Our Privacy Policy

This Notice is primarily for the benefit of our clients or potential clients or for related third parties whose data we may process as part of the provision of legal services. We maintain and will provide separate privacy notices in relation to the collection and use of personal information about our staff and employees, including potential employees, during and after their working relationship with us. 

This firm processes your data in accordance with the terms of the Data Protection Act 2018, the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 and the relevant provisions relating to the General Data Protection Regulation contained within the European Union (Withdrawal) Act 2018 (UK GDPR). This Data & Privacy Notice explains, in detail, the types of personal data we may collect about you when you interact with us. It also explains how we will store and handle that data and keep it safe. Unless otherwise indicated, references in this Data and Privacy Notice to the GDPR refer to the UK GDPR.

We know that there's a lot of information here, but we want you to be fully informed about your rights, and how our firm uses your data. We hope the following sections will answer any questions you have but if not, please do get in touch with us.

Conditions for Processing Data

We are only entitled to hold and process your data where the law allows us to. The current law on data protection (Article 6 GDPR) sets out a number of different reasons for which a law firm may collect and process your personal data. These include:

Contractual obligations

The main purpose for our holding your data is to provide you with legal services under the agreement we have with you. This agreement is a contract between us and the law allows us to process your data for the purposes of performing a contract (or for the steps necessary to enter in to a contract). We may also need to process your data to meet our contractual obligations to the Legal Aid Agency where you receive legal aid to fund your case or advice.

Legitimate Interests

In specific situations, we require your data to pursue our legitimate interests in a way which might reasonably be expected as part of running our business and which does not materially impact your rights, freedom or interests. This may include to satisfy our external quality auditors or our Regulators.

Legal compliance

If the law requires us to, we may need to collect and process your data. For example, we can pass on details of people involved in fraud or other criminal activity.

Consent

In some situations, we can collect and process your data with your consent. For example, when you tick a box to receive email newsletters. When collecting your personal data, we'll always make clear to you which data is necessary in connection with a particular service.

When do we collect your data?

We normally collect your data when you provide it to us or when it is provided to us by others (your opponent's solicitors for example) during your case. You may give us your data by email; through an online web form; over the telephone; face to face; or by post.

We also collect data automatically with regard to each of your visits to our website including technical information.

What sort of data do we collect?

Information you provide to us:

You voluntarily give us your personal information for instance when:

• you contact us via our website
• provide a comment on our website
• write a review
• sign up to any newsletters 
• interact with us on social media platforms, and/or 
• use our services.

Where we request information from you we will collect the information set out in the relevant web pages, or as explained to you over the telephone or face to face. 

Client services

We may collect personal data as follows:

• name and contact details (including address, email and phone numbers). This may include asking for and keeping a copy of your passport/driving licence and proof of address
• date of birth
• personal information that may be included in communications with us
• payment information and financial information that relates to a contractual relationship including bank details.

We may gather details of your age; ethnicity; gender etc. if required to do so by the Legal Aid Agency where you are in receipt of Legal Aid. Where you have Legal Aid, we may also gather financial information from you.

We also collect and hold information about your case or legal problem.

Depending on the circumstances of their legal matters, for some clients, we may have access to or process personal data relating to criminal convictions and offences or related security measures. The special condition for processing this data (pursuant to Schedule 1 and Article 10 of the GDPR) is because it is necessary for, connected to and/or or relates to legal claims including for the purposes of assisting with legal proceedings, obtaining legal advice and/or establishing, exercising or defending legal rights. We have considered the risks and impact associated with the processing of criminal offence data not least with regard to data minimisation, security and transparency. All such data is processed in line with the commitments and policies within this Privacy Notice.

Depending on the circumstances of their legal matters, for some clients, we may have access to or process special category data including:

• personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership
• genetic data
• biometric data processed for the purpose of uniquely identifying a natural person, or
• data concerning health or a natural person’s sex life or sexual orientation.

