Privacy Notice

1.1 We are required to explain why we are asking for information about you, how we intend to use the information you provide and whether we will share this with anyone else, and how we will keep it safe 

1.2 This privacy notice applies to individuals whose personal information we collect or process in connection with our activities, including:

1.2.1 Individual clients and prospective clients;

1.2.2 Current and former employees, workers and contractors of corporate clients, prospective corporate clients and other organisations we work with;

1.2.3 Individuals who contact us through our website, by telephone, by email or through other communication channels;

1.2.4 Individuals who make payments to us, including through our website;

1.2.5 Individuals who apply for employment, training contracts, work placements or other opportunities with Nash & Co Solicitors; and

1.2.6 Individuals who subscribe to our newsletters, attend our events or otherwise interact with our website and services.

2.1 We are Nash & Co Solicitors LLP, a law firm authorised and regulated by the Solicitors Regulation Authority our address is Beaumont House, Beaumont Park, Plymouth, Devon, PL4 9BD. Our company registration number is OC326240

3.1 If you have any concerns or questions about our use of your personal data, or wish to make a complaint about the way we handle your personal data, you can contact our Managing Partner (and Data Protection Officer) in writing at the above address or by email at igrimshaw@nash.co.uk

3.2      We will formally acknowledge your complaint within 30 days and investigate your complaint without undue delay.

3.3     If you remain dissatisfied with the outcome of our investigation of your complaint, you do have the right to escalate the complaint to the Information Commissioner’s Office. Further details can be found towards the end of this privacy notice.

4.1     Some of the information that you provide to us is required for us to provide you with our legal services under your contractual agreement with us.  Without this information, we will not be able to enter into a contract with you or work on a legal matter for you.

4.2     We will also hold your information in our marketing database to allow us to provide and offer further services to you.  This is not required by us in order for us to work on your legal matters and you may request to be removed from our marketing database at any time.  If you would like your personal details to be removed from our marketing database, please email dbriggs@nash.co.uk

4.3     Finally, we hold a small amount of your information in our practice management systems which we use to hold details of our contacts generally and more specifically for regulatory compliance, financial and conflict searching purposes.

4.4 We do not use artificial intelligence (“AI”) to make fully automated decisions, or to train or improve AI systems, or to track behaviour or analyse preferences or build profiles about individuals.

5.1     We are collecting information about you in order to achieve the purposes set out in clause 4 above. This includes:

Personal details of any of our instructing contacts

5.1.1  personal details (such as name, gender and date of birth);

5.1.2  contact details (such as your address, telephone number and email address);

5.1.3  personal information such as details of allergies or food preferences;

5.1.4  payment information (such as bank account details or information about any other payment method);

Personal details relevant to a legal matter

5.1.5   personal details of any person involved in a legal matter (such as name, gender and date of birth);

5.1.6   contact details of any such person (such as address, telephone number and email address);

5.1.7   other personal details, including the following special categories of information where this is relevant to a legal matter: race, ethnic origin, politics, religion, trade union membership, genetics, biometrics (where used for ID purposes), health, sex life and sexual orientation;

Marketing contact details

5.1.8   details held in our marketing database which include the following standard categories: name, organisation, job title, postal address, email address, phone number and subscriptions to newsletters;

Marketing and survey information

5.1.9   your responses to our surveys;

5.1.10 details of any agreement or objection to receiving marketing information from us;

5.2 Recruitment and job applicant information

Where you apply for a position with Nash & Co Solicitors, we may collect and process personal information relevant to your application and our recruitment process.

This may include your name, contact details, employment history, qualifications, professional memberships, education, CV, covering letter, references and information provided during interviews or assessments.

Where relevant and permitted by law, we may also process information relating to your right to work in the UK, any adjustments you require during recruitment and information necessary to carry out appropriate pre-employment checks.

We may receive information directly from you or, where appropriate, from recruitment agencies, referees and other third parties involved in the recruitment process.

We use this information to consider your suitability for a role, communicate with you about your application, arrange interviews and assessments, carry out appropriate checks and, where an offer is made, take steps towards entering into an employment or training contract.

We will only collect and use special category information or information about criminal convictions where this is necessary, lawful and relevant to the recruitment process.

5.3 Online payments

Where you make a payment to Nash & Co Solicitors through our website, we may collect or receive information necessary to identify, process, record and reconcile that payment.

This may include your name, contact details, payment amount, transaction reference, client or matter reference and information about the status of the payment.

