Your data, handled with care.

How we collect, use, share and protect your personal information.

We will respect your privacy and work hard to meet strict regulatory requirements.

UK data protection law changed significantly on 25 May 2018. The General Data Protection Regulation (GDPR) is a positive step towards giving you more control over how your data is used and how we contact you. If you are an individual, your rights under the GDPR include:

The right to be informed
The right of access
The right to rectification
The right to erasure
The right to restrict processing
The right to data portability
The right to object
Rights in relation to automated decision making and profiling

We use your personal data to help us provide an excellent client service, including tailoring the information we share with you so that it is relevant, useful and timely. We will not sell your personal data to third parties, and we will give you easy ways to manage your marketing choices if you receive direct marketing from us.

We are regulated by the Solicitors Regulation Authority (SRA) and are already subject to strict rules of confidentiality. Keeping your information private and secure is part of the fabric and culture of our firm. Please help us keep your data secure by carefully following any guidance we give, for example on communicating bank details and transferring funds to us.

We are sometimes obliged to share your personal data with external authorities without notifying you, for example as required by anti-money laundering and counter-terrorist financing legislation. In all other cases we will be transparent and explain why we are requesting your data and how we are using it.

Lawful bases for processing your data

We may use personal information only where we have a proper and lawful reason to do so. This includes sharing it with others outside the firm, for example an auditor of a relevant quality standard. The GDPR says we must have one or more of these reasons:

Contract: the processing is necessary for a contract we have with an individual, or because they have asked us to take specific steps before entering into a contract.
Legal obligation: the processing is necessary to comply with the law (not including contractual obligations).
Legitimate interests: the processing is necessary for our legitimate interests or those of a third party, unless there is a good reason to protect the individual's personal data which overrides those interests. A legitimate interest is when we have a business or commercial reason to use your information.
Consent: the individual has given clear consent for us to process their personal data for a specific purpose.

Special categories and criminal convictions data

For these types of data we rely on further conditions in Schedule 1, Part 3 of the Data Protection Act 2018. The primary condition is "legal claims", met where the processing:

is necessary for, or in connection with, any legal proceedings (including prospective legal proceedings);
is necessary for obtaining legal advice; or
is otherwise necessary for establishing, exercising or defending legal rights.

Where we process data under Schedule 1, Part 2, condition 18 (safeguarding of children and individuals at risk), the processing will be necessary to protect an individual from neglect or physical, mental or emotional harm, or to protect their physical, mental or emotional well-being, in circumstances where consent cannot be given, cannot reasonably be obtained, or obtaining it would prejudice that protection.

We comply with Schedule 1, Part 4 of the Act, which requires an appropriate written policy explaining our security procedures and data retention periods. This is set out in the firm's Information Management and Security Policy, which we retain and produce to the Information Commissioner on request.

Who we share your data with

Subject to the SRA Code of Conduct and our duty of client confidentiality, we may share your personal information with:

Lawyers or other organisations on the other side of a matter
Barristers or experts we instruct
The courts and other tribunals
Your personal representatives or attorneys
Auditors
Lenders
Estate agents, IFAs, referrers and similar
Organisations we introduce you to
HM Revenue and Customs
Central and devolved government
Fraud prevention agencies, including the National Crime Agency
The SRA and other regulators
ID checking organisations

Automated decision-making

We do not use automated decision-making in our legal work. All decisions about you and your matter are made by a person.

Personal data we use

Your name
Date of birth
Home address
Contact details such as phone numbers and email addresses
Bank details and account information
Medical information (where applicable)
Employment details
Data that identifies you by cookies when you use our website

When you use the enquiry or appointment forms on this website, we receive the details you enter so that we can reply. The forms are protected from spam by Google reCAPTCHA, which is subject to Google's privacy policy and terms.

Sending data outside the European Economic Area

Unless your matter involves an international element, we do not normally send your personal data outside the EEA. If we do, we will seek your consent, explain the risks and discuss possible safeguards depending on the country involved.

If you refuse to provide personal data

If you refuse to provide information we request, it may cause delay and we may be unable to continue to act for you or complete your matter.

Marketing information

From time to time we may send you letters or emails about changes in the law and actions you might consider in light of them, for example reviewing your will. We will do so either because you have consented or because we have a legitimate interest. You have the right to object and ask us to stop at any time, and you can change your mind later.

How long we keep your information

We are legally obliged to keep certain information for at least 5 years and typically store your file for 6 years before destroying it. However:

Will files and Lasting Power of Attorney files are kept indefinitely
Conveyancing purchase files and probate files are kept for 15 years
In some cases, for example legal aid matters, we must keep files for longer; this will be set out in our closing letter
Wills and other documents are stored indefinitely

We keep your name and contact details on our database until you tell us you would like them removed, for example if you change solicitor.

Getting a copy of your personal information

To access your personal data, write to: Gareth Edmondson, Data Protection Supervisor, Amphletts Solicitors, 49 Conway Road, Colwyn Bay, Conwy LL29 7AN.

Correcting your information

If you think any information we hold about you is incomplete or wrong, you have the right to ask us to correct it. Please contact us as above.

Other rights

You may ask us to delete (erase) your data or stop using it if there is no longer any need for us to keep it, and to restrict processing. On data portability: subject to any lien for unpaid fees, we will promptly (where permitted) transfer your paper file to another solicitor on receipt of your signed consent. If your file is electronic, we will take reasonable steps to export it in a portable format, although we cannot guarantee compatibility with every system.

Consent

In some cases the GDPR requires your explicit consent, for example to process data about racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health, sexual life, or the commission or alleged commission of offences and related proceedings. Where acting for you involves such data, for example obtaining your medical records, we will seek your explicit consent. You may withdraw consent by contacting us, although we may then be unable to progress your case or continue to act for you.

How to complain

If you are unhappy with how we are using your personal data, please contact us using the details above. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/concerns.

Updating this notice

We will update this notice from time to time to reflect ICO guidance, the requirements of data protection law and other relevant changes in the law or regulations, and to learn from published cases of data protection breaches.