Hart Brown Privacy Notice to all clients.

 

Hart Brown Privacy Notice to all clients who are individuals

The European Union General Data Protection Regulation requires us (the data controller) to provide you (the data subject) with the information in bold at the beginning of each section below.  The information is set out in the sections.

1. The identity and contact details of the controller and of our representative.
Controller – Hart Brown
Resolution House, Riverview, Walnut Tree Close, Guildford, Surrey GU1 4UX

Controller’s representative – David Wallace, Resolution House, Riverview, Walnut Tree Close, Guildford, Surrey GU1 4UX

djw@hartbrown.co.uk

01483 887589

2. Contact details of the data protection officer, where applicable.
Hart Brown does not have a data protection officer

3. The purposes of the processing for which the personal data are intended and the legal basis for the processing.

3.1. When you seek our assistance we will record and store your full names, and contact details, and all personal data you give us then, to enable us to understand your need for our help, allocate it to the most suitable specialist, and set up a contract with you. During your matter we will record and store all further personal data you give us (or we receive from anyone else – such as your medical records for a clinical negligence case) relevant or potentially relevant to our achieving your desired objective.  We will use your personal data as necessary in that connection, such as running and presenting your case in court proceedings, preparing your will, running a trust for you, or assisting your house move.The legal basis for all that processing is that it is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract.

3.2. When we have completed the work you have instructed us to do, we will process all relevant personal data by storing and having it available for you. Paper storage is likely to be until the relevant limitation period for your matter expires in case this is relevant for a complaint or claim by you against us.  Electronic storage is likely to be indefinite but (subject to the points below) your personal data stored electronically can be deleted at your request after the expiry of the limitation period.  The reason for indefinite storage is principally that information from a closed matter can be useful to you in the future.The legal basis for this processing is that (for the limitation period) it is necessary for the purposes of the legitimate interests pursued by us.

3.3. When we have completed the work you have instructed us to do, we will process your name, contact details, and a sufficient summary of the matters on which we worked for you by storing and using these to check in connection with later enquiries whether we have a conflict of interests by reason of having acted for you in connection with those matters. There will be no time limit for that.We will also process your identification documents by storing and reviewing them if and when you next instruct us.The legal basis for the processing is that it is necessary for compliance with a legal obligation to which we are subject.

3.4. We will process all accounting records on matters on which you instruct us by creating and storing them for the purpose of each matter while it is current and, after each matter has been completed, by storing them for the period for which we are required by regulation to keep them (at present six years from the conclusion of the matter). After that, the accounting records will continue to be stored as they are part of an integrated accounts system and deleting them would undermine that integrity.The legal basis for the processing is initially that it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into a contract and then it is necessary for the purposes of the legitimate interests pursued by us and (for the period the regulation mentioned applies) necessary for compliance with a legal obligation to which we are subject.

3.5. We will process all information relevant to a complaint or claim (or a potential claim or complaint) by you against us by sharing it with our insurers and their solicitors and any barrister instructed in that connection by them or us, to be able to deal properly with the situation and correctly identify and fund any liability arising. We will process the relevant personal data by storing it (and referring to it appropriately) until there is no further possibility that it might be needed in connection with a complaint or claim. By doing that we are protecting your vital interests as well as our own.

The legal basis for the processing is that it is necessary to protect your vital interests or those of another natural person and it is necessary for the purposes of the legitimate interests pursued by us.

3.6. We will share personal information with law enforcement or other authorities if legally required.

The legal basis for the processing is that it is necessary for compliance with a legal obligation to which we are subject.

3.7. We will use your personal data, if and when necessary and to the necessary extent, to pursue any rights we may have against you.

The legal basis for this processing is that it is necessary for the purposes of the legitimate interests pursued by us.

3.8. We will use your contact details to seek your consent to our marketing our services and events to you and our emailing to you electronic publications we issue. If you give that consent, we will use other information we have about you to try to ensure you only receive from us marketing material of any kind that is likely to be of interest to you.  We do not send marketing material to all consenting clients.  We do not share any of your personal data with anyone else for marketing purposes.  You can withdraw your consent at any time – details will be given on to how to do that when we seek your consent.  If you do not give consent or you withdraw it, we will not market our services or events to you or email to you electronic publications we issue.

The legal basis for our seeking your consent is that it is necessary for the purposes of the legitimate interests pursued by us.  The legal basis for our marketing our services and events to you, and emailing to you electronic publications we issue if you give your consent, is that you will have given your consent.

4. Where the processing is necessary for the purposes of the legitimate interests pursued by us what are those legitimate interests?

In respect of 3.2 and 3.5, the legitimate interests are to enable any complaint or claim to be investigated properly and a just result achieved.In respect of 3.4, the legitimate interest is to enable us to maintain an integrated and testable accounting system.In respect of 3.7, the legitimate interest is to enforce the relevant right.In respect of 3.8, the legitimate interest is to seek your consent to suitable marketing to you.

