Privacy Policy

We take your privacy seriously. Please read this privacy policy carefully as it contains important information on who we are and how and why we collect, store, use and share your personal information. It also explains your rights in relation to your personal information and how to contact us or the Information Commissioner’s Office in the event you have a complaint.

We collect, use and are responsible for certain personal information about you. As such we are subject to the UK General Data Protection Regulation (GDPR) and  the Data Protection Act 2018. For those purposes we are the  ‘data controller’.


It would be helpful to start by explaining some key terms used in this policy:

We, us, ourGordons LLP and Gordons Yorkshire Limited
Data Protection LeadData Protection Lead, Gordons LLP, 1 New Augustus Street, Bradford, BD1 5LL Email:
Personal informationAny information relating to an identified or identifiable living individual
Special category personal informationPersonal information revealing racial or ethnic origin, political opinions, religious beliefs, philosophical beliefs or trade union membership

Genetic and biometric data

Data concerning health, sex life or sexual orientation



We may collect and use the following personal information about you:

  • your name and contact information, including email address and telephone number(s);
  • special category personal information, if required, to enable us to either provide our services to you or discharge our professional legal obligations during the course of litigation;
  • details of your spouse and family members, if required, to enable us to provide our services to you or discharge our professional legal obligations during the course of litigation;
  • personal information from documentation such as your utility bills, passport and/or driving licence to confirm your identity and comply with Anti-Money Laundering legislation;
  • your billing/payment information, transaction and payment card information, credit profile and history and bank details;
  • information to enable us to undertake credit or other financial checks on you;
  • information about how you use our website, mobile applications, IT, communication and other systems;
  • your employment history;
  • details of the pages you visited on our website, your IP address, devices you use and website address you used to access our site or applications from.


We collect most of this personal information directly from you, in person, by telephone, email, business documents or from your employer/employee or other witnesses as part of an investigation. We may also receive information from your family members/co-habitants if you have asked them to supply information to us. However, we may also collect information:

  • from publicly accessible sources, e.g. DVLA, Companies House or HM Land Registry, social/business media platforms;
  • directly from a third party, e.g.:
    • credit reference agencies;
    • customer due diligence providers;
    • internet service provider;
    • software service provider;
    • other legal advisors;
    • an intermediary who introduces us to you/your business;
    • the Courts; and
    • postal providers.
  • from a third party with your consent, e.g. your bank, building society, DVLA, accountant/ financial advisor;
  • from cookies on our website—for more information on our use of cookies, please see our cookie policy
  • via our IT systems, e.g.
    • door entry systems and reception logs;
    • automated monitoring of our websites and other technical systems, such as our computer;
    • networks and connections, CCTV and access control systems, communications systems; and


We may collect and process personal data about you as follows:

  • when you complete forms on our website (“Site”). This includes where you request a quote, ask us to contact you or sign up to receive communications from us;
  • when you report to us a problem with our Site or contact us for any other reason. We may keep a record of that correspondence; and
  • we may collect and process details of your visits to our Site including, but not limited to, traffic data, location data, weblogs and other communication data, whether this is required for our own billing purposes or otherwise, and the resources that you access (see our Cookie Policy).

We may also collect data in the following ways:

  • IP Address

We may collect information about your device including, where available, your Internet Protocol address, to protect against fraud, and your device’s operating system and browser type, for system administration and to report aggregate information to our advertisers. This is statistical data about our users’ browsing actions and patterns, and does not identify any individual.


  • Cookies

A cookie is a small piece of data sent from our website and stored on your device’s web browser. Our Site uses the following types of cookies, strictly necessary, targeting and performance cookies. Strictly necessary cookies make out Site function and cannot be switched off in our systems. We’d also like to set additional targeting and performance cookies on your device. However, according to the UK GDPR we’re obliged to give you the option to reject the use of cookies not strictly necessary for the function of our Site when you access As such, these cookies won’t be set unless you enable them. For further information see our Cookie Policy



Under data protection law, we can only use your personal information if we have a proper reason for doing so, e.g.:

  • to comply with our legal and regulatory obligations;
  • for the performance of our contract with you or to take steps at your request before entering into a contract;
  • for our legitimate interests or those of a third party, but only where these are not overridden by your interests, rights or freedoms;
  • to allow you to participate in interactive features of our Site, when you wish;
  • to ensure that the Site’s content is presented in the best way for you/your device;
  • to improve our Site and services;
  • to process and deal with any enquiries made by you; and
  • where you have given consent.


Website Links

Our Site may contain links to, and be linked from other websites. If you follow a link to other websites, they will apply different privacy policies, which you should read.  We do not accept any responsibility or liability for them.


