Privacy Policy

 

1. Introduction 

 

In order to carry out our work, it may be necessary for us to collect, store and process your personal information. Community Law Service (Northampton and County), hereafter referred to as CLS, takes its responsibilities very seriously with regard to safeguarding your personal data.

 

This privacy notice explains the types of personal data we may collect, how we will store and handle that data, and the steps that we will take to keep it safe, in accordance with the UK General Data Protection Regulation (UKGDPR). It applies to all clients, prospective clients and other contacts about whom we hold personal information.

 

We hope that this notice will answer any questions that you have about how we handle your personal data, but please feel free to get in touch with us at enquiries@communitylawservice.org.uk if you require any further information.

 

CLS is registered with the Information Commissioner’s Office. (Registration number: Z1750080)

 

2. Personal data we collect 

 

Most of the data we collect about you comes directly from you, our client, for example, when you first approach us for advice. This will include the following:

• personal details (e.g., name, age or date of birth, passport information or other identification information as applicable);
• contact details (e.g., phone number, email address, postal address or mobile number);
• transactional details (e.g., payment awards made to you);
• financial information (e.g., bank account number, credit or debit card numbers, financial history);
• details about your health (e.g., where your health is part of your claim or has an impact on your situation);
• details about your housing situation, where it is relevant to your case.
• information relating to your immigration status if it is relevant to your case.
• Demographic information that helps us to monitor equal access to our services/equal opportunities in our recruitment processes, e.g., your age, your ethnicity, your gender etc.
• religious beliefs, where it is relevant to your case;
• Information relating to your education and past employment, if you are applying for a job with us;
• Data that is collected for the purposes of legal compliance, e.g., to carry out necessary money laundering checks etc.;
• Information relating to your advice needs, depending on your case and what we are doing to advise and assist you.
• Records of our communications with you, and of other communications and/or actions taken in relation to your case.

 

If you do not provide necessary personal data that we request, it may adversely affect how we provide our services to you and in some cases could mean that we are unable to provide you with the services and/or perform all of our obligations to you.

 

We will also hold information we collect about you from other sources. This could include:

 

• information from credit reference agencies and fraud prevention agencies;
• publicly available information about you which is available online or otherwise;
• organisations that provide their own data, or data from other third parties, to enable us to enhance the personal data we hold, and then provide more relevant services to you;
• criminal record checks and information;
• employers;
• utility providers;
• people you have authorised or are appointed to act on your behalf.

 

If you give us personal data about other people, then you confirm that they are aware of the information in this Notice about how we will use their personal data. This may happen if you supply us information about your dependents or relatives or friends that you ask us to speak to, or who will act on your behalf.

 

We will only collect personal information relating to children (under 13 years old) as part of your case and if you have supplied us with the information.

 

 

3. How will we collect your data? 

 

We normally collect your data when you provide it to us or when it is provided to us by others. You may give us your data by email; through an online form or web portal; over the telephone; face to face; or by post.

 

We may also collect personal data automatically when you use the website and when you navigate through the website. Data collected automatically includes the tracking of visitor interaction with our site by Google Analytics in order to produce statistical reports for us (see section 6 below).

We may monitor or record phone calls with you in case we need to check we have carried out your instructions correctly, to resolve queries or issues, for regulatory purposes, to help improve our quality of service and to help detect or prevent fraud or other crimes. Conversations may also be monitored for staff training purposes.

 

 

4. How we use your personal data, and the legal basis for doing so 

 

We will only collect, process and store your personal data in the following circumstances:

 

We have set out below, in a table format, a description of all the ways we use the various types of personal information and which of the legal bases we rely on to do so.

 

We have also identified what our legitimate interests are where appropriate. Note that we may process your personal data on more than one lawful basis depending on the specific purpose for which we are using your data. Where we are relying on a legitimate interest, these are also set out below:

 

 