Payments may be processed using a third-party payment service provider. Depending on how the payment facility operates, payment card details may be collected directly by that provider rather than by Nash & Co Solicitors.

We use payment information to administer payments, maintain accurate financial records, respond to payment enquiries, prevent fraud and comply with applicable legal, accounting and regulatory obligations.

6.1 How long we keep your personal data
We keep your personal data only for as long as is necessary for the purposes for which we collected it, including to satisfy any legal, regulatory, tax, accounting or reporting requirements that apply to us.

6.2 Anti-money laundering records. As a firm subject to the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, we are required to keep the identity, due diligence and transaction records we obtain about you for at least five years from the end of our business relationship with you or from the completion of an occasional transaction. We will not keep transaction records obtained during a business relationship for more than ten years. When this period ends, we will delete the personal data we obtained for anti-money laundering purposes unless we are required to keep it by law, we are permitted or required to keep it for the purposes of legal or court proceedings, or you have consented to our keeping it. We process the personal data we obtain for anti-money laundering purposes only for the prevention of money laundering, terrorist financing and proliferation financing, or as otherwise permitted by those Regulations.

6.3 Retention beyond these periods. We may keep your personal data for a longer period where we are required to do so by law, where it is necessary for the purposes of actual or anticipated legal proceedings, or where we reasonably believe there is a prospect of a complaint or litigation in connection with our relationship with you.

6.4 How we decide how long to keep your data. Where no fixed period applies, we determine the appropriate retention period by considering the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it and whether we can achieve those purposes by other means, and any applicable legal, regulatory, tax, accounting or other requirements.

7.1 The information which we collect about you will be obtained through a variety of sources which may include:

7.1.1   information provided by you;

7.1.2   from any communication you have with us in relation to any legal matter or potential instruction;

7.1.3   in relation to attendance at any of our training or marketing events;

7.1.4   when you sign up for a newsletter;

7.1.5   when you complete surveys that we use for research purposes;

7.1.6   information collected automatically about you;

7.1.7   information collected from third parties;

7.1.8   we may collect information about you from third parties where we carry out identity verification credit or anti-fraud checks against your name using third party databases.

8.1 The information which you provide to us will be used for the following purposes: 

8.1.1   it will be stored and used by us in accordance with this privacy statement and also in accordance with your rights under the data protection laws;

8.1.2   it will be collected and used by us for the purpose of providing our legal services to you;

8.1.3   it will be used to improve the services you receive from us; and

8.1.4   it will allow us to offer you further information and services which may be useful to you.

8.2     Some of the information which we collect will be special categories of personal data such as information about your ethnic background or any disability you may have.  We will use this for the purposes of working on your legal matter(s) and as needed to provide better services to you (for example when hosting an event to take account of your needs).

8.3 Processing payments

Where we collect or receive personal information in connection with a payment, we process that information for the purposes of administering and recording the transaction.

Depending on the circumstances, our lawful basis may be the performance of a contract under Article 6(1)(b), compliance with legal obligations under Article 6(1)(c) or our legitimate interests under Article 6(1)(f) in receiving payments, maintaining accurate financial records and preventing fraud.

The applicable lawful basis will depend on the purpose of the processing and the circumstances in which the payment is made.

9.1 In accordance with the data protection laws, we need a "legal basis" for collecting and using information about you. There are a variety of different legal basis for processing personal data which are set out in the data protection laws.

9.2     The lawful basis on which we rely in order to use the information which we collect about you for the purposes set out in this notice will be:

9.2.1   using your information in this way is necessary for us to perform the contract between us and in order to take steps at your request prior to entering into the contract; and

9.2.2   using your information is necessary for us to comply with legal and regulatory obligations to which we are subject, for example our obligations to comply with the requirements of the Money Laundering Regulations 2017 and the Solicitors Regulation Authority Code of Conduct; and

9.2.3   using your information pursuant to our legitimate interests, namely to hold your data for marketing purposes.

9.3 Special category personal information

In the course of providing legal services, we may need to collect and process special category personal information. This may include information about an individual's health, racial or ethnic origin, religious or philosophical beliefs, trade union membership, sexual orientation or other information protected under Article 9 of the UK GDPR.

We will only process this information where we have an appropriate lawful basis under Article 6 of the UK GDPR and a separate condition for processing special category information under Article 9.

Where the processing is necessary for the establishment, exercise or defence of legal claims, including obtaining or providing legal advice in connection with legal rights and obligations, we may rely on Article 9(2)(f) of the UK GDPR.

