Home > Privacy Policy

Privacy Policy

Gordons LLP and Gordons Yorkshire Limited (we, us, our) take your privacy seriously. Please read this privacy policy carefully as it contains important information on who we are and how and why we collect, store, use and share your personal information. It also explains your rights in relation to your personal information and how to contact us or the Information Commissioner’s Office (ICO) in the event you have a complaint.

We collect, use and are responsible for certain personal information about you. As such we are subject to the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other domestic legislation relating to the processing of personal data as they may be enacted, amended or replaced from time to time. For the purposes of UK GDPR we are the ‘data controller’. Gordons LLP are registered with the ICO with registration reference Z5755504 and Gordons Yorkshire Limited with reference ZA019870.

This policy applies to individuals who we provide legal services to, individuals who are involved with our provision of legal services (such as employees of clients, or those on the other side of a transaction or dispute on which we are instructed) and those who visit our website or make enquiries to us. We have separate privacy notices for employees and applicants.

PERSONAL INFORMATION WE COLLECT ABOUT YOU

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

Special category personal data means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data, health, sex life or sexual orientation data.

We may collect and use the following personal information about you depending on your relationship and interactions with us:

  • your name, date of birth, and contact information, including address, email address and telephone number(s);
  • special category personal data, if required, to enable us to either provide our services to you or discharge our professional legal obligations during the course of litigation or otherwise with your consent;
  • details of your spouse and family members, if required, to enable us to provide our services to you or discharge our professional legal obligations during the course of litigation
  • personal information from documentation such as your utility bills, passport and/or driving licence to confirm your identity and comply with Anti-Money Laundering legislation;
  • your billing/payment information, transaction and payment card information, credit profile and history and bank details;
  • information to enable us to undertake credit or other financial checks on you;
  • information about how you use our website, mobile applications, IT, communication and other systems;
  • your employment history;
  • details of the pages you visited on our website, your IP address, devices you use and website address you used to access our site or applications from.

HOW YOUR PERSONAL INFORMATION IS COLLECTED

We collect most of this personal information directly from you when acting for you or a client, in person, by telephone, over email, from business documents, or from third parties such as our professional contacts or your employer/employee or other witnesses as part of an investigation or dispute. We may also receive information from your family members/co-habitants if you have asked them to supply information to us. However, we may also collect information:

  • from publicly accessible sources, e.g. DVLA, Companies House or HM Land Registry, social/business media platforms;
  • directly from a third party, e.g.:
    • credit reference agencies;
    • customer due diligence providers;
    • internet service providers;
    • software service providers;
    • intermediaries who introduce us to you/your business;
    • other legal and professional advisors in matters in which our client is involved;
    • a party to a transaction or dispute in which our client is involved;
    • personal representatives, beneficiaries, trustees and executors in matters in which our client is involved;
    • the Courts and Tribunals;
    • regulators and law enforcement bodies in the course of an investigation; and
    • postal providers.
  • from a third party with your consent, e.g. your bank, building society, DVLA, accountant/ financial advisor;
  • from cookies on our website—for more information on our use of cookies, please see our cookie policy
  • via our IT systems, e.g.
    • door entry systems and reception logs;
    • automated monitoring of our websites and other technical systems, such as our computer;
    • networks and connections, CCTV and access control systems, communications systems; and
    • email.

We may collect and process personal data about you as follows:

  • when you complete forms on our website (“Site”). This includes where you request a quote, ask us to contact you or sign up to receive communications from us;
  • when you report to us a problem with our Site or contact us for any other reason. We may keep a record of that correspondence; and
  • we may collect and process details of your visits to our Site including, but not limited to, traffic data, location data, weblogs and other communication data, whether this is required for our own billing purposes or otherwise, and the resources that you access (see our Cookie Policy).

We may also collect data in the following ways:

  • IP Address

We may collect information about your device including, where available, your Internet Protocol address, to protect against fraud, and your device’s operating system and browser type, for system administration and to report aggregate information to our advertisers. This is statistical data about our users’ browsing actions and patterns, and does not identify any individual.