Purpose/Activity	Lawful basis for processing including basis of legitimate interest
To register you as a new client.	Performance of a contract with you.
In order to provide you with legal advice, assistance and/or representation under the contractual relationship that we have with you;	a) Performance of a contract with you; (b) Necessary to comply with a legal obligation; (c) Necessary for our legitimate interests (to provide an effective and efficient service).
To manage our relationship with you which will include: (a) Communicating with you about progress with your case (b) To manage complaints, rectify problems and to resolve queries.	(a) Performance of a contract with you; (b) Necessary to comply with a legal obligation; (c) Necessary for our legitimate interests (to keep our records updated, provide a high standard of service, to study how clients use our services, avoid complaints in future).
In order to comply with our contractual obligations with external agencies such as the Legal Aid Agency which may be funding your case;	(a) Performance of a contract with you; (b) Necessary for our legitimate interests (to keep our records updated, provide a high standard of service, to study how clients use our services, avoid complaints in future).
To develop and improve services through assessment and analysis of the information.	a) Necessary for our legitimate interests (to study how clients use our services, to develop them and grow the service).
To manage our relationships with suppliers (using personal contact information they have provided); for example, to arrange servicing agreements; contacts and correspondence with suppliers; and to follow up invoice queries, issue escalations and resolutions in line with the agreed contractual terms and conditions. From time to time this supplier information may be used to invite supplier staff to meetings and events.	(a) Performance of a contract with you (the supplier); (b) Necessary for our legitimate interests (to maintain standards, run the service efficiently, protect our interests) (c) Necessary to comply with a legal obligation (to provide information to our auditors and HMRC).
To administer, manage and protect the service and our website (including, quality measures, troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data).	(a) Necessary for our legitimate interests (to process job applications or to satisfy the requirements of our external quality auditors and for running the service, provision of administration and IT services, network security, (b) Necessary to comply with a legal obligation.
To undertake checks for the purposes of security and for detecting and preventing fraud and money laundering, and to verify your identity before we provide services to you.	a) Performance of a contract with you; (b) Necessary to comply with a legal obligation; (c) Necessary for our legitimate interests (to protect the service, prevent fraud, money-laundering and other crimes).
To use data analytics to improve our website, services, client relationships and experiences	Necessary for our legitimate interests (to define types of clients for our products and services, to keep our website updated and relevant, to develop our services and to inform future strategy).
To comply with regulatory and legal obligations to which we are subject and cooperate with regulators and law enforcement bodies.	(a) Necessary to comply with a legal obligation; (b) Necessary for our legitimate interests (to protect the service); (c) For the use of sensitive data, where it is in the substantial public interest.
In order to protect the life or health of an individual.	(a) Vital interests

 

 

Special Category Data

 

What we use your special category data for	Lawful basis for processing
If you are a client in some cases for due diligence checks (e.g., criminal convictions)	Substantial public interest
We may use medical information to provide appropriate advice, to determine if you are a vulnerable client, or where your health is relevant to the advice we are providing, to resolve complaints and queries and help you apply for suitable services and remedies.	(a) Substantial public interest; (b) Where we have your consent.
We may ask you for information which might allow us to know your religious beliefs in order to provide effective advice and identify appropriate services and remedies.	(a) Substantial public interest (b) Where we have your consent
Demographic information that helps us to monitor equal access to our services/equal opportunities in our recruitment processes, e.g., your age, your ethnicity, your gender etc.	Substantial public interest;
To comply with regulatory and legal obligations to which we are subject and cooperate with regulators and law enforcement bodies.	Substantial public interest

 

We may also use your anonymised data to provide statistical information for reports to our funders and/or other external agencies and/or to ensure legal and regulatory compliance. We will ensure that individuals are not personally identifiable from this information.

 

 

5. Consent 

 

In certain circumstances (see for example section 6 below) we may need to request your consent to collect and use certain types of personal data when we are required to do so by law (for example, sometimes when we process special category data). If we ask for your consent to process your personal data, you have the right to object and you may withdraw your consent at any time by contacting us

 

Should you not wish to provide your consent, it may be difficult to provide effective services directly related to the data.

 

 

6. Who we may share your data with 

 

We will treat all your personal information as private and confidential (even when you are no longer a client). We will not reveal your name, address, or any details of your relationship with us to anyone, other than in the following cases:

• We may need to share your data with barristers; translators; costs draftsmen in order to progress your case.
• Our third-party service providers. These may include for example: secure file storage and destruction companies; our external quality auditors; our financial auditors; our external IT services provider;
• If you make a claim against our service, or if we consider circumstances have arisen which may give rise to a claim, then it may be necessary for us to supply a copy of your file to our insurers.
• In the case of a complaint, we may also need to share your case records with external authorities that regulate the legal profession so that they may investigate appropriately.
• We may also need to share your data with the appropriate authorities if we become aware of significant safeguarding concerns where there is risk to your life or that of another person, and/or if we become aware of suspected criminal activities.

 

Before we disclose personal data to a third party, we take steps to ensure that the third party will protect personal data in accordance with applicable privacy laws and in a manner consistent with this Notice. Third parties are required to restrict their use of this personal data to the purpose for which the data was provided.

