Privacy & Cookie Policies

Privacy Policy

The General Data Protection Regulation (the “GDPR”) seeks to protect personal data and the rights of data subjects. 

It is important that you read this notice, together with any other privacy information or notices we may provide when we are collecting personal information about you, so that you are aware of how and why we are using such information.

• We reserve the right to update this notice at any time. We recommend that you regularly check our website for updates
• If you have any questions about this notice or how we handle your personal information, please contact Lee Marston, by email lee.marston@clough-willis.co.uk or by post to: Lee Marston, Clough & Willis Solicitors, 2 Manchester Road, Bury, BL9 0DT
• It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during the course of our engagement with you
• This notice describes how Clough & Willis collect and use your personal information 

Who are we?

Clough & Willis Solicitors 

• We are a 'data controller'. This means that we are responsible for deciding how we hold and use personal information about you.
• This notice applies to prospective, existing and former Clients (including employees and representatives of our corporate Clients); individual and business contacts and prospects; referrers; individuals who request information from us; any person who provides services to us, either as an individual or as the employee or representative of a corporate service provider; third parties acting for our Clients; parties on the other side of our Client matters and lawyers acting for such parties.

What information do we hold? 

Personal data means any information relating to a person who can be directly or indirectly identified.

We collect different information depending on your relationship with us 

Individual Clients 

The following personal information is collected and processed.  

Purpose/Activity	Lawful basis for processing
(a) Your name, address and contact details.  (b) Your bank details / debit or credit card details and statements  (c) DOB  (d) ID documents driving licence /  passport / utility bills  (e) We process other information relating to your matter including criminal records /     interview statements / medical details / NI number / employment details & earnings /   school records / unique tax payers reference /  children’s name relating to your legal   matter and our instructions.  (f) Deeds/Wills/LPAs	(a) Performance of a contract with you  (b) Necessary to comply with a legal & regulatory obligation  (c) Necessary for our legitimate interests  (d) Necessary for the purpose of providing legal advice to you.
(a) Your marketing preferences and details of any services you have subscribed to	(a) Legitimate interest of promoting and growing our business and in our providing   you with relevant legal services.
(a) Lifestyle information and information about your family	(a) Legitimate interest of informing and improving the service we provide to you.
(a) Feedback you provide to us on our services or events	(a) Legitimate interest of managing our business and improving our services.

Individual prospects and other non-client contacts

The following personal information is collected and processed.

Purpose/Activity	Lawful basis for processing
(a) Your name, address and contact details.  (b) Your bank details / debit or credit card details and   statements  (c) DOB  (d) ID documents driving licence / passport / utility bills  (e) We process other information relating to your matter   including criminal records / interview statements / medical   details / NI number / employment details & earnings /   school records / unique tax payers reference /  children’s   name relating to your legal matter and our instructions.	(a) Performance of a contract with you  (b) Necessary to comply with a legal & regulatory   obligation  (c) Necessary for our legitimate interests  (d) Necessary for the purpose of providing legal advice   to you.
(a) Your marketing preferences and details of any services   you have subscribed to	(a) Legitimate interest of promoting and growing our   business and in our providing you with relevant legal   services.
(a) Lifestyle information and information about your family	(a) Legitimate interest of informing and improving the   service we provide to you.
(a) Feedback you provide to us on our services or events	( a) Legitimate interest of managing our business and   improving our services.

Individual service providers 

The following personal information is collected and processed.

Purpose/Activity	Lawful basis for processing
(a) Your name, title, business address, telephone number   and email address  (b) Contract details including financial information and   bank details  (c) Credit checks and verification of your identity	(a) Performance of a contract between us  (b) Necessary to comply with a legal & regulatory   obligation  (c) Necessary for our legitimate interests
(a) Your marketing preferences and details of any services   you have subscribed to	(a) Legitimate interest of promoting and growing our   business and in our providing you with relevant legal   services.
(a) Lifestyle information and information about your family	(a) Legitimate interest of informing and improving the   service we provide to you.
(a) Feedback you provide to us on our services or events	(a) Legitimate interest of managing our business and   improving our services.

