Processing of (personal) data by the entity in charge of the online application process

We take your privacy very seriously. This privacy notice explains when and how we collect personal data, how and why we use it, how we might share it, as well as how we keep it secure. It also explains your rights in relation to your personal information and how you can contact us with any queries about your personal information.

1. Who we are

Holmes & Hills LLP is a limited liability partnership authorised and regulated by the Solicitors Regulation Authority (SRA Number: 534489). You may know of Holmes & Hills LLP simply as Holmes & Hills, Holmes & Hills Solicitors or by its trading style, Blackwater Law. Holmes & Hills LLP is a ‘Data Controller’ as defined by the General Data Protection Regulations (GDPR). Throughout this privacy notice Holmes & Hills LLP is referred to as ‘we’, ‘us’ and ‘our’.

2. What information will we collect from you?

For the purposes set out in section 4), we collect your personal information and in some instances ‘special category’ information.

Your personal information includes your name, address, telephone number, email address, financial information, date of birth, National Insurance number and electronic identifiers. We may also collect other details subject to the nature of the matter you have instructed us on, including: details of your spouse/partner and dependents or other family members as necessary to deliver services such as those relating to Family Law matters.

‘Special category’ information includes racial or ethnic origin, trade union membership, genetic data, criminal convictions and information concerning your health, sex life or sexual orientation.

‘Special category’ data will only be processed by us on the grounds of carrying out our contract to deliver services to you, to protect your vital interests, to protect the interests of someone physically or legally unable to give consent or to defend a legal claim, as well as circumstances set out in 4) a) below.

3. Sources of personal information

We collect personal information through a number of means, including:

From you providing this to us in a face-to-face meeting, or via telephone, e-mail, social media or completion of an online form
Recorded calls - sometimes your call may be recorded for training and quality services
Referrals from third parties you deal with
Financial institutions
Government bodies
Health organisations
Digital tracking technologies
From individuals you are personally connected with or related to, or whom are party to a transaction, dispute or other matter that you are connected to.
Solicitors firms
Accountancy firms
Insurance providers

4. How and why we use your personal information

We may collect information from you to allow us to:

a) Provide you with details about our services

Prior to entering into a contract with us to provide you with services, you are likely to want information from us relating to the services you require. We will collect your personal information so as to provide you with this service information. Where you are enquiring about particular services, for example such as litigious claims, you may provide us with ‘special category’ information so that we can provide you with accurate guidance relating to the strength of any potential claim and the appropriateness of our services, for example.

b) Administer applications for employment with us

If you enquire about a vacancy or apply for a position with us, we will collect your personal information so as to provide you with further details regarding the position of interest and to administer the application process. In the event you provide us with consent to do so, we will use your personal information to provide you with details of vacancies which become available in future.

c) Deliver services to you or your business

We will collect and process your personal information as necessary to deliver services to you as you have requested pursuant to our contract with you. This includes undertaking client due diligence in order to comply with our legal and regulatory obligations.

d) Communicating with you as a party connected to a client

We may be required to communicate with parties who aren’t clients, for example if these parties are beneficiaries or who are named as attorneys for our clients.

e) Provide for billing of services procured from us

In the event you owe us money, we will use your personal information to aid us in recovering this debt. It is in our legitimate business interest to do this.

f) Manage and deal with complaints

In the event you make a complaint about our legal services, we will process your personal information according to our Complaints Procedure which we advise in our Terms of Business.

g) Meet our legal and regulatory obligations

As part of our authorisation and regulation by the Solicitors Regulation Authority and pursuant to relevant UK and EU legislation, we will process your personal information as necessary to ensure compliance with our legal and regulatory obligations.

h) External audits and quality checks

Files relating to your matter and containing personal information may be inspected by third party auditors (including but not limited to LEXCEL, Association of Personal Injury Lawyers, ATE/BTE legal insurers, The Law Society, Action against Medical Accidents, Resolution) to ensure we maintain service quality and operational standards in the interests of our clients and in support of our legitimate business interest to maintain our accredited statuses.

i) Improve operational effectiveness

Your personal information may be processed as part of statistical analysis in support of our legitimate business interest of ensuring we operate as effectively and efficiently as possible, so we can provide our clients with the best possible service at the best possible price.

j) Provide for your partaking in a prize-draw or survey

It is in our legitimate business interest to monitor service standards and as part of this we may use your personal information to invite you to provide us with feedback and in analysing any feedback. As part of providing us with feedback, you may grant consent to use of a testimonial you have provided on our marketing materials and websites. If as part of providing us with feedback you enter into the associated prize-draw, we may process your personal information in operating this.

k) Monitor and audit usage of our websites and make

When visiting our websites, anonymous online identifiers derived from your personal data (including gender, geographic location and other demographic location) will form part of an aggregated data set. This aggregated data will be used to monitor the performance of our websites, in particular to monitor technical faults and to make improvements to usability and enhance the visitor experience. This anonymous personal information may be shared with advertising partners, digital consultants and digital publishers to serve advertising to you relating to our services, legal updates, events or changes concerning Holmes & Hills LLP. This is because it is in our legitimate business interest to enhance the performance of our digital assets and effectively target the promotion of our services.

This personal information is collected using cookies and other tracking technologies. See Cookie Policy.

Our websites may contain links to other websites so as to provide you with easy access to third party content we believe may be of interest. These other sites will not be under our control and will therefore not be governed by this Privacy Notice. We are not responsible for the protection and privacy of your personal information that is shared with these third party websites. We recommend you familiarize yourself with the privacy statements and cookie policies of these third party websites.

l) Communicate with you about services, legal updates, events and changes concerning Holmes & Hills LLP (i.e. marketing)

We have a legitimate business interest to process your personal information in order to promote our services, legal updates, events and news concerning Holmes & Hills LLP. We will not normally require your consent to process your personal information for these purposes, where we do, we will seek this separately and clearly.

Where we have provided services to you in your personal capacity or your relationship with us is unrelated to your position or relationship to a corporate entity (Ltd, PLC, LLP, etc.) then we will process your personal information to send you communications relating to our services, legal updates, events and changes to Holmes & Hills LLP in electronic format with your consent.

Where you have not provided consent and where we have carried out a Legitimate Interest Assessment which reasonably confirms your interests, freedoms and rights do not override our legitimate business interest, we will process your personal information to communicate with you via means other than email.

Where we have provided services to a business which you represented in our dealings with that business, or your relationship with us is related to your position at a corporate entity (Ltd, PLC, LLP, etc.) and where we have carried out a Legitimate Interest Assessment which reasonably confirms your interests, freedoms and rights do not override our legitimate business interest, we will process your personal information to send you these communications in either electronic or non-electronic form.

Where we send ‘marketing’ communications to you by email we may collect information about your engagement with this content, your web browsing activity, operating system and IP address. We may collect this information to improve the communications you receive so that these provide the greatest value to you and in support of our legitimate business interest of promoting our services and/or retaining your custom. If you wish to cease receiving such communications you can opt-out using the appropriate links in any such email that is sent to you, or you can contact us at mydata@holmes-hills.co.uk. You may continue to receive emails relating to any services we are providing.

To better understand you as a client, including your other or future legal needs and to meet your reasonable expectations for relevant, timely and accessible communications from us; as well as to provide for compliance with the GDPR and other relevant UK and EU legislation; and to help manage the accuracy of your personal information, we may share your personal information with software providers (specifically email software as a service providers) and data service providers. This is because it is in our legitimate business interest to provide you with timely information on service offerings you may need, in our legitimate business attempt to engage, retain or re-engage you as a client, through legally compliant means.

‘Special category’ data will not be used in the targeting of aforementioned ‘marketing’ communications.

We do not knowingly target communications, ‘marketing’ or otherwise, at children.

We will never sell your personal information to third parties for their ‘marketing’ or any other purpose.

5. Keeping your personal information secure

We take the security of your personal information very seriously and have appropriate security measures to prevent personal information being lost or damaged through accident or unlawful access. Those accessing your data will do so in an authorised manner and are subject to a duty of confidentiality. We also have stringent technological and, where possible, physical controls in place to restrict access to our systems and documentation.

We have procedures in place to deal with any suspected data breach and will inform you and any relevant regulator in the event of a suspected data breach where we are legally required to do so.

6. Who might we share your information with?

We may share your personal information with relevant third parties as necessary to deliver services to you as contracted. These parties include, but are not limited to:

HM Land Registry
HM Revenue & Customs
Other Solicitors
Companies House
Courts and Tribunals
Agents, Insurers and Brokers
Legal Counsel
Accountancy firms
Non-legal expert advisors
Medical experts and agencies
Financial institutions
Law enforcement agencies
Insurance providers
Software providers
Local authorities
Identification and money laundering verification providers
Document signing representatives
Other relevant third parties as necessary and in accordance with the terms of this privacy notice.

Where the sharing of your personal information is not necessary to provide the services you have requested from us or for reasons elsewhere stated in this privacy notice, your consent will be sought prior to this personal information being shared.

7. How long do we hold your information?

Where we are providing or have provided services to you, we will keep your personal information for as long as is necessary to deliver the contracted services you have requested from us or in order to comply with legal and regulatory obligations, resolve disputes and legal claims, as well as enforce the terms of our contracts. In other circumstances we will hold personal information for as long as is necessary and in accordance with this privacy notice.

In some instances we will anonymise your personal information in order to provide for statistical analysis over periods extending beyond the retention period, we therefore cease to process your personal information as part of this statistical analysis.

8. Your rights

Under the General Data Protection Regulations you have the rights set out below.

a) The right to be informed

This Privacy Notice and our Cookie Policy fulfil our obligations to inform you of how we process personal information as a result of you engaging our services, contacting us about our services, requesting ‘marketing’ communications and/or visiting our websites.

b) The right of access

You have the right to request access to the personal information we hold about you.

c) The right to rectification

You have the right to request that any personal information is rectified if this is inaccurate or incomplete.

d) The right to erasure (the right to be forgotten)

You have the right to request the erasure of your personal information where there is not a compelling reason for us to continue to hold this.

e) The right to object

You have the right to object to processing of personal information on the grounds of legitimate interest. Where we can demonstrate compelling legitimate grounds for the processing, which override your interests, freedoms and rights, your personal information may continue to be processed.

f) The right to restrict processing

You have the right to request that we block or restrict the processing of your personal information in certain circumstances.

g) Rights relating to automated decision-making and profiling

We do not subject your personal information to automated decision-making other than as part of the process of entering into a contract. We may profile your personal information so as to better understand you as a client, including your other or future legal needs and to meet your reasonable expectations for relevant, timely and accessible communications from us. This is because it is in our legitimate business interest to provide you with timely information on service offerings you may need, in our attempt to engage, retain or re-engage you as a client, through legally compliant means.

To opt-out of profiling, contact us using the details provided in section 12) Contact us.

When exercising these rights, we will go through a process of verifying your identify to ensure data is not disclosed to parties that do not have the right to receive it. These rights can be exercised without cost but for circumstances where requests made of us are excessive in their frequency or scope, or are unfounded, a reasonable fee will be charged.

Responding to a request to exercise a right

We will aim to respond to all requests within one calendar month but in some circumstances it may take us longer to respond if your request is one of a series of requests, your request is particularly complex, you are requesting excision of multiple rights at once, or we are having difficulty verifying your identify.

9) Where your personal information is held

Information may be held at our offices and those of relevant third parties (see section 6) Who might we share your information with?) with whom your personal information may be shared for the reasons set out previously. Some of these third parties may be based outside of the European Economic Area (EEA). Also see section 11) Transferring your personal information outside of the EEA.

10) Making a complaint

If you are not satisfied with our response to your comment or question relating to our processing of your personal information and you think we are not processing your personal information in accordance with legislation, you can complain to the Information Commissioner’s Office (ICO).

11) Transferring your personal information outside of the EEA

In order to deliver the requested services to you as contracted, in some circumstances it may be necessary to share your personal information with third parties outside of the EEA. We will only transfer data outside the EEA if one of the following applies:

The European Commission has made the decision that the country to which we transfer the personal data ensures an adequate level of protection for the data subjects.
Appropriate safeguards are in place such as binding corporate rules and standard contractual clauses approved by the European Commission.
Where an expert or advisor is located outside of the EEA, where you are based outside of the EEA, or where there is an international element to your matter, amongst others.
The transfer of information is necessary for reasons set out in the GDPR, this includes reasons of public interest, to establish, exercise or defend legal claims or to protect your interests where you are incapable of giving consent for physical or legal reasons.
You have provided explicit consent to the proposed transfer.

Non-EEA countries do not have the same data protection laws as the United Kingdom and EEA.

12) Contact us

You can contact us about your personal information or our processing of this using mydata@holmes-hills.co.uk or by calling 01206 593933. Alternatively you can write to us at the below address:

Holmes & Hills LLP, A12 Commercial Hub, London Road, Marks Tey, Colchester, Essex, CO6 1ED.

Processing of (personal) data by the operator of the recruitment website

General information

This recruitment website is operated by Personio SE & Co. KG, which offers a human resource and candidate management software solution (https://www.personio.com/legal-notice/). Data transmitted as part of your application will be transferred using TLS encryption and stored in a database. The sole controller of this data within the meaning of article 24 of the GDPR is the enterprise carrying out this online application process. Personio’s role is limited to operating the software and this recruitment website and, in this context, being a processor under article 28 of the GDPR. In this case, the processing by Personio is based on an agreement for the processing of orders between the controller and Personio. In addition, Personio SE & Co. KG processes further data, some of which may be personal data, to provide its services, in particular for operating this recruitment website. We will refer to this in more detail below.

The controller

The controller under data protection law is:
Personio SE & Co. KG
Seidlstraße 3
80335 München
Tel.: +49 (89) 1250 1004
Entry in the commercial register
Commercial register entry number: HRA 115934
Registration Court: Amtsgericht München
Data Protection Officer contact: privacy@personio.com

Access logs (“server logs”)

Each access to this recruitment website automatically causes general protocol data, so-called server logs, to be collected. As a rule, this data is a pseudonym and thus does not allow for inferences about the identity of an individual. Without this data, it would, in some cases, be technically impossible to deliver or display the contents of the software. In addition, processing this data is absolutely necessary under security aspects, in particular for access, input, transfer, and storage control. Furthermore, this anonymous information can be used for statistical purposes and for optimizing services and technology. In addition, the log files can be checked and analyzed retrospectively when unlawful use of the software is suspected. The legal basis for this is §25 subsection 2 Sentence 2 TDDDG. Generally, data such as the domain name of the website, the web browser and web-browser version, the operating system, the IP address, as well as the timestamp of the access to the software is collected. The scope of this log process does not exceed the common log scope of any other site on the web. These access logs are stored for a period of up to 7 days. There is no right to object to this.

Error logs

So-called error logs are generated for the purpose of identifying and fixing bugs. This is absolutely necessary to ensure we can react as quickly as possible to possible problems with displaying and implementing content (legitimate interest). As a rule, this data is a pseudonym and thus does not allow for inferences about the identity of an individual. The legal basis for this is §25 subsection 2 Sentence 2 TDDDG. When an error message occurs, general data such as the domain name of the website, the web browser and web-browser version, the operating system, the IP address, as well as the timestamp upon occurrence of the respective error message and/or specification is collected. These error logs are stored for a period of up to 7 days. There is no right to object to this.

Use of cookies

So-called cookies are used on parts of this recruitment website. They are small text files which are stored on the device with which you access this recruitment website. As a general rule, cookies serve the purpose of ensuring secure access to a website (“absolutely necessary”), implementing certain functionalities such as standard-language settings (“functional”), improving the user experience or the performance of the website (“performance”), or placing targeted advertisements (“marketing”). On this recruitment website, we generally use only cookies that are absolutely necessary, functional or performance-related, in particular for implementing certain default settings such as language, for identifying the job advertising channel, or for analyzing the performance of a job advert via which a user accessed this recruitment website. The use of cookies is absolutely necessary for providing our services and thus for the performance of the contract (article 6 (1) b) of the GDPR). Period of storage: up to 1 month or until the end of the browser session Right to object: You can determine via your browser settings whether you allow or object to the use of cookies. Please note that deactivating cookies may result in limited or completely blocked functionalities of this recruitment website.

Rights of data subjects

If Personio SE & Co. KG as the controller processes personal data, you as the data subject have certain rights under Chapter III of the EU General Data Protection Regulation (GDPR), depending on the legal basis and the purpose of the processing, in particular the right of access (article 15 of the GDPR) and the rights to rectification (article 16 of the GDPR), erasure (article 17 of the GDPR), restriction of processing (article 18 of the GDPR), and data portability (article 20 of the GDPR), as well as the right to object (article 21 of the GDPR). If the personal data is processed with your consent, you have the right to withdraw this consent under article 7 III of the GDPR. To assert your rights as a data subject in relation to the data processed for the purpose of operating this recruitment website, please refer to Personio SE & Co. KG’s Data Protection Officer (see item B).

Concluding provisions

Personio reserves the right to adjust this data privacy statement at any point in time to ensure that it is in line with the current legal requirements at all times, or in order to accommodate changes in the services offered, for example when new services are introduced. In this case, the new data privacy statement applies to any later visit of this recruitment website or any later job application.