Gibson Kerr will be a “controller” of the personal information that you provide to us when you instruct us to act on your behalf.
When you become a client of Gibson Kerr, we will collect, store and use the personal information that you provide to us in your instructions and during the course of our solicitor/client relationship. We may ask you for additional personal information during the course of our solicitor/client relationship, which shall be collected, stored and used in accordance with this privacy notice.
We may also collect, store and use the following personal information relating to you from third parties from time to time and if you would like information regarding any such information, please let us know.
Why we need your personal information – contractual purposes
We need to collect your personal information so that we can perform our service agreement with you. We will use your personal information to:
- provide you with legal advice, including by communicating with you by email, letter and/or telephone;
- represent you as your solicitors in connection with any legal matter you instruct in;
- respond to and communicate with you regarding your questions, comments, support needs or complaints, concerns or allegations in relation to the provision of legal services by us to you, including using your personal information to investigate any complaint by you and take any appropriate action.
In relation to any information you provide us with relating to your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation, we will only store that information where it specifically relates to, and is relevant to, the legal advice/services you have asked us to provide you with.
If you do not provide us with all of the personal information that we need to collect then this may affect our ability to provide you with legal advice and represent you as your solicitors.
Why we need your personal information – legal obligations
We are under a legal obligation to process certain personal information relating to our clients for the purposes of complying with our obligations under:
- the Law Society of Scotland requirements for solicitors, including the Law Society of Scotland Practice Rules 2011, and relevant legislation, including the Legal Services (Scotland) Act 2010; and
- UK anti-money laundering legislation, including The Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 (SI 2017 No. 692) and Proceeds of Crime Act 2002.
Why we need your personal information – legitimate interests
We also process our clients’ personal information in pursuit of our legitimate interests to:
- send clients communications by email or post with information regarding legal updates and information;
- promote our services by sending clients communications with information regarding our firm and our services;
- invite our clients as guests to any events we may hold.
Where we process your personal information in pursuit of our legitimate interests, you have the right to object to us using your personal information for the above purposes. If you wish to object to any of the above processing, please contact us
by email on gdpr@gibsonkerr.co.uk,
by telephone on 0131 385 8823,
or by writing to us at:
GDPR Manager
Gibson Kerr
6 Randolph Crescent
Edinburgh
EH3 7TH
If we comply with your objection, this may affect our ability to undertake the tasks above for the benefit of you as a client.
Why we need your personal information – Public Interest in Public Health
In light of the coronavirus pandemic, for as long as there is a risk to public health from this or any future pandemic, before any meeting takes place in person, we will ask you some questions to establish the risk of contraction of disease by the parties to the meeting. We will use this information to establish if a meeting can proceed safely. If we learn that any person in that meeting has a confirmed case of disease, depending on the timing of that diagnosis, we may contact the parties to that meeting to inform them.
Who we share your personal information with
We may be required to share personal information with statutory or regulatory authorities and organisations to comply with statutory obligations. Such organisations include the Law Society of Scotland for compliance purposes and the Police National Crime Agency for AML purposes.
Gibson Kerr employs third party suppliers to provide services, including client case management software, IT services, and cashroom services. These suppliers may process personal data on our behalf as “processors” and are subject to written contractual conditions to only process that personal data under our instructions and protect it.
We may also share personal data with other professional advisors for the purposes of taking advice.
In the event that we do share personal data with external third parties, we will only share such personal data strictly required for the specific purposes and take reasonable steps to ensure that recipients shall only process the disclosed personal data in accordance with those purposes.
Please note that if we instruct an Advocate in relation to your case, that Advocate will be the Data Controller for any personal data they process. The Faculty of Advocate’s privacy policy will apply to any such personal data, which can be obtained at: http://www.advocates.org.uk/instructing-advocates/privacy-policies
How we protect your personal information
Your personal information is stored on our electronic filing system and our servers based in the UK, and some data is also stored in paper files in our storage system within our offices. This data is accessed by our staff and data processors for the purposes set out above. We have appropriate safeguards in place to protect your data.
How long we keep your personal information
We keep our clients’ personal data indefinitely to ensure ongoing compliance with our legal and contractual obligations as set out above.
Your rights
You can exercise any of the following rights by writing to us at
gdpr@gibsonkerr.co.uk, or:
GDPR Manager
Gibson Kerr
6 Randolph Crescent
Edinburgh
EH3 7TH
Your rights in relation to your personal information are:
- you have a right to request access to the personal information that we hold about you by making a “subject access request”;
- if you believe that any of your personal information is inaccurate or incomplete, you have a right to request that we correct or complete your personal information;
- you have a right to request that we restrict the processing of your personal information for specific purposes; and
- if you wish us to delete your personal information, you may request that we do so.
Any requests received by Gibson Kerr will be considered under applicable data protection legislation. If you remain dissatisfied, you have a right to raise a complaint with the Information Commissioner’s Office at www.ico.org.uk.