Privacy Notice

1. Introduction

1.1       Russells Solicitors ("we" / "us" / “our”) recognise the importance that individuals place on their privacy when they provide us with personal data; as a firm, we are committed to protecting and respecting the privacy of any personal data we process.

1.2        This policy ("Privacy Notice") sets out the basis on which any personal data we collect from you or any third party, or that you provide to us, will be processed by us. In addition to this Privacy Notice:

• our website Terms of Use apply to the use of any personal data collected from you as a result of your use of co.uk (the "Site"); and
• our client Terms and Conditions of Business apply to the use of any personal data collected from you in the course of us providing legal services to you, or to any organisation that you work or act for ("you” / “your organisation”).

1.3         Additionally, when you visit the Site, we may send a cookie to your computer. A cookie is a text file containing a small amount of data that allows us to improve the functionality of our Site and provide you with a tailored Site experience. For further details on how we use cookies, please see our Cookies Policy, which forms part of this Privacy Notice.

1.4        This Privacy Notice does not apply to our use of Personal Data where we act as an employer (save for the purposes of pre-employment and recruitment).

1.5        Please read and understand the following carefully to understand our views and practices regarding your personal data and how we will treat it.

1.6        For the purposes of this Privacy Notice, “UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, and “consent”, “controller”, “personal data”, “process”, “processing” “profiling”, and “third party” shall have the definitions prescribed to them under the UK GDPR. Where a user is subject to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”), references to the UK GDPR under this Privacy Notice shall be deemed to be references to the GDPR.

1.7        For the purpose of the UK GDPR, Russells Solicitors of Yalding House, 152-156 Great Portland Street, London, W1W 5QA acts as the controller of personal data we process.

1.8        If you have any questions, comments or complaints regarding this Privacy Notice or how we process your personal data, please contact our Data Protection Officer, Alex Cole, at media@russells.co.uk or at:

Russells Solicitors
Yalding House
152 -156 Great Portland Street
London
W1W 5QA
United Kingdom

2. Information we may collect from you

2.1       During the course of our business, we may collect various types of personal data about you, including:

• personal identification information and employment details such as your name, age and job role;
• contact details such as your home or office address, e-mail address, and phone number;
• identity verification details such as copies of passports and utility bills and any other information necessary to enable us to comply with our client due diligence / anti-money laundering obligations;
• log data and computer information when accessing the Site, including  your Internet Protocol (“IP”) address and device information; and
• any other information relevant to the work that we undertake (or plan to undertake) that you provide to us.
• We will only receive or gather special categories of data (including data regarding ethnic origin, political opinions, religious beliefs, trade union membership, health, sex life or sexual orientation) or data relating to criminal convictions where you provide it to us voluntarily, you have manifestly made the data public, or where it is necessary for the establishment, exercise or defence of legal claims.
• We may collect the above mentioned types of personal data from you in a number of different ways, including:
• where you, or other persons at your organisation, contact us (e.g. by phone, e-mail or otherwise). We may receive personal data about you via different communications channels, and we may keep a record of such data and/or of the correspondence in line with our data retention policy;
• where our clients or prospective clients provide us with personal data about you where it is relevant and connected to the work that we undertake (or it is envisaged that we may undertake) for our clients; or
• from publicly available sources, we may for instance gather personal data about you from public sources or from enquiries that we may make to ensure we hold accurate contact details about you.
• Certain personal data about you will be created and logged automatically when you access the Site. This is often referred to as "log data”, and includes but is not limited to:
• technical information, including the type of device(s) you use, a unique device identifier, the IP address used to connect your device(s) to the Internet, network information, browser type and version, time zone setting, browser plug-in types and versions and your operating system and platform; and
• information and details about your use of our Site (including but not limited to traffic data; location data; weblogs and other communication data; the full Uniform Resource Locators (URL) clickstream to, through and from our Site (including date and time); what you viewed or searched for; page response times, download errors; length of visits to certain pages; page interaction information (such as scrolling, clicks, and mouse-overs); and methods used to browse away from the page).
• We may receive personal data about you from other sources such as analytics providers and search information providers.

3. How we use your information

3.1       We will only use your personal data in connection with the running of our legal business and the provision  of legal services to our clients, and at all times in compliance with applicable data protection laws, including the UK GDPR. Specifically, your personal data is only collected and processed by us where:

• you have consented to the processing of your personal data;
• we are required to process your personal data to comply with legal obligations which we are subject to;
• it is necessary to enable us to defend, prosecute or make a claim against you, us or a third party;
• it is necessary for us to process your personal data in order for us perform a contract we have entered into with you or to take steps (at your request) necessary to enter into a contract with you; or
• in certain cases, where we have a legitimate business interest in processing your personal data (i.e. when it is essential for us to process your personal data to enable us to operate the Site).