This may apply to information provided directly by a client or obtained from another person or organisation in connection with a legal matter, including employment disputes, personal injury claims, medical negligence claims and other legal proceedings or potential claims.

In other circumstances, we may rely on another applicable Article 9 condition, including explicit consent under Article 9(2)(a), where that condition is appropriate and its requirements are satisfied.

Where special category information is processed for employment or recruitment purposes, we may rely on Article 9(2)(b), together with the relevant provisions of the Data Protection Act 2018, where applicable.

We will only process special category information where it is necessary and proportionate for the relevant purpose and will apply appropriate safeguards to protect it.

9.4     We may also use your sensitive personal data for the purposes of your comfort when hosting a marketing event or for facilitating marketing communications with you (for example using large type).  We will do this only with your express consent.

9.5 Recruitment

Where we process personal information in connection with recruitment, the lawful basis will depend on the purpose for which the information is used.

This may include:

9.5.1 Taking steps at your request before entering into an employment or training contract, under Article 6(1)(b) of the UK GDPR;

9.5.2 Complying with legal obligations, including relevant employment and right-to-work requirements, under Article 6(1)(c); and

9.5.3 Our legitimate interests in assessing applications, managing recruitment and selecting suitable candidates, under Article 6(1)(f), where those interests are not overridden by your rights and interests.

Where special category information is processed during recruitment, we will also identify an appropriate condition under Article 9 of the UK GDPR and, where required, the Data Protection Act 2018.

We will not rely on consent simply because an applicant has voluntarily supplied personal information.

10.1 We may share information about you with our contractors and sub-contractors.  The contractors and sub-contractors shall be contractually required to ensure that they adhere to the security requirements imposed by the data protection laws.

10.2    Our contractors and sub-contractors will only be able to use the information when completing work on behalf of us.  Examples of subcontractors we use regularly are:

10.2.1 Outsourced information technology service providers, which providers may incorporate AI capabilities in the provision of their services but which do not permit the sharing of personal data outside of the Nash & Co dataset;

10.2.2 Outsourced document production services;

10.2.3 Hosted web services, (e.g. Bluestone 360 Limited but also others) who may access your information for the purposes of maintenance of their service; and.

10.2.4 Barristers and/or Solicitor Agents;

10.2.5 Private investigators;

10.2.6 Expert witnesses and/or other professional advisors including advisors appointed by another party;

10.2.7 Accountants

10.2.8 Costs Lawyers

10.2.9 Payment processing providers, merchant services providers and financial institutions involved in processing, verifying, administering and recording payments made to us, including payments made through our website.

Regulators and other legal obligations

10.3    We may also be required to share your information with our regulators, the Solicitors Regulation Authority, who are permitted access to this information by law and with other organisations where we have a legal obligation to share the information with them.

Insurers

10.4    We may need to share your information with our Insurers in certain circumstances, to ensure protection of the firm and of you.

Auditors

10.5    Nash & Co Solicitors LLP is Lexcel accredited. Lexcel is an accreditation indicating quality in relation to legal practice management standards. To maintain this and other accreditations we are regularly audited by external auditors such as the Legal Aid Agency and Legal Expenses Insurers.  We will ensure that any auditors access your information solely for the purposes of carrying out the audit in question and that they are subject to the security requirements imposed by the data protection laws.

Other organisations

10.6    We may from time to time share your information with other organisations but only to the extent required to allow them to maintain services provided to us and always subject to appropriate confidentiality provisions.

11.1 We primarily operate in the United Kingdom. However, some of the third-party service providers we use may process, store or access personal information outside the UK.

11.2 Where personal information is transferred internationally, we will ensure that the transfer complies with applicable UK data protection legislation and that an appropriate legal mechanism is in place.

11.3 Depending on the country and organisation involved, this may include:

11.3.1 Transferring information to a country or organisation covered by UK adequacy regulations;

11.3.2 Transferring information to a qualifying US organisation participating in the UK Extension to the EU-US Data Privacy Framework, where the relevant requirements are met; or

11.3.3 Using appropriate contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, together with any additional assessments or safeguards required by law.

11.4 Where we rely on contractual safeguards for an international transfer, you may contact us using the details in Section 3 to request further information about those safeguards and how to obtain a copy.

11.5 We review the international transfer arrangements associated with our service providers to ensure that personal information is protected in accordance with applicable data protection requirements.

