This Privacy Statement explains our collection of personal information about you and the conditions under which we may disclose personal information to others, and how we keep it safe and secure.
Contents
Personal Information collected
Sources of Personal Information
Why we collect Personal Information
Access to Personal Information
Protection of Personal Information
How long do we keep Personal Information
Your Rights to receive Personal Information
Use of Personal Information – Complaints
Privacy Statement
Who is Hall Ellis Solicitors?
Hall Ellis Solicitors is a trading name of Hall Ellis Limited, which is a company authorised and regulated by the Solicitors Regulation Authority with number 626988.
Hall Ellis Solicitors registered with the Information Commissioner’s Office with registration number ZA322276.
Personal information is collected and processed by Hall Ellis Limited. We are the data controller of personal information you provide us.
Personal Information collected
The personal information collected by us depends upon what you ask us to do.
The two types of personal information protected by law in the UK under the Data Protection Act 2018 and UK GDPR:
- personal data: this is data which identifies you or may, when combined with other information may be used to identify you. It includes your name, address, telephone number, date of birth and contact information.
- special categories of personal data: this is data that is legislated to be data about you which is more personal than personal data, such as data about your racial or ethnic origin, religion, sexual orientation, political opinions, health, trade union membership, philosophical views, biometric and genetic data.
If you are a client or prospective client of our firm, we request information required to be collected by us to verify your identity under our professional rules of conduct and anti-money laundering laws. In some cases - rarely - we may need to ask for sensitive personal data.
If you are simply browsing our website or making an enquiry by telephone, email or letter, we do not collect any personal data about you, other than the information that you provide us.
Sources of Personal Information
The personal information we receive might be obtained from a number of different sources, which include:
- The information you send us about yourself
- Information you provide to us about others
- Information passed to us by others, so that we can do the work you have asked us to do. These might include:
- banks and building societies
- organisations and people that have referred work to us
- financial institutions
- public registers administered by entities with a statutory function, such as Intellectual Property Office in the UK, European Intellectual Property Office or Land Registry
- regulatory bodies, such as the Solicitors Regulation Authority and Financial Conduct Authority.
- businesses which provide anti-money laundering verification
- information published on the internet
- people who refer others to us that may wish to receive help from us.
- third party data suppliers
How we receive personal data
We receive personal data in a number of ways:
- enquiry sent to us electronically, such as by email or web form
- subscribing to a newsletter or news feed
- subscribing to social media channel
- completing questionnaires
- answers to questions we ask
- comments on any blog, forum, or other online discussion we participate in
- receipt of documents which contain personal information
Why we receive Personal Information
As a law firm, we are requested to perform tasks and provide legal advice on a number of different types of situations. To do so, we usually need to understand who the people are involved, so that we can carry out what is requested.
In doing so, we might need to use personal data to:
- confirm that you are who you say you are
- communicate with you
- communicate with others
- assess your legal rights and those of others
- represent you in a transaction or a dispute, which might include attending before a court, tribunal, negotiation or mediation whether in person, telephone or other communications media
- enter into contracts with service providers on your behalf
- maintain records of transactions with others, such as parties to a contract, parties to disputes, and lawful and unlawful behaviour
- carry out enquiries to verify the existence or likelihood of a turn of circumstances
- respond to complaints and allegations against us
- we can understand the requirements of those that engage us and better meet their needs and requirements.
Access to Personal Information
At the top of our list of priorities is to keep information you provide us, whether personal information or not, confidential. We only disclose information you provide us with your permission, other than in an emergency where it appears reasonable to do so at the time on the information we have, and in those rare cases set out further below.
We do not sell or rent share personal information. We share personal information with those that we are required to, and those who we have to.
We maintain a information security and IT policies and procedures to minimise the potential for mistakes on how to deal with your personal information.
We may need to disclose personal information to:
- bodies with a statutory function, like Companies House, the Intellectual Property Office, the Land Registry or HMRC
- Courts and tribunals
- business and individuals of any description and those (such as other solicitors and agents) representing others in respect of assertions of legal rights, negotiations and/or transactions
- suppliers to us, such as:
- barristers
- mediators and arbitrators
- accountants
- payroll processors
- auditors
- transcribers and translators
- insurers and insurance brokers
- others that provide professional services to us
- others where we have a legal obligation to do so, such as the Solicitors Regulation Authority
- those charged with prevention of financial crime and terrorist activities
- others where there is an emergency and we believe that either you or others are at risk.
When personal information is shared with others we take all reasonable steps to ensure that they comply with our instructions to them, and they do not use your personal information for their own purposes, unless you have expressly consented to them doing so.
