This privacy notice tells you what we do with information we collect about you. It’s relevant to anyone who uses our services, including clients, prospective clients and former clients. We refer to all of these individuals as “you” in this notice.
How we collect what we need
Eden Legal Limited (“Eden”) will be a “controller” of the personal information that you provide to us when you instruct us to act on your behalf.
When you become a client of Eden, we will collect, store and use the personal information that you provide to us in your instructions and during our solicitor / client relationship. We may ask you for additional personal information during our client / solicitor relationship, which shall be collected, stored and used in accordance with this privacy notice.
We can also collect, store and use personal information relating to you when you become our client from any person that you are jointly instructing us with in the same matter. For example, this might include your spouse, business partner or another family member of yours who is also our client. We will ask them to confirm that they have your permission to give us this information about you.
In some cases, we may collect personal information about you from another solicitor who has acted for you previously, or who has certified copies of your identity documents where you are not able to meet us in person. In such cases, you will have given the other solicitor permission to send that information to us.
Why we need your personal information – contractual purposes
We need to collect our clients’ personal information so that we can perform our service agreement with you. This includes using our clients’ personal information to:
- provide you with legal advice, including by example, communicating with you by email, letter, text message, app-based messaging service and/or telephone;
- represent you as your solicitors in connection with your transaction or case;
- communicate with other solicitors, local authorities, government agencies and other relevant parties about your case or transaction;
- organise specialist insurance policies on your behalf such as bonds of caution or defective title policies;
- contact you to about your case or transaction after it has finished (e.g. to send relevant information to you or to seek your instructions about any further steps or new information that we are made aware of); and
- enforce the terms of our service agreement with you or defend any claims made under the agreement
We cannot provide our services to you unless we use your personal information in this way. If you do not provide us with all the personal information that we need to collect, then this may affect our ability to provide you with legal advice and / or represent you as your solicitors.
Why we need your personal information – legitimate purposes
We also process our clients’ personal information in pursuit of our legitimate interests to:
- promote our services by sending clients communications with information for upcoming events and legal updates;
- invite our clients as guests to our events, including seminars;
- better understand you as a customer, including asking you to provide feedback on the services we provide to you;
- establish or defend a legal claim; and
- recover a debt if you owe us money.
Where we process your personal information in pursuit of our legitimate interests, you have the right to object to us using your personal information for any of the above purposes. If we comply with your objection, this may affect our ability to undertake the tasks above for the benefit of you as a client.
We will tell you if we decide that we do not agree with your objection.
Why we need your personal information – legal obligations
We are under a legal obligation to process certain personal information relating to our clients for the purposes of complying with our obligations under the law and our professional rules. These include:
- the Law Society of Scotland requirements for solicitors;
- the terms of our professional indemnity insurance policy;
- Anti-Money Laundering and Terrorist Financing laws;
- Any legal and regulatory requirements for complaints against solicitors; and
- The terms of any order from a court.
Who we share your personal information with
We are required to share your personal data with other people to enable us to represent you as solicitors and perform our service agreement with you. This includes, other solicitors, courts and tribunals, the Office of the Public Guardian, Registers of Scotland, the person that you are entering a transaction with, or having legal dealings with, your own accountant, surveyor, financial advisor and your bank or other lender.
We may be required to share personal information with statutory or regulatory authorities and organisations to comply with statutory obligations. Such organisations include for example – the Law Society of Scotland, the Scottish Legal Complaints Commission, HMRC, Revenue Scotland, Companies House and Registers of Scotland.
We may be required to share your information with law enforcement or government agencies to comply with statutory obligations or court orders.
We may also share your personal data with our professional advisors for the purposes of taking advice and with our professional indemnity insurers for the purposes of intimating any claims under our policy.
Eden Legal Limited employs third party suppliers to provide services, including IT support, cloud computing services, telephone answering services, banking facilities and legal search services These suppliers may process personal data on our behalf as “processors” and are subject to obligations to only process that personal data under our instructions and protect it. We will only share your personal data with third parties whom we consider to be GDPR compliant.
In the event that we do share personal data with external third parties, we will only share such personal data strictly required for the specific purposes and take reasonable steps to ensure that recipients shall only process the disclosed personal data in accordance with those purposes.
How we protect personal information held electronically
Your personal information is stored on our electronic filing system which is operated and managed by Leap Legal Software. The servers that host our system are based in the EU. The system is accessed by our staff and contractors for the purposes set out above.
Our Wi-F network is secured using WPA2 encryption.
We use ESET antivirus software. It is configured to automatically update, scan e-mails and check for malicious websites.
How long we keep your personal information
We keep your personal data for the minimum retention periods as are set by the Law Society of Scotland from time to time. These vary depending on the type of case that we have worked on for you. As a general rule we will review, and possibly delete, your personal information following a period of at least ten years after your case or transaction has finished.
We have a data retention policy that sets out the periods for retaining and reviewing all information that we hold. This sets out different retention periods and you can request a copy of this from us.
You can exercise any of the following rights by writing to us at: The Data Protection Lead, Eden Legal Limited, Unit E3, 6 Auld Bond Road, Perth PH1 3FX.
Your rights in relation to your personal information are:
- you have a right to request access to the personal information that we hold about you by making a “subject access request”;
- if you believe that any of your personal information is inaccurate or incomplete, you have a right to request that we correct or complete your personal information;
- you have the right to ask for a copy of your personal information to pass to another organisation in certain circumstances
- you have a right to request that we restrict the processing of your personal information for specific purposes; and
- if you wish us to delete your personal information, you may request that we do so (the so-called “right to be forgotten”).
Any requests received by Eden will be considered under applicable data protection legislation.
Sometimes we will not be able to stop using your personal information when you ask us to (e.g., where we need to use it because the law requires us to do so or we need to retain the information for regulatory purposes).
In other cases, if we stop using your personal information, we will not be able to provide services to you.
We will tell you if we are unable to comply with your request, or how your request might impact on you, within one month of your request to exercise any of your rights.
If you wish to complain about how we are processing your personal data, you have a right to raise a complaint with the Information Commissioner’s Office.
You can contact the ICO by telephone on 0303 123 1113. You can also contact them by post, email, or by on line chat. For full details, please see the ICO website at www.ico.org.uk