Privacy Notice

It may be helpful to explain some key terms used in this notice:

The table below sets out the personal data we will or may collect in the course of advising and/or acting for you.

This personal data is required to enable us to provide legal services to you. If you do not provide the information we request, this may delay or prevent us from providing services to you.

• from publicly accessible sources, e.g. Companies House or HM Land Registry;
• directly from a third party, e.g.:
  • sanctions screening providers;
  • credit reference agencies;
  • client due diligence providers;
• from a third party with your consent, e.g.:
  • your bank or building society, another financial institution or advisor;
  • consultants and other professionals we may engage in relation to your matter;
  • your employer and/or trade union, professional body or pension administrators;
  • your doctors, medical and occupational health professionals;
• via our website—we use cookies on our website (for more information on cookies, please see our cookies policy)
• via our information technology (IT) systems, e.g.:
  • case management, document management and time recording systems;
  • automated monitoring of our websites and other technical systems, such as our computer networks and connections, communications systems, email and instant messaging systems

Under data protection law, we can only use your personal data where we have a lawful basis for doing so. This will usually be because:

• we need to provide legal services to you;
• we are required to comply with legal or regulatory obligations;
• we have a legitimate business reason for using the information; or
• you have given your consent.

The table below summarises the main ways in which we use personal data and the legal basis for doing so.

Where we process special category personal data, we will do so in accordance with applicable data protection legislation and any additional legal conditions that apply. In some cases this will be based on your consent, but it may also be necessary to establish, exercise or defend legal claims, comply with legal obligations or for other lawful reasons permitted by data protection legislation.

We may send you information about:

• legal developments that may be relevant to you;
• our services;
• events and publications; and
• new service offerings.

We do this because we have a legitimate interest in keeping clients and contacts informed about matters that may be of interest to them. Where consent is required by law, we will ask for it separately.

We will never sell your personal data or allow other organisations to use it for their own marketing purposes.

You can opt out at any time by:

• emailing marketing@nalders.co.uk;
• using the unsubscribe link in a marketing email; or
• replying STOP to a marketing text message.

We may ask you to review your preferences if you instruct us again or if there are changes to our services or legal obligations.

We routinely share personal data with:

• professional advisers whom we instruct on your behalf or refer you to, such as barristers, medical professionals, accountants, tax advisers and other experts;
• other third parties where necessary to carry out your instructions, such as mortgage lenders, HM Land Registry, Companies House and other organisations involved in your matter;
• credit reference agencies;
• our insurers and insurance brokers;
• external auditors, for example in connection with Lexcel, ISO or other accreditations and financial audits;
• our bank;
• external service suppliers, representatives, agents, technology providers and software platforms that we use to support and improve the delivery of legal and administrative services, including case management systems, document management systems, client onboarding and identity verification platforms, appointment scheduling systems, document collation and analysis services, communication platforms and approved artificial intelligence tools and services operating within our technology environment.

We only allow our service providers to handle your personal data where we are satisfied that appropriate confidentiality, information security and data protection measures are in place. We also impose contractual obligations on service providers to ensure that they only use your personal data to provide services to us and, where applicable, to you.

Where we use external technology providers, including approved artificial intelligence providers, we only do so where we are satisfied that appropriate confidentiality, information security and data protection safeguards are in place.

We may disclose and exchange information with law enforcement agencies, courts, tribunals, regulators and other public authorities where required to comply with our legal and regulatory obligations.

We may also need to share personal data with other parties in connection with a sale, merger, acquisition, restructuring or other corporate transaction involving our business. We will seek to share the minimum information necessary and, where appropriate, information will be anonymised. Recipients of the information will be subject to confidentiality obligations.

Information may be held at our offices and those of our third party agencies, service providers, representatives and agents as described above (see ‘Who we share your personal data with‘).

Personal data may also be processed within approved technology platforms used by the firm, including approved cloud-based services and approved artificial intelligence tools operating within our Microsoft 365 environment.

