Privacy notice

Any reference to “we”, “our” or “us” means Davies and Partners Solicitors Ltd which is authorised by the Solicitors Regulatory Authority.
This privacy notice is for clients and other contacts.  We are committed to protecting your privacy. We are providing you with this privacy notice so that you are reliably informed about what personal data we collect about you, how we use it, who we share it with and what your rights are. It describes the ways in which we collect, store and process your personal data (personal information).

Should you wish to make an individual rights request under the Data Protection Act 2018, please email our Data Protection Officer at: [email protected]

Alternatively, you can write to us at:

Rowan House
Barnett Way
Barnwood
Gloucester
GL4 3RT

Who we are

Davies and Partners Solicitors Ltd is a law firm in the UK offering a broad range of legal services to national and international organisations and institutions, small and medium- sized businesses and private individuals.

We act as a “Data Controller” in respect of the information gathered and processed by us. A Data Controller determines the purposes of which, and the manner in which, any personal data is processed. We are registered with the Information Commissioner (registration reference: ZA235543).

In order that you are reliably informed about how we operate, we have developed this privacy notice (also known as a Fair Processing Notice or FPN), which describes the ways in which we collect, manage, process, store and share information about you. This privacy notice also provides you with information about your data privacy rights.

What personal information we collect, store and use and the purposes for using your information

Your personal information contains certain information about you as an individual which identifies who you are, such as name, address, telephone number date or birth, video/CCTV etc. Sometimes the information we collect is sensitive in nature such as health information or your religious beliefs. Such sensitive information is given added protection.

Please also note all the personal information we receive from you is also treated with the strictest of confidentiality.

We may process your personal information (where we have received this directly from you or from another source) if:

• You are a client or prospective client
• You use our website or other services we may provide through our website or our social media accounts
• You are an individual within any third party we engage with such as our suppliers or other service providers such as marketing agencies
• A client has provided us with your information
• You have been referred to us from a third party or we have collected information about you from another third party.

You are a client or prospective client

As an essential part of our business, we collect and manage client information. In doing so, we observe applicable data protection laws and are committed to protecting and respecting clients’ privacy, rights and personal information.

The personal information that we collect about you is to manage and administer your engagement with us as a client or prospective client and provide our services. We collect personal information which includes your name, address, contact details, NI number, passport/driving license details, financial information (including bank details, details of any benefits, tax and tax residency, savings and loan information, and expenditure), employment details, details of dependents and spouse.

We may also collect, store and use more sensitive special category personal information that may include marital, civil partnership or relationship status, details of your partner, civil partner or spouse, physical or mental health details, religious and other beliefs, and racial or ethnic origin.

We collect this in a number of different ways. For example, you may provide this personal information to us directly, online, over the telephone or when corresponding with us by email or letter. Alternatively, you may receive information because, as a client, you have a legal or other need with which we may be able to support you.

We use this personal information to set you up as a client, open a file, provide our advice and services and administer and manage our relationship with you. Our approach is to identify your legal needs and use our expertise to respond to your requirements, throughout our relationship with you.

Our reasons for using your information include:

• Carrying out regulatory and compliance checks in order to set you up as a client including checks to verify your identity, fraud and credit checks
• Enable business development including sending legal updates, publications and details to events
• Administer and manage use of our website and social media accounts
• Making and receiving payments to and from you in accordance with your instructions
• Communicating with you via email, telephone and in writing about the work we are doing for you
• Recording telephone conversations or meetings for regulatory, monitoring and quality purposes and to administer and improve our services to you
• Carrying out client satisfaction surveys
• Carrying out our compliance obligations (other than those referred to above)
• Processing and responding to any complaints
• Bringing or defending legal proceedings
• Ensuring that our colleagues are trained and competent in their duties
• In restricted circumstances, for testing purposes – we fully test our systems and services, to ensure that they will work as expected and will not cause loss or damage to data. Wherever we can, we use anonymous data. Only in very limited circumstances will we use personal data and, on these occasions, the data will be protected in a secure and closed environment and deleted as soon as the testing is completed.
• We also use and share information which does not identify you (‘anonymised data’) to improve our services and those of others. For example, if you have contacted us about a potential claim which we ultimately conclude that we cannot assist with, then we may share a limited amount of effectively anonymised data about your case with public bodies for the purpose of improving patient safety.

