORMATION WE COLLECT AND USE FROM OUR CLIENTS
2.1
In the course of the provision of legal services (the Services) we collect some or all of the following personal data from our clients:
2.1.1
name;
2.1.2
the names of children (if any);
2.1.3
residential and address and business address;
2.1.4
contact details, for example telephone number and email address;
2.1.5
date of birth;
2.1.6
gender;
2.1.7
marital status;
2.1.8
copies of passport, national identity card, driving licence, utility bills, bank statements and similar documents;
2.1.9
business and professional qualifications and experience;
2.1.10
immigration status and work permits;
2.1.11
data from our building access controls; and
2.1.12
data from our IT and communications monitoring system.
3
THE PERSONAL INFORMATION WE COLLECT FROM VISITORS TO OUR WEBSITE
3.1
We will collect information that you voluntarily provide to us if you fill in a form in our website or apply for a vacancy through the website. This information may include the following personal data:
3.1.1
name;
3.1.2
residential and business address;
3.1.3
contact details, for example email and telephone number;
3.1.4
and, where you provide it, some categories of personal data, for example ethnic origin and gender.
3.2
We do not use cookies currently on our website.
4
REASONS WE COLLECT AND USE PERSONAL DATA
4.1
We will only process personal data for the following purposes:
4.1.1
responding to your queries, requests and other communications;
4.1.2
providing legal services;
4.1.3
enabling suppliers and service providers to carry out certain functions on our behalf in order to provide legal services, including webhosting, data storage, identity verification, technical, logistical, courier or other functions, as applicable;
4.1.4
allowing you to use features on our website, when you choose to do so;
4.1.5
sending you personalised marketing communications requested by you;
4.1.6
ensuring security and preventing or detecting fraud;
4.1.7
administration, including complaints’ resolution, troubleshooting of our website, data analysis, testing of new features, research, statistical and survey purposes;
4.1.8
developing and improving the legal services we offer; and
4.1.9
complying with applicable law, including anti-money laundering legislation, guidelines and regulations or in response to a lawful request from a court or regulatory body.
4.2
The legal basis for our processing of personal data for the purposes described above will typically include:
4.2.1
processing necessary to fulfil a contract that we have in place with you or other data subjects, such as processing for the purposes set out in paragraphs
4.1.1, 4.1.2 and 4.1.4;
4.2.2
your consent, such as processing for the purposes set out in paragraph
4.1.5;
4.2.3
processing necessary for our or a third party’s legitimate interests, such as processing for the purposes set out in paragraphs 4.1.1, 4.1.2, 4.1.3, 4.1.6, 4.1.7 and 4.1.8, which is carried out on the basis of our legitimate interests to ensure that legal services are properly provided, our security and our clients security and our proper administration;
4.2.4
processing necessary for compliance with a legal obligation to which we are subject, such as processing for the purposes set out in paragraph 4.1.9; and
4.2.5
any other applicable legal grounds for processing from time to time.
5
SPECIAL CATEGORIES OF (SENSITIVE) PERSONAL DATA
5.1
You may also supply us with, or we may receive, special categories of (or sensitive) personal data. This is defined by data protection laws to include personal data revealing a person’s racial or ethnic origin, religious or philosophical beliefs, or data concerning health. We process these special categories of personal data on the basis of one or more of the following:
5.1.1
where you have given explicit consent to the processing of the personal data for one or more specified purpose(s);
5.1.2
where the processing relates to personal data which is manifestly made public by you;
5.1.3
where the processing is necessary for the establishment, exercise or defence of legal claims;
5.1.4
where the processing is necessary for reasons of substantial public interest, in accordance with applicable law. Such reasons include where the processing is necessary:
(a) for the purposes of the prevention or detection of an unlawful act or for preventing a fraud;
(b) for the provision of confidential advice.
6
DATA RELATING TO CRIMINAL CONVICTIONS AND OFFENCES
6.1
We collect and store personal data relating to criminal convictions and offences (including the alleged commission of offences) only where necessary for the purposes of:
6.1.1
the prevention or detection of an unlawful act and it is necessary for reasons of substantial public interest;
6.1.2
providing or obtaining legal advice; or
6.1.3
establishing, exercising or defending legal rights.
