Privacy Policy

Simison & Co Limited is committed to protecting the privacy and security of your personal information. This privacy policy contains important information about how we collect and use personal information about you, in accordance with applicable legislation including: the UK General Data Protection Regulation, the EU General Data Protection Regulation and the Data Protection Act 2018 (‘data protection law’). It also explains your rights in relation to your personal data and how to contact us or the supervisory authorities in the event you have a complaint.

Simison & Co Limited is a ‘data controller’, which means that we are responsible for deciding how we hold and use your personal information.  When we say ‘we’, ‘us’ or ‘our’ in this policy, we are referring to Simison & Co Limited, its subsidiaries and all affiliated entities.  When we say “you” or “your” in this policy, we refer to any individual whose data we process, including but not limited to:
Clients (including former clients);
Relatives or Associates of our clients whose data is relevant to our client’s matter;
Executors;
Company executives, beneficial owners and persons with significant control;
Personal Representatives;
Trustees;
Attorneys.
We are registered as a data controller with the Information Commissioner’s Office as follows:
Simison & Co Limited,  C/O Wilson Partners Limited, TOR, Saint-Cloud Way, Maidenhead, Berkshire, England, SL6 8BN. Registration number: ZA930265

Personal data we collect about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). There are ‘special categories’ of more sensitive personal data which require a higher level of protection. The personal data about you which we collect, store, and use may include but is not limited to the following categories:

• personal contact details such as name, title, addresses, telephone numbers, and personal email addresses;
• work contact details;
• date of birth;
• gender;
• information to enable us to verify your identity, such as driving licence, utility bill or passport;
• a copy of your signature including copies of documents you sign in your name or on behalf of a business;
• financial information such as bank details, tax details and source of funds information and details of any relevant sanctions;
• details of your professional social media presence, such as LinkedIn;
• details of your spouse/ partner, dependants, wider family and care givers;
• your employment details, including salary and benefits, misconduct, sickness, performance or grievance;
• your nationality and immigration status and information from related documents;
• any other personal data relevant to our clients’ matters or the operation of our business;
• job application details, e.g. date of birth, employment history, qualifications, references, equality and diversity monitoring information;
• ‘Special category data’, including data relating to health (including disabilities), ethnicity, race, religious beliefs, trade union membership and genetic information and biometric data;
• information about criminal convictions and offences;
• audio, video and CCTV recordings; and/or
• information gathered through the automated monitoring of our websites, computer networks, communication and phone systems and connections e.g. Google Analytics, Google Adwords or Bing.

How your personal data is collected

We collect most of your personal data from you direct. However, we may also collect information via / from third party sources. Those third party sources include but are not limited to:

• publically accessible sources such as Companies House or HM Land Registry;
• third parties (with your consent) such as your bank / building society, your employer and trade union, your doctors and other health professionals, consultants , insurers, brokers and other professionals with whom we may engage in relation to your matter;
• networking and social events;
• correspondence we may receive from third parties about you or your matters;
• third parties relevant to an application for employment (e.g. referees);
• online client portals;
• case management systems;
• automated monitoring of our websites, computer networks, communications systems and connections; and/or
• systems to ensure the security of our premises, including security CCTV footage.

Legal grounds for using your personal information

We will only process your personal information where we have a lawful basis for doing so. There are six lawful bases, four of which are applicable to our business and the processing of your personal information.  We have given some examples of where each basis applies, as follows:

• to decide whether to enter a contract with you or to perform that contract with you. We rely on this lawful basis to process your personal information to perform our contract for legal services with you;
• to comply with a legal obligation. We rely on this lawful basis where, for example, we are required to provide your personal data under a Court Order or as required by our regulator;
• where we have a legitimate interest to process your information, provided your interests and fundamental rights do not override those interests. We may market our services to you on the grounds of legitimate interest, but we will always give you the option to opt-out of those communications; and/or
• where you have given us your consent. Where we cannot rely on any other lawful basis, we will request your consent to process your personal information. This might be relevant if we need to process your ‘special category data’ for any reason other than carrying out our contract for legal services for you.

Some of the above grounds for processing can overlap and there may be several grounds which justify our use of your personal information.

How we use your personal information

We may use your data in the following ways:

• to create client and matter records and files to enable us provide legal services;
• to conduct checks to identify our clients, verify their identity and determine source of funds and wealth;
• to respond to a request for or query about your personal information;
• to screen for financial and other sanctions or embargoes;
• to process your application for employment;
• to process your request to provide services to us as a third party supplier and monitor your contractual arrangement with us;
• to send you marketing information, including updates on services and details of events in which we believe you might be interested;
• to process it in accordance with our operational policies including checking for conflicts of interests, monitoring client service delivery, recording complaints and claims information and creating archiving records;
• to gather and provide information required by or relating to financial returns, reports and audits;
• to respond to enquiries or investigations by regulatory bodies or law enforcement agencies;
• as part of any report required by our insurers or legal advisers; for external audits and quality checks; and/or
• for the purposes of complying with our professional, legal and regulatory obligations.

How we use your special category data

‘Special category data’ requires higher levels of protection. We may only process your special category data if we have a lawful basis and a specific condition for doing so. The following four conditions are most relevant to how we process your special category data:

• where processing is necessary for the establishment, exercise or defence of legal claims (or whenever courts are acting in their judicial capacity);
• we only process it where that processing is necessary to protect your vital interests or those of another natural person, where you are physically or legally incapable of giving consent (e.g. where we liaise with a third party under a power of attorney);
• we only process it where the personal data has been manifestly made public by the data subject; or
• where it is needed in the public interest, such as for equal opportunities monitoring.

