1.1 Godfrey Wright Limited operate as part of a group of law firms owned by Lawfront Group Limited, known as the “Lawfront Group”. The Lawfront Group is committed to safeguarding the privacy and security of your personal data.

1.2 This Privacy Notice explains how and why the Lawfront Group collects, uses and otherwise processes your personal data in accordance with UK data protection law. It also sets out information regarding your rights in relation to your personal data. This Privacy Notice supplements any other fair processing notices that may be provided to you from time to time.

1.3 In this Privacy Notice, “we”, “us” and “our” refers to any of the businesses in the Lawfront Group (as the context requires) and “you” refers to any individual whose personal data we collect when providing our services, including:

1.3.1 our clients (if the client is an individual), our client contacts (if the client is a business or other organisation) and third parties engaged by our clients;

1.3.2 individuals that apply for a job or internship within the Lawfront Group;

1.3.3 counterparties of our clients and other third parties connected to work that we carry out for our clients;

1.3.4 professional advisers, experts and consultants involved in the work that we carry out for our clients; and

1.3.5 any other individual whose personal data we obtain during the course of carrying on our commercial activities, including representatives and employees from third party suppliers.

1.4 We are the controller of the personal data that we process, i.e. the organisation which determines, alone or jointly with another party, how your personal data is processed and for what purposes. This means that we are legally responsible for ensuring our systems, processes, suppliers and people comply with data protection laws in relation to the personal data that we handle. Where we transfer your personal data to or receive your personal data from third parties, those third parties may also be controllers. More information about this is provided in Section 7 (Sharing your Personal Data) of this Privacy Notice.

1.5 We may change this Privacy Notice at any time as the need arises. All changes to this Privacy Notice will become effective immediately. Please review this Privacy Notice regularly to keep up to date.

2.1 If you have any questions about this Privacy Notice or our processing of your personal data, please contact Cathryn Selby, Chief Risk Officer and Group Legal Counsel, of our Professional Standards Team at [email protected].

3.1 By ‘personal data’ we mean any information (including opinions) which relates to an individual and from which they can be identified either directly or indirectly through other data which the Lawfront Group has or is likely to have in its possession.

3.2 We may collect, store and use the following personal data when engaging with you or when providing our legal services:

3.2.1 Identification information: such as your title, name, date of birth, the company you work for, your job title or position, your passport or other official forms of ID and your NHS number;

3.2.2 Contact information: such as your address, email address, phone number, and marketing preferences;

3.2.3 Financial information: such as your bank details, credit control information, fees information, credit rating, National Insurance number, and tax and benefits information;

3.2.4 Professional information: such as your expertise and experience, feedback on your services (including opinions) from our people and/or our clients and other information relevant and connected to how you may have performed any service referred to you by us;

3.2.5 Recruitment information: such as the information in your CV, your education, training, professional qualifications and previous employment;

3.2.6 Technical information: such as your IP address, records of your visits to our online services, your online registration details and login credentials, records of your visits to our premises (e.g. turnstile/swipe access logs);

3.2.7 Correspondence information: such as personal data contained in documents and correspondence exchanged with you or relating to you, including statements and opinions of yours, statements about you, opinions of you and information relating to the matters that you would like us to support you with;

3.2.8 Special category personal data: such as information relating to your trade union membership, race, ethnicity, sexual orientation, religious beliefs or health, including medical records and expert reports;

3.2.9 Criminal offences data: such as information in connection with corporate or non-corporate crime related matters, sanctions information and matters concerning victims of crime or other matters where this information informs our work;

3.2.10 Images and recordings: such as CCTV footage taken at our premises and photos taken at our meetings or events and recordings of meetings or calls; and

3.2.11 Other personal data: such as personal data provided to us by you, by our client, or by third parties on our client’s behalf in the course or providing legal or other professional services to our client. This may include special categories of personal data and personal data relating to criminal convictions and offences or related to security measures.

