Privacy Policy

Who We Are

Gard & Co Solicitors is committed to protecting and respecting your privacy.

For the purposes of UK data protection law, including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, Gard & Co Solicitors is the data controller responsible for your personal data.

Contact details:

Gard & Co Solicitors
4 Bretonside
Plymouth
PL4 0BY

Telephone: 01752 668246

Email: enquiries@gardandco.com

If you have any questions regarding this Privacy Policy or how we handle your personal data, please contact our Data Protection Officer.

Scope of this Privacy Policy

This Privacy Policy explains how we collect, use, store and protect personal information relating to:

• Existing clients
• Prospective clients
• Former clients
• Website visitors
• Enquirers
• Beneficiaries and executors
• Opposing parties
• Witnesses
• Referrers
• Suppliers and contractors
• Employees and job applicants
• Other individuals whose personal data we process in the course of providing legal services

The Information We Collect

Depending upon the nature of our relationship with you, we may collect:

Identity Information

• Name
• Date of birth
• Nationality
• Passport or driving licence details
• Other identity verification documents

Contact Information

• Address
• Email address
• Telephone numbers

Financial Information

• Bank account details
• Transaction information
• Source of funds and source of wealth information
• Payment records

Matter Information

This may include information relevant to the legal services we provide, such as:

• Family information
• Employment information
• Property information
• Probate information
• Litigation information
• Medical information
• Criminal offence information (where relevant and lawful)

Technical Information

When you visit our website we may collect:

• IP address
• Browser type
• Device information
• Website usage information
• Cookie preferences

Please also refer to our Cookie Policy.

How We Collect Personal Information

We may obtain personal information:

• Directly from you
• Through our website or contact forms
• From identification and electronic verification providers
• From estate agents, mortgage brokers and lenders
• From courts, tribunals and government bodies
• From medical experts and other professionals
• From publicly available sources
• From third parties involved in your legal matter
• From regulatory and anti-money laundering databases

Why We Use Personal Information

We may use your information to:

• Provide legal advice and legal services
• Open and administer client files
• Carry out identity verification checks
• Comply with anti-money laundering legislation
• Carry out conflict checks
• Communicate with you regarding your matter
• Manage billing and accounts
• Improve our website and services
• Recruit and manage staff
• Comply with legal and regulatory obligations
• Defend or pursue legal claims
• Prevent fraud and financial crime

Our Lawful Bases for Processing

Under UK GDPR, we rely on one or more of the following lawful bases:

Contract

Where processing is necessary to provide legal services to you or to take steps at your request before entering into a contract.

Legal Obligation

Where we are required to comply with legal or regulatory requirements, including:

• Solicitors Regulation Authority requirements
• Anti-money laundering legislation
• Tax and accounting obligations
• Court orders and legal processes

Legitimate Interests

Where processing is necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms.

Examples include:

• Conflict checking
• Practice management
• Cybersecurity
• Risk management
• Debt recovery
• Service improvement

Consent

In limited circumstances we may ask for your consent, for example in relation to certain marketing communications.

Where we rely on consent, you may withdraw it at any time.

Special Category Data

Where we process special category data (such as health information), we will only do so where a lawful condition under data protection legislation applies.

Anti-Money Laundering, Identity Verification and Fraud Prevention

As a firm of solicitors, we are subject to legal and regulatory obligations designed to prevent money laundering, terrorist financing, sanctions breaches, fraud and other financial crime.

Before and during the course of our retainer, we may be required to obtain, verify and retain information relating to:

• Your identity;
• Your address;
• Your source of funds;
• Your source of wealth;
• The purpose and intended nature of transactions;
• Politically Exposed Person (PEP) status;
• Financial sanctions screening results; and
• Other information required to comply with applicable legislation and regulatory requirements.

To fulfil these obligations, we may:

• Request documentary evidence from you;
• Carry out electronic identity verification checks;
• Verify information against publicly available records;
• Use third-party verification and compliance providers;
• Conduct sanctions and anti-money laundering screening; and
• Make enquiries of third parties where appropriate and lawful.

Processing for these purposes is generally carried out to comply with our legal obligations and to protect against fraud and financial crime.

Where required by law, we may disclose information to law enforcement agencies, regulators, courts, government authorities and other bodies responsible for the prevention, detection and investigation of crime.

We may be legally prohibited from informing you where we have made a disclosure to the relevant authorities.

Conflict Checking and Professional Obligations

As a regulated firm of solicitors, we have a professional obligation to identify and manage conflicts of interest and risks to client confidentiality.

