PRIVACY POLICY
About this notice
1. This privacy notice contains information about the information SMA Solicitors collect, store and otherwise process about you and the reasons for the processing. It also tells you who we share this information with, the security mechanisms we have put in place to protect your data and how to contact us in the event you need further information.
Who are we?
2. SMA, as a firm of solicitors, collect, use and are responsible for personal information about you. When we do this, we are the ‘controller’ of this information for the purposes of the GDPR and the Data Protection Act 2018.
3. If you need to contact us about your data or the processing carried out you can use the contact details at the end of this document or those that have been supplied during the course of our client care agreement.
What do we do with your personal information?
Information collected from you
4. When carrying out the provision of legal services or providing a reference, SMA collects personal information that you provide which may include any or all of the following:
4.1. personal details
4.2. family details
4.3. lifestyle and social circumstances
4.4. goods and services
4.5. financial details
4.6. education, training and employment details
4.7. physical or mental health details
4.8. racial or ethnic origin
4.9. political opinions
4.10. religious, philosophical or other beliefs
4.11. trade union membership
4.12. sex life or sexual orientation
4.13. genetic data
4.14. biometric data for the purpose of uniquely identifying a natural person
4.15. criminal proceedings, outcomes and sentences, and related security measures
4.16. other personal data relevant to instructions to provide legal services, including data specific to the instructions in question.
Information collected from others
5. We may also obtain the same categories of personal information listed above third parties, such as other legal professionals or experts, members of the public, your family and friends, witnesses, courts and other tribunals, investigators, government departments, regulators, public records and registers.
How do we use your personal information?
6. We may use your personal information for the following purposes:
6.1. to provide legal services to our clients, including the provision of legal advice and representation in courts, tribunals, arbitrations, and mediations
6.2. to keep accounting records and carry out office administration
6.3. to take or defend legal or regulatory proceedings or to exercise a lien
6.4. to respond to potential complaints or make complaints
6.5. to check for potential conflicts of interest in relation to future potential cases
6.6. to promote and market my services
6.7. to carry out anti-money laundering and terrorist financing checks
6.8. to train other solicitors / paralegals and when providing work-shadowing opportunities
6.9. to respond to requests for references
6.10. when procuring goods and services
6.11. to publish legal judgments and decisions of courts and tribunals
6.12. as required or permitted by law.
Whether information has to be provided by you, and why
7. If we have been instructed by you or on your behalf on a case, or if you have asked for a reference, your personal information has to be provided, to enable us to provide you with advice or representation or the reference, and to enable us to comply with my professional obligations, and to keep accounting records.
The legal basis for processing your personal information
8. We rely on the following as the lawful bases on which we collect and use your personal information:
8.1. If you have consented to the processing of your personal information, then we may process your information for the Purposes set out above to the extent to which you have consented to us doing so.
8.2. If you are a client, processing is necessary for the performance of a contract for legal services or in order to take steps at your request prior to entering into a contract.
8.3. In relation to information which is in categories (4.7) to (4.16) above (these being categories which are considered to include particularly sensitive information and which include information about criminal convictions or proceedings) we rely on your consent for any processing for the purposes set out in purposes above. We need your consent to carry out processing of this data for these purposes. However, if you do not consent to processing for purposes the following: responding to potential complaints and providing a reference, we will be unable to take your case or to provide a reference. This is because we need to be able to retain all the material about your case until there is no prospect of a complaint and to provide an informed and complete reference.
8.4. In relation to information in categories 4.7-4.16 above (these being categories which are considered to be particularly sensitive information and include information about criminal convictions or proceedings), we are entitled by law to process the information where the processing is necessary for legal proceedings, legal advice, or otherwise for establishing, exercising or defending legal rights.
8.5. In relation to information which is not in categories 4.7-4.16 above, we rely on our legitimate interest and/or the legitimate interests of a third party in carrying out the processing for the Purposes set out above.
8.6. In certain circumstances processing may be necessary in order that we can comply with a legal obligation to which we are subject (including carrying out anti-money laundering or terrorist financing checks).
8.7. The processing is necessary to publish judgments or other decisions of courts or tribunals.
Who will we share your personal information with?
9. If you are a client, some of the information you provide will be protected by legal professional privilege unless and until the information becomes public in the course of any proceedings or otherwise. As your representatives, we have an obligation to keep your information confidential, except where it otherwise becomes public or is disclosed as part of the case or proceedings.