3.2        We may use your personal data in the following ways during the course of our business:

• To provide our legal services to you or to another client of ours. Where you are a client or a prospective client, your personal data is processed for this purpose on the legal basis of: contractual performance; legitimate interests (to provide our legal services); and/or consent. Where you are not our client or a prospective client, but we receive personal data about you for the purpose of the provision of legal services to our clients, we do so on the legal basis of: legitimate interests (to provide our legal services to our clients);
• To maintain our client records and to comply with our legal and regulatory obligations (including our anti-money laundering obligations). Personal data is processed for these purposes on the legal basis of: compliance with legal obligations; bringing and defending legal claims; and/or legitimate interests (to run our legal practice and comply with our obligations;
• To make you aware of regulatory obligations or changes in the law that may be relevant to you. We will also use your personal data to notify you in connection with any changes to any of our terms and conditions to which you are subject. Personal data is processed for these purposes on the legal basis of: compliance with legal obligations; legitimate interests (to showcase our expertise and build our practice); and/or contractual performance;
• To facilitate a sale, restructuring or reorganisation of, any part of our business or its assets. Such processing may include the limited disclosure of your personal data as part of any due diligence process to which we are subject. Personal data is processed for these purposes on the legal basis of: legitimate interests (in order to allow us to reorganise our business);
• To develop and improve our business and services. We process your personal data for research and development purposes to help us understand and enhance the quality of services you receive. Personal data is processed for these purposes on the legal basis of: legitimate interests (to ensure our business remains competitive and provides a high quality service);
• To ensure the Site and any advertising subsisting therein operates effectively. We may process your personal data to: improve your experience on the Site and resolve any troubleshooting issues; undertake testing; improve our security; and monitor the effectiveness of any adverts displayed to you. Personal data is processed for these purposes on the legal basis of: legitimate interests (to ensure our clients and other users are able to effectively access our Site); contractual performance and/or consent;
• To ensure we are paid for any work undertaken on your behalf. Where outstanding fees are owed to us in connection with work we have undertaken on your behalf, we may need to process your personal data to enable us to recover those funds owed to us. Personal data is processed for these purposes on the legal basis of: bringing and defending legal claims; contractual performance; and/or legitimate interests (to ensure we are fairly remunerated for our services); and
• For pre-employment and recruitment purposes. We may process personal data you provide to us in connection with possible employment opportunities with us (if you are subsequently employed by us, your personal data will be processed in accordance with our employee privacy policy). We will not process special category personal data in connection with our recruitment processes unless you voluntarily provide such personal data to us. Personal data is processed for these purposes on the legal basis of: contractual performance; and/or legitimate interests (to ensure we hire the right candidate for the job).

3.3        We do not use your personal data as part of any automated decision-making, including profiling, which produces legal or similarly significant effects concerning you.

4. How we disclose your information

4.1       We do not sell, share, or transfer your personal data except as set out in this Privacy Notice.

4.2      We may share your personal data with our selected partners and third party service providers including:

• our IT and technology support partner(s), including any cloud storage provider(s);
• our cloud based customer relationship and document management system supplier;
• our accountants, auditors and insurance brokers;
• our email processing and archiving, and business software suppliers;
• analytics and search engine providers that assist us in the improvement and optimisation of the Site; and
• relevant external advisors or experts engaged during the course of providing our legal services (e.g. barristers).

4.3       Where necessary in the course of, and as part of, providing legal services to our clients, we may also share your personal data with other persons who are parties to, or involved in the subject matter of those legal services.

4.4        Examples of situations where we may disclose your personal data to third parties include:

• where we buy or sell any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets;
• if we are, or substantially all of our assets are, acquired by a third party, in which case personal data held by us about our clients will be one of the transferred assets; or
• if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, and other agreements (including our Terms of Use), or to protect our rights, or property, or safety, or those of others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

4.5      Other than as expressly set out in this Privacy Notice or as otherwise required or permitted by law, we will not share, sell or distribute any personal data you provide to us without your consent.

6. Third-party websites

6.1        The Site may, from time to time, contain links to and from third party websites.  If you follow a link to any of these websites, please note that those websites have their own privacy policies and privacy practices. We do not control such third parties’ websites and as such do not accept any responsibility or liability for how these websites process or handle your personal data.  Please check these  websites’ policies before you submit any personal data to these websites.

7. Your rights

7.1       In certain circumstances, the UK GDPR may provide you with the right (subject to certain exceptions) to:

• request from us further details as to how your personal data is processed;
• request from us a copy of any personal data we hold about you;
• request that we rectify or complete your personal data, where it is inaccurate or incomplete for the purposes of our processing of the data;
• request that we erase your personal data where we have no legal basis to continue processing that personal data;
• request that we restrict how we process your personal data;
• object to any processing that is based solely on our, or a third party’s legitimate interests, upon which event we shall suspend processing until we demonstrate legitimate purposes that justify that processing. We may however continue to use data for the purpose of establishment, exercise or defence of legal claims; and

• withdraw your consent for future processing (where the processing is based on that consent).

7.2      We will always endeavour to support your rights as a data subject under paragraph 7.1 above, however the exercise of such rights shall at all times remain subject to certain exemptions set out at law and the rights and responsibilities we are subject to at law.

7.3        In line with the UK GDPR, we will comply with any valid request for information under the rights explained above within one month, though we may opt to extend this period by a further two months where necessary, taking into account the complexity and number of the requests you have made to us. This will normally be provided free of charge. If the request is manifestly unfounded, excessive or repetitive we may charge a reasonable fee or refuse to action the request.

7.4       If you withdraw your consent for us to process your personal data and we are unable to rely on another legal basis to process that personal data, we may be unable to offer certain benefits and services to you. For example, if you do not provide data regarding your health which is relevant to a legal case upon which we are acting, this may adversely affect our ability to represent you to the greatest possible extent.

8. Complaints

8.1        You have the right to make a complaint about how we process your personal data to the Information Commissioner (the UK’s data protection regulatory authority):

https://ico.org.uk/concerns/

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow
Cheshire, SK9 5AF
Tel: +44 303 123 1113

9. Changes to this policy

9.1        We may revise this Privacy Notice from time to time. Please check this page regularly to take notice of any changes we may have made.