McEvedys Privacy Notice

1. About this Notice

McEvedys Solicitors & Attorneys Ltd ("McEvedys", "we", "us" or "our") is committed to protecting personal information and respecting privacy.

This Privacy Notice explains how we collect, use, disclose and protect personal information in the course of our legal practice and through our website. It also explains the rights individuals have in relation to their personal information.

For the purposes of UK data protection law, the data controller is:

McEvedys Solicitors & Attorneys Ltd
8 St James's Square
London SW1Y 4JU
Telephone: 0207 243 6122
Email: victoria@mcevedys.com

McEvedys is authorised and regulated by the Solicitors Regulation Authority, SRA No. 564276.

2. Who this Notice Covers 

In the course of our business we process personal information concerning a range of individuals. These may include:

• current, former and prospective clients;
• directors, officers, employees, shareholders and representatives of clients and other organisations;
• parties and prospective parties to litigation, transactions and other legal matters;
• witnesses and prospective witnesses;
• barristers, solicitors, experts, arbitrators and other professional advisers;
• persons identified or referred to in evidence, correspondence, legal proceedings or other material provided to us;
• suppliers and other professional and business contacts;
• persons who contact us or use our website; and
• other individuals whose personal information we receive in the course of providing legal services or conducting our business.

The fact that we hold personal information concerning an individual does not necessarily mean that the individual is or has been a client of McEvedys.

3. Personal Information We Collect 

The personal information we process will depend upon the circumstances and may include:

• names, titles and contact details;
• employment, directorship and other business or professional information;
• identification and verification information obtained for client acceptance, anti-money laundering, sanctions and other regulatory purposes;
• financial, payment and billing information;
• information contained in correspondence and communications;
• information contained in legal documents, evidence, witness statements, pleadings, court and tribunal documents and other material relating to legal matters;
• information provided by or on behalf of clients or other persons in connection with our legal services;
• information generated by us in the course of providing legal services and administering our practice;
• technical information arising from electronic communications and use of our website; and other information relevant to the matters on which we are instructed or to the operation of our business.

In the course of legal work we may also process special category personal data, including information concerning health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric information, or sex life or sexual orientation. Where relevant to legal proceedings or our legal or regulatory obligations, we may also process criminal offence data. 

4. Where We Obtain Personal Information

We may obtain personal information directly from the individual concerned.

We may also obtain information from other sources, including:

• our clients and persons acting on their behalf;
• other parties to legal proceedings, transactions or disputes;
• solicitors, barristers and other professional advisers;
• courts, tribunals, arbitrators and other dispute-resolution bodies;
• witnesses and experts;
• regulators, government agencies and public authorities;
• Companies House and other public registers;
• publicly available sources, including websites and published material;
• professional and commercial databases and information services; and
• service providers used in connection with our legal practice and business.

Where information has not been obtained directly from you, data protection law may in some circumstances permit us not to provide privacy information individually, including where you already have the information, where providing it would be impossible or involve disproportionate effort, or where another applicable exemption applies. We will apply those provisions where relevant.

5. How and Why We Use Personal Information

We process personal information where this is necessary or appropriate for the conduct of our legal practice and business.

Providing legal services and entering into retainers

We may process personal information where necessary:

• for conflict, client acceptance and other preliminary checks;
• to take steps at a person's request before entering into a retainer;
• to perform our contractual obligations to clients; and
• to provide legal advice, representation and other legal services.

Our legitimate interests

We may process personal information where necessary for our legitimate interests or those of our clients or others, provided those interests are not overridden by the rights and interests of the individual concerned. Those interests may include:

• providing, administering and improving our legal services;
• managing client and professional relationships;
• managing and administering our business;
• accounting, billing and recovering fees;
• maintaining business records;
• information and systems security;
• protecting the firm, our clients and others against legal, regulatory and commercial risk; and
• establishing, exercising or defending legal rights and claims.

Legal and regulatory obligations

We process personal information where necessary to comply with our legal, professional and regulatory obligations, including anti-money laundering, sanctions, professional conduct, court, tax, accounting and regulatory requirements, and lawful requests from courts, regulators, lawenforcement agencies and other public authorities.

Legal proceedings and legal claims

We may process personal information where necessary in connection with actual or contemplated legal proceedings and for the establishment, exercise or defence of legal claims. This may include information concerning clients, former clients, counterparties, directors and employees of companies, witnesses, experts and other persons involved in or relevant to a legal matter.

Where necessary for these purposes, this may include special category personal data and criminal offence data, subject to the conditions and safeguards required by applicable data protection legislation.

Consent

Where we rely specifically upon consent as the lawful basis for processing, you may withdraw that consent at any time. Withdrawal does not affect processing already undertaken lawfully and does not prevent us from continuing to process information where another lawful basis applies.

We do not generally rely upon consent where processing is necessary to provide legal services, comply with our professional or legal obligations, or establish, exercise or defend legal claims. 

6. When You Provide Information to Us

In some circumstances you are required to provide particular information so that we can comply with legal or regulatory obligations or enter into or perform a retainer. For example, we may need identification and verification information for anti-money laundering, sanctions or client acceptance purposes.

If required information is not provided, we may be unable to act, continue acting or provide a particular service. Where the provision of information is optional, we will not treat it as mandatory.