  • Cookies

A cookie is a small piece of data sent from our website and stored on your device’s web browser. Our Site uses the following types of cookies, strictly necessary, targeting and performance cookies. Strictly necessary cookies make out Site function and cannot be switched off in our systems. We’d also like to set additional targeting and performance cookies on your device. However, according to the UK GDPR we’re obliged to give you the option to reject the use of cookies not strictly necessary for the function of our Site when you access gordonsllp.com. As such, these cookies won’t be set unless you enable them. For further information see our Cookie Policy https://www.gordonsllp.com/cookie-policy/

 

HOW AND WHY WE USE YOUR PERSONAL INFORMATION

Under data protection law, we can only use your personal information if we have a proper reason for doing so, e.g.:

  • to comply with our legal and regulatory obligations;
  • for the performance of our contract with you or to take steps at your request before entering into a contract;
  • for our legitimate interests or those of a third party, but only where these are not overridden by your interests, rights or freedoms;
  • to allow you to participate in interactive features of our Site, when you wish;
  • to ensure that the Site’s content is presented in the best way for you/your device;
  • to improve our Site and services;
  • to process and deal with any enquiries made by you; and
  • where you have given consent.
What we use your personal information forOur reasons
To provide legal advice and services, to conduct litigation and/or to act in a transaction on behalf of our clientsFor the performance of our contract with our clients, or to take steps at our clients request before entering into a contract with them
To meet our contractual and/or professional and legal obligations
To prevent and detect fraud and criminal activity against us, you or your employer/employeeFor our legitimate interests or those of a third party, i.e. to minimise fraud that could be damaging for us and for you
Conducting checks to identify our clients, their employees and verify their identity

Screening for financial and other sanctions or embargoes

Other processing necessary to comply with professional, legal and regulatory obligations that apply to our business, e.g. under health and safety regulations, statutory accounting requirements

To comply with our legal and regulatory obligations
Gathering and providing information required by or relating to audits, enquiries or investigations by regulatory bodiesTo comply with our legal and regulatory obligations
For the establishment, exercise or defence of our legal rights, for example, defencing a claim against us or pursuing a debt owed to usFor our legitimate interests, i.e. to enable us to defend legal claims against us and to pursue debts which are owed to us
Operational reasons, such as improving efficiency, training and quality controlFor our legitimate interests or those of a third party, i.e. to be as efficient as we can so we can deliver the best service for you at the best price
Statistical analysis to help us manage our business, e.g. in relation to our financial performance, client base, service offering or other efficiency measuresFor our legitimate interests or those of a third party, i.e. to be as efficient as we can so we can deliver the best service for you whilst meeting our professional obligations
Preventing unauthorised access and modifications to our systemsFor our legitimate interests or those of a third party, i.e. to prevent and detect criminal activity that could be damaging for us and for you

To comply with our legal and regulatory obligations

Updating and enhancing client recordsFor the performance of our contract with you or to take steps at your request before entering into a contract

To comply with our legal and regulatory obligations

For our legitimate interests or those of a third party, e.g. making sure that we can keep in touch with our customers about existing services and new products

Ensuring safe working practices, staff administration, training and assessmentsTo comply with our legal and regulatory obligations

For our legitimate interests or those of a third party, e.g. to make sure we are following our own internal procedures and working efficiently so we can deliver the best service to you

Marketing our services and those of selected third parties to:
• existing and former clients and their employees
• third parties who have previously expressed an interest in our services
• third parties with whom we have had no previous dealings.		For our legitimate interests or those of a third party, i.e. to promote our business to existing and former customers

With your consent

Credit reference checks via external credit reference agenciesFor our legitimate interests or those of a third party, i.e. to ensure our clients are likely to be able to pay for our services
External audits and quality checks, e.g. for accreditations and the audit of our accountsFor our legitimate interests or a those of a third party, i.e. to maintain our accreditations so we can demonstrate we operate at the highest standards

To comply with our legal and regulatory obligations

The above table does not apply to special category personal information, which we will only process as set out in paragraph ‘LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA’ below.

