Lock & Marlborough

Data Protection Privacy Policy

Introduction

Lock and Marlborough are the 'controllers' of the information that we collect about you ('personal data'). Being controllers of your personal data, we are responsible for how your data is processed. The word 'process' covers most things that can be done with personal data, including collecting, storing, using and destroying that data. This data will be processed in accordance with the Data Protection Act (2018) and UK General Data Protection Regulation.

Any data that you submit using the contact details on this website will be held by Lock and Marlborough securely and in accordance with the Data Protection Act (2018) and UK General Data Protection Regulation for 6 months before being securely and confidentially destroyed unless your request leads to a substantive matter.

This notice explains why and how we process your data, and explains the rights you have around your data, including the right to access it and to object to the way it is processed. Please see the section on 'Your rights as a data subject' for more information.

We are a Law Firm and our contact details are:

Address: 2 The Broadway, Gunnersbury Lane, W3 8HR
Email: enquiries@lockandmarlborough.co.uk
Telephone Number: 020 8993 7231

We are registered with the office of the Information Commissioner Registration number Z7049689

Our Data Protection Office (DPO) is Rafiq Sumra.

Personal Data

'Personal data' is any information that relates to a living, identifiable person. This data can include your name, contact details, and other information we gather as part of our relationship with you. It can also include 'special categories' of data, which is information about a person’s race or ethnic origin, religious, political or other beliefs, physical or mental health, trade union membership, genetic or biometric data, sex life or sexual orientation. The collection and use of these types of data is subject to strict controls. Similarly, information about criminal convictions and offences is also limited in the way it can be processed.

We are committed to protecting your personal data, whether it is 'special categories' or not, and we only process data if we need to for a specific purpose, as explained below.

We collect your personal data mostly through our contact with you, and the data is usually provided by you, but in some instances we may receive data about you from other people/organisations. We will explain when this might happen in this Notice.

This statement contains information about:

1. Contacting you
2. Our grounds for processing your data when we work with you
3. Who we share your data with
4. How we store your data and how long we keep it for.
5. Your rights as a data subject

If you do not provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you and you do not provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you. In this case, we may stop providing that service but we will notify you if this is the case at the time.

Personal data received from third parties

Information from our clients, the courts and other legal professionals may include personal data about individuals that is relevant to a legal matter that we are working on. We are committed to protecting all personal data that we hold and will treat this data with the same care that we treat data held about our clients. Where personal information about another person is shared with us by a client, we require that they have considered the bases under which they have supplied that information and that they have sought permission to do so where required.

Processing your data to provide you with our services

In general terms we process your data to fulfil our responsibilities in the relationship that we have with you. You can find a list of specific purposes for processing your data and the legal basis for each type of processing at the end of this document.

At times, we may further process data which we have already collected. We will only do this if the new purpose for processing it further is compatible with the original purpose that the data was collected for. We will tell you about any further processing before carrying it out.

Who we share your data with

For some processing purposes we share your data with third parties. This is a list of the information we may share with external recipients, and for what purpose:

• Our IT system providers have access to data so that we can ensure that our systems operate effectively and that we are running current versions of software.
• Financial and quality auditors view data to monitor that we are complying with statutory and regulatory requirements and to confirm that we are complying with the requirements of the Lexcel practice quality mark.
• We will share you data with other legal professionals, costs drafting and other technical experts when that is appropriate to fulfil the requirements of the service we are providing for you.

We manage our own paper archive records and Shredit manages controlled destruction of the records when they reach the end of their retention period.

How we store your data

Your personal data is held in both hard copy and electronic formats.

Electronic data, including emails, is stored in our servers, which are located in the UK. All providers of cloud services that we use are accredited to the ISO27001 standard.
We rarely transfer personal data to other jurisdictions. If we need to do this with your data we will tell you about the transfer and the safeguards in place to protect your data, before the transfer takes place.

How long will we hold your data?

We will only hold your information for as long as necessary to provide the legal services and then for only so long as we are required either contractually or under our regulatory obligations. This will depend on the type of the case / matter. After this time, we will confidentially destroy all information that we hold about you other than your name, address and date of birth which we will be obliged to continue to hold for 15 years for the purposes of ensuring that we never act for another client where doing so would conflict with our obligations of confidentiality to you.

Your rights as a data subject

As a data subject, you have the following rights in relation to your personal data processed by us:

• To be informed about how your data is handled;
• To gain access to your personal data;
• To have errors or inaccuracies in your data changed;
• To have your personal data erased, in limited circumstances;
• To object to the processing of your personal data for marketing purposes or when the processing is based on the public interest or other legitimate interests;
• To restrict the processing of your personal data, in limited circumstances;
• To obtain a copy of some of your data in a commonly used electronic form, in limited circumstances;
• Rights around how you are affected by any profiling or automated decisions.

Withdrawing consent

If we are relying on your consent to process your data, you may withdraw your consent at any time.

Exercising your rights, queries and complaints

For more information on your rights, if you wish to exercise any right or for any queries you may have or if you wish to make a complaint, please contact Rafiq Sumra at Lock and Marlborough on 020 8993 7231.