There may be circumstances in which we may contact you after the end of our business relationship with you. This might be because we have a regulatory obligation to do so, because you have asked for us to do so or because we genuinely believe it’s in your best interests to do so. We rely on consent or legitimate interests as our lawful bases for contacting you.

You use our website or other services we may provide through our website or social media accounts

If you fill in a form on our website, or contact us via other means such as email, telephone or by post, we will collect the information you provide when you contact us, such as your name and contact details. We will use this personal information to:

• Send you the information you have requested, for example about our products and services.
• Respond to your enquiry.

When you visit our website, we will also collect your personal information via cookies. We use both essential and non-essential cookies on our website which collect information such as your browsing patterns and information about the device you are using. We may use this information to inform our marketing and future business strategies. Full details of how we use cookies can be found in our cookie policy.

You are an individual within any third party we engage with such as our suppliers or other service providers such as marketing agencies

As part of our business dealings, we engage with third party service providers and their workforce to enter into agreements or other services and products. If you are an individual within such third-party service providers, we will process your personal information as set out in this privacy notice.

A client has provided us with your information

Our client may give us personal information about you as part of asking us to provide advice to them. This may include your name, address, contact details, NI number, passport/driving license details, financial information (including bank details, details of any benefits, tax and tax residency, savings and loan information, and expenditure), details of dependents and spouse.

We may also collect, store and use more sensitive special category personal information that may include marital, civil partnership or relationship status, details of your partner, civil partner or spouse, physical or mental health details, religious and other beliefs, and racial or ethnic origin.

We will use this personal information to carry out our compliance checks or to give advice to our client or to trustees where you are a beneficiary

You have been referred to us from a third party or we have collected information about you from another third party

If an employee of Davies and Partners Solicitors Ltd or any other third party has obtained your consent, we may contact you in relation to our services or any other matter that you have consented to. We will be using your personal data for this purpose based on your consent.

How we use your personal information

We use the data collected from you for the specific purposes listed in the table below.

We may share your personal information with trusted third parties from time to time. These third parties are our processors who will only process your personal information in accordance with our instructions. We will not share your personal information with a third party for marketing purposes unless we have your consent to do this. We do not sell any personal information to any third party so that they can send you their marketing material.

Please note that this table also explains the legal basis for processing your data, linked to each processing purpose; and in what circumstances your data will be shared with a third-party organisation.

Do you have to provide us with your personal information?

Where we have said that your personal information is used to comply with statutory requirements, carry out a contract with you or to take steps to enter into that contract, we will need you to provide the personal information requested. If you don’t provide the personal information we need when we ask for it, we may not be able to respond to you, enter a contract with you, meet our obligations under the contract, or comply with our legal obligations.

If you have any concerns about whether you need to provide your personal information, please contact our Data Protection Officer at [email protected]

Do we transfer your personal information outside the UK?

It may sometimes be necessary to transfer personal information outside the UK. We will only transfer your personal information overseas where e.g. our third-party service providers who we share personal information with (as set out above) are based outside the UK, have support services located outside the UK or host personal information outside the UK.

We only transfer your personal information outside the UK where we are sure that your personal information is protected to the same standard as it would be protected in the UK.

If you would like further information on the safeguards we have in place for transfers of your personal information outside the UK, please contact: [email protected] 

Can we change the purpose that we collect, store and use your personal information for?

We will only use your personal information for the purposes set out above unless another purpose we want to use it for is compatible with those original purposes.

If we change the purpose for which we are using your personal information we will contact you and explain how the new purpose is compatible with the original purpose, if we would like to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do this.

How long will we keep your personal information for?