Some of these third parties may be based outside the European Economic Area. For more information, including how we safeguard your personal data when this occurs, please see below: ‘Transferring your personal data out of the EEA‘.

We will retain your personal data after we have finished advising or acting for you where this is necessary:

• to respond to any questions, complaints or claims made by you or on your behalf;
• to demonstrate that we have treated you appropriately and in accordance with our professional obligations;
• to comply with legal, regulatory, accounting, insurance and record-keeping requirements; and
• to establish, exercise or defend legal claims.

We will not retain your personal data for longer than is necessary for the purposes set out in this notice. Different retention periods apply to different categories of personal data and different types of matter. Further details are available in our Records Retention Schedule, which is available on request.

This retention approach applies both to information provided to us and to information created during the course of providing legal services, including records, correspondence, notes, analyses and other work product generated by our staff or with the assistance of approved technology systems.

When it is no longer necessary to retain your personal data, we will securely delete, destroy or anonymise it.

To deliver services to you, it is sometimes necessary for us to transfer your personal data outside the United Kingdom and/or the European Economic Area (EEA), for example:

• where our service providers, technology providers, approved artificial intelligence providers or software platforms process data outside the United Kingdom or the EEA;
• if you are located outside the United Kingdom or the EEA;
• where there is an international element to the matter on which we are advising you.

Whenever we transfer personal data outside the United Kingdom or the EEA, we ensure that appropriate safeguards are in place and that the transfer complies with applicable data protection laws.

Depending on the circumstances, these safeguards may include:

• transfers to countries that have been recognised as providing an adequate level of protection for personal data;
• the use of Standard Contractual Clauses and, where required, the UK International Data Transfer Addendum or other approved transfer mechanisms;
• contractual, technical and organisational measures designed to protect personal data.

Some of the technology platforms used by the firm, including approved cloud-based systems and approved artificial intelligence tools, may involve the processing of personal data outside the United Kingdom or the EEA. Where this occurs, we take steps to ensure that appropriate safeguards are in place and that your personal data remains protected.

If you would like further information about international transfers of your personal data, please contact us.

You have the following rights, which you can exercise free of charge:

Nalders LLP does not make decisions affecting clients solely through automated processing or artificial intelligence systems without appropriate human involvement.

For further information on each of those rights, including the circumstances in which they apply, please contact us or see the https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/guidance published by the Information Commissioner’s Office (ICO) on individual rights under data protection legislation.

If you would like to exercise any of those rights, please:

• email, call or write to us – see below: How to contact us;
• provide enough information to identify you (for example your full name, address and client or matter reference number);
• provide proof of your identity and address (for example a copy of your driving licence or passport and a recent utility bill or bank statement); and
• let us know what right you wish to exercise and the information to which your request relates.

We have appropriate technical and organisational security measures in place to protect personal data against accidental loss, unauthorised access, misuse, alteration or disclosure. Access to personal data is restricted to those who have a genuine business need to know it. Anyone processing personal data on our behalf does so only in an authorised manner and is subject to confidentiality obligations.

Some of the systems used by the firm include approved cloud-based technologies and artificial intelligence tools. Where such systems are used, we seek to ensure that appropriate technical and organisational measures are in place to protect personal data, maintain confidentiality and comply with applicable data protection requirements.

We also have procedures in place to identify, investigate and respond to suspected personal data breaches. Where we are legally required to do so, we will notify affected individuals and the appropriate regulator.

If you would like further information about protecting yourself against fraud, identity theft, cybercrime, viruses and other online risks, please visit www.getsafeonline.org. Get Safe Online is supported by HM Government and leading businesses.

We hope that we can resolve any query or concern you may raise about our use of your personal data.

You also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK’s independent authority for data protection and privacy matters, if you believe that we have not complied with applicable data protection laws.

The ICO can be contacted via its website at httpsn 0303 123 1113.