4.1 We will only process your personal data where we are legally permitted to do. There are a number of different legal bases set out in UK data protection law and we explain which ones we rely on in Section 4.2. We are only permitted to process special category personal data or criminal offences data when we have satisfied certain conditions in the UK data protection law. The conditions that we rely upon are set out in Section 4.3 and 4.4 respectively.

4.2 We process your personal data by relying on the following legal bases under the UK data protection law, dependent on the purpose for which we are processing your personal data as described further in Section 5 (Why we process your Personal Data) below:

4.2.1 it is necessary to pursue our (or a third party’s) legitimate interests, as long as we have concluded that these interests do not override your rights to privacy. We will reach this decision by carrying out a balancing exercise to make sure our legitimate interests are not overridden by your right to privacy. Our legitimate interests will be those which are reasonably expected in the course of our business as a group of law firms and will be to achieve the purposes set out in Section 5 (Why we Process your Personal Data) below;

4.2.2 it is necessary for the performance of a contract with you or to take steps at your request prior to entering into a contract (e.g. in connection with the provision of legal or other professional services to you);

4.2.3 to meet our legal and regulatory obligations (e.g. to comply with anti-money laundering requirements); and

4.2.4 you have provided your consent to use your personal data (e.g. to send you marketing materials or where you complete a survey).

4.3 Special categories of personal data

4.3.1 We process special categories of personal data:

(a) if this is necessary to establish, exercise or defend legal claims;

(b) for reasons of public interest in connection with a statutory provision;

(c) with your consent; or

(d) if this personal data has been made public by you.

4.4 Criminal offences data

4.4.1 We process criminal offence data, where necessary:

(a) with your consent;

(b) where that personal data has been manifestly made public by you;

(c) in relation to legal claims;

(d) to prevent or detect unlawful acts;

(e) to comply with regulatory requirements relating to unlawful acts and dishonesty and/or for reasons of public interest combined with a statutory provision (e.g. to protect the public against dishonesty, to prevent fraud); and

(f) in relation to our obligations concerning suspicion of terrorist or counter-proliferation financing or money laundering.

5.1 We may process your personal data for the following purposes:

5.1.1 to provide, manage and personalise our services to you;

5.1.2 to manage and administer our relationship with you (e.g. communicating with you, instruction, and conflict checking, file opening, billing procedures and credit checks);

5.1.3 to facilitate our internal business operations (e.g. internal record keeping, procurement and accounting practices);

5.1.4 to conduct the recruitment process, including receiving and processing job applications and arranging interviews;

5.1.5 to establish, exercise or defend legal claims. This includes where you are the counterparty and our client is taking action against you and circumstances where claims are made against or by us;

5.1.6 as required by law and to comply with our statutory and regulatory obligations (e.g. anti-money laundering, disclosure obligations and court orders);

5.1.7 to manage complaints, take action to put matters right and to answer questions;

5.1.8 to send you marketing materials and complete any request that you may make in relation to your marketing preferences, or other preferences relating to our communications with you;

5.1.9 to promote our services and to contact you with communications about legal updates, newsletters and events;

5.1.10 to organise and run events that you have expressed an interest in attending;

5.1.11 to monitor and analyse our interactions with you to improve our relationship with you and help us to grow and develop our business;

5.1.12 for information and physical security and the prevention and detection of criminal and dishonest activity, including to ensure the security of our website and premises, and protect our information systems against data breaches, viruses and similar threats (e.g. by monitoring patterns of activity and scanning communications for appropriate content, attachments and viruses);

5.1.13 to manage changes to our business (e.g. if we enter into any business arrangements (such as a joint venture with a partner) or if there is a change in our ownership or we merge with another company);

5.1.14 to enter into arrangements with your employer where you are a representative for or employee from a third party supplier that we use; and

5.1.15 for referral purposes, we maintain a database of legal services providers and personal data relating to other third parties such as experts for similar purposes.

6.1 We are committed to keeping your personal data secure. We have implemented appropriate physical, electronic and operational security safeguards to prevent unauthorised disclosure or access to your personal data. We will notify you and any applicable regulator of a personal data breach relating to your personal data where we are legally required to do so.

