Privacy Policy

1. Who we are and what this policy covers

Blackwood & Slaughter, Legal Counsel & Advocates (“the firm”, “we”, “us” or “our”) is a firm of solicitors with its principal office at 1 Mayfair Place, Mayfair, London W1J 8AJ, United Kingdom. We are the data controller of the personal data described in this policy, for the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

This policy explains what personal data we collect through www.blackwoodandslaughter.com (“the site”), why we collect it, with whom we share it, how long we keep it, and what rights you have in relation to it. It applies to visitors to the site and to people who contact the firm through it.

This policy does not govern information we hold about clients in the course of a professional engagement. Information provided to us once an engagement letter has been signed is governed by our engagement terms, by legal professional privilege where it applies, and by our professional obligations of confidentiality under the professional obligations of confidentiality. Those obligations are, in almost every respect, stricter than this policy.

2. Information we collect

Information you give us

If you complete the enquiry form on the site, or write to us by email or post using the details published here, we collect the information you choose to provide. That ordinarily includes:

• your name;
• your company or organisation, where you give one;
• your email address;
• your telephone number, where you give one;
• the nature or type of the matter you select; and
• the free-text summary of the matter you write in your message.

Please keep that first message general. Do not send privileged, confidential or highly sensitive detail through the site before we have completed a conflicts check and confirmed an engagement in writing. Material sent to us beforehand may not attract legal professional privilege, and in some circumstances we may be unable to withhold it from a party we already act for.

Information collected automatically

When you visit the site, our hosting infrastructure records limited technical information for security, diagnostic and availability purposes, including:

• your IP address;
• your browser type and user agent string;
• the pages you view and the date and time of each request; and
• the referring URL, where your browser sends one.

Cookies and tracking

The site uses no advertising cookies and no third-party analytics cookies, and it sets no tracking cookies of any kind. We do not operate advertising pixels, we do not build behavioural profiles, and we do not permit third parties to track you across other websites through this one. The technical records described above are created by the web server in the ordinary course of serving the page; they are not used to identify you as an individual except where necessary to investigate abuse, fraud or a security incident.

3. How and why we use your information

We use personal data for the following purposes, and for no others:

• To respond to your enquiry. To read what you have sent, to ask any clarifying question, and to reply to you.
• To run conflicts checks. Before we can consider acting, we must check the names of the parties and their affiliates against our records of current and former clients and adverse parties. This is a professional requirement, not an optional step.
• To provide legal services. Where an engagement follows, to open the matter, to administer it, and to deliver the services agreed.
• To comply with our professional, legal and regulatory obligations. Including record-keeping, client identification and verification under the money laundering regulations, and responses to lawful requests from courts, the Solicitors Regulation Authority and other regulators.
• To operate and protect the site. To keep the site available, to diagnose faults, and to detect and prevent abuse, spam submissions and attacks on our infrastructure.

Lawful bases under Article 6 UK GDPR

We must have a lawful basis for every act of processing. We rely on the following:

• Legitimate interests (Article 6(1)(f)), in reading and responding to enquiries, in assessing prospective instructions, in operating and securing the site, and in the proper administration of the firm, where those interests are not overridden by your interests, rights and freedoms;
• Contract (Article 6(1)(b)), for steps taken at your request before entering into a contract where you approach us about a possible engagement, and for the performance of the engagement itself once an engagement letter is in place;
• Legal obligation (Article 6(1)(c)), for conflicts records, client identification and verification, professional record-keeping and regulatory response; and
• Consent (Article 6(1)(a)), where we ask for it, which you may withdraw at any time without affecting the lawfulness of processing carried out before withdrawal.

Where we rely on legitimate interests, we have carried out a balancing exercise and you may ask us to explain it.

Special category data and criminal offence data

Some legal matters cannot be described without disclosing special category data within the meaning of Article 9 UK GDPR, such as data revealing health, racial or ethnic origin, religious or philosophical beliefs, trade union membership, sex life or sexual orientation, or data concerning criminal allegations, proceedings or convictions. We ask you not to include such detail in a first enquiry, but where you do, or where a matter requires us to process it, we rely on Article 9(2)(f) of the UK GDPR, that the processing is necessary for the establishment, exercise or defence of legal claims, together with the corresponding condition in Schedule 1 to the Data Protection Act 2018, which for us is ordinarily the condition for legal claims and judicial acts. Criminal offence data is processed under Article 10 UK GDPR on the same Schedule 1 basis. We maintain the appropriate policy document that the Act requires where one is needed.

4. Disclosure of your information

We do not sell personal data. We have never sold personal data and we do not share it for behavioural advertising of any kind. We disclose personal data only in the following circumstances:

• Service providers. Our website hosting, email, document management and IT security providers process information on our behalf, under written terms that require them to act only on our instructions, to keep the information confidential and to apply appropriate security measures.
• Professional advisers. Our own auditors, insurers, bankers and lawyers, where reasonably necessary and subject to duties of confidentiality.
• Counsel, agents and experts. Barristers, foreign counsel, agents and expert witnesses, where a matter requires it and you have instructed or authorised us to engage them.
• Legal and regulatory compliance. Where we are required to disclose information by law, by an order of the court, by a witness summons, or to the Solicitors Regulation Authority, the Legal Ombudsman, the Information Commissioner or another regulatory or disciplinary body; and where disclosure is necessary to establish, exercise or defend legal claims, or to prevent harm.
• Business reorganisation. In the event of a merger, combination or reorganisation of the firm, subject to our continuing professional duties of confidentiality.

5. International transfers

The firm is established in the United Kingdom and our systems are hosted in the United Kingdom or the European Economic Area wherever we can arrange it. Some of our service providers, and some matters, nevertheless require personal data to be transferred outside the United Kingdom.

Where we make a restricted transfer of personal data out of the United Kingdom, we do so only on one of the following bases:

• the receiving country, territory or sector is covered by UK adequacy regulations made by the Secretary of State, so that no further safeguard is required;
• the transfer is made under the International Data Transfer Agreement, or under the UK Addendum to the European Commission’s Standard Contractual Clauses, in each case supported by a transfer risk assessment and by appropriate technical and organisational measures; or
• an exception in Article 49 UK GDPR applies, most often because the transfer is necessary for the establishment, exercise or defence of legal claims, or because it is necessary to perform a contract made in your interest. Cross-border litigation and cross-border transactions routinely require this.

You may request details of the safeguards applied to any transfer by writing to the address in section 12.

6. How long we keep information

We keep personal data only for as long as it is needed for the purpose for which it was collected, and then for such further period as our professional and legal obligations require. Those obligations include professional record-keeping, the periods during which