12.1 The information that you provide will be stored securely on our electronic and hard copy filing systems.  We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

13.1 In limited circumstances we may use your information for a purpose other than those set out in this policy. If we intend to do so, we will provide you with information relating to that other purpose before using it for the new purpose.

14.1 We will store personal data which you provide to us on your matter file in accordance with our file destruction policy.

14.1.1 we have a formal written agreement with you to retain a file or category of files for a specified period of time, in which case the agreed period of time will prevail;

14.1.2 we write to you proposing a different date for document and data retention, normally either in the matter engagement or a file closing letter; or

14.1.3 a party to the matter does not have capacity or is a minor, in which case we will hold the file for 25 years;

14.2   This means that we will hold your file for the relevant time period after which we will delete, destroy or encrypt it.  If you wish to retain copies of any documents or data beyond that time period you must contact us before the expiry of the relevant time period.  Charges may apply to any extended retention period or if you would like us to provide a copy of your file.

14.3   In addition, we will store some of your personal data including name, date of birth, job title, organisation, email address:

14.3.1 in our firm’s practice management system for a minimum of seven years, primarily for conflict checking and regulatory compliance, including anti-money laundering and identification verification, purposes after which it will be encrypted.

14.4 Marketing
We will use your personal data to send you marketing communications about our own products and services where you have asked us to, or where we are otherwise permitted to do so by law.

14.4.1 Email and text marketing. We will only send you marketing by email or text message where:

• you have given us your consent to do so; or

• you are an existing or prospective customer whose contact details we obtained in the course of selling, or negotiating the sale of, a product or service to you; the marketing relates only to our own similar products and services; and you were given, and did not take, the opportunity to opt out when we collected your details.

Every marketing email or text we send will include a simple, free way to opt out (for example, an unsubscribe link). You can tell us to stop sending you marketing at any time by [using the unsubscribe link in any message] / [contacting us at [insert address / email]].

14.4.2 Your consent. Where we rely on your consent, you can withdraw it at any time, and it will be as easy to withdraw as it was to give. Withdrawing consent does not affect the lawfulness of anything we did before you withdrew it. If you withdraw your consent, we will stop using your personal data for the relevant marketing.

14.5 Recruitment information
If you apply for a position with Nash & Co Solicitors, we will use the personal information you provide to assess your application and manage the recruitment process.

If your application is unsuccessful, we will normally retain relevant recruitment records for up to 18 months after the recruitment process has concluded. This allows us to respond to queries or complaints, establish, exercise or defend legal claims and maintain records of previous applications.

We may delete certain information, including supporting documents and detailed application materials, before this period ends where it is no longer required.

If your application is successful, relevant information will be transferred to your employment records and retained in accordance with our employee data retention policy.

14.6 Payment information
We retain payment and transaction records for the periods required by applicable accounting, tax, legal and regulatory obligations and, where relevant, in accordance with our client matter file retention arrangements.

Information held by third-party payment providers may be subject to their own applicable retention requirements. Further information about those providers and their processing arrangements may be available through their respective privacy notices.

15.1 If you have any questions about our use of your personal data, you are welcome to contact us.  You will find our contact details in clause 3.1.  If you notice any errors in your personal data, you have the right to have them corrected.

15.2    Under certain circumstances, by law you have the right to:

15.2.1 Request access to your personal information (commonly known as a “data subject access request”).  This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it;

15.2.2 Request correction of the personal information that we hold about you.  This enables you to have any incomplete or inaccurate information we hold about you corrected;

15.2.3 Request erasure of your personal information.  This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it.  You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below);

15.2.4 Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.  You also have the right to object where we are processing your personal information for direct marketing purposes;

15.2.5 Request the restriction of processing of your personal information.  This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it;

15.2.6 Request the transfer of your personal information to another party.

16.1 In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time.  To withdraw your consent, please contact the contact details set out in clause 3.1.  Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

17.1 If you send us personal data about anyone other than yourself, you will ensure you have any appropriate consents or other lawful basis and notices in place to enable us to transfer that personal data to us so that we may use it for the purposes for which you provide it to us.

18.1 If, after raising a data protection complaint with us, you are not satisfied with the way we use your information or have dealt with your complaint, you have the right to complain to the Information Commissioner's Office (the "ICO").  You can contact the ICO by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF or visiting https://ico.org.uk/make-a-complaint/.

19.1 We may amend this privacy statement at any time so please review it frequently and at least each time you submit personal information to us.  Our current privacy statement applies to all information that we have about you and your matters.