We collect, use and are responsible for certain personal data about you. When we do so we are subject to the UK General Data Protection Regulation (UK GDPR).
Who we are:
Data is collected, processed, and stored by Sandstone Legal Limited, trading as “Sandstone Legal”. Sandstone Legal Limited is a limited company, incorporated in England and Wales, authorised and regulated by the Solicitors Regulation Authority under number 808140 .
We are what is known as the “Data Controller” of the personal information you provide to us. We handle and store your personal information in accordance with the law, including the UK GDPR and the Data Protection Act 2018.
Sandstone Legal is registered with the UK Information Commissioner’s Office (ICO) under registration number ZA518143.
What information will we collect from you?
We will only collect information from you that is relevant to the matter we are dealing with, which shall depend on what you have asked us to do or what we are contracted to do for you.
There are two types of personal data (personal information) that you may provide to us, which include:
- Personal Data: This is general information that you supply about yourself, i.e., your name, address, gender, date of birth, contact details, financial information etc.; and
- Sensitive personal data: Certain personal data we collect is treated as a special category to which additional protections apply under data protection law. This is, by its nature, more sensitive information, which may reveal your racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual orientation, trade union membership, health, biometric and genetic data.
Personal data is generally restricted to basic personal data and any information needed to complete identity checks. Where we process special category personal data, we will ensure we are permitted to do so under data protection laws, e.g.:
- We have your explicit consent
- The processing is necessary to protect your (or someone else’s) vital interests where you are physically or legally incapable of giving consent; or
- The processing is necessary to establish, exercise or defend legal claims.
Who do we receive information from?
While acting for you we may receive information about you from various sources including the following:
- You might volunteer the information about yourself
- From publicly accessible services, e.g., Companies House or HM Land Registry
- Information might be passed to us by third parties in order that we can undertake legal work on your behalf. Typically, these organisations include:
- Claims Management Companies
- Organisations that have referred work to us
- Financial Institutions, who provide your personal records / information
- Panel providers who allocate legal work to law firms
- Accountants and other professionals
- Central and local government
- Courts and tribunals
- Sanctions screening providers
- Credit reference agencies
Please be assured that this information will be treated confidentially at all times and will only be used where necessary.
How and why we use your personal data:
Under data protection law, we can only use your personal data if we have a proper reason, e.g.:
- Where you have given consent
- To comply with our legal and regulatory obligations
- For the performance of a contract with you or to take steps at your request before entering into a contract; or
- For our legitimate interests or those of a third party
A legitimate interest is when we have a business or commercial reason to use your personal data, so long as this is not overridden by your own rights and interests. We will carry out an assessment when relying on legitimate interests, to balance our interests against your own.
The primary reason for asking you or others to provide us with your personal information is to provide legal services to you so we may perform our contract.
The following are some other examples of what we may use your information for:
- Verifying your identity
- Verifying source of funds
- Liaising with you
- Obtaining insurance policies on your behalf, including After the Event Legal Expenses Insurance
- Progressing your file, including providing you with legal advice, carrying out litigation and attending hearings on your behalf, preparing documents or completing transactions
- Seeking advice from third parties, including legal and non-legal experts
- Responding to a complaint or allegation of negligence to us
- Retaining financial records of your transactions and those transaction we make on your behalf
- Where it is necessary for reasons of substantial public interest
How will we use your information?
We may use your information for the following purposes:
- Provision of legal services, including advising and acting on behalf of clients
- Direct marketing
- Determining the effectiveness of promotional campaigns and advertising
- Network and information systems security
- Administering any accounts
- Processing your bank / credit card detail in order to obtain / make payments
- Prevention and detection of fraud
- Credit reference checks (where appropriate)
- Identity checks
- Provision of education and training to customers and clients
We may use your personal information for legitimate interests such as direct marketing or under reasonable expectation to provide you with information you would expect to receive or that would benefit and enhance our relationship. This information will help us review and improve our products, services and offers. You have the right to object to this processing and should you wish to exercise that right (see ‘How to contact us’ below).
Who will we share your information with?
Sandstone Legal have robust data protection procedures in place to oversee the effective and secure processing of your personal data. We will not sell or rent your information to third parties, nor will we share your information with third parties for marketing purposes outside of Sandstone Legal.