Lawful Basis
On each of case of processing, we rely on lawful basis to use personal information, such as:
- Work for our Clients:
- processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract;
- processing is necessary in order to protect your vital interests or of another natural person;
- processing is necessary for the performance of a task carried out in the public interest
- establish, exercise or defend legal claims
- Administrative functions of our business:
- processing is necessary for compliance with a legal obligation to which we are subject;
- processing is necessary for the purposes of our legitimate interests or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject
- Marketing:
- the data subject has given consent to the processing of his or her personal data for one or more specific purposes
- processing is necessary for our legitimate interests or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject
- Regulatory Compliance:
- processing is necessary for compliance with a legal obligation to which we are subject;
- processing is necessary in order to protect your vital interests or of another natural person;
- processing is necessary for the performance of a task carried out in the public interest
- processing is necessary for our legitimate interests or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject
We also process personal data and special categories of personal data for reasons of important public interest and protection of the rights of other natural or legal persons.
Transfers
As a general rule, we do not transfer personal data out of the UK.
Exceptions include where:
- the transfer is necessary for the performance of a contract with you
- the transfer is necessary for the conclusion or performance of a contract concluded with us, in your interest, or another natural or legal person
- the transfer is necessary for important reasons of public interest
- the transfer is necessary for the establishment, exercise or defence of legal claims
Protection of Personal Data
We are computer literate and are aware of risks of using technology. We take confidentiality of our client’s affairs seriously, along with personal data we receive.
We use dedicated security hardware which implements firewalls, detection of malware in packets, and a variety of encryption methodologies to protect personal data in transit. We store personal data on password protected systems. Those systems are encrypted themselves. We control access to premises where personal data in our control is stored.
How long do we keep Personal Information
We maintain personal information in physical and/or electronic form. We retain the personal information for as long as we need to, to satisfy the purposes for which the personal data was collected, and otherwise as required by law or by contract.
Some of the situations are:
- where we perform legal work for you, for a minimum of 6 years after our last invoice. This may be longer where we need to re-open your case for defending claims or complaints
- enquiries from member of the public, for up to 12 months
- where we are entrusted with original deeds or evidence of ownership of intellectual property, indefinitely
Your Rights to receive Personal Information
Data Protection legislation entitles you to request a series of categories of personal information from us, all of which relate to you and nobody else. These are referred to in the legislation as data subject access requests.
Depending on your circumstances some or all of the following rights apply:
- Right to be informed: of the personal information we process which relates to you
- Right to rectification: you are entitled to have personal data rectified if it is inaccurate or incomplete
- Right to erasure / "right to be forgotten": you have the right to request the deletion or removal of your personal data where there is no compelling reason for its continued processing. This right only applies in the following specific circumstances:
- Where the personal data is no longer necessary in respect of the purpose for which it was originally received
- Where consent is relied upon as the lawful basis for holding your data and you withdraw your consent
- Where you object to the processing and there is no overriding legitimate interest for continuing the processing
- The personal data was unlawfully processed
- Where you object to the processing for direct marketing purposes
- The right to object: You have the right to object to processing based on legitimate interests and direct marketing. This right only applies in the following circumstances:
- An objection to stop processing personal data for direct marketing purposes is absolute – there are no exemptions or grounds to refuse – we must stop processing in this context
- You must have an objection on grounds relating to your particular situation
- We must stop processing your personal data unless:
- We can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms; or
- The processing is for the establishment, exercise or defence of legal claims.
- Right to restrict processing: you have the right to request the restriction or suppression of your data. When processing is restricted, we can store the data but not use it. This right applies when:
- Where you contest the accuracy of the personal data – we should restrict the processing until we have verified the accuracy of that data
- Where you object to the processing (where it was necessary for the performance of a public interest or purpose of legitimate interests), and we are considering whether our organisation’s legitimate grounds override your right
- Where processing is unlawful and you request restriction
- If we no longer need the personal data but you require the data to establish, exercise or defend a legal claim
If you wish to receive copies of personal information, please write to us at the contact information on our website, or to our registered address. We will usually acknowledge receipt of your request within 7 days.
You are not entitled to receive copies of documents which contain personal information, only the information about you contained within them. This means that we would provide you with the information such as your name, address, contact details, date of birth and special categories of personal data which relate to you. Much of what we receive from clients - if not all - is protected from disclosure by legal professional privilege.
Use of Personal Information – Complaints
If you are not satisfied how we handle your personal data, you are able to contact us directly in the first instance. If you do not wish to do so, or you believe that we are unlawfully processing your personal information, you are able to complain to the Information Commissioner’s Office at https://ico.org.uk/global/contact-us/.