In addition to contract lawful condition for processing under Article 6 of the GDPR (see above), Article 9(2)(f) of the GDPR) permits us to process this data where it is necessary for, connected to and/or or relates to legal claims including for the purposes of assisting with legal proceedings, obtaining legal advice and/or establishing, exercising or defending legal rights. We will only process this specific data if it is necessary to establish, exercise or defend a client’s legal rights. We will ensure that the use of this data is relevant and proportionate and that we do not hold any more data than is needed. All such data is processed in line with the commitments and policies within this Privacy Notice.

Website or third party sources

We collect certain related technical information including, but not limited to, traffic data, location data, logs (including, where available, the IP address and location of the device connecting to the online services and other technical information and identifiers about the device and the nature of the visit such as clickstream to, through and from our website) and other communication data, and the resources that you use.

On occasions, we acquire information from other companies, to collect information about how visitors to our website use the site. Information is also collected about how you arrived at our websites in the first place, including what links or adverts you have viewed or clicked on to reach us, or any search terms you have used. We do this to maintain and improve our website, getting a better understanding of visitor and client profiles and ultimately delivering a better experience. Information may be collected through the use of cookies or pixels.

CCTV

We have installed CCTV systems in some of our offices and on the outside of the buildings and personal data in form of images or CCTV footage may be recorded.

We operate CCTV in accordance with the ICO CCTV Code of Practice and are processing CCTV data in order to pursue our legitimate interests of:

• promoting a safe working environment and monitoring health and safety at our premises
• monitoring the safety and security of our premises
• deterring and assisting in the prevention, investigation and detection of crime and/or serious breaches of policies and procedures, and
• assisting with the identification and prosecution of offenders, including use of images as evidence in criminal proceedings.

CCTV is never used for any automated decision taking.

In all locations, signs are displayed notifying individuals that CCTV is in operation. Images captured by CCTV will not be kept for longer than is necessary and ordinarily, will not be retained for more than 30 days. However, on occasions, there may be a need to keep images for longer such as where a crime is being investigated.

We will only disclose images and audio to other authorised bodies such as the police or other law enforcement agencies for the purposes set out above.

How do we use your data?

Provision of services

We only use your data for the purposes of providing you with legal advice, assistance and where appropriate, representation and for reasons directly associated with those services (i.e. providing information to quality auditors; the Legal Aid Agency etc.)

In particular:

• to deliver our services 
• to manage our relationship and communicate with you
• to provide you with advice or guidance about our services
• to make and manage payments
• to respond to complaints and seek to resolve them
• to train our staff and measure the quality of the service we give to clients.

Regulatory

We also use data to communicate with our regulators or legislators and to obey laws, regulations and codes of conduct that apply to us.

For example, we will process your data to enable us to identify and/or verify your identity and conduct fraud, credit and anti-money laundering checks in accordance with anti-money laundering and counter terrorism financing legislation and regulation.

Consent

We may use your data to notify you of our other services but only where we have your consent to do so.

Website enhancement and business development

We also use data to develop our business and services. In particular:

• to respond to individual experiences shared with us and for editorial content
• to enhance your online experience
• to conduct research and surveys
• to develop and manage our services including marketing of new or enhanced services 
• to research your views and experiences for research and editorial purposes, including through requests for feedback on our services
• to understand your website journey, including what pages you have viewed and for how long
• to administer and keep safe and secure our website and for internal operations, including data analysis, testing, statistical purposes.

Cookies

A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

By law, we may not place cookies on your computer without your consent, unless they are strictly necessary to the operation of the service that we provide on the Website.

We use traffic log cookies to identify which pages are being used. This helps us analyse data about web page traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.

We use Google Analytics to monitor how our website is being used so we can make improvements. Our use of Google Analytics requires us to pass to Google your IP address (but no other information) – Google uses this information to prepare site usage reports for us, but Google may also share this information with other Google services. In particular, Google may use the data collected to contextualize and personalize the ads of its own advertising network. Related information:

• Google's privacy policy
• How Google uses this information.