Usually, we will only use your information within Sandstone Legal. However, there may be circumstances, in carrying out your legal work, where we need to disclose some information to third parties, for example:
- Companies within the Sandstone Legal group
- HM Revenue & Customs
- HM Land Registry
- Courts and Tribunals
- Solicitors acting on the other side
- Providers of identity verification
- Asking an independent barrister or Counsel for advice or to represent you
- Non legal experts to obtain advice or assistance
- Translation Agencies
- Contracted Suppliers
- Outsourcing Companies
- External auditors (e.g., those who audit our accounts) or our regulators, i.e., The Solicitors Regulation Authority, Information Commissioners Office etc.
- Payment Service companies that process transactions for us (e.g., Direct Debits and card transactions, automated payment service)
- Bank or Building Society; or other financial institutions
- The Financial Ombudsman Service, Financial Services Compensation Scheme, Pension Ombudsman Service
- Communication providers (e.g., text/live chat service providers)
- Third-party funders
- Insurance Companies, i.e., for the purposes of acquiring After the Event Insurance
- Client feedback review platforms, including Trustpilot
- PR & Marketing agencies who help to promote our products and services and manage our brands
- Any third parties who may have introduced you to our services that may require updates as to the progression of your matter
- Other Third Parties: Where we have your consent to do so, or where we are required to do so under a legal or regulatory obligation, such as the prevention of financial crime or terrorism
- We might share some of your information with the emergency services if we think you or others are at risk
How long will we keep your information for?
Your personal information will be retained only for as long as necessary to fulfil the purposes for which the information was collected, or as required by law, or as long as is set out in any relevant contract you may hold with us. For example:
- As long as necessary to carry out your legal work
- For a minimum of 7 years from the conclusion or closure of your legal work should you or we, need to re-open your case for the purpose of defending complaints or claims brought against us
- For the length of a trust
In some cases, we may retain your information for a longer period. Where this applies, we will advise you of this at the time, for example:
- Matrimonial matters (financial orders or maintenance agreements etc.)
- Probate matters where there is a surviving spouse or civil partner may be retained until the survivor has died to enable us to deal with the transferable Inheritance Tax Allowance
- Wills and related documents may be kept indefinitely
- Personal injury matters involving lifetime awards or PI Trusts may also be kept indefinitely
As a general rule, if we are no longer providing services to you, we will delete or anonymise your account data after seven years. However, as above, different retention periods apply for different types of personal data and for different services.
Following the end of the relevant retention period, we will delete or anonymise your personal data.
More information is set out in our data retention policy, which is available on request.
How we will keep your personal data secure:
We have appropriate security measures to prevent personal data from being accidentally lost or used or accessed unlawfully. We limit access to your personal data to those who have a genuine business need to access it. Those processing your personal data will do so only in an authorised manner and are subject to a duty of confidentiality.
We also have procedures to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.
If you want detailed information from Get Safe Online on how to protect your personal data and other information and your computers and devices against fraud, identity theft, viruses and many other online problems, please visit www.getsafeonline.org. Get Safe Online is supported by HM Government and leading businesses.
Transferring your personal data out of the UK:
The countries outside of the UK have differing data protection laws, some of which may provide lower levels of protection of privacy.
It is sometimes necessary for us to transfer your personal data to countries outside of the UK. In those cases, we will comply with the applicable UK laws designed to ensure the privacy of your personal data.
We may use outsourcing companies located outside of the UK for administrative services and may have outsourcing agreements with companies based in South Africa and India.
Under data protection laws, we can only transfer your personal data to a country outside of the UK where:
- the UK government has decided the particular country ensures an adequate level of protection of personal data (known as an ‘adequacy regulation’) further to Article 45 of the UK GDPR. A list of countries the UK currently has adequacy regulations in relation to is available here.
- there are appropriate safeguards in place, together with enforceable rights and effective legal remedies for you; or
- a specific exception applies under relevant data protection law.
Where we transfer your personal data outside the UK, we do so on the basis of an adequacy regulation or (where this is not available) by ensuring the use of legally-approved standard data protection clauses recognised or issued further to Article 46(2) of the UK GDPR. In the event we cannot or choose not to continue to rely on either of those mechanisms at any time, we will not transfer your personal data outside the UK unless we can do so on the basis of an alternative mechanism or exception provided by UK data protection law and reflected in an update to this policy.
If you would like further information about data transferred outside of the UK, or a copy of the standard data protection clauses we use please contact us (see ‘How to contact us’ below).
What rights do you have?