7. Who We May Share Personal Information With

Where appropriate and lawful, we may disclose personal information to: 

• our clients and persons authorised to act on their behalf;
• courts, tribunals, arbitrators and other dispute-resolution bodies;
• parties and prospective parties to litigation, disputes and transactions;
• solicitors and other lawyers;
• barristers and local or foreign counsel;
• experts, consultants and other professional advisers;
• witnesses and other persons involved in legal matters;
• •insurers and insurance brokers;
• the SRA, ICO and other regulators or public authorities;
• banks, accountants and other financial or professional service providers;
• identity-verification, anti-money laundering and sanctions-screening providers;
• providers of legal research and professional databases;
• IT, email, cloud, telecommunications and cybersecurity providers;
• document-production, storage, archiving and administrative service providers; and
• other suppliers whose services are reasonably required for the operation of our practice.

We disclose only such information as is reasonably necessary for the relevant purpose and subject to our professional duties, including duties of confidentiality and legal professional privilege. 

8. International Transfers

The nature of our work means that personal information may sometimes need to be transferred to, accessed from or processed in countries outside the United Kingdom. This may occur, for example, when we work with foreign lawyers, experts, parties or service providers or where technology providers operate internationally.

Where a transfer is a restricted transfer under UK data protection law, we will use a lawful transfer mechanism. Depending upon the circumstances, this may include UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where applicable), appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum, or another permitted exception.

Where appropriate safeguards are used, we will carry out the assessment required by UK law to determine, reasonably and proportionately, that the standard of protection for the information will not be materially lower after the transfer and will apply any additional protections required.

9. Security

We take appropriate technical and organisational measures to protect personal information against unauthorised or unlawful processing and against accidental loss, destruction, alteration or disclosure.

Our employees and service providers are required to respect the confidentiality and security of information to which they have access. No electronic transmission or storage system can, however, be guaranteed to be completely secure.

10. How Long We Keep Personal Information

We retain personal information for no longer than is reasonably necessary for the purposes for which it was collected and for legitimate legal, regulatory, professional and business purposes.

The appropriate retention period depends upon the nature of the information and the circumstances in which it is held. Relevant considerations include our professional and regulatory obligations, limitation periods and legal claims, anti-money laundering and other statutory requirements, tax and accounting requirements, the nature and duration of the client relationship and the need to maintain appropriate records of legal work undertaken.

Different categories of information may therefore be retained for different periods.

11. Your Data Protection Rights

Depending upon the circumstances and applicable law, you may have rights to: 

• obtain information about our processing of your personal data;
• request access to personal data concerning you;
• request correction of inaccurate or incomplete information;
• request erasure of personal data;
• request restriction of processing;
• object to particular processing;
• receive certain information in a portable form; and
• withdraw consent where processing is based upon consent.

These rights are not absolute. They may be restricted by applicable data protection legislation and other legal principles and exemptions, including legal professional privilege, duties of confidentiality, the rights of other individuals and provisions concerning legal proceedings and legal claims.

The right of access is a right to personal data and the accompanying information required by law. Depending on the circumstances, personal data may be provided by supplying copies of documents, by providing extracts, or in another intelligible form. It does not necessarily require us to provide an unredacted copy of every document or an entire client or litigation file in which personal data appears.

When responding to a subject access request we are required to carry out reasonable and proportionate searches for relevant personal data. Where clarification is reasonably required to enable us to respond, data protection law allows the response period to be paused while we await that clarification.

If you wish to exercise a data protection right, please contact us using the details below. We may need information reasonably necessary to verify your identity before acting on a request

12. Automated Decision-Making

We do not ordinarily make decisions about individuals based solely on automated processing where the decision produces legal effects or similarly significant effects. If we introduce processing of that kind, we will provide the information and safeguards required by applicable data protection law.

13. Website Enquiries and Cookies 

If you contact us through our website, we will process the information you provide, including your name, email address and the contents of your enquiry, for the purpose of considering and responding to it and, where appropriate, considering whether we can provide legal services.

Please do not provide confidential or sensitive information through the website unless necessary. Sending an enquiry does not by itself create a solicitor-client relationship.

Information about cookies and similar technologies used on our website is provided in our Cookie Notice.

14. Marketing

We may from time to time send legal updates or other professional communications to persons who have asked to receive them or where we are otherwise lawfully permitted to do so.

You may ask us to stop sending marketing communications at any time by using any unsubscribe facility provided or by contacting us at victoria@mcevedys.com.

15. Data Protection Complaints 

If you have a concern or complaint about how we use your personal information, you may raise it directly with us by contacting Victoria McEvedy at victoria@mcevedys.com or at the postal address below.

We will acknowledge a data protection complaint within 30 days of receipt, take appropriate steps to investigate it without undue delay, keep you informed about the progress of the complaint where appropriate, and notify you of the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO):

Information Commissioner's Office
Website: www.ico.org.uk
Telephone: 0303 123 1113

You are not required to complain to us before contacting the ICO, although the ICO may ask whether you have first raised the matter with us. 

16. Contact Us

Questions about this Privacy Notice or the exercise of data protection rights should be addressed to:

Victoria McEvedy
McEvedys Solicitors & Attorneys Ltd
8 St James's Square
London SW1Y 4JU
Telephone: 0207 243 6122
Email: victoria@mcevedys.com

17. Changes to this Notice

We may update this Privacy Notice from time to time to reflect changes in our practice, technology or applicable law. The current version will be published on our website.