Corporate Clients, suppliers and third party business contacts and prospects 

The following personal information is collected and processed.

Purpose/Activity	Lawful basis for processing
(a) Names, titles and business contact information   including addresses, telephone numbers and email   addresses for your employees and representative  (b) Bank account details  (c) Proof of address of directors / shareholders  (d) Verification of the company registration details  (e) We process information relating to your legal matter   and our instructions.  (f) If you are an employer, information about your staff   may also be processed	(a) Performance of a contract between us  (b) Necessary to comply with a legal & regulatory   obligation  (c) Necessary for our legitimate interests  (d) Necessary for the purpose of providing legal advice  to you.
(a) Your marketing preferences and details of any services   you have subscribed to	(a) Legitimate interest of promoting and growing our   business and in our providing you with relevant legal   services.
(a) Any events your employees and representatives have   attended	(a) Legitimate interest of promoting and growing our   business and in our providing you with relevant legal   services.
(a) Feedback you (your employees or representatives)   provide to us on our services	(a) Legitimate interest of managing our business and   improving our services.

Parties on the other side in Client matters 

The following personal information is collected and processed.

Purpose/Activity	Lawful basis for processing
For parties / representatives acting on the other side  (a) We will collect your contact details  (b) Information about you / your client(s)  (c)  Process information contained in documents reviewed   by us as part of our due diligence and/or as provided to us   in disclosure.	(a) Performance of a contract between us  (b) Necessary to comply with a legal & regulatory   obligation  (c) Necessary for the purpose of providing legal advice   to our client with the purpose of establishing, exercising  or defending legal claims

How we collect information about you? 

• Personal information is collected from you when you enquire about our services, become a client, you register for an event or register to receive information from us, or where we enter into a contract to receive services from you.
• Further information will be collected and processed during the period of our relationship or contract.
• We also collect information about you from parties acting on the other side.
• Information from other third parties, such as other professionals (doctors, accountants, police), employer, partner organisations, credit reference agencies or other background check agencies.
• We may collect information about you from public sources, such as Companies House or the Land Registry, from an online search or from social media sites. 

Lawful basis for using your personal information

We will only use your personal information when the law allows us to. 

• The performance of a contract we have entered into with you.
• To comply with our legal and regulatory obligations
• Where it is necessary for our legitimate interests
• To protect yours or someone else’s vital interests 

There may be several grounds which justify our use of your personal information.

Change of purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. 

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law. 

Sensitive personal information

Further justification is needed for collecting, processing, storing and using the following types of sensitive personal information: 

• nationality, race or ethnicity
• physical or mental health, including any medical condition or disability
• sexual orientation or sex life
• political opinions
• genetic information and biometric data
• religious or philosophical beliefs
• trade union membership
• information relating to criminal convictions and offences. 

We may process particularly sensitive personal information if we are under a legal / regulatory obligation to do so, to establish, exercise or defend a legal claim or if it becomes necessary to protect your vital interests or those of another person. 

We may approach you for your written consent to allow us to process certain particularly sensitive information. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. 

Criminal convictions

We may process criminal conviction information if we are under a legal / regulatory obligation to do so, to establish, exercise or defend a legal claim or if it becomes necessary to protect your vital interests or those of another person.

Anti-Money Laundering 

We are required by law to verify the identity of all new Clients and after a period of time existing Clients. 

For Corporate Clients we will need to verify the identity of the directors, shareholders, beneficial owners, management and/or other relevant background information. 

We will require evidence of source of funds at the outset, which we may request and/or obtain from third parties. We will also require in some circumstances to make enquiries of any unusual transactions such as the transfer of large amounts of cash. 