We will generally retain personal information for a period of six years after the termination of our business relationship with you. For example, if you become a client of our firm, your information will typically be held for seven years after your case has closed. Equally, if you enquire whether we might be able to support your claim, but you do not ultimately become a client of our firm, your information will be held for no longer than seven years after your enquiry was made.

To request additional information about our firm’s retention periods, please contact us.

At the end of the retention period, we will delete, anonymise or put the personal data beyond use.

Do we intend to do automated decision-making or profiling?

We use certain tools that use artificial intelligence – such as transcriptions of meetings, spell check and anti-virus software – to work efficiently and safely. These tools may process some personal data, however our employees review the output from the technology, wherever appropriate. We do not use your personal information to make automated decisions about you.

How do we process your personal information in relation to marketing?

If you are one of our clients, we may use your personal information for the purposes of providing you with further information about the services that Davies and Partners Solicitors Ltd can offer, including sending legal updates, publications and details of events and webinars, that may be of use to you.

Whether you are a client or other interested party, we may also send marketing material to you, tailored to your needs and interests. These might include legal updates, publications and invitations to events.

We will only do this if either you have agreed to receive this content, or we consider that we have a legitimate interest to share the marketing material with you and this interest does not override your rights.

Where we carry out marketing via email or other electronic means we will also comply with our obligations under the Privacy and Electronic Communications Regulations 2003.

We use your personal information to carry out client satisfaction surveys based on our legitimate interests in order to receive feedback as a business and improve our services that we provide to clients.

Use of Meta Pixel and Meta Advertising

We utilize the Meta Pixel (formerly known as the Facebook Pixel) on our website to understand user interactions and to optimize our advertising efforts on Meta platforms such as Facebook and Instagram. The Meta Pixel enables us to track actions taken on our website, such as page visits and form submissions, which assists in measuring the effectiveness of our ads and in delivering relevant advertisements to our users.

This tracking involves the collection of data such as your IP address, browser information, and the pages you visit on our site. This information may be shared with Meta Platforms Ireland Limited, located at 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, and may be used by Meta in accordance with its Data Policy.

We process this data based on your consent, in line with Article 6(1)(a) of the UK GDPR. You have the right to withdraw your consent at any time. To manage your preferences regarding the Meta Pixel and to opt out of data collection for advertising purposes, you can adjust your browser settings to refuse cookies or visit the Digital Advertising Alliance’s opt-out portal.

For more detailed information on how Meta collects and processes data, please refer to Meta’s Privacy Policy.

In any case, you can, of course, opt out of receiving our marketing by contacting our Data Protection Officer at [email protected] and, where we send you marketing material via email, an option to unsubscribe will be given in each email.

What security and privacy measures have we put in place to help protect your personal information?

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. These measures include:

• Protecting against potential breaches of confidentiality
• Ensuring all IT facilities are protected against damage, loss or misuse
• Increasing awareness and understanding of the requirements of information security, and the responsibility of our colleagues to protect the confidentiality and integrity of the information that they handle
• Ensuring the optimum security of our website.

In addition, we limit access to your personal information to those employees, agents, contractors and other third parties (see above) who have a business need-to-know.

We have put procedures in place to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Our security procedures mean that we may occasionally request proof of identity before we are able to disclose personal information to you.

Your data privacy rights

You have the following rights under data privacy laws:

• Right to be informed
• Right to access
• Right to rectification
• Right to be forgotten
• Right to object
• Right to restrict processing
• Right to data portability
• Right to withdraw consent
• Right to make a complaint

Right to be informed

This privacy notice together with our cookie policy together fulfil our obligation to tell you about the ways in which we use your personal information.

Right to access

You have the right to ask us what personal information we hold about you (Subject Access Request) and to have a copy of that personal information from us (along with certain other details).

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond 

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Should you wish to make an individual rights request under UK GDPR, please email our Data Protection Officer at: [email protected].

Alternatively, you can write to us at:

Rowan House
Barnett Way
Barnwood
Gloucester
GL4 3RT

Right to rectification

If any of the personal information that we hold about you is inaccurate, you have the right to ask us to correct any errors in your personal information.