We seek to ensure that our information collection and processing is always proportionate. We will notify you of any material changes to information we collect or to the purposes for which we collect and process it.

Website Links
Our Site may contain links to, and be linked from other websites. If you follow a link to other websites, they will apply different privacy policies, which you should read. We do not accept any responsibility or liability for them.

WHO WE SHARE YOUR PERSONAL INFORMATION WITH

We routinely share personal information with:

  • those that supply us with goods and services;
  • other professional advisers, barristers, expert witnesses, auditors, bankers, insurers and brokers, credit reference agencies;
  • HM Revenue & Customs, HM Courts & Tribunal Service, regulators, police and other authorities who may require us to report processing activities in certain circumstances;
  • IT software providers that host our website and store/maintain data for us;
  • other parties in matters in which our client is involved.

We only allow our service providers to handle your personal information if we are satisfied they take appropriate measures to protect your personal information. We also impose contractual obligations on service providers to ensure they can only use your personal information to provide services to us and to you, unless you agree otherwise.

We may disclose and exchange information with law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations.

We may also need to share some personal information with other parties, such as potential buyers of some or all of our business or during a re-structuring. Usually, information will be anonymised but this may not always be possible. The recipient of the information will be bound by confidentiality obligations.

MARKETING

Where you indicate you would like to receive marketing correspondence from us, subscribe to our mailing lists, newsletters, legal updates, or give us your details at any events we hold or attend, we may use your personal data for our legitimate interests in order to provide you with details of our services, legal and business updates and events which we think may interest you.

We may also share your personal data with organisations who jointly deliver events with us or delegates from those events (with your consent).

You have the right to opt-out of receiving the information detailed at any time. To opt-out of receiving such information you can:

  • click on the unsubscribe button in any electronic marketing communication; or
  • email us at marketing@gordonsllp.com or call 0333 987 5500 giving us your contact details.

We will not share your personal information with any other third party for marketing purposes without your consent.

LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA

We will only use your personal data where the law allows us to. Most commonly, we will use your personal data in the following circumstances:

  • for performance of a contract we enter into with you;
  • for compliance with a legal or regulatory obligation; and
  • for our legitimate interests (as described in this policy) insofar as those interests are not overridden by your interests, rights or freedoms.

In relation to special categories of personal data, we will only use your data for the reasons set out in this privacy policy and only if:

  • you have given your explicit consent (such as signing a form of authority to access medical records);
  • the processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law; or
  • the processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.

We will only process the personal data of a child below the age of 16 years where consent is given or authorised by the holder of parental responsibility over the child and/or to satisfy a legal obligation.

WHERE YOUR PERSONAL INFORMATION IS HELD

Information may be held at our offices, third party agencies, service providers, representatives and agents as described above (see above).

Some of these third parties may be based outside the European Economic Area. For more information, including on how we safeguard your personal information when this occurs, see below under: ‘Information may be held at our offices, third party agencies, service providers, representatives and agents as described above (see above).
Some of these third parties may be based outside the European Economic Area. For more information, including on how we safeguard your personal information when this occurs, see below under: ‘Transferring your personal information out of the UK or EEA’.

HOW LONG YOUR PERSONAL INFORMATION WILL BE KEPT

We will keep your personal information while you have an account with us, whilst we are providing services to you/your employer and for at least seven years after we have delivered our services to you or your employer. We will only keep your personal information for as long as is necessary:

  • to respond to any questions, complaints or claims made by you or on your behalf;
  • to show that we treated you fairly;
  • to keep records required by law;
  • to discharge our contractual/legal obligations owed to you or your employer;
  • to demonstrate we have discharged our obligations;
  • for accounting and audit purposes.

We will not retain your personal information for longer than necessary for the purposes set out in this policy. Different retention periods may apply for different types of personal information.

When it is no longer necessary to retain your personal information, we will delete or anonymise it.

