Privacy Policy
Mortlake Law & Mediation Privacy Policy
Mortlake Law Ltd t/a Mortlake Law & Mediation a company of lawyers and mediators committed to protecting and respecting privacy. This notice sets out the basis on which any personal data we collect from you, or that is provided to us, will be processed by us. It is aimed primarily at clients of this firm but includes how we may make use of personal data held about others also. Please read the following carefully to understand how we will treat your information, protect it and to understand more about your rights. Where applicable, by providing your personal information to us you are agreeing to us using your information as described in this policy.
Definitions We or Us: Mortlake Law Ltd whose R/O is at of 53 Sheen Lane, East Sheen, London SW14 8AB.
Personal data: Any data or information, in electronic or organised hard copy, that identifies you personally or which relates to you when you are identifiable.
Special categories of personal data: Sensitive information relating to you, namely: health records; information regarding your sex life, sexual orientation, political opinions, religious or philosophical beliefs, racial or ethnic origin, trade union membership; and genetic and biometric data.
Personal data we process:- • Names and contact details • ID and other information we require to conduct due diligence • Personal and financial information relating to our clients’ legal matters • Special categories of personal data (i.e.‘sensitive personal data’), where relevant to our clients’ legal matters.
Our lawful basis for processing your personal data and special categories of personal data:- • If you have given consent to the processing of your personal data (including special categories of personal data), then we may process that data for the purposes for which you have given consent. • If you are a client, processing of personal data is necessary for the performance of our contract to provide legal services and/or to take steps at your request prior to entering such a contract. The lawyer mediator/-client relationship is a contractual one, and to perform our contract, it is unavoidable that this requires us to process personal data. • We are permitted by law to process personal data where this is necessary to comply with legal duties. We have legal and regulatory duties to process certain personal data, including ID and other information we require to conduct due diligence. • We are permitted by law to process personal data where this is necessary for the purposes of pursuing legitimate interests, whether our own or those of third parties such as our clients. We and our clients have a legitimate interest in giving and receiving legal and mediation advice and assistance and in processing personal data in connection with the provision of those services and for the purposes described below.
- We have a legitimate interest in processing the personal data of our clients for the purposes of marketing our services. • For special categories of personal data, we are permitted to process personal data (e.g. health records) where it is necessary for the establishment, exercise, or defence of legal claims.
How will we use your personal data. We use personal data processed by us for the following purposes: • to identify clients and provide clients with the legal services requested; • to provide clients with information requested about services we offer; • to carry out our obligations arising from any contracts entered into between our clients and us and to provide clients with the information and services that they request from us; • to carry out checks in relation to conflicts of interest; • to conduct due diligence on our clients (including money laundering and similar checks); • to notify clients about changes to our service; • to market our business; • to deal with, and to respond to, feedback, queries or complaints; • to comply with our regulatory obligations and the requirements of our insurers; • to administer, support, improve and develop our business and to enforce our legal rights.
Where we get your personal data from:- • Our clients and our clients’ representatives • Public records • Other parties whom we contact in the course of carrying out legal services for our clients (e.g. doctors, employers, estate agents, accountants, banks, surveyors, medical professionals, friends, family, witnesses, other parties with an interest in a particular legal matter (and their representatives), courts, regulatory bodies and other advisors and specialists involved in the matter).
Data rights Subject to certain exceptions, you may have the right, free of charge, to: • Access your personal data (known as a subject access request) • Have mistakes rectified • Have your personal data erased by us or restrict the way we process your personal data (subject to certain conditions) • ‘Port’ your personal data to another provider • Object to us using your personal data for direct marketing • Not be subject to ‘automated processing’ (often referred to as ‘profiling’). You simply need to contact us to exercise any of your rights. In the case of marketing, there is always an ‘unsubscribe’ button in our marketing emails.
Please note however that if you are not a client of this firm then our legal duties as lawyers and mediators to keep the affairs of our clients confidential may limit how we can interact with you and what information we can provide to you. We may not be able to confirm whether we process your personal data or not because to do so may compromise client confidentiality or legal /mediation professional privilege. To the extent that you have consented to our processing of your personal data, you have the right to withdraw this consent at any time, without affecting the lawfulness of any processing conducted prior to the withdrawal of your consent. However, where we also rely on other bases for processing your personal data, you may not be able to prevent processing of your data on those bases. For more information on your legal rights see the Information Commissioner’s website (www.ico.org.uk).
Retention of personal data We are required by our insurers and regulators to keep your file and personal data for minimum periods. We retain personal data because it may be required in the event of a later complaint or claim. We are not however permitted to keep your personal data indefinitely or for longer than is necessary. Our retention policy is that the minimum period we will keep files and other personal data relating to a legal matter is 6 years after the date of the last work conducted on it. We may keep a file for significantly longer than that if it is necessary and in our legitimate interests to do so (for example files relating to wills, property, or children, or where you request this). All our files and other documents containing personal data are destroyed securely.
Sharing your personal data– In providing legal services to our clients, we may need to share personal data with our staff, clients, other professionals who we instruct (e.g. barristers), third parties who are vital to a transaction (e.g. mortgage providers, the courts, witnesses), other parties with an interest in a particular legal matter (and their representatives) and providers of services that are necessary to progress a legal matter (e.g. to perform our client due diligence checks on you). In the case of personal data of clients, our clients may instruct us to share their personal data with third parties (such as estate agents, family members or other representatives). We may also need to share your personal data with our regulators, insurers, and law enforcement agencies. We use external auditors to review our files for training, compliance, and quality. Where we share your personal data with third parties, we will ensure that they are have appropriate data protection arrangements in place.
Where we hold your personal data. Your data will be stored at our offices and on our IT equipment, or where your information is shared with a third party, at their premises or on their IT equipment. Transferring your personal data outside of the EEA Since we do not have offices outside England & Wales, we have no reason to transfer your personal data outside the European Economic Area unless you or a third party with whom we must share your personal data are based outside the EEA. Where we use third party IT services (e.g. ‘cloud’ based software) we shall ensure that their data centres are either within the EEA or that there are lawful safeguards in place to protect your personal data to the same standard as if it were held within the EEA. Data Protection Officer. Our Data Protection Officer is Richard Buxton.
For Data Protection legislation, the data controller is Richard Buxton.
Complaints and questions If you have a complaint or question about our use of your personal data, please contact in the first instance our Data Protection Officer. You may also make complaints direct to the Information Commissioner’s Office (web: www.ico.org.uk/concerns Tel: 0303 123 1113).