What we use your personal information forOur reasons
To fulfil our obligations as your employer under your contract of employment or as required by lawFor the performance of our contract with you, or to take steps at your request before entering into a contract
To conduct litigation on behalf of our clientsTo meet our contractual and/or professional  legal obligations
To prevent and detect fraud against you or your employer/employeeFor our legitimate interests or those of a third party, i.e. to minimise fraud that could be damaging for us and for you
Conducting checks to identify our clients, their employees and verify their identity

Screening for financial and other sanctions or embargoes

Other processing necessary to comply with professional, legal and regulatory obligations that apply to our business, e.g. under health and safety regulations, statutory accounting requirements

To comply with our legal and regulatory obligations
Gathering and providing information required by or relating to audits, enquiries or investigations by regulatory bodiesTo comply with our legal and regulatory obligations
Ensuring business policies are adhered to, e.g. policies covering security and internet useFor our legitimate interests or those of a third party, i.e. to make sure we are following our own internal procedures so we can deliver the best service to you and/or your employer/employees
Operational reasons, such as improving efficiency, training and quality controlFor our legitimate interests or those of a third party, i.e. to be as efficient as we can so we can deliver the best service for you at the best price
Ensuring the confidentiality of commercially sensitive informationFor our legitimate interests or those of a third party, i.e. to protect trade secrets and other commercially valuable information

To comply with our legal and regulatory obligations

Statistical analysis to help us manage our business, e.g. in relation to our financial performance, customer base, product range or other efficiency measuresFor our legitimate interests or those of a third party, i.e. to be as efficient as we can so we can deliver the best service for you at the best price
Preventing unauthorised access and modifications to systemsFor our legitimate interests or those of a third party, i.e. to prevent and detect criminal activity that could be damaging for us and for you

To comply with our legal and regulatory obligations

Updating and enhancing client recordsFor the performance of our contract with you or to take steps at your request before entering into a contract

To comply with our legal and regulatory obligations

For our legitimate interests or those of a third party, e.g. making sure that we can keep in touch with our customers about existing services and new products

Statutory returnsTo comply with our legal and regulatory obligations
Ensuring safe working practices, staff administration and assessmentsTo comply with our legal and regulatory obligations

For our legitimate interests or those of a third party, e.g. to make sure we are following our own internal procedures and working efficiently so we can deliver the best service to you

Marketing our services and those of selected third parties to:

·       existing and former clients and their employees

·       third parties who have previously expressed an interest in our services

·       third parties with whom we have had no previous dealings.

For our legitimate interests or those of a third party, i.e. to promote our business to existing and former customers
Credit reference checks via external credit reference agenciesFor our legitimate interests or those of a third party, i.e. to ensure our clients are likely to be able to pay for our services
External audits and quality checks, e.g. for accreditations and the audit of our accountsFor our legitimate interests or a those of a third party, i.e. to maintain our accreditations so we can demonstrate we operate at the highest standards

To comply with our legal and regulatory obligations


The above table does not apply to special category personal information, which we will only process  as set out in paragraph ‘LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA’ below.


We seek to ensure that our information collection and processing is always proportionate. We will notify you of any material changes to information we collect or to the purposes for which we collect and process it.




We routinely share personal information with:

  • those that supply us with goods and services;
  • other professional advisers, barristers, auditors, bankers and insurers and brokers, credit reference agencies;
  • HM Revenue & Customs, HM Courts & Tribunal Service, regulators, police and other authorities who may require us to report processing activities in certain circumstances;
  • IT software providers that host our website and store/maintain data for us;

We only allow our service providers to handle your personal information if we are satisfied they take appropriate measures to protect your personal information. We also impose contractual obligations on service providers to ensure they can only use your personal information to provide services to us and to you, unless you agree otherwise. We may also share personal information with external auditors.

We may disclose and exchange information with law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations.

We may also need to share some personal information with other parties, such as potential buyers of some or all of our business or during a re-structuring. Usually, information will be anonymised but this may not always be possible. The recipient of the information will be bound by confidentiality obligations.

We will not share your personal information with any other third party.


Where you indicate you would like to receive marketing correspondence from us,

subscribe to our mailing lists, newsletters, legal updates, enter any of our competitions or give

us your details at any events we hold or attend, we may use your personal data for our

legitimate interests in order to provide you with details of our services, legal and

business updates and events which we think may interest you. We may also share your

personal data with organisations who jointly deliver events with us or delegates from

those events.