In limited circumstances, where we need to process your special category data and we cannot rely on any of the four conditions set out above, we will only process it with your express written consent.
We may use your special category data in the following ways:

• to create client and matter records and files to enable us to provide legal services to you;
• to share with third parties in the course of your matter and in accordance with your instructions;
• to respond to requests from our regulator to provide, for example, information on equality and diversity;
• to respond to a request for your personal information; and/or

Who we share your personal data with

While carrying out our work and your instructions we sometimes need to share your personal data with third parties, including but not limited to:

• professional advisers who we instruct on your behalf or refer you to, such as barristers, costs draftsmen, medical professionals, accountants, tax advisors, architects, estate agents,insurers, case management companies or other experts;
• other third parties where necessary to carry out your instructions,
• our regulator, the Solicitors Regulation Authority;
• our own legal advisers, insurers and brokers;
• Government departments i.e. Companies House, Land Registry, HMP, HMRC, DWP, Inland Revenue, Legal Ombudsman;
• external auditors and accreditors (e.g. SRA );
• our bank; and/or
• our data processors, including but not limited to trustees, translators, third-party IT providers and reprographics providers.

We only allow third parties to handle your personal data if we are satisfied they take appropriate measures to protect it.  If we share personal data with them, they will process that data as a data controller or a data processor, dependent upon how they will process that data, and in accordance with the data sharing requirements of data protection law.  We may disclose and exchange information with law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations.
We may also need to share personal data with other third parties, such as potential buyers of some or all of our business, or during a restructuring.  Usually, information will be anonymised but this may not always be possible. The recipient of the information will be bound by confidentiality obligations.

Transferring your personal data out of the EEA

In delivering our services to you, it is sometimes necessary for us to share your personal data outside the EEA.  This might arise where, for example, you are domiciled overseas, your matter has an international dimension or where our service providers are located outside the EEA.  Any transfers of personal data outside the EEA are subject to special rules under data protection law.  We will therefore put in place appropriate safeguards where we transfer your information outside of the EEA by either:

• ensuring that there is an adequacy decision by the European Commission in respect of those countries in place; and/or
• ensuring that information is treated by third parties in a way that is consistent with and which respects the EU and UK laws on data protection. Our standard practice is to use the standard data protection contract clauses which have been approved by the European Commission.

Keeping and storing your personal data

The security of your personal data is of paramount importance to us.  The majority of the personal data we hold is stored electronically, in our secure IT systems, or in hard copy, either at our secure office premises or at a secure offsite archive provider.  It may also be stored by third parties processing your data on our behalf (see who we share your data with) but in accordance with a data sharing agreement.
We retain your personal data in accordance with our Terms of Business and our Retention Policy set out in our Legal Services Guidelines. We do so for one (or more) of the following reasons:

• in accordance with regulatory, insurance or statutory requirements
• to respond to any enquiries, complaints or claims made by you or on your behalf; or
• where we have a legitimate interest in retaining your personal data (e.g. to prevent conflicts of interest).

Different retention periods apply for different types of data.  Please contact us if you would like to see a copy of our Legal Services Guidelines.

Withdrawing your consent

Where we process your personal data on the lawful basis of having obtained your specific consent, you are welcome to withdraw that consent at any time.  Please contact us to let us know (see the “How to contact us” section below).

Your rights

Under the GDPR you can exercise a number of rights, as follows:

You will not have to pay a fee to exercise any of your rights, however, we may charge a reasonable fee if a request for access is clearly unfounded or if it is deemed to be excessive. Alternatively, we may refuse to comply with a request in such circumstances.  We will ask for proof of identity before we provide any personal information, to prevent any unauthorised access.
If you would like to exercise any of these rights, please contact our Data Compliance Officer — see below ‘How to contact us’.

Keeping your personal data secure

We have security measures which strive to prevent personal data from being accidentally lost, or used or accessed unlawfully. We follow strict procedures as to how your personal information is processed, to prevent any unauthorised person obtaining access to it. All personal information you register on our website will be located behind a firewall and we will use our strict procedures and security features to try to prevent unauthorised access to our systems. Unfortunately, the transmission of information via the internet is not completely secure and although we strive to protect your personal data, we cannot absolutely guarantee the security of your data. Those processing your information within our business and on our behalf, will do so only in an authorised manner and are subject to a duty of confidentiality.
We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

How to contact us

If you would like to contact us to discuss any aspect of this Policy, please contact our Data Compliance Officer, as follows:
Data Compliance Officer: Sheila Simison
Email: sheila@simison.co.uk
Telephone: 07768258385
Address: Simison & Co Limited, Registered Office : C/O Wilson Partners Limited, TOR, Saint-Cloud Way, Maidenhead, Berkshire, England, SL6 8BN

How to complain

We hope that our Data Compliance Officer can resolve any query or concern you may raise about our use of your information. However, the General Data Protection Regulation also gives you the right to lodge a complaint with a supervisory authority, in particular in the European Union (or European Economic Area) state where you work, normally live or where any alleged infringement of data protection laws occurred. The supervisory authority in the UK is the Information Commissioner who may be contacted at https://ico.org.uk/concerns or telephone: +44 0303 123 1113.
This policy will be regularly reviewed and updated.
Dated:  April 2022