10. It may be necessary to share your information with the following:
10.1. data processors, such as SMA’s staff, IT support staff, email providers, data storage providers
10.2. other legal professionals
10.3. experts and other witnesses
10.4. prosecution authorities
10.5. courts and tribunals
10.6. trainee solicitors / paralegals / administrative staff
10.7. lay clients
10.8. family and associates of the person whose personal information we are processing
10.9. in the event of complaints, the Head of Complaints, the Solicitors Regulatory Authority (SRA), and the Legal Ombudsman
10.10. other regulatory authorities
10.11. current, past or prospective employers
10.12. education and examining bodies
10.13. business associates, professional advisers and trade bodies, e.g. the SRA
10.14. the intended recipient, where you have asked us to provide a reference
10.15. the general public in relation to the publication of legal judgments and decisions of courts and tribunals
11. We may be required to provide your information to regulators, such as the Solicitors Regulatory Authority, the Financial Conduct Authority or the Information Commissioner’s Office. In the case of the Information Commissioner’s Office, there is a risk that your information may lawfully be disclosed by them for the purpose of any other civil or criminal proceedings, without our consent or yours, which includes privileged information.
12. We may also be required to disclose your information to the police or intelligence services, where required or permitted by law.
Sources of information
13. The personal information we obtain may include information which has been obtained from:
13.1. other legal professionals
13.2. experts and other witnesses
13.3. prosecution authorities
13.4. courts and tribunals
13.5. trainee solicitors / administrative staff / paralegals
13.6. lay clients
13.7. family and associates of the person whose personal information we am processing
13.8. in the event of complaints, members of the firm who deal with complaints, the Bar Standards Board, and the Legal Ombudsman
13.9. other regulatory authorities
13.10. current, past or prospective employers
13.11. education and examining bodies
13.12. business associates, professional advisers and trade bodies, e.g. the Bar Council
13.13. the intended recipient, where you have asked us to provide a reference.
13.14. the general public in relation to the publication of legal judgments and decisions of courts and tribunals
13.15. data processors, such as our staff, IT support staff, email providers, data storage providers
13.16. public sources, such as the press, public registers and law reports
Transfer of your information outside the European Economic Area (EEA)
14. This privacy notice is of general application and as such it is not possible to state whether it will be necessary to transfer your information out of the EEA in any particular case or for a reference. However, if you reside outside the EEA or your case or the role for which you require a reference involves persons or organisations or courts and tribunals outside the EEA then it may be necessary to transfer some of your data to that country outside of the EEA for that purpose. If you are in a country outside the EEA or if the instructions you provide come from outside the EEA then it is inevitable that information will be transferred to those countries. If this applies to you and you wish additional precautions to be taken in respect of your information please indicate this when providing initial instructions.
15. Some countries and organisations outside the EEA have been assessed by the European Commission and their data protection laws and procedures found to show adequate protection. The list can be found here. Most do not. If your information has to be transferred outside the EEA, then it may not have the same protections and you may not have the same rights as you would within the EEA.
16. We may transfer your personal information to the following which are located outside the European Economic Area (EEA):
16.1. cloud data storage services based in the USA who have agreed to comply with the EU-U.S. Privacy Shield, in order to enable us to store your data and/or backup copies of your data so that we may access your data when they need to. The USA does not have the same data protection laws as the EU but the EU-U.S. Privacy Shield has been recognised by the European Commission as providing adequate protection.
16.2. cloud data storage services based in Switzerland, in order to enable us to store your data and/or backup copies of your data so that we may access your data when we need to. Switzerland does not have the same data protection laws as the EU but has been recognised by the European Commission as providing adequate protection.
17. If we decide to publish a judgment or other decision of a Court or Tribunal containing your information then this will be published to the world.
18. We will not otherwise transfer personal information outside the EEA (except as necessary for providing legal services or for any legal proceedings).
19. If you would like any further information please use the contact details at the end of this document.
How long will we store your personal data?
20. We will normally store all your information:
20.1. Until at least 1 year after the expiry of any relevant limitation period (which will usually be 15 years as recommended by my insurers), from the date of the last item of work carried out, the date of the last payment received or the date on which all outstanding payments are written off (whichever is the latest). This is because it may be needed for potential legal proceedings or subject to a complaint. At this point any further retention will be reviewed and the data will be marked for deletion or marked for retention for a further period. The latter retention period is likely to occur only where the information is needed for legal proceedings, regulatory matters or active complaints. Deletion will be carried out (without further notice to you) as soon as reasonably practicable after the data is marked for deletion.