6.2 We secure the personal data that we collect and hold about you, including by deploying encryption technology, password protection and access controls. We also require our employees to undertake training in data privacy and to follow our internal policies and procedures relating to data.

7.1 Your personal data may be shared with:

7.1.1 service providers who support the operation of our business (e.g. IT services providers, business support service providers, postal, courier and telecommunication service providers, review platforms and companies we use for marketing campaigns, financial institutions and other payment services providers, and providers of debt management services);

7.1.2 other third parties connected to, involved in or engaged by us to support our work (e.g. courts and authorities, representatives from the Legal Aid Agency, professional advisers (including accountants, financial auditors and tax advisers), external auditors in relation to our accreditations, legal counsel, experts and witnesses;

7.1.3 law enforcement, judicial, governmental and regulatory agencies, or professional bodies or similar where and to the extent that we are compelled to do so by law, regulation or professional obligations;

7.1.4 third parties in connection with changes to our business, such as a new owner, or merging partner; and

7.1.5 other third parties in appropriate circumstances (e.g. where we run a joint seminar/webinar with a third party that you wish to attend (and where the event is a webinar, your registration name may be visible to other attendees during the event)).

7.2 Some of these recipients may be acting as controllers. We will limit the personal data that we share to the minimum required for the relevant purpose and will seek to ensure that your personal data remains appropriately protected if it is shared.

8.1 Where we share your personal data with third parties in accordance with Section 7 (Sharing your Personal Data), those third parties may be located outside of the UK/EEA. In all cases, your personal data is handled and protected in accordance with UK data protection law.

8.2 Where we use cloud services, our data will generally be hosted within the UK or EEA. If we transfer any personal data to third parties outside of the UK, we may rely on: (a) a lawful exception to the rules relating to overseas data transfers (for example, you have given your explicit consent or it is necessary to make the transfer to fulfil our contract with you); (b) a decision from the Secretary of State (or other mechanism permitted under the UK data protection laws) determining that the country provides an adequate level of protection to the UK data protection laws; or (c) appropriate safeguards in respect of transfers of personal data to a country outside of UK (for example, by requiring the recipient of the personal data in the other country to agree to the standard contractual clauses or international data transfer agreement approved under the UK data protection law).

9.1 Your personal data is retained by us in accordance with applicable law and regulation. Our data retention periods vary depending on the location, nature and context of the personal data that we have in our care, and are calculated taking into account the following factors:

9.1.1 potential claims or litigation;

9.1.2 guidance from official bodies such as relevant data protection supervisory authorities and professional regulatory bodies;

9.1.3 how long we need to keep the data to fulfil the original purpose for which it was collected;

9.1.4 the nature and sensitivity of personal data; and

9.1.5 legal obligations to which we are subject.

9.2 This means that, in general, we delete personal data when:

9.2.1 the purpose for its processing has been fulfilled or the contractual relationship with our client, you or your company has ended;
9.2.2 all mutual claims have been fulfilled; and

9.2.3 there are no other legal obligations to retain the personal data nor legal bases for further processing.

9.3 Typically, we retain personal data in client files for 7 years after the completion of the matter, unless there are specific circumstances compelling us to retain the client files for a longer period. For example, if you tell us that you do not want to receive marketing communications from us, we will keep a record of this for a longer period of time.

9.4 In some circumstances you can ask us to delete your personal data. Please see below for more information about your right to erasure. We may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes.

10.1 You have certain rights relating to your personal data. These include the right to:

10.2 We encourage you to contact us if you have any questions, comments or concerns about how we handle your personal data. Please contact the Professional Standards Team at [email protected]

10.3 The UK data protection law also gives you the right to lodge a complaint with the data protection supervisory authority for the UK which is the Information Commissioner’s Office (ICO). You can contact the ICO using the details set out below:

Data Protection Supervisory Authority: Information Commissioner’s Office

Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline number: 0303 123 1113