We collect, use and are responsible for certain personal information about you. As such we are subject to the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018. For those purposes we are the ‘data controller’.
It would be helpful to start by explaining some key terms used in this policy:
|We, us, our||Gordons LLP and Gordons Yorkshire Limited|
|Data Protection Lead||Data Protection Lead, Gordons LLP, 1 New Augustus Street, Bradford, BD1 5LL Email: firstname.lastname@example.org.|
|Personal information||Any information relating to an identified or identifiable living individual|
|Special category personal information||Personal information revealing racial or ethnic origin, political opinions, religious beliefs, philosophical beliefs or trade union membership
Genetic and biometric data
Data concerning health, sex life or sexual orientation
PERSONAL INFORMATION WE COLLECT ABOUT YOU
We may collect and use the following personal information about you:
- your name and contact information, including email address and telephone number(s);
- special category personal information, if required, to enable us to either provide our services to you or discharge our professional legal obligations during the course of litigation;
- details of your spouse and family members, if required, to enable us to provide our services to you or discharge our professional legal obligations during the course of litigation;
- personal information from documentation such as your utility bills, passport and/or driving licence to confirm your identity and comply with Anti-Money Laundering legislation;
- your billing/payment information, transaction and payment card information, credit profile and history and bank details;
- information to enable us to undertake credit or other financial checks on you;
- information about how you use our website, mobile applications, IT, communication and other systems;
- your employment history;
- details of the pages you visited on our website, your IP address, devices you use and website address you used to access our site or applications from.
HOW YOUR PERSONAL INFORMATION IS COLLECTED
We collect most of this personal information directly from you, in person, by telephone, email, business documents or from your employer/employee or other witnesses as part of an investigation. We may also receive information from your family members/co-habitants if you have asked them to supply information to us. However, we may also collect information:
- from publicly accessible sources, e.g. DVLA, Companies House or HM Land Registry, social/business media platforms;
- directly from a third party, e.g.:
- credit reference agencies;
- customer due diligence providers;
- internet service provider;
- software service provider;
- other legal advisors;
- an intermediary who introduces us to you/your business;
- the Courts; and
- postal providers.
- from a third party with your consent, e.g. your bank, building society, DVLA, accountant/ financial advisor;
- via our IT systems, e.g.
- door entry systems and reception logs;
- automated monitoring of our websites and other technical systems, such as our computer;
- networks and connections, CCTV and access control systems, communications systems; and
We may collect and process personal data about you as follows:
- when you complete forms on our website (“Site”). This includes where you request a quote, ask us to contact you or sign up to receive communications from us;
- when you report to us a problem with our Site or contact us for any other reason. We may keep a record of that correspondence; and
We may also collect data in the following ways:
- IP Address
We may collect information about your device including, where available, your Internet Protocol address, to protect against fraud, and your device’s operating system and browser type, for system administration and to report aggregate information to our advertisers. This is statistical data about our users’ browsing actions and patterns, and does not identify any individual.
HOW AND WHY WE USE YOUR PERSONAL INFORMATION
Under data protection law, we can only use your personal information if we have a proper reason for doing so, e.g.:
- to comply with our legal and regulatory obligations;
- for the performance of our contract with you or to take steps at your request before entering into a contract;
- for our legitimate interests or those of a third party, but only where these are not overridden by your interests, rights or freedoms;
- to allow you to participate in interactive features of our Site, when you wish;
- to ensure that the Site’s content is presented in the best way for you/your device;
- to improve our Site and services;
- to process and deal with any enquiries made by you; and
- where you have given consent.
Our Site may contain links to, and be linked from other websites. If you follow a link to other websites, they will apply different privacy policies, which you should read. We do not accept any responsibility or liability for them.