In some circumstances we may decline to, or may not be permitted to, act until such procedures have been completed. We reserve the right to decline to act or, if appropriate, cease to act should these procedures not be completed to our satisfaction. 

Data sharing

If you are a Client, we will share your personal information with third parties where required, for example to meet our regulatory obligations.  For example: 

• the Solicitor's Regulation Authority (SRA), Legal Ombudsman, HMRC or other government or law enforcement agencies;
• our insurance providers and our professional indemnity insurance broker; and
• Lexcel (the Law Society's legal practice accreditation service) and other auditors, for the purpose of auditing our compliance with our legal obligations (including Anti-Money Laundering requirements) and the SRA rules. 

We may share your information if we refer you to a third party adviser for specialist advice or if we are prevented from acting for you due to a conflict. 

The following activities are carried out by third party service providers on our behalf: archiving and records management; confidential waste disposal; IT support and maintenance; hosting our website (including analytics); marketing campaigns; carrying out surveys and obtaining feedback on our services. 

If you attend one of our events we may share names and contact details with our co-organisers and on the delegate list which is shared with other attendees. 

We do not allow our third party service providers to use your personal information for their own purposes. Where we do share information with third parties, they are responsible to you for their use of your information and compliance with the law. 

Transferring information outside the European Economic Area (EEA)

All our personal information is hosted on servers located within the EEA. 

We may transfer the personal information we collect about you to countries outside the EU in order to process your personal information on one of the grounds listed above. It is possible that the European Commission will have deemed such countries adequate. This means we can transfer your personal information to those countries as they will provide an adequate level of protection for your personal information. 

However, not all countries to which we may transfer your personal information will be deemed adequate by the European Commission. To ensure that your personal information does receive an adequate level of protection we will put in place standard contractual clauses approved by the European Commission with those third parties wherever necessary. This ensures that your personal information is treated in a way that is consistent with and which respects the applicable laws on data protection. 

Data security 

Appropriate security measures are in place to prevent your personal information from being lost, used or accessed in an unauthorised way, altered or disclosed.

A procedure is in place to deal with any suspected data security breach.  We will notify you together with our regulatory body of a suspected breach where we are legally required to do so. 

Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure. 

How long will we will keep your information?

We will only retain your personal information for as long as is necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements. 

To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements. 

Where a minimum retention period is required by law (such as retaining records for HMRC purposes or for compliance with the SRA requirements, or anti-money laundering law), we comply with that minimum period.

We retain Client documents in line with the Law Society's recommended retention periods. We apply the same rules to electronic files as to paper files. 

If for any reason we are required to retain your information longer than our standard retention periods, we will let you know (unless we are prevented by law from doing so).

Your rights in connection with personal information

Under certain circumstances, by law you have the right to: 

• Right of access - commonly referred to as subject access, gives you the right to obtain a copy of the personal information we hold on you.
• Right to rectification – you have a right to correct personal information that is held about you if it is inaccurate or incomplete.
• Right to withdraw consent - in the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we are required to continue to process your information in accordance with another lawful basis which has been notified to you.
• Right to erasure – in certain circumstances you have the right to ask us to delete or remove your personal information.  This is also known as the ‘right to be forgotten’. The right is not absolute and only applies in certain circumstances.
• Right to restrict processing - in certain circumstances you have the right to restrict the processing of your personal data.  This means that you can limit the way we use your data and is an alternative to requesting the erasure of you data.
• Right to data portability – you have the right to have the personal data we hold about you to be transferred to another organisation in a structured, commonly used and machine readable format. It also gives you the right to request that we provide this data directly to another data controller.
• Right to object – this gives you the right to object to us processing your personal data, however this right only applies in certain circumstances. 

To withdraw your consent or to exercise any of the above rights please contact Lee Marston, by email lee.marston@clough-willis.co.uk or by post to: Lee Marston, Clough & Willis Solicitors, 2 Manchester Road, Bury, BL9 0DT 

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances. 

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it. 

Cookie Policy