You have the following rights under the UK GDPR:
- Right to be informed: This is fulfilled by way of issuing this Privacy Notice and our full explanation as to how we use your personal data.
- Right of access: The right to be provided with a copy of your personal data
- Right to rectification: The right to require us to correct any mistakes in your personal data
- Right to erasure / Right to be forgotten: The right to require us to delete your personal data—in certain situations
- Right to restriction of processing: The right to require us to restrict processing of your personal data—in certain situations, e.g., if you contest the accuracy of the data
- Right to data portability: The right to receive the personal data you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations
- Right to object: The right to object to your personal data being processed for direct marketing (including profiling). In certain other situations to our continued processing of your personal data, e.g., processing carried out for the purpose of our legitimate interests unless there are compelling legitimate grounds for the processing to continue or the processing is required for the establishment, exercise or defence of legal claims.
- Rights concerning automated decision-making and profiling: The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you
For more information on each of those rights, including the circumstances in which they apply, please contact us (see ‘How to contact us’ below) or see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals’ rights under the General Data Protection Regulation.
If you would like to exercise any of those rights, please:
- email, call or write to us—see below: ‘How to contact us’
- provide enough information to identify yourself (eg your full name, address and client or matter reference number) and any additional identity information we may reasonably request from you
- let us know what right you want to exercise and the information to which your request relates
Updating your details:
If any of the information that you have provided to us changes, for example if you change your name or e-mail address, please let us know (see below ‘How to contact us’).
We will use your personal data to send you updates (by email, text message, telephone, or post) about our services, including exclusive offers, promotions, or new services.
How we collect personal data:
The following are examples, although not exhaustive, of how we might collect your personal information:-
- Sign up to receive one of our newsletter
- Submitting an online enquiry
- Following / liking / subscribing to our social media channels
- Completing a questionnaire on our website
- Ask us a question or submitting any queries or concerns you have via email or on social media channels
- Post information to our website or social media channels, for example when we offer the option for you to comment on, or join discussions
- When you leave a review about us on Trustpilot.com
The legal basis for using personal data for marketing purposes:
We handle enquiries at different stages and therefore group those enquiries in three distinct ways. We shall take the following steps in each instance:
Consent will need to be recorded before being added to marketing campaigns.
We have a legitimate interest in using your personal data for marketing purposes (see above ‘How and why we use your personal data’). This means we do not usually need your consent to send you marketing information. Upon collecting your personal data, you will be provided the opportunity to opt in to receiving marketing communications from us. We hope you will provide this information as you may find our communications useful, but if you choose not to, this will have no effect on accessing our legal services. Clients will have the option to exclude themselves from marketing by clicking the unsubscribe link on any marketing emails they may receive, on the telephone when speaking with an advisor, or by contacting us.
We appreciate that you may decide that you do not wish to receive marketing communications and we shall respect that choice. We have a legal obligation pursuant to the Data Protection Act 2018 and the UK GDPR to stop sending marketing communications if you object. If you do not want us to use your personal data in this way, please let us know (see below ‘How to contact us’).
Fixed fee clients:
Legitimate interest will be the legal basis for using your personal data for marketing purposes, as described within the ‘Retainer Clients’ section immediately above.
We use publicly available social media platforms to promote our services, to provide updates and to share any news and promotional updates. We may collect personal information from these social media platforms, for example, if you post a message on our Facebook page. By providing any of your information to us through these platforms you should be aware that:
- The social media web pages are publicly available, and you must not provide any personal or sensitive information on our pages that are accessible to the public, such as your account information.
- We may ask you for your account information via a private message to identify you and to service any request you make; and
Other types of advertising:
We do not have any control over the advertisements you see on other third-party websites, however you can request to opt out or customise these advertisements by using the Google Ads Preference Manager.
We may from time to time, record calls that you make to us or we make to you or any other third party. This is for training, monitoring and quality purposes. Some calls may be observed by staff for training and development purposes.
Who can you complain to?
If you are unhappy about how we are using your information or how we have responded to your request, then you should contact us in the first instance (see below ‘How to contact us’). We hope we will be able to resolve any issues you may have.
You also have the right to lodge a complaint with the Information Commissioner’s office. The UK’s Information Commissioner may be contacted using the details at https://ico.org.uk/make-a-complaint or by telephone: 0303 123 1113.
How to contact us:
If you have any queries about this policy please contact us in writing, by post or email at the following addresses:
T: 0161 470 1511