TRANSFERRING YOUR PERSONAL INFORMATION OUT OF THE UK OR EEA

To deliver services to you, it may become necessary to share your personal information outside the UK or the European Economic Area (EEA). We may do this if our service providers are located outside the UK or EEA. If we do transfer your data out of the UK or the EEA, such transfers will be subject to special rules under UK data protection law, particularly if data is to be transferred to countries that do not have data protection laws of a standard comparable to that of the UK. We will always ensure there are adequate safeguards in place (such as the Standard Contractual Clauses or other valid transfer mechanism approved by the UK Government / Information Commissioner) where your data is shared to a with such countries.

If you accept/give your consent to cookies or similar technologies from our website, your personal data may also be transferred to selected third parties outside of the UK and EEA. For further details see our Cookies Policy.

YOUR RIGHTS

You have the following rights, which you can exercise free of charge:

Access (known as a ‘Data Subject Access Request’ or ‘DSAR’)The right to be provided with a copy of your personal information (the right of access).
RectificationThe right to require us to correct any mistakes in your personal information.
To be forgottenThe right to require us to delete your personal information—in certain situations.
Restriction of processingThe right to require us to restrict processing of your personal information—in certain circumstances, e.g. if you contest the accuracy of the data.
Data portabilityThe right to receive the personal information you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations
To objectThe right to object:

—at any time to your personal information being processed for direct marketing (including profiling);

—in certain other situations to our continued processing of your personal information, e.g. processing carried out for the purpose of our legitimate interests.

Not to be subject to automated individual decision makingThe right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you.
To withdraw consentIf you have provided us with a consent to use your personal data you have a right to withdraw that consent at any time. If we are unable to comply with a request, we will tell you why.
Withdrawing consent will not affect the lawfulness of our use of your personal data in reliance on that consent before it was withdrawn.

 

For further information on each of those rights, including the circumstances in which they apply, please contact us or see the Guidance from the ICO on individuals’ rights under the UK GDPR.

We may ask for proof of identification before dealing with a request to satisfy ourselves of the identity of the requestor. The timescale for responding to a request will not begin until we have received the requested information.

We usually have one calendar month to respond to a request although this period may be extended for an additional two months in certain circumstances. We will inform you of any extension within the first month and the reason(s) why.

If you would like to exercise any of the above rights, please:

  • contact our Data Protection Lead at dp@gordonsllp.com or write to us (See below ‘HOW TO CONTACT US SECTION’);
  • let us know what right you want to exercise and the information to which your request relates.

KEEPING YOUR PERSONAL INFORMATION SECURE

We have appropriate security measures to prevent personal information from being accidentally lost, or used or accessed unlawfully. We limit access to your personal information to those who have a genuine business need to access it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality. We continually test our systems to ensure your personal information is safe.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator, including the Information Commissioner’s Office, of a suspected data security breach where we are legally required to do so.

If you want detailed information from Get Safe Online on how to protect your information and your computers and devices against fraud, identity theft, viruses and many other online problems, please visit www.getsafeonline.org. Get Safe Online is supported by HM Government and leading businesses.

HOW TO COMPLAIN

We hope that we can resolve any query or concern you may raise about our use of your information. Please contact us in the first instance with details of your query or complaint.

However, should you remain dissatisfied with how we have handled your query or complaint, you have the right to lodge a complaint with the Information Commissioner’s Office who may be contacted at https://ico.org.uk/ concerns or telephone: 0303 123 1113, or to take action through the Courts.

CHANGES TO THIS PRIVACY POLICY

This privacy notice was last updated in April 2024. We may change this privacy policy from time to time so please regularly check this policy on our website for any changes.

HOW TO CONTACT US

Please contact us by post, email or telephone if you have any questions about this privacy policy or the information we hold about you.

Our contact details are:

Post: Data Protection Lead, Gordons LLP, 1 New Augustus Street, Bradford, BD1 5LL

Email:  dp@gordonsllp.com

Telephone: 0333 987 5500

DO YOU NEED EXTRA HELP?

If you would like this notice in another format (for example audio, large print, braille) please contact us.