This policy describes:

• What personal information we collect about you and how we obtain your personal information.
• How we use your personal information, for which purposes, and who we share your personal information with.
• Where we process your personal information.
• Your rights regarding your personal information.

What: Collection of your personal information
We may collect personal information from you in the course of our business, when you contact us or request information from us, when you seek to, or engage, our legal services or if you are signing up to receive legal updates or news from us from time to time. We collect most of this directly but the sources of any indirect collection are identified in this policy.

The types of personal information that we process includes:

• Basic information, such as your name (including name prefix or title),
• The company you work for, and your title or position.
• Contact information, such as your postal address, email address and phone number(s).
• Financial information, such as payment-related information.
• Technical information, such as information from communications with you electronically.
• Identification and background information provided by you or collected as part of our business acceptance processes.
• Personal information provided to us by or on behalf of our clients or generated by us in the course of providing services, which may include special categories of data.
• Any other information relating to you which you may provide to us.

Why: Use of your personal information
McEvedys uses your personal information for the following purposes:

To perform our Services Contract and for the establishment and defence of your Legal Rights

• To determine whether we can provide services to you with a view to entering a retainer.
• To deliver legal advice or assistance to you and to perform our retainer with you.
• To deliver other services to you, such as pro-bono services or legal updates.

For our Legitimate Interests

• This will include tasks necessary for the operation of our commercial and business activities such as for governance, accounting and managing our business and our provision of services to you.
• We may use other companies to provide certain administrative and other services to us or on our behalf, including mailing and delivering items and sending postal mail and copying and printing service providers as well as archive providers.
• We may also share your personal information with certain trusted third parties under contracts (including confidentiality agreements) in place with them, including our email and IT, bookkeeping and accounting service providers as well as our bank and identity verification and database verification services.
• We may also share your personal information with certain trusted third parties engaged in the course of the services we provide to clients and with their prior consent, such as barristers and local counsel or expert witnesses or other lawyers internationally who work on your cases. These third parties are regulated and will usually also be subject to the same obligations to protect personal data.

To comply with Legal Obligations

McEvedys may disclose your personal information if required to do so by law to government agencies or regulators such as the SRA or ICO but will only do so strictly as required or under the terms of a court order.

You are also entitled to request details of the information we hold about you and how we process it. You also have a right in accordance with applicable data protection law to have it rectified or deleted, to restrict our processing of that information, to stop unauthorised transfers of your personal information to a third party and, in some circumstances, to have personal information relating to you transferred to another organisation. You also have the right to lodge a complaint in relation to our processing of your personal information with the ICO, our supervisory authority, and we to defend the same.  With informed Consent McEvedys may use or disclose your personal information if you ask us to do so. For example where you ask us to write to someone for you or to assert a claim or a defence. McEvedys may use or disclose your personal information if you ask us to process any special categories of data about you (including racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union memberships, genetic or biometric data, data about your health, sexual life or orientation). McEvedys may use or disclose your personal information for marketing purposes in accordance with and only on the terms of your express consent.

Where: Location
Your information will be stored and processed in the United Kingdom in so far as possible. However, we also seek your consent to transfer the data outside the United Kingdom where necessary:

• To provide services to you by communicating with parties located out of the United Kingdom such as co-counsel or opposing counsel or legal experts or arbitrators.
• Where third party IT or other services or applications use servers/or are themselves based out of the United Kingdom. These may include providers of international trade mark or patent databases, online searching or other services or applications. Where there is a viable domestic option, we will try to select that option rather than share your data across borders and with countries where there is less legal protection. In such cases, we will ensure that the country has a reciprocal level of protection and may apply additional protections and will ensure where possible that third parties are appropriately certified and regulated. Currently, communications and other software providers used by us may transfer our content out of the UK but any such providers are certified under the EU-US Privacy Shield Framework and/or by the binding corporate rules or model clauses approved by the EU. If you do not want us to share your data in this manner, you can speak to us.

How: use of your personal information
McEvedys have adopted the following core principles to govern our use, collection and disclosure of personal data. Personal data must:

• be processed fairly and lawfully and to the extent required under law with valid and informed consent;
• be obtained for specific and lawful purposes;
• be kept accurate and up to date;
• be adequate, relevant and not excessive in relation to the purposes for which it is used;
• not be kept for longer than is necessary for the purposes for which it is used;
• be processed in accordance with the rights of individuals;
• be kept secure to prevent unauthorised processing and accidental loss, damage or destruction. This means that we will meet industry standards of best practice.

Your rights:
When you register, or otherwise give us personal information, McEvedys will not use or share that information with third parties without your permission, other than for the exceptions already listed. It will only be used for the purposes stated above.

The European Union’s General Data Protection Regulation (GDPR) and other applicable data protection laws provide certain rights for data subjects. You are entitled to request details of the information we hold about you and how we process it. You may also have a right in accordance with applicable data protection law to have it rectified or deleted, to restrict our processing of that information, to stop unauthorised transfers of your personal information to a third party and, in some circumstances, to have personal information relating to you transferred to another organisation. You may also have the right to lodge a complaint in relation to our processing of your personal information with the ICO, the UK’s supervisory authority.

Should you wish to stop receiving content from us you will be given the opportunity to unsubscribe each time you receive an email by clicking on the “unsubscribe” link located at the bottom of the email, or you can email your request to victoria@mcevedys.com at any time.

If you object to the processing of your personal information, or if you have provided your consent to processing and you later choose to withdraw it, we will respect that choice in accordance with our legal obligations.

Please note that even after you have chosen to withdraw your consent we may be able to continue to process your personal information to the extent required or otherwise permitted by law, in particular in connection with exercising and defending our legal rights or meeting our legal and regulatory obligations. These generally require that we keep legal, business and accounting records for a six year period.

You can edit your personal information by emailing victoria@mcevedys.com and advising us of the change in details.

Updates to this policy
McEvedys may occasionally update this statement.

Contact information
All data protection queries should be made to our Data Protection Officer, Victoria McEvedy.

The identity of the Data Controller is:

McEvedys Solicitors & Attorneys Ltd, 8 St. James Square, London SW1Y 4JU

London SW1Y 4JH.
0207 243 6122
victoria@mcevedys.com

Complaints
Any complaints about your data may also be referred to the ICO at www.ico.org.uk