20.2. We will store some of your information which we need to carry out conflict checks for the rest of the firms’ existence. However, this is likely to be limited to your name and contact details/ the name of the case. This will not include any information within categories 4.7-4.16 above.
20.3. Information related to anti-money laundering checks will be retained until five years after the completion of the transaction or the end of the business relationship, whichever is the later.
20.4. Names and contact details held for marketing purposes will be stored indefinitely or until we become aware or are informed that the individual has ceased to be a potential client.
Consent
21. As explained above, we are relying on your explicit consent to process your information in categories 4.7-4.16 above. You provided this consent when you agreed that SMA would provide legal services/you asked us to provide a reference.
22. You have the right to withdraw this consent at any time, but this will not affect the lawfulness of any processing activity we have carried out prior to you withdrawing your consent. However, where we also rely on other basis for processing your information, you may not be able to prevent processing of your data. For example, if you have asked us to work for you and we have spent time on your case, you may owe us money which we will be entitled to claim.
23. If there is an issue with the processing of your information, please contact my clerks using the contact details below.
Your rights
24. Under the GDPR, you have a number of rights that you can exercise in certain circumstances. These are free of charge. In summary, you may have the right to:
24.1. ask for access to your personal information and other supplementary information
24.2. ask for correction of mistakes in your data or to complete missing information we hold on you
24.3. ask for your personal information to be erased, in certain circumstances
24.4. receive a copy of the personal information you have provided to us or have this information sent to a third party. This will be provided to you or the third party in a structured, commonly used and machine readable format, e.g. a Word file
24.5. object at any time to processing of your personal information for direct marketing
24.6. object in certain other situations to the continued processing of your personal information
24.7. restrict our processing of your personal information in certain circumstances.
25. If you want more information about your rights under the GDPR please see the Guidance from the Information Commissioners Office on Individual’s rights under the GDPR.
26. If you want to exercise any of these rights, please:
26.1. use the contact details at the end of this document
26.2. we may need to ask you to provide other information so that you can be identified
26.3. please provide a contact address so that you can be contacted to request further information to verify your identity
26.4. provide proof of your identity and address
26.5. state the right or rights that you wish to exercise.
27. We will respond to you within one month from when we receive your request.
Marketing emails
28. Please note if you wish to unsubscribe from any marketing emails that you receive from SMA, you can do so emailing info@smalaw.co.uk (subject line ‘unsubscribe’). It may take up to one week for this to become effective.
How to make a complaint?
29. The GDPR also gives you the right to lodge a complaint with the Information Commissioners’ Office if you are in the UK, or with the supervisory authority of the Member State where you work, normally live or where the alleged infringement of data protection laws occurred. The Information Commissioner’s Office can be contacted at http://ico.org.uk/concerns/.
Future processing
30. We do not intend to process your personal information except for the reasons stated within this privacy notice. If this changes, this privacy notice will be amended and placed on our website page.
Changes to this privacy notice
31. This privacy notice was last updated on 30 July 2020
32. We continually review our privacy practices and may change this policy from time to time. When we do it will be placed on our website.
Contact details
33. If you have any questions about this privacy notice or the information we hold about you, please contact us using the contact details below.
Website or third party sources
We collect certain related technical information including, but not limited to, traffic data, location data, logs (including, where available, the IP address and location of the device connecting to the online services and other technical information and identifiers about the device and the nature of the visit such as clickstream to, through and from our website) and other communication data, and the resources that you use.
On occasions, we acquire information from other companies, to collect information about how visitors to our website use the site. Information is also collected about how you arrived at our websites in the first place, including what links or adverts you have viewed or clicked on to reach us, or any search terms you have used. We do this to maintain and improve our website, getting a better understanding of visitor and client profiles and ultimately delivering a better experience. Information may be collected through the use of cookies or pixels
Cookies
A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site.
You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.
By law, we may not place cookies on your computer without your consent, unless they are strictly necessary to the operation of the service that we provide on the Website.
e.g. We use traffic log cookies to identify which pages are being used. This helps us analyse data about web page traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.
We use Google Analytics to monitor how our website is being used so we can make improvements. Our use of Google Analytics requires us to pass to Google your IP address (but no other information) – Google uses this information to prepare site usage reports for us, but Google may also share this information with other Google services. In particular, Google may use the data collected to contextualize and personalize the ads of its own advertising network. Related information:
If you have any queries about the cookies that we use, or would like more information, please contact info@smalaw.co.uk
In writing: 460-462 Green Lanes, Palmers Green, N13 5XD London
Email: info@smalaw.co.uk
Phone: 020 8951 9959