Home > Privacy Policy

Privacy Policy

Coulson Read Lewis Solicitors are Data Controllers as defined by the Data Protection Act 2018.

We are registered withe the Information Commissioner’s Office (ICO) under registration number CSN0755865.

Matt Lewis is the partner of the firm responsible for Privacy, his contact details arel

Matt Lewis

1&2 Offa Street

Hereford

Herefordshire

HR1 2LJ

01432 357005

Email – matt@coulsonreadlewis.co.uk

The Type of Personal Information we Collect

Personal Data is processed lawfully, fairly and transparently, without adversely affecting the rights of the data subject.

We are only entitled to hold and process personal data where the law allows us to.

Teh current law on data protection (Article 6 GDPR) sets out a number of different reasons for which a law firm may collect and process your personal data. The processing of personal data is deemed lawful if at least one of the following applies;

Contractual Obligations – where processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering onto a contract. In much of our client work, the main purpose for our holding of the client’s personal data will be to provide them with legal services under the agreement we have with them. This agreement is a contrcat between us, and we may process their personal data for the purposes of performing a conract (or the steps necessary to enter into a contract). We will also need to process staff member’s personal data in order to meet our obligations as an employer under contrcats of employment.
Legitimate Interests – the processing is necessary for the purposes of the legitimate interests pursued by us as the data controller or by a third party, except where such interests are overriden by the fundamental rights and freedoms of the dtat subject which require protection of personal data, in paerticular where the data subject is a child. In specific stutaions, we may require personal data to pursue our firm’s legitimate interests in a way which might reasonably be expected as part of running or business and which does not materially impact the data subject’s rights, freedoms or interests. This may include to satisfy our external quality auditors or our regulator.
Legal Compliance – the processing is necessary for compliance with a legal obligation to which our firm, as a data controller, is subject. If the law requires us, we may need to collect and process personal data to meet our legal and regulatory obligations. For example, we may need to pass on personal data when we need to pass on details of people involved in fraud or other criminal activivty. we may also need to process our staff member’s persoanl data as part of our ecxercise of specific rights in the field of employment law.
Consent – the data subject has given consent to the processing of their personal data for one or more specific purposes. In limited circumstances, we may approach data subjects for their written cond=sent to allow us to process personal data and in particular certain particularly sensitive data. If we do so, we provide the data subject with full details of the information that we would like and the reason we need it, so that they can carefully consider whther they wish to consent.
Vital Interests – the oprocessing is necessary to protect the vital interests of the data subject or of another natural person.
Public Interest – the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.

Special Category Data

Special categories of particularly sensitive personal data require higher levels of protection and we have to ensure we have further justification for collecting, storing and using this type of personal information.

We have to ensure we have fully considered the risks and impact associated with the processing of such data not least with regard to data minimalisation, security and transparency.

We may process special category data (or sensitive personal data) on the following circumstances:

Where we need to carry out our legal obligations or exercise rights in connection with the law.
Where is it is needed in the public interest, such as for equal opportunities monitoring.
Where it is needed in relation to legal claims or where it is needed to protect a data subject’s interests (or someon else’s interests).
In the course of legitimate buiseness activities with the appropriate safeguards.
In limited circumstances, with explicit consent.

Depending on the circumstances of their legal matters, for some clients, we may have access to or process special category data including;

personal data revealing racial or ethnic origin, political opinions, religous or philosphical beliefs, or trade unuin membership.
genetic data.
biometric data processed for the purpose of uniquely identifying a natural person, or,
data concerning health or a natural person’s ex life or sexual orientation.
in the context of casework, the details and merits of a matter.

In addistion to contract lawful condition for processing under Article 6 of GDPR, Article 9(2)(f) of the UK GDPR permits us to process this data where it is necessary for, connected to and/or relates to legal claims including for the purposes of assisting with legal proceedings, obtaining legal advice and/or establishing, exercising or defending legal rights. We only process this specific data if it is necessary to establish, exercise or defend a client’s legal rights. we will ensure that the use of this data is relevant and proportionate and that we do not hiold any more data than is needed.

Depending on the circumstances of their legal matters, for some clients, we may hace access to or process personal data relating to crimina convictions and offences or related security measures. The special condition for processing this data (pursuant to Schedule 1 and Article 10 of the UK GDPR) is because it is necessary for, connected to and/or relates to legal claims including for the purposes of assisting with legal proceedings, obtaining legal advice and/or establishing, exercising or defending legal rights.

How We Store Your Personal Information

Our policy is to protect the information we hild, as detailed above, from all threats, whetehr internal, external, deliberate or accidental.

It is our policy to ensure that;

Information is protected against unauthorised access.
Information is kept confidential.
The integrity of information we hold is maintained.
All breaches of information security, actual or suspected are reported (immiediately), inbestigated and resolved, and
Business and individual requirements for the availability of information and iformation systems are met.

Your personal information is securely stores within the firm’s CAse Management Software (LEAP) and physically i your case file.

Your personal information is disposed of in accordance with the Solicitor Regulation (SRA) Rules of File Retention.

The period of retention varies according to the type of case we are dealing with;

Criminal Law – 6 years (life sentence – indefinately)
Divorce and Family Law – 10 Years (change of name – indefinately)
Family Law (Care Proceedings) – 6 years
Family Law (legally Aided) – 10 years
Residential Conveyancing – 10 years
Wills & Probate – 15 years
Wills – Indefinately

The physical files containing all of the physical personal material we hold about you is securely stored when the file is archived.

The electronic files and material we hold is securely stored within the firm’s Case Management System.

Destruction of Personal Information and Data

Once files have been retained in accordance with the SRA’a retention rules as above, they are destroyed securely by a confidential shredding company.

Your Data Protection Rights

Under data protection law, you have rights including:

Your right of access – You have the right to ask us for copies of your personal information.
Your right of rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is inoomplete.
Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.
Your right to data portability – You have the right to ask that we tranfer the personal information you gave us to another organisation, or to you, in certain circumstances.