Source: https://decoded.legal/privacy_notice_prospective_clients.php
Timestamp: 2019-12-09 00:42:45
Document Index: 321097407

Matched Legal Cases: ['Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6']

Privacy notice: prospective clients
We keep to a minimum the information we hold about you
We use your data to provide our services to you, meet our legal obligations, and improve our website
We delete your data when it is no longer needed for these things
Generally, we do not give your information to third parties, but there are some exceptions
You have lots of privacy rights
We record calls
We are happy to answer your questions about any of this
This page was last updated on 18th May 2018
📄 What data we hold
If you contact us, we will hold the following information about you:
Your name, identity and contact information
Information about your business activities
Information and documents about your matters or enquiries, including communications with you
We also generate log files from various servers: this will include an IP address assigned to you or, more likely, to someone who provides you with Internet access. All our client-facing platforms are accessible via Tor, and you can access this site within Tor. If you do not want us to see your actual IP address, feel free to visit us via Tor.
References to the basis of processing (e.g. "(Basis: Art. 6(f).)") are a reference to the article of the General Data Protection Regulation under which we undertake the processing in question.
The law requires that, in some situations, we must know who you are before we can give you legal advice. decoded.legal’s approach to this is to check the identity of all clients.
The level of checking we need to undertake depends on the potential risk, and there are certain factors which are considered to be high risk. One example is if you are an individual and are not able to meet us face-to-face. (Yes, this is a rather archaic rule given video conferencing, but it is a rule.)
We will do what we can to make this as painless as possible. If you would prefer not to provide these information, we will not be able to act for you.
We retain identity verification information for as long as you are our client and then five years, or else five years from the point you decide you do not want to become a client.
(Basis: Art. 6(c): we have to do this processing to comply with legal and regulatory obligations.)
We may need to ask questions about the source of your money, to discharge our regulatory obligations relating to proceeds of crime and terrorist funding. If you would prefer not to provide these information, we will not be able to act for you.
Fulfil our legal and regulatory obligations
As solicitors in a regulated law firm, we have a whole host of professional regulatory obligations. If we have to process personal data to fulfil them — for example, if our regulator, the Solicitors Regulation Authority, demanded information — we will do so.
If you give us a ring or make contact by email, we will follow up on your enquiry and see if there is a way in which we can help you. We keep a record of enquiries received, to help us plan our business strategy and check that we are offering what potential clients want.
(Basis: Art. 6(b): we need to use your details to follow up with you. Art. 6(f): business planning is a legitimate thing for us to do, and keeps us relevant and hopefully more in tune with your needs.)
We may use the logs from our servers to assist in our firm's security, as well as to determine visitor behaviour and help us plan our strategy (e.g. such as working out which pages on the site are most popular, or whether particular events have caused an increase in traffic).
(Basis: Art. 6(c): we have legal and regulatory obligations to protect our clients and their information. Art. 6(f): strategy planning is a legitimate, indeed sensible, thing for a business to do.)
Your data and the EEA
We do not transfer or process data outside the European Economic Area unless we have your specific consent or where the nature of the processing requires it (for example, where we are emailing a party to your matter who is based outside the EEA, or because you have chosen to use an email or other communications service which routes data outside the EEA).
Occasionally, to provide a high quality of service, we may work on your matters when we are outside the EEA (for example, when on business or even if we are on holiday) — if this might be a problem for you, please let us know, and we can discuss.
You have lots of rights in respect of our processing of your personal data. The relevant rights are:
get access to your personal data and information about our processing of it
in some circumstances, restrict our processing of your data for strategy planning purposes, and compel us to erase the bits we do not use for security purposes
object to our processing for strategy planning purposes and other "legitimate interests" purposes
If you want to exercise any of these rights, please just contact us.
You also have the right to lodge a complaint about our processing with a supervisory authority — you probably want the UK's Information Commissioner's Office.
As a general principle, we will not transfer your personal data to third parties without your permission.
There are two exceptions to this:
It is possible, though unlikely, that we might be forced to disclose your information in response to a court order or other binding mandate.
As solicitors, we have professional duties, including to to co-operate with our regulator, the Solicitors Regulation Authority, as well as to report suspicious transactions or money laundering. We may not even be able to tell you of our suspicions if, in doing so, we would be committing the offence of tipping off. We will still try to minimise any sharing of your personal data.
We also have a small number of companies providing services to us. We use telephony services, which would get to see your phone number if we call you, and a broadband supplier which could see your email address if your own email server does not support opportunistic TLS (but not the content of what you send us, if you encrypt it). We also use an external accountancy service but, unless you are a sole trader or a partnership, they are unlikely to see any personal data relating to you.
All our computers are full-disk encrypted, as are our phones and tablets.
Our preference is to use PGP/GPG-encrypted email, but we appreciate that it may not be convenient for you to do so.
WWe have a secure document transfer portal, which lets you send documents to us, and us to send documents to you. It is less convenient than email, but is more secure than unencrypted email. Depending on the nature of the advice, we may choose to use this to transfer information to you. If you want to use it to send specific documents to us, just let us know. If you want to protect all documents you send to us, we encourage you to set up PGP/GPG.
"Normal" phone calls are not encrypted. We offer encrypted audio/video conferencing, if you'd prefer to use that — it works with most browsers without needing any additional software.
All our client-facing platforms are accessible via Tor, and you can access this site within Tor.
If you have particular security requirements, please contact us to discuss how we can support you.
🎤 Call recording
We record our calls, as we find that it can be useful to listen again to conversations, particularly the more technical ones, to help understand what we have been told. By being able to do this automatically, we save you having to repeat yourself. That way, we can hopefully ask more relevant and useful questions.
Calls are recorded and stored on our own systems.
We delete each recording as soon as we have decided that we will no longer need to listen to it again. In most cases, this is immediately after the call takes place.
Occasionally — for example, a call with an insurance provider, or with a party who is not a client — we may retain a recording, as evidence that a particular conversation took place, or of what was said.
If we have a phone call relating to a client's matter where the client is not present, we may share the call recording with that client by their preferred communications mechanism (which may include unencrypted email).
Here's our legitimate interests assessment for our call recording.
Data about clients: duration of your relationship with us, then seven years
Client ID verification: duration of your relationship with us, then five years
Enquiry data: duration of enquiry, then one year
Server logs: up to one year
contact@decoded.legal
Please encrypt it, if you can. Here is our PGP/GPG key. You can also find our keys on keys.openpgp.org, and via Web Key Directory.
phone Voice & video
Please email and arrange a time to speak.
We offer "normal" phone calls, SIP, and encrypted audio/video calls.
We record calls.
We'll never spam you or sell your information. Ever. More info here.
Authorised Law Firm badge
View our Authorised Law Firm digital badge here. The badge is hosted by a third party (which purports to act as a processor of the Solicitors Regulation Authority). They used to load Google Analytics automatically, but the SRA has said that it is not going to do so "at the moment". As we cannot be sure when they might start to use it again, we suggest that you only view our badge if you are willing to send your IP address to the third party, and Google (to load a jQuery resource), and potentially for them to run Google Analytics JavaScript on your device. Here is the third party's privacy notice.
decoded.legal is:
authorised and regulated by the Solicitors Regulation Authority (626329)
subject to the SRA's code of conduct
a company registered in England and Wales (9856909) with a registered office address of 48A Dene Way, Donnington, Newbury, Berkshire, RG14 2JW
registered as a data controller with the Information Commissioner's Office (ZA152364)
registered for VAT in England and Wales (229 6427 86)
Check it is us calling you