|What we use your personal information for||Our reasons|
|To fulfil our obligations as your employer under your contract of employment or as required by law||For the performance of our contract with you, or to take steps at your request before entering into a contract|
|To conduct litigation on behalf of our clients||To meet our contractual and/or professional legal obligations|
|To prevent and detect fraud against you or your employer/employee||For our legitimate interests or those of a third party, i.e. to minimise fraud that could be damaging for us and for you|
|Conducting checks to identify our clients, their employees and verify their identity
Screening for financial and other sanctions or embargoes
Other processing necessary to comply with professional, legal and regulatory obligations that apply to our business, e.g. under health and safety regulations, statutory accounting requirements
|To comply with our legal and regulatory obligations|
|Gathering and providing information required by or relating to audits, enquiries or investigations by regulatory bodies||To comply with our legal and regulatory obligations|
|Ensuring business policies are adhered to, e.g. policies covering security and internet use||For our legitimate interests or those of a third party, i.e. to make sure we are following our own internal procedures so we can deliver the best service to you and/or your employer/employees|
|Operational reasons, such as improving efficiency, training and quality control||For our legitimate interests or those of a third party, i.e. to be as efficient as we can so we can deliver the best service for you at the best price|
|Ensuring the confidentiality of commercially sensitive information||For our legitimate interests or those of a third party, i.e. to protect trade secrets and other commercially valuable information
To comply with our legal and regulatory obligations
|Statistical analysis to help us manage our business, e.g. in relation to our financial performance, customer base, product range or other efficiency measures||For our legitimate interests or those of a third party, i.e. to be as efficient as we can so we can deliver the best service for you at the best price|
|Preventing unauthorised access and modifications to systems||For our legitimate interests or those of a third party, i.e. to prevent and detect criminal activity that could be damaging for us and for you
To comply with our legal and regulatory obligations
|Updating and enhancing client records||For the performance of our contract with you or to take steps at your request before entering into a contract
To comply with our legal and regulatory obligations
For our legitimate interests or those of a third party, e.g. making sure that we can keep in touch with our customers about existing services and new products
|Statutory returns||To comply with our legal and regulatory obligations|
|Ensuring safe working practices, staff administration and assessments||To comply with our legal and regulatory obligations
For our legitimate interests or those of a third party, e.g. to make sure we are following our own internal procedures and working efficiently so we can deliver the best service to you
|Marketing our services and those of selected third parties to:
· existing and former clients and their employees
· third parties who have previously expressed an interest in our services
· third parties with whom we have had no previous dealings.
|For our legitimate interests or those of a third party, i.e. to promote our business to existing and former customers|
|Credit reference checks via external credit reference agencies||For our legitimate interests or those of a third party, i.e. to ensure our clients are likely to be able to pay for our services|
|External audits and quality checks, e.g. for accreditations and the audit of our accounts||For our legitimate interests or a those of a third party, i.e. to maintain our accreditations so we can demonstrate we operate at the highest standards
To comply with our legal and regulatory obligations
The above table does not apply to special category personal information, which we will only process as set out in paragraph ‘LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA’ below.
We seek to ensure that our information collection and processing is always proportionate. We will notify you of any material changes to information we collect or to the purposes for which we collect and process it.
WHO WE SHARE YOUR PERSONAL INFORMATION WITH
We routinely share personal information with:
- those that supply us with goods and services;
- other professional advisers, barristers, auditors, bankers and insurers and brokers, credit reference agencies;
- HM Revenue & Customs, HM Courts & Tribunal Service, regulators, police and other authorities who may require us to report processing activities in certain circumstances;
- IT software providers that host our website and store/maintain data for us;
We only allow our service providers to handle your personal information if we are satisfied they take appropriate measures to protect your personal information. We also impose contractual obligations on service providers to ensure they can only use your personal information to provide services to us and to you, unless you agree otherwise. We may also share personal information with external auditors.
We may disclose and exchange information with law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations.
We may also need to share some personal information with other parties, such as potential buyers of some or all of our business or during a re-structuring. Usually, information will be anonymised but this may not always be possible. The recipient of the information will be bound by confidentiality obligations.
We will not share your personal information with any other third party.
Where you indicate you would like to receive marketing correspondence from us,
subscribe to our mailing lists, newsletters, legal updates, enter any of our competitions or give
us your details at any events we hold or attend, we may use your personal data for our
legitimate interests in order to provide you with details of our services, legal and
business updates and events which we think may interest you. We may also share your
personal data with organisations who jointly deliver events with us or delegates from
You have the right to opt-out of receiving the information detailed at any time. To opt-out of receiving such information you can:
- click on the unsubscribe button in any electronic marketing communication; or
- email us at email@example.com or call 0333 987 5500 giving us your contact details.
LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA
We will only use your personal data where the law allows us to. Most commonly, we will use your personal data in the following circumstances:
- for performance of a contract we enter into with you;
- for compliance with a legal or regulatory obligation; and
- for our legitimate interests (as described in this policy) and ) insofar as those interests are not overridden by your interests, rights or freedoms.