5. The categories of personal data involved.

For the purpose of creating a contract with us – your full names, all contact details, and all personal data necessary to enable us to understand enough about what you want us to do to enable us to assess the work, and provide you with an estimate and a letter of engagement.For the purpose of doing the work for you – all personal data that are or could be relevant to the work being done successfully.  Where relevant, that will include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership or data concerning health or your sex life or sexual orientation.

6. The possible recipients or category of recipients of the personal data.

6.1. We will not share any of your personal data with anyone or any organisation other than where it is appropriate or necessary to progress the matter on which you have instructed us or where we are required to do so for legal reasons or for compliance or accreditation purposes. Once we have released any personal data, we will not be in control of or able to ensure its security.  However, except in the context of the prevention, investigation, detection or prosecution of criminal offences, any organisation to which we release the personal data will itself be bound to keep your data secure and generally to comply with the requirements of the General Data Protection Regulation.  Where, for the purposes of implementing your instructions, we need to release any of your personal data to a natural person in the course of a purely personal or household activity, that assurance of security will not apply.  Any personal data we do release to a third party will be limited to what must be released for the relevant purpose to be achieved.

6.2. In respect of all matters:

6.2.1 The hosts running our software on their systems

6.2.2 Our software suppliers

6.2.3 The providers of our copying machines, which also act as scanners, to the extent that when a document is copied or scanned the machine automatically makes an electronic copy

6.2.4 Our external accreditation auditors, to the extent that they ask to see individual files or relevant accounts records

6.2.5 Our external accountancy auditors

6.2.6 The Solicitors Regulation Authority, to the extent that we are obliged to report an issue to them

6.2.7 The Legal Ombudsman, to the extent that a complaint is made to her office about us

6.2.8 Our I.T. support contractors, to the extent necessary for them to provide that support

6.2.9 Our professional indemnity insurers and their (and, if different, our) professional advisers, to the extent appropriate if and when circumstances arise where there might be a claim against us and by us on that insurance policy, to enable us to achieve a fair outcome for you

6.2.10 The relevant authorities if we suspect there might have been or there might be an offence or attempted offence whether against the Money Laundering Regulations or otherwise

6.2.11 The courts if a court action is necessary or relevant.

6.3 In the cases of residential property (house moves) and commercial property work for an individual or individuals acting together as such:

6.3.1 The Land Registry, in respect of the personal data required to be provided to it to enable your purchase to be registered there

6.3.2 HMRC, in respect of the personal data required to be provided to it to enable the Stamp Duty Land Tax requirements to be met

6.3.3 Your existing lender, if any, in respect of the personal data required to be provided to it to redeem an existing loan and your intended lender, if any, in respect of the personal data required to be provided to it to enable a loan to be made

6.3.4 Any intended surveyor, to the extent necessary to enable a survey appointment to be arranged and/or the surveyor to communicate with you

6.3.5 The solicitor for the other party, to the extent necessary for the contract terms to be agreed

6.3.6 The landlord of premises acquired by you, any managing agent, management company or solicitor employed by the landlord or management company, to the extent necessary to register the purchase with the landlord and/or management company and arrange any share transfer

6.3.7 Insurance companies, to the extent necessary to obtain quotes for any relevant indemnity insurance policy and then put any policy selected in place

6.3.8 Any estate agent involved in your sale/or purchase, to the extent necessary to enable the sale and/or purchase to proceed.

6.4 In the case of a civil court claim or other action for you or brought against you by another:

6.4.1 Your barrister, if any, for advice, drafting of court or similar documents, and the presentation of your case whether in court or otherwise

6.4.2 Your insurers or potential insurers, if any, to enable insurance cover to be obtained or confirmed and in any event maintained and to enable the case to be run for you with the benefit of continuing insurance cover so far as possible

6.4.3 Any relevant expert, in respect of the personal data required to enable the expert or potential expert to provide a report (and make all necessary arrangements for any relevant examination) and advise or act as an expert witness for you

6.4.4 The court (or other tribunal), in respect of all personal data required to be provided to it, if court (or other tribunal) proceedings are to be started and/or pursued or defended

6.4.5 The mediator or arbitrator, in respect of the personal data required to be given to a mediator or arbitrator if mediation or arbitration is agreed or obligatory

6.4.6 The other party to the matter and their solicitors, to the extent necessary to pursue your matter for you

6.4.7 An agency for sorting medical records, if you have a clinical negligence claim or potential claim, for your medical records to be sorted

6.4.8 Your employer or former employer, to the extent necessary to enable us to implement your instructions in connection with your employment.

6.5 In the case of family work (such as divorce or associated financial arrangements):

6.5.1 As 6.3.1. to 6.3.6. inclusive

6.5.2 An actuary, to the extent necessary to obtain a valuation of pension rights

6.5.3 An accountant or other tax adviser, to the extent necessary to obtain tax advice, if relevant

6.5.4 The Land Registry in respect of the personal data required to be provided to it to enable any relevant registration to be effected there

6.5.5 Any relevant insurance company, SIPP trustee, or financial adviser, to the extent necessary to correspond with them or any of them about your or your spouse’s pension or prospective share of pension and register any change ordered by the court.