Right to be forgotten

You have the right to ask us to delete your personal information where:

• we don’t need your personal information anymore.
• you withdraw your consent to our use of your personal information, and we have no other legal basis to keep your personal information.
• you have asked us to review and explain our legitimate interests to you and we don’t actually have a valid legitimate interest to do what we are doing.
• our use of your personal information is illegal.
• we have to delete your personal information to comply with our legal obligations.

Right to object

You have the right to ask us to review and explain our legitimate interests to you where we are collecting, storing and using your personal information on a legitimate interests basis, including where we are collecting, storing and using for profiling or by automated means. You have the right to object to our legitimate interests and that collection, storage and use unless we can demonstrate compelling legitimate grounds.

You also have the right to object to us sending you marketing communications.

Right to restrict processing

You have the right to ask us to restrict our use of your personal information where:

• You don’t think the personal information we have about you is correct, so that we can check if it is correct.
• What we are doing with your personal information is illegal, but you would rather we stop using your personal information rather than delete it.
• We don’t need your personal information anymore, but you need us to keep it so that you can exercise any legal rights.
• You have asked us to review and explain our legitimate interests to you, so that we can check whether we actually have a valid legitimate interest to do what we are doing.

If any of these circumstances apply, then please contact us.

Right to data portability

The right to ask us to provide you with a copy of the personal information you have provided to us, in a structured, commonly used and machine-readable format and the right to transfer that personal information to another entity where: (i) we are using your personal information on the basis of your consent or on the basis that it is necessary to perform a contract with you; and (ii) the use we are making of your personal information is carried out by automated means. If you would like to move, copy or transfer the electronic personal information that we hold about you to another organisation, please contact us.

Right to withdraw consent

Where we are using your personal information based on your consent you have the right to withdraw that consent at any time by contacting our Data Protection Officer at [email protected]

Right to make a complaint

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), (the UK regulator for data protection issues, who may be contacted at Wycliffe House, Water Lane, Wilmslow SK9 SAF or ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO and so, if you are happy to do so, please contact us in the first instance and we will try to resolve your issue.

Visits to our offices

What personal information do we collect if you visit us and how do we use it?

If you visit one of our offices, there are CCTV cameras to capture images. The data controller of the CCTV may share images with us for the purposes of security, employee safety and in certain circumstances, to verify information (such as when you visited our site or to establish facts in relation to health and safety incidents).

There are notices at our offices informing visitors that CCTV cameras are recording. We do not have access to the CCTV images.

How can you contact us?

Questions and comments regarding this Privacy Notice are welcome, and should be sent to our Data Protection Officer at: [email protected] 

Alternatively, you can write to our Data Protection Officer at:

Rowan House
Barnett Way
Barnwood
Gloucester
GL4 3RT

Should you wish to make an individual rights request under UK GDPR, please contact the Data Protection Officer using the details provided above.

Complaints

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

Changes to the privacy policy and your duty to inform us of changes

We keep our privacy policy under regular review.  It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us, for example a new address or email address.

Appendix 1

External Third Parties

Including but not limited to:

1. Professional advisers acting as processors or controllers based within England and Wales who provide consultancy, banking, legal, insurance and accounting services.
2. Legal counsel, advisors, consultants and professional experts who will provide advice and support in relation to the advice we are providing.
3. A court or tribunal where we are acting for you in a dispute or litigation.
4. The solicitors and advisers acting on the other side of your matter.
5. HM Revenue & Customs, HM Land Registry, regulators and other authorities acting as processors or controllers based in the United Kingdom who require reporting of processing activities in certain circumstances.
6. Law enforcement agencies where required by law (such as the prevention of financial crime and terrorism).
7. Regulatory bodies including the Solicitors Regulation Authority.
8. Our professional indemnity insurer if we notify them of a potential circumstance which could lead to a claim or a claim is made against us and in order to defend that claim.
9. Service providers acting as processors based within the EEA who provide IT and system administration services, debt collectors, market research and data analytics providers.
10. InfoTrack who provide identity verification, sanction list and PEP list checks to comply with the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.
11. Access Legal who provide our case management software and who provide cloud-based collaboration tools. This involves the electronic transfer of relevant correspondence and documents from your file, which will include personal and could include special category data, to a secure cloud-based system. Clients will be provided with specific terms and conditions which includes GDPR / Data Protection requirements when logging in to this facility. This data does not leave the EU.
12. CloudClevr who provide additional IT support to our employees and firm.
13. External auditors who may carry out independent checks on your file as part of our accreditations.
14. DocuSign – Electronic signatures provider. This involves sharing certain Identity and Contact data, and where appropriate the same for witnesses (provided by you), matter and Advice data to enable contracts and other documents to be signed and executed and returned electronically. The data is stored within the EU and this data will not be retained by DocuSign or used for any other purpose.
15. BundleDocs – Document collation tool.  This involves the sharing of your Contact, Financial, Advice and matter related data via this platform to compile a document bundle for a number of purposes including court bundles, deal bibles, electronic casebooks, transaction bibles, electronic closing binders, case bundles, ebriefs and report books. This provider processes data via Microsoft Azure Cloud and the data is stored in Dublin or Amsterdam and is not used for any other purpose.
16. Microsoft Azure when using MS Teams transcription facility – MS Teams is a collaboration tool that includes video calling. We may if appropriate use the transcription facility within this tool to capture an accurate record of the conversation for file continuity, compliance and cost recovery purposes. This involves capturing a narrative of the conversation in real time which is stored in Microsoft Azure cloud computing (Dublin). This narrative is only retained within Azure for a period of 60 days but will be downloaded and saved for the duration of your matter and the appropriate retention period thereafter.
17. Trustpilot – We may contact you via email to invite you to review any services you received from us in order to collect your feedback and improve our services. We use Trustpilot A/S to collect your feedback which means that we will share your name, email address and reference number with Trustpilot. If you want to read more about how Trustpilot process your data, you can find their privacy policy on their website. We may also use such reviews in other promotional material and media for our advertising and promotional purposes. This data does not leave the EU and will be removed upon closure of your matter.
18. Microsoft Copilot and Teams (provided by Microsoft Corporation), Thomson Reuters CoCounsel, Westlaw Edge and Practical Law Company (PLC) (all provided by Thomson Reuters Corporation).  These providers process data only to the extent necessary to deliver AI-based functionality and under contractual obligations ensuring data security, confidentiality, and compliance with applicable laws.  Data processed through these tools—including legal queries, documents, and meeting transcripts—is not used to train AI models nor shared with unauthorized third parties.  We do not otherwise share personal data with third parties in connection with our use of generative AI, unless required by law or with your explicit consent. We do not transfer your personal data outside the UK unless adequate safeguards are in place, in accordance with UK data protection law.
19. Meta Platforms, Inc. (including Facebook and Instagram) and Google LLC (including GoogleAds and related services. We may share limited data with Meta and Google such as: Website browsing behaviour (via Pixel or Google Tags); Hashed identifiers (such as email addresses, if used in audience creation). This data is used strictly for advertising purposes and is not sold or used for unrelated activities. In some instances, we and these providers act as joint controllers, particularly when we define audience segments and they deliver the ads. In such cases we are responsible for ensuring we have a lawful basis for processing. Meta and Google are responsible for how they use the data for their own systems (e.g., improving ad platforms, cross-platform targeting). You can view their privacy policies at: Meta: https://www.facebook.com/privacy/policy Google: https://policies.google.com/privacy. You have the right to: Withdraw your consent to marketing cookies at any time; Object to your data being used for direct marketing; Access, correct, or erase your personal data; Adjust your ad preferences using the tools provided above. We do not use Meta or Google advertising tools to make automated decisions that would have a legal or similarly significant effect on you.
20. Agencies who provide medical records sorting, collation, pagination and summarising services. This involves the provision of special category data to these providers. Each provider has undergone a stringent vetting process and they are subject to contractual requirements which ensure the safety and security of your data. This data does not leave the EU.