- you have given your explicit consent (such as signing a form of authority to access medical records);
- the processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law; and
- the processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.
We will only process the personal data of a child below the age of 16 years where consent is given or authorised by the holder of parental responsibility over the child and/or to satisfy a legal obligation.
WHERE YOUR PERSONAL INFORMATION IS HELD
Information may be held at our offices, third party agencies, service providers, representatives and agents as described above (see above).
Some of these third parties may be based outside the European Economic Area. For more information, including on how we safeguard your personal information when this occurs, see below under: ‘Transferring your personal information out of the EEA’.
HOW LONG YOUR PERSONAL INFORMATION WILL BE KEPT
We will keep your personal information while you have an account with us, whilst we are providing services to you/your employer and for at least 7 years after we have delivered our services to you or your employer. We will only keep your personal information for as long as is necessary:
- to respond to any questions, complaints or claims made by you or on your behalf;
- to show that we treated you fairly;
- to keep records required by law;
- to discharge our contractual/legal obligations owed to you or your employer;
- to demonstrate we have discharged our obligations;
- for accounting and audit purposes.
We will not retain your personal information for longer than necessary for the purposes set out in this policy. Different retention periods may apply for different types of personal information.
When it is no longer necessary to retain your personal information, we will delete or anonymise it.
Where you have subscribed to receive marketing material from us we will keep your personal data for 2 years from the point at which you invite us to send you communications or from the point at which you interact with us, unless you unsubscribe.
TRANSFERRING YOUR PERSONAL INFORMATION OUT OF THE UK OR EEA
To deliver services to you, it may become necessary to share your personal information outside the UK or the European Economic Area (EEA). We may do this if our service providers are located outside the UK or EEA. If we do transfer your data out of the UK or the EEA, such transfers will be subject to special rules under UK data protection law, particularly if data is to be transferred to countries that do not have data protection laws of a standard comparable to that of the UK. We will always ensure there are adequate safeguards in place (such as the Standard Contractual Clauses or other valid transfer mechanism approved by the UK Government / Information Commissioner) where your data is shared to a with such countries.
If you accept/give your consent to cookies or similar technologies from our website, your personal data may also be transferred to selected third parties outside of the UK and EEA. For further details see our Cookies Policy.
You have the following rights, which you can exercise free of charge:
|Access||The right to be provided with a copy of your personal information (the right of access)|
|Rectification||The right to require us to correct any mistakes in your personal information|
|To be forgotten||The right to require us to delete your personal information—in certain situations|
|Restriction of processing||The right to require us to restrict processing of your personal information—in certain circumstances, e.g. if you contest the accuracy of the data|
|Data portability||The right to receive the personal information you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations|
|To object||The right to object:
—at any time to your personal information being processed for direct marketing (including profiling);
—in certain other situations to our continued processing of your personal information, e.g. processing carried out for the purpose of our legitimate interests.
|Not to be subject to automated individual decision making||The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you|
For further information on each of those rights, including the circumstances in which they apply, please contact us or see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals’ rights under the General Data Protection Regulation.
If you would like to exercise any of those rights, please:
- contact our Group Data Manager at firstname.lastname@example.org;
- let us know what right you want to exercise and the information to which your request relates.
KEEPING YOUR PERSONAL INFORMATION SECURE
We have appropriate security measures to prevent personal information from being accidentally lost, or used or accessed unlawfully. We limit access to your personal information to those who have a genuine business need to access it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality. We continually test our systems to ensure your personal information is safe.
We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator, including the Information Commissioner’s Office, of a suspected data security breach where we are legally required to do so.
If you want detailed information from Get Safe Online on how to protect your information and your computers and devices against fraud, identity theft, viruses and many other online problems, please visit www.getsafeonline.org. Get Safe Online is supported by HM Government and leading businesses.
HOW TO COMPLAIN
We hope that we can resolve any query or concern you may raise about our use of your information.
You have the right to lodge a complaint with the Information Commissioner’s Office who may be contacted at https://ico.org.uk/concerns or telephone: 0303 123 1113, or to take action through the Courts.
HOW TO CONTACT US
Our contact details are:
Post: Data Protection Lead, Gordons LLP, 1 New Augustus Street, Bradford, BD1 5LL
Telephone: 0333 987 5500
DO YOU NEED EXTRA HELP?
If you would like this notice in another format (for example audio, large print, braille) please contact us.