6.6 In the case of trusts, wills, the administration of estates and similar work:

6.6.1 For Executors and Administrators – the Probate Registry, to the extent necessary to obtain a Grant of Probate or Letters of Administration

6.6.2 For Deputies

6.6.3 For Attorneys (under a Power of Attorney)

6.6.4 Your financial adviser, if and to the extent relevant and appropriate, to enable best advice and assistance from him or her and from us.

6.7 In the case of company and commercial work for an individual or for individuals acting together as such:

6.7.1 Companies House, to the extent required to register you as a shareholder, director or officer

6.7.2 The accountant or tax adviser, if any appointed by you or the company, to enable him or her to advise and assist as required in a matter in hand for you

6.7.3 The other party to a transaction or matter and their solicitors, to the extent necessary and appropriate to enable the transaction or matter to be progressed and completed.

6.8 In the case of an individual (or individuals acting together as such) landlord or tenant involved in leasehold extension or a similar matter:

6.8.1 Any intended surveyor, to the extent necessary to enable a survey appointment to be arranged and/or the surveyor to communicate with you

6.8.2 The other party to a matter and their solicitors, to the extent necessary and appropriate to enable the matter to be progressed and completed

6.8.3 The Lands Tribunal, if relevant, to the extent necessary to enable your case to be presented before and at any hearing

6.8.4 The Land Registry, to the extent appropriate to enable any change in the registration resulting from the matter to be registered.

7. Can we transfer your personal data to a third country or international organisation?

Hart Brown does not usually transfer any information internationally. We can make an international transfer of personal data if it is necessary for the performance of a contract between you and us or for pre-contractual steps to be taken at your request.  Otherwise, unless the country in question ensures an adequate level of protection or there are appropriate safeguards and effective legal rights and remedies are available for you, we will be obliged to explain all the risks to you before seeking your consent to make the data transfer.  This will have to be addressed if the issue arises, and could delay or prevent progress.

8. What is the period for which your personal data will be stored?

See 3 above

9. Is the provision of personal data a statutory or contractual requirement or a requirement necessary to enter into a contract, and are you obliged to provide personal data, and what are the possible consequences of failure to provide such data?

There is seldom, if ever, any requirement or obligation on you to provide personal data to Hart Brown.  However, if before a contract with us is made you do not provide the personal data essential for that purpose, we will not be able to enter into a contract with you or therefore do the work for you at all; and if after the contract has been made you do not (on your initiative or at our request) provide us with personal data relevant or potentially relevant to your matter, it is likely to undermine the prospects of a successful outcome and could prevent us from progressing or completing the work.  Your failure to provide such data could entitle us to end our contract with you

10. The existence of automated decision making, including profiling

Hart Brown does not use automated decision making including profiling

11. What is the source of your personal data not obtained from you and, if applicable, will this come from publicly accessible sources?

In a sale of your home, we will seek confirmation of your ownership, and details of all mortgages on it, from the Land Registry (a public source).

In a property purchase with the benefit of a mortgage loan, we will ask the Land Charges Registry (a public source) to confirm that you are not bankrupt and have nothing pending against you, as required by the lender.

In a clinical negligence claim for you, we will seek all your medical records from your GP and any relevant hospital.  They are not public sources.

In a clinical negligence claim for you, we will usually arrange for your medical records and you to be examined by a relevant expert (not a public source) and will be provided by the expert with personal data.

In a personal injury claim for you, we will usually arrange for you (and perhaps your medical records) to be examined by a relevant expert (not a public source) and will be provided by the expert with personal data.

In any other civil dispute, if an expert is used it is possible that he or she (not a public source) will provide personal data to us.

In all matters we are likely to be provided with some personal data (or allegations) by the other party (not a public source)

12. Your data protection rights

12.1 You have the right to request from us access to and rectification or (in certain circumstances) erasure of personal data or (in certain circumstances) restriction of processing concerning you

12.2 Where the processing is carried out by us on the basis that it is necessary for the purposes of the legitimate interests pursued by us, you have the right to object to it continuing and we must stop the processing unless we demonstrate legitimate grounds for the processing which override your interests, rights and freedoms or the processing is for the establishment, exercise or defence of civil claims

12.3 Where the processing is based on consent or under or leading to a contract and the processing is carried out by automated means, you have the right to receive from us the personal data concerning you which you have provided to us and the right to transmit those data to another controller

12.4 Where the processing is based on consent, you have the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal

12.5 You have the right to lodge a complaint with the Information Commissioner’s Office, who may be contacted at https://ico.org.uk/concerns/ or telephone:0303 123 1113 but we invite you to tell us first if you have any complaint, so we can attend to it as soon as possible. If you would like to exercise any of those rights, please:

  • email, call or write to David Wallace,
  • let us have enough information to identify you,
  • let us have proof of your identity and address (a copy of your driving licence or passport and a recent utility or credit card bill), and
  • let us know the information to which your request applies.