7
MARKETING
7.1
We use your personal data to notify you by email, telephone, post or SMS about important legal developments and services which we think you may find valuable, for sending you newsletters, invitations to seminars and similar marketing.
7.2
In this connection we may disclose personal data to third parties providing marketing services to us, or with whom we are conducting joint marketing exercises.
7.3
You have the right to opt out of receiving direct marketing communications from us at any time by contacting our DPO, Juliette Peters, using the contact details set out above, or using the unsubscribe link in emails.
8
EMAIL MONITORING
8.1
Email which you sent to us or which we send to you may be monitored by us to ensure compliance with professional standards and our internal compliance policies. Monitoring is not continuous or routine, but may be undertaken on the instruction of a partner where there are reasonable grounds for doing so.
9
WHO WE SHARE YOUR PERSONAL INFORMATION WITH
9.1
We routinely share personal data from our clients with third party experts, barristers engaged on a case, the court and the other party’s legal representatives. This data sharing enables us to provide legal services to our clients and to manage the case. We will share personal information with law enforcement or other authorities if required by applicable law. We will not share personal information with any other party.
10
WHETHER INFORMATION HAS TO BE PROVIDED BY YOU, AND IF SO WHY
10.1
If clients do not provide the personal data that we ask for and that we need to enable us to carry out their instructions, it may delay or prevent us from providing legal services to them.
10.2
The provision of name and address and information on identity documents is required from clients to enable us to comply with our obligations under anti-money laundering legislation.
11
HOW LONG PERSONAL INFORMATION WILL BE KEPT
11.1
We will hold the information we hold for our anti-money laundering checks on our clients for five years from the end of our relationship with the client. We will hold all other personal information on clients for six years from the conclusion of their case. We hold the information visitors to our website give us for six months.
12
TRANSFER OF YOUR INFORMATION OUT OF THE EUROPEAN ECONOMIC AREA (EEA)
12.1
We will not routinely transfer personal data outside of the EEA or to any organisation governed by public international law or which is set up under any agreement between two or more countries. If we do propose to transfer personal data outside of the EEA, we will check that the data subject’s privacy rights are adequately protected by appropriate technical, organisational, contractual or other lawful means.
13
YOUR RIGHTS
13.1
Under the GDPR data subjects have a number of important rights. Those include rights to:
13.1.1
fair processing of information and transparency over how we use your personal information;
13.1.2
access your personal information;
13.1.3
require us to correct any mistakes in your information;
13.1.4
require the erasure of personal information concerning you in certain situations;
13.1.5
receive the personal information concerning you which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to a third party in certain situations;
13.1.6
object at any time to processing of personal information concerning you for direct marketing;
13.1.7
object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you;
13.1.8
object in certain other situations to our continued processing of your personal information;
13.1.9
otherwise restrict our processing of your personal information in certain circumstances.
13.2
If you would like to exercise any of those rights, please:
13.2.1
Email, call or write to our DPO, Juliette Peters, at juliette.peters@petersmay.com or 020 3036 0058;
13.2.2
Let us have proof of your identity and address (a copy of your driving licence or passport and a recent utility or credit card bill); and
13.2.3
Let us know the information to which your request relates.
14
KEEPING YOUR PERSONAL INFORMATION SECURE
14.1
We have appropriate security measures in place to prevent personal information from being accidentally lost or used or accessed in an unauthorised way. We limit access to personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.
14.2
We also have procedures in place to deal with any suspected data security breach. We will notify the data subject and any applicable regulator of a suspected data security breach where we are legally required to do so.
15
HOW TO COMPLAIN
15.1
We hope that our DPO, Juliette Peters, can resolve any query or concern raised about our use of personal information.
15.2
The General Data Protection Regulation also gives a right to lodge a complaint with a supervisory authority, in particular in the European Union (or EEA) state where you work, normally live or where any alleged infringement of data protection laws has occurred. The supervisory authority in the UK is the Information Commissioner who may be contacted at https://ico.org.uk/concerns/ or telephone 0303 1231113.
16
CHANGES TO THIS PRIVACY NOTICE
16.1
This privacy notice was published on 24th September 2018.
16.2
We may change this privacy notice from time to time, and when we do we will update the copy on our website.