Before accepting instructions, and at appropriate stages throughout a matter, we may conduct conflict checks using information provided by clients, prospective clients and other parties connected with a matter.

Information used for conflict checking may include:

• Names of individuals;
• Names of businesses, trusts and organisations;
• Addresses;
• Names of connected persons; and
• Other information necessary to identify potential conflicts of interest.

Conflict checking is necessary to enable us to comply with our professional and regulatory obligations and to protect the interests of our clients.

Even where we do not proceed with instructions, or after a matter has concluded, we may retain limited information for conflict checking, risk management and regulatory purposes.

As a result, requests for deletion of personal information may not always be granted where retention remains necessary:

• To comply with professional obligations;
• To comply with legal or regulatory requirements;
• To establish, exercise or defend legal claims;
• To maintain records necessary for future conflict checks; or
• To protect client confidentiality and the integrity of our professional services.

Where information is retained for these purposes, access will be restricted and the information will only be used where necessary.

Who We Share Information With

Where appropriate we may share information with:

• Barristers
• Courts and tribunals
• Experts and consultants
• Medical professionals
• Estate agents
• Surveyors
• Mortgage lenders
• HM Land Registry
• HM Revenue & Customs
• The Probate Registry
• Executors and beneficiaries
• Regulators and law enforcement agencies
• IT service providers and cloud service providers
• Professional indemnity insurers
• External auditors

We only share personal information when there is a valid legal basis for doing so.

International Transfers

We may use reputable service providers that process information outside the United Kingdom.

Where personal information is transferred internationally, we will ensure that appropriate safeguards are in place in accordance with UK data protection laws, which may include:

• UK adequacy regulations;
• International Data Transfer Agreements (IDTAs);
• International Data Transfer Addendums; or
• Other lawful transfer mechanisms.

Data Security

We take the security of personal information seriously and implement appropriate technical and organisational measures designed to protect personal data from:

• Unauthorised access
• Loss
• Misuse
• Alteration
• Disclosure
• Destruction

Our measures include access controls, staff training, cybersecurity procedures and secure document management systems.

If a personal data breach occurs, we will assess the risks and comply with our reporting obligations to the Information Commissioner’s Office and affected individuals where required.

How Long We Keep Information

We retain personal information only for as long as is necessary for the purposes for which it was collected and to comply with legal, regulatory and professional obligations.

Typical retention periods include:

• Conveyancing matters: up to 16 years.
• Higher value personal injury matters: up to 16 years.
• Most other legal matters: typically 7 years after file closure.

Some records may be retained for longer periods where:

• We hold original wills or deeds.
• We are subject to legal or regulatory obligations.
• The information is required for conflict checking purposes.
• The information may be required in connection with potential legal claims.

Full details are available in our Data Retention Policy.

Your Rights

Subject to certain exemptions and limitations, you have the right to:

• Be informed about how your data is used.
• Access your personal information.
• Request correction of inaccurate data.
• Request deletion of your personal data.
• Restrict processing.
• Object to processing.
• Request transfer of your data where applicable.
• Withdraw consent where processing is based on consent.
• Challenge certain automated decision-making and profiling activities.

Requests for Access to Personal Data

You may request a copy of the personal information we hold about you.

Requests should be sent to our Data Protection Officer.

We will normally respond within one month, although this period may be extended where permitted by law.

We may request evidence of identity before responding.

Requests for Erasure

You may request that we erase your personal information in certain circumstances.

However, the right to erasure is not absolute. We may refuse a request, in whole or in part, where we are required or entitled to retain information, including where retention is necessary:

• To comply with legal obligations;
• To comply with anti-money laundering legislation;
• To comply with Solicitors Regulation Authority requirements;
• To comply with court orders or other legal processes;
• To establish, exercise or defend legal claims;
• To maintain records required for conflict checking purposes;
• To protect legal professional privilege or duties of confidentiality; or
• For archiving, risk management, insurance or regulatory purposes.

Where we are unable to erase information, we will explain the reasons for our decision to the extent permitted by law.

Marketing Communications

If you subscribe to updates or request information from us, we may contact you regarding relevant legal services.

You may opt out of marketing communications at any time by contacting us or using the unsubscribe facility included in our emails.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Any updates will be posted on this page together with the date of the latest revision.

Complaints

If you have concerns about how we use your personal information, please contact our Data Protection Officer in the first instance.

You also have the right to complain to:

Information Commissioner’s Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: https://www.ico.org.uk