 

Our website https://www.communitylawservice.org.uk is hosted by Hostpapa. The website utilises various cookies that are described in our Cookie Policy. The website contains links to third-party websites, which have their own data controllers and privacy policies. The third parties and the cookies they use are further described in our Cookie Policy.

 

Transferring your personal data 

Usually, we avoid transferring your personal data outside the UK. However, when assisting you with issues relating to immigration it may become necessary to transfer personal data to organisations or individuals who can progress your case. In such circumstances we will inform you of who we propose to transfer your personal data to and which personal data will be transferred. You understand that in most cases we will be transferring your personal data to individuals and organisations that you have identified to us. We will obtain your consent to transfer your personal data.

 

 

7. What are your responsibilities? 

 

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes while you are using our services. If you send us personal data about anyone other than yourself you should ensure that, where appropriate, you have any appropriate consents and notices in place to enable you to transfer that personal data to us, and so that we may use it for the purposes for which you provide it to us.

 

 

8. What rights do you have? 

 

• You have the right to request access to any personal data that we hold about you.
• You have the right to ask us to correct or update any information that we hold about you.
• In certain circumstances, you have the right to ask us to stop processing your information, or to restrict the way in which your information is processed.
• Where you have given us your consent to use your personal data, you have the right to change your mind at any time and withdraw that consent.
• You have the right to request the erasure of your personal information where there is no good reason for us continuing to process or store it.
• In certain circumstances, you can also ask us to transfer your personal information to a third party.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, request that we transfer a copy of your personal information to another party, or make a complaint regarding our processing of your personal data please contact us at enquiries@communitylawservice.org.uk.

 

You will not usually have to pay a fee to access your personal information. However, in exceptional cases, if your request for access is deemed to be unreasonable and/or excessive, we have the right to decline your request or to charge a reasonable fee to cover the costs of collating and providing this information.

 

In cases where we are processing your personal data on the basis of our legitimate interest, you can ask us to stop for reasons connected to your individual situation. We must then do so unless we believe we have a legitimate overriding reason to continue processing your personal data. If we choose not to action your request, we will explain to you the reasons for our refusal.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

 

 

9. How will we protect your data? 

 

We take our responsibilities with regard to protecting your data very seriously. We will treat your data with the utmost care and take all appropriate steps to protect it. We have clear data protection and information security policies and procedures in place, and these processes are regularly reviewed as part of our quality assurance and compliance processes.

 

We take all reasonable measures to protect our IT systems from Cyber Attack.

 

We regularly monitor our systems for possible vulnerabilities and attacks in order to identify ways of further strengthening security.

 

 

10. How long will we keep your data? 

 

We will only keep your data for as long as is necessary for the purpose(s) for which it was provided. We have a retention policy which helps us ensure information is only held for the correct period. We then delete or de-identify your data. The retention period is generally linked to the amount of time available to bring a legal claim, Normally, this will be no longer than 6 years after your case or matter ends. We will retain your personal data after this time if we are required to do so to comply with the law, if there are outstanding claims or complaints that will reasonably require your personal data to be retained, or for regulatory or technical reasons. If we do, we will continue to make sure your privacy is protected.

 

When deciding what the correct time is to keep the data for, we look at its amount, nature and sensitivity, potential risk of harm from unauthorised use or disclosure, the processing purposes, if these can be achieved by other means and legal requirements.

 

 

11. Where will your data be processed? 

 

Your data will be stored and processed within the UK or within the European Economic Area (EEA). If we ever need to share your personal data with third parties or suppliers outside EEA, we will inform you before we do so.

 

 

12. How to make a complaint 

 

If you have any concerns or questions about the way in which we are handling your data, please contact us at enquiries@communitylawservice.org.uk so that we can discuss these with you.

 

If you believe that your data has not been handled appropriately, or if you are unhappy with our response to any requests that you have made with regard to your data, you have the right to make a complaint to the Information Commissioner’s Office. Further details about how to do this can be found on the Information Commissioner’s Office website at www.ico.gov.uk, or you can call them on 0303 123 1113.

 

 

13. Changes to this Notice 

 

We monitor and regularly update our policies and procedures to maintain the privacy of your personal information. As a result, our privacy notice may change from time to time. Any changes we make to this Notice in the future will be posted on this page and, where appropriate, notified to you by email. Please check back frequently to see any updates or changes to this Notice.