You have the right to opt-out of receiving the information detailed at any time. To opt-out of receiving such information you can:

  • click on the unsubscribe button in any electronic marketing communication; or
  • email us at or call 0333 987 5500 giving us your contact details.



We will only use your personal data where the law allows us to. Most commonly, we will use your personal data in the following circumstances:

  • for performance of a contract we enter into with you;
  • for compliance with a legal or regulatory obligation; and
  • for our legitimate interests (as described in this policy) and ) insofar as those interests are not overridden by your interests, rights or freedoms.

In relation to special categories of personal data, we will only use your data for the reasons set out in this privacy policy and only if:

  • you have given your explicit consent (such as signing a form of authority to access medical records);
  • the processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law; and
  • the processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.


We will only process the personal data of a child below the age of 16 years where consent is given or authorised by the holder of parental responsibility over the child and/or to satisfy a legal obligation.



Information may be held at our offices, third party agencies, service providers, representatives and agents as described above (see above).

Some of these third parties may be based outside the European Economic Area. For more information, including on how we safeguard your personal information when this occurs, see below under: ‘Transferring your personal information out of the EEA’.



We will keep your personal information while you have an account with us, whilst we are providing services to you/your employer and for at least 7 years after we have delivered our services to you or your employer. We will only keep your personal information for as long as is necessary:

  • to respond to any questions, complaints or claims made by you or on your behalf;
  • to show that we treated you fairly;
  • to keep records required by law;
  • to discharge our contractual/legal obligations owed to you or your employer;
  • to demonstrate we have discharged our obligations;
  • for accounting and audit purposes.

We will not retain your personal information for longer than necessary for the purposes set out in this policy. Different retention periods may  apply for different types of personal information.

When it is no longer necessary to retain your personal information, we will delete or anonymise it.

Where you have subscribed to receive marketing material from us we will keep your personal data for 2 years from the point at which you invite us to send you communications or from the point at which you interact with  us, unless you unsubscribe.



To deliver services to you, it may become necessary to share your personal information outside the UK or the European Economic Area (EEA). We may do this if our service providers are located outside the UK or EEA. If we do transfer your data out of the UK or the EEA, such transfers will be subject to special rules under UK data protection law, particularly if data is to be transferred to countries that do not have data protection laws of a standard comparable to that of the UK. We will always ensure there are adequate safeguards in place (such as the Standard Contractual Clauses or other valid transfer mechanism approved by the UK Government / Information Commissioner) where your data is shared to a with such countries.

If you accept/give your consent to cookies or similar technologies from our website, your personal data may also be  transferred to selected third parties outside of the UK and EEA. For further details see our Cookies Policy.



You have the following rights, which you can exercise free of charge:

AccessThe right to be provided with a copy of your personal information (the right of access)
RectificationThe right to require us to correct any mistakes in your personal information
To be forgottenThe right to require us to delete your personal information—in certain situations
Restriction of processingThe right to require us to restrict processing of your personal information—in certain circumstances, e.g. if you contest the accuracy of the data
Data portabilityThe right to receive the personal information you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations
To objectThe right to object:

—at any time to your personal information being processed for direct marketing (including profiling);

—in certain other situations to our continued processing of your personal information, e.g. processing carried out for the purpose of our legitimate interests.

Not to be subject to automated individual decision makingThe right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you


For further information on each of those rights, including the circumstances in which they apply, please contact us or see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals’ rights under the General Data Protection Regulation.

If you would like to exercise any of those rights, please:

  • contact our Group Data Manager at;
  • let us know what right you want to exercise and the information to which your request relates.



We have appropriate security measures to prevent personal information from being accidentally lost, or used or accessed unlawfully. We limit access to your personal information to those who have a genuine business need to access it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality. We continually test our systems to ensure your personal information is safe.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator, including the Information Commissioner’s Office, of a suspected data security breach where we are legally required to do so.

If you want detailed information from Get Safe Online on how to protect your information and your computers and devices against fraud, identity theft, viruses and many other online problems, please visit Get Safe Online is supported by HM Government and leading businesses.



We hope that we can resolve any query or concern you may raise about our use of your information.

You have the right to lodge a complaint with the Information Commissioner’s Office who may be contacted at or telephone: 0303 123 1113, or to take action through the Courts.



This privacy notice was last updated on November 2021. We may change this privacy policy from time to time and will notify you with any significant updates.



Please contact us by post, email or telephone if you have any questions about this privacy policy or the information we hold about you.

Our contact details are:

Post: Data Protection Lead, Gordons LLP, 1 New Augustus Street, Bradford, BD1 5LL


Telephone: 0333 987 5500


If you would like this notice in another format (for example audio, large print, braille) please contact us.