If you have any queries about the cookies that we use, or would like more information, please contact us by emailing privacy@russellrussell.co.uk 

How do we protect your data?

We take protecting your data very seriously. The data you give us may be subject to Legal Professional Privilege and is often extremely sensitive and confidential.

With this in mind we will treat your data with the utmost care and take all appropriate steps to protect it. We have clear data protection and information security policies and procedures in place (along with Regulatory and other legal obligations to keep your data safe) and these are regularly assessed as part of our Quality Standards and compliance processes.

We protect our IT system from Cyber Attack. Access to your personal data is password-protected, and sensitive data is secured by encryption.

We regularly monitor our system for possible vulnerabilities and attacks, and we carry out penetration testing to identify ways to further strengthen security.

How long will we keep your data?

We only keep your data for as long as is necessary for the purpose(s) for which it was provided. 

We use the following retention periods and review these periodically to make sure we are only keeping personal data and other data for as long as is needed:

• information in a matter file or related to a matter or instructions to us such as information on our case management system will usually be kept for a period of seven years after the case or matter ends unless it is required to be kept for longer (for instance, the information is required for another or related case or matter or where the person is currently under the age of eighteen, in which case data will need to be held for seven years after they reach the age of eighteen), or we have another legal basis to process that information. This is because we are required to keep client files for that period by our Regulator and/or by the SRA. This also protects you should you be unhappy with our services and want to complain or even due us after your case ends.
• data obtained for compliance with crime or fraud prevention has to be retained by us to meet our legal or regulatory obligations for five years from the close of the individual matter or the end of our business relationship with a relevant person, whichever is later
• enquiries where we do not take on your case are kept for only 18 months
• any complaints files for seven years after the complaint is concluded (with the associated matter file(s)
• financial information and any financial transactions will be kept for a period of 7 years to comply with HMRC requirements except for cardholder data which will generally be destroyed immediately after the transaction is processed.

For some data we may decide that it is proper and appropriate to keep data for longer than the above, but we will notify you if we believe that your case falls into this category or there is another reason your data has to be retained.

Who do we share your personal data with?

We sometimes share your personal data with trusted third parties. We only do this where it is necessary for providing you legal services or for the effective operation of our legal practice.

For example, we may share your data with barristers; experts; translators; costs draftsmen; process servers; secure file storage and destruction companies; auditors; the company that securely hosts our off-site cloud storage servers.

• We apply a strict policy to those recipients or data processors to keep your data safe and protect your privacy. In particular:
• We provide only the information they need to perform their specific services.
• They may only use your data for the exact purposes we specify in our contract with them.
• We work closely with them to ensure that your privacy is respected and protected at all times.
• If we stop using their services, any of your data held by them will either be deleted or rendered anonymous.

Where is your data processed?

Your data is stored and processed within the United Kingdom (UK). If we ever have to share your personal data with third parties and suppliers outside the UK we will seek your specific consent to do so.

What are your rights?

You have the following rights under the UK GDPR:

1. the right to be informed – the provision of clear and concise information about what we do with your personal data, as outlined within this Data & Privacy Notice
2. the right of access – commonly referred to as a ‘data subject access request’, this enables you to request a copy of your personal data to understand how and why we are using your data, and to check we are doing so lawfully. If we choose not to action your request, we will explain to you the reasons for our refusal
3. the right to rectification – the ability to have inaccurate personal data rectified or, in specific circumstances dependent on the purposes for our processing of your data, the ability to have incomplete personal data completed
4. the right to erasure – also known as the right to be forgotten, this permits you to request we erase your personal data. This only applies to data we hold at the time your request is received and does not apply to any data that may be obtained in the future. Please note that this is not an absolute right and only applies in certain circumstances. We may have overriding duties to retain some data which you cannot ask to be erased immediately or at all. For instance, once you become a client of our firm or you are an interested party in a case, we will be required by our regulators and for legal purposes to retain some of your personal data and other information within casefiles for a certain period (for retention periods, please see above)
5. the right to restrict processing – the ability to request a temporary restriction on the processing of your personal data, where one of a limited number of reasons specified by the ICO applies
6. the right to data portability – the ability to receive personal data you have provided to us in a structured, commonly used and machine readable format. This also gives you the right to request that we transmit this data directly to another Data Controller
7. the right to object – the ability, in certain circumstances, to request we stop processing your personal data. This request may relate to all of your personal data we hold or only certain information, and may only apply to a particular purpose for processing
8. rights in relation to automated decision making and profiling – restrictions on the use of automated decision making and profiling where such decisions have a legal or similarly significant effect on you. It is unlikely that our firm will use automated decision making and profiling.

