The EU General Data Protection Regulation seeks to protect and enhance the rights of individuals relating to the handling of their personal data.  Worthingtons Solicitors is committed to protecting and respecting your personal data.  We may change this Privacy Notice at any time by updating this page so you should therefore check our website at www.worthingtonslaw.co.uk from time to time to ensure you are aware of any changes.  It is important that you read this Privacy Notice, together with our terms and conditions that we may provide on occasions when we are collecting or processing personal information about you.  Our full terms and conditions can also be found on our website at any time.  It is important that the personal information we hold about you is accurate and current.  Please keep us informed if your personal information changes during your relationship with us.

Who we are – Worthingtons Solicitors is a registered Data Controller with the Information Commissioner’s Office (ICO).  Our Data Protection Office (DPO) can be contacted at our registered address: 24-38 Gordon Street, Belfast, BT1 2LG.

In what capacity do we collect data from you?  During the course of our business providing legal services, Worthingtons compiles and holds certain personal information about you for the purposes of providing you with legal services.  In providing these services, we will act as both a Data Processor and in some instances, as a Data Controller in respect of your personal information.

Collection of your personal data – we use different methods to collect personal information from and about you.

• Directly from you using our file opening sheet, our website contact form, by e-mail or by phone.
• From third parties – we will also gather personal information from other sources, including from lenders, other law firms, credit reference agencies, Legal Services Agency, Court Service, regulatory bodies and/or any other government body or statutory agency.

Personal data we hold relating to you – personal information means any information about an individual from which that person can be identified.  It does not include data where the identity has been removed (anonymous data).  We may collect, use, store and transfer different kinds of personal information about you, examples are as follows:

• full name and title
• contact information including e-mail addresses and postal addresses, telephone numbers and fax numbers
• details of any potential conflicts of interest
• adverse credit and negative media
• criminal convictions
• date of birth
• identification or supporting documents (such as passport, driving license, birth certificate, utility bill etc)
• IP address
• gender
• bank details

Our use of your personal information – we will only use your personal information when the law allows us to.  We will use your personal data where we need to:

• In order to meet our contractual obligations under our agreement with you
• Where it is necessary for our legitimate interests (or those of a third party and your interests and fundamental rights do not override those interests).
• Where we need to comply with a legal or regulatory obligation.

We do not rely on consent as a legal basis for processing your personal information other than in relation to sending third party direct marketing communications to you.  We do not share your personal information or data with any third party for this purpose.

Sharing your data with third parties – we may share your data with our telecoms and IT support services to help with the running of our day to day business activities.

Complaints relating to our handling of personal data – any complaints regarding the way we handle personal data can be made by contacting our DPO at our registered address or by contacting the ICO at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF or by telephoning their helpline on 0303 123 1113.

Our legal basis for collecting and processing personal data – we collect, retain, process and share with third parties personal data relating to our clients for the performances of a contract to provide legal services, legitimate interests or for any legal obligations we may have.

Subject Access Requests – you can request an electronic copy of your personal data we hold or withdraw your consent for us to retain and/or process your personal data at any time by contacting us in writing at our registered address.  Should you need to make a change to any of your personal data or if you would like us to erase your personal data that we hold you can make a request to us in writing at our registered address.

Data Retention Policy – we will retain personal data we hold in relation to you after the completion of your case in line with the Law Society of Northern Ireland file disposal and destruction guidelines.

Using your data for marketing purposes – we may use personal data to market directly to you.  We do not share personal data with any third party for this purpose.  You have the right to object to us marketing directly to you.  You can send any objections to us in writing at our registered address and we will remove your personal data from any marketing list we hold.  If we do market to you we will provide you with a way to “opt out” of any marketing process.

Your rights under GDPR – under GDPR, you have certain rights in respect of the processing of your personal information, which may vary dependent on the legal basis for collection of your personal information and the uses made of this personal information.

For all uses made of your personal information you have the right to be informed about how we use your personal information, and this notice discharges that obligation.  However, further rights may apply n different circumstances, as set out below:

• Right of access – you have a right to access a copy of the personal information that is held about you (subject to Data Protection Laws).
• Right of rectification – you have a right to correct personal information that is held about you if it is inaccurate or incomplete.
• Right to be forgotten – in certain circumstances you can ask for the personal information held about you to be erased (please note our retention period set out in point 17 of this notice).
• Right to restrict processing – where certain conditions apply you have a right to restrict processing (please note this may impact our ability to provide our services to you).
• Right to data portability – you have the right to have the personal information held about you to be transferred to another organisation upon receipt of a signed form of authority.
• Where applicable Worthingtons will provide copies of personal information electronically, in a structured, commonly used, and machine readable form.
• Right to object – you have the right to object to certain types or processing, such as marketing (please note that we will only ever use your contact information for marketing purposes where you have provided express consent).
• Right to withdraw consent – in the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time.  To withdraw your consent, please contact our DPO by post at 24-38 Gordon Street, Belfast, BT1 2LG.
• In the event you wish to exercise any of these rights, please make you request in writing to our DPO at our registered address.

Data Retention Periods – we will only retain your personal information for the duration of our contract with you and for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.  To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

Security – we have put in place measures to protect the security of your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We are committed to ensuring that your personal information is secure.  In order to prevent unauthorised access or disclosure we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the personal information we collect online.  We will use our best efforts to ensure that no unauthorised parties have access to any of your personal information and we restrict access to non-public information about you to those individuals and entities that need to know the personal information to be able to provide products and services to you.

Worthingtons website

Cookies – we use cookies to provide a better user experience.  A cookie is a small data file that is used in order to make websites work, or work more efficiently, as well as to provide statistical and analytical information.  Statistical and analytical information from cookies provide us with general and not individually specific information about the web traffic of the website.  This information helps us monitor our website so that we can manage the website’s capacity and efficiency.

External links – this website may contain links to enable you to visit other websites of interest more easily.  However, once you have used these links to leave our website, you should note that we do not have any control over that other website.  Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and this Privacy Notice does not govern such sites.

• All phone calls made to and by us, or internally, will be monitored or recorded.
• All e-mail correspondence, both incoming, outgoing and internal, will be monitored.
• This Privacy Notice is not designed to form a legally binding contract.
• Use of Worthingtons’ services constitutes acceptance by you of the Privacy Notice.  If you do not wish to accept the Privacy Notice, you should inform us immediately, in writing, at our registered address.

This Privacy Notice was last updated in January 2019.