For further details on your rights, please visit the Information Commissioner’s Office at https://ico.org.uk/your-data-matters/

Contact Details

For information on how your information is used, how we maintain the security of our information, and to exercise your rights to access information we hold on you, please contact us. Similarly, if you believe that the information we hold is wrong or out of date, please let us know and we will update it. The person in this firm responsible for data protection is our Data Protection Officer, Andrew Perry, and enquires and requests can be sent to him by emailing privacy@russellrussell.co.uk or in writing to Atria, Spa Road, Bolton, BL1 4AG.

Links to other websites

Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this policy. You should exercise caution and look at the privacy statement or policy applicable to the website in question.

The Regulator

If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner's Office.

• You can contact them by calling 0303 123 1113.
• Or go online to www.ico.org.uk (opens in a new window; please note we can't be responsible for the content of external websites).

Changes to this Notice

We do not intend to process a client or related third party’s personal information for any reason other than stated within this privacy notice. If this changes, we will update this privacy notice on this webpage and in any documentation we will send to you. However, internet and data privacy best practice and acceptable standards are developing. We therefore reserve the right to revise this Notice at any time. If this Notice changes in any way, we will place an updated version on this webpage. For all other clients with ongoing instructions, we will provide a copy directly. Continued instructions to us will signify that you agree to any such changes.

Version: August 2023

xxxxxx

For the purpose of the GDPR (General Data Protection Regulation) you can contact our Risk and Compliance Officer, Neil Seddon, who can be contacted via email at privacy@russellrussell.co.uk. He is supported in data protection matters by our Data Protection Officer, Andrew Perry.

This policy covers the following:

1. Who are we?
2. Sources of information
3. Visitors to our offices
4. What information do we ask for?
5. How do we use your information?
6. Marketing and sharing your information
7. How long do we keep your information?
8. How do we protect your personal data?
9. How you can access the information we hold about you?
10. What are your rights under GDPR?
11. Our website and websites linked to ours.
12. How to contact us about data privacy?

Who are we?

• Russell & Russell Solicitors LLP is a limited liability partnership registered in England & Wales, No. OC420972 | VAT no. GB 146 948 331
• The registered office is Atria, Spa Road, Bolton, BL1 4AG. where a list of members is open to inspection
• Russell & Russell Solicitors LLP is authorised and regulated by the Solicitors Regulation Authority, No. 653317
• Russell & Russell is the trading name for Russell & Russell Solicitors LLP
• Our ICO Registration Number is: ZA491951.

Sources of information

• We collect most of this personal information directly from you – in person, by telephone, text or email and/or via our website and any apps. However, we may also collect information from:
  • publicly accessible sources, e.g. Companies House or HM Land Registry;
  • a third party directly, e.g. a business such as an estate agency or claims management company that has introduced you to Russell & Russell;
  • customer due diligence providers;
  • a third party with your consent, e.g. your bank or building society.
  • Information provided to us when you communicate with us for any reason, usually in connection with work we are doing for you.
  • Information may be passed to us by third parties in order that we can undertake legal work on your behalf. For example, referrers of work, banks, building societies and medical institutions.

Visitors to our offices

• Visitors to our offices are required to sign in and out. Basic information such as the visitor’s name and business is recorded. The sign-in sheets are kept secure and destroyed after a short period of time. These records are only accessed if we need to investigate an incident.
• CCTV – our Newport Street, Advice Centre in Bolton office has CCTV cameras installed. We consider CCTV necessary for the safety of our staff and visitors, as well as the detection and prevention of crime.

What information do we ask for?

• This notice is intended for clients and prospective clients. The information we will request from you will depend on what you have asked us to do or what we are contracted to do for you. This personal information is required to provide legal services to you. If you do not provide personal information we ask for, it may delay or prevent us from providing legal services to you.
  • Personal data: is the general information that you supply about yourself, such as your name, address, gender, date of birth & contact details and information needed to complete identity (ID) checks. It may also include other information depending on your legal matter such as financial and banking information, family details and similar.
  • Sensitive personal data: is, by its nature, more sensitive information and may include your racial or ethnic origin, religion, health or criminal convictions or details of your children for example.
  • In the majority of cases personal data will be restricted to basic personal information necessary to act on your behalf. However, some of the work we do may require us to ask for more sensitive personal information.
  • Where individuals contact us for information, we collect basic information such as name, contact details and the nature of their enquiry. Information will normally be used only for the purposes of responding to the enquiry. 
  • Inbound telephone calls to certain departments are recorded and a sample of the calls are monitored for compliance and quality purposes. The recordings are stored for a short period of time and the retention periods for other enquiries vary depending on the nature but they will be kept for no longer than necessary.
  • Website enquiries - you may give us information about you by filling in forms on our website or by corresponding with us by phone, e-mail or otherwise. This includes information you provide when you register to use our Website or when you report a problem with our Website. The information you give us may include your name, address, e-mail address and phone number and financial information

How do we use your information?

• We process the information you provide primarily for the provision of legal services to you and our use of that information is subject to your instructions, data protection law and our duty of confidentiality.
• The following are some examples of how we process your data: 
  • To carry out our contractual commitments to you, comply with the law or where processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.
  • compliance with our legal and regulatory obligations;
  • Money Laundering Regulations 2017. Before establishing a business relationship or entering into an occasional transaction with a new client any personal data received from clients in order to comply with the Regulations will only be processed for the purpose of preventing money laundering or terrorist financing unless such processing is permitted by law or the client consents to any alternative use of the data;
  • updating and enhancing client records;
  • analysis to help us manage our practice;
  • Statutory returns;
  • External audits and quality checks, e.g. for Lexcel, CQS, WIQS and accounts audits;
  • To seek advice from third parties; such as legal and non-legal experts. For example, barristers, expert witnesses and other professional advisers, including sometimes advisers appointed by another party to your matter.
  • To provide you with information requested from us relating to our services and to provide information on other services which we feel may be of interest to you if you have consented to receive such information.

Marketing and sharing your information

• If you’d like to receive marketing information from us in the future you will need to give us consent to send information to you about our services. To opt in please complete our marketing consent form. 
• You can also opt out of receiving marketing information from us at any time by clicking on “unsubscribe” on emails you receive from us or contacting privacy@russellrussell.co.uk.
• We might share your information with legal representatives on the other side of the transaction and with third party experts if required. We may also share your information with government and other organisations when necessary such as the Legal Aid Agency, HMRC, the Courts, National Probation Service or Court of Protection to name some common examples.
• We understand the importance of your privacy, so you can be assured that we’ll not share your information with any third parties for marketing purposes. 

How long do we keep your information?

• Your personal information will be retained in computer and paper files, only for as long as necessary to fulfil the purposes for which the information was collected; or as required by law; or as long as is set out in any relevant contract you may hold with us. For example:
  • We will keep your personal information while we are providing legal services to you. Thereafter, we will keep your personal information for as long as is necessary to respond to any questions, complaints or claims made by you or on your behalf, show that we treated you fairly and keep records required by law.
  • We will not retain your personal information for longer than necessary for the purposes set out in this notice.
  • Different retention periods apply for different types of legal matters. The retention period will be noted on your file closing correspondence at the completion of your case.
  • For most matters a minimum of 6 years from the conclusion or closure of your legal work; in the event that you, or we, need to re-open your case for the purpose of defending complaints or claims.
  • Some information or matters may be kept for longer, for example:
    • Property purchase 15 years
    • Unregistered property deeds may be kept indefinitely to evidence ownership.
    • Matrimonial matters including financial orders or maintenance agreements.
    • Probate matters until a surviving spouse or civil partner has died in order to deal with any transferable Inheritance Tax allowance.
    • Wills and related documents may be kept indefinitely.
    • For the duration of a trust.
    • Personal injury matters which involve lifetime awards or PI Trusts may be kept for longer periods.

How do we protect your personal data?

• We recognise that your information is valuable and we take all reasonable measures to protect it whilst it is in our care.
• We have appropriate security measures to prevent personal data from being accidentally lost, or used or accessed unlawfully. We limit access to your personal data to those who have a genuine business need to access it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality. 
• We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.
• Information may be held at our offices, or on backup servers maintained by our IT Team. Alternatively, it may be held by third parties noted above.
• In rare situations these third parties may be based outside the European Economic Area (EEA). Territories outside the EEA countries generally do not have the same data protection laws as the UK and EEA. We will, however, take reasonable steps to ensure the transfer complies with data protection law and all personal information will be secure.

How you can access the information we hold about you

• You have a right of access under data protection law to the personal data that we hold about you. We seek to keep that personal data correct and up to date. You should let us know if you believe the information we hold about you needs to be corrected or updated.
• You are entitled to request a copy of your personal data, known as a Subject Access Request. A request for access to your personal data means you are entitled to a copy of the data we hold on you – such as your name, address, contact details, date of birth, information regarding your health etc. This means that a Subject Access Request will not normally result in you getting a copy of your file because you are only entitled to your personal data – not the documents that contain that data.
• If you wish to make a request, please do so in writing addressed to our Data Protection Officer on the contact details below or contact the person dealing with your matter.

What are your rights under GDPR?

• You have the following rights, which you can exercise free of charge:
  • Access - The right to be provided with a copy of your personal information (the right of access)
  • Rectification - The right to require us to correct any mistakes in your personal information 
  • To be forgotten - The right to require us to delete your personal information—in certain situations
  • Restriction of processing - The right to require us to restrict processing of your personal information—in certain circumstances, e.g. if you contest the accuracy of the data 
  • Data portability - The right to receive the personal information you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations. 
  • To object - The right to object: at any time to your personal information being processed for direct marketing (including profiling);  in certain other situations to our continued processing of your personal information, e.g. processing carried out for the purpose of our legitimate interests. 
• If you would like to exercise any of those rights, please send an e-mail to privacy@russellrussell.co.uk. Please note that before discussing any request we may require you to provide information in order to verify your identity. 
• How to complain - We always aim to resolve any query or concern you may raise about our use of your information. Please send details of any concerns to privacy@russellrussell.co.uk
• The DPA also gives you right to lodge a complaint with the data protection regulator, the ICO. For more information, please visit the ICO website.

Our website and websites linked to ours

• You might find links to third party websites on our website. These websites should have their own privacy policies which you should check. We do not accept any responsibility or liability for their policies.

Contact us about data privacy

• We welcome any queries, comments or requests you may have regarding this policy please do not hesitate to contact us at privacy@russellrussell.co.uk.
• If you would prefer to write to us then please write to the Data Protection Officer, Russell & Russell Solicitors LLP, Atria, Spa Road, Bolton, BL1 4AG. 
• We keep our privacy notice under regular review so please check for updates from time to time. This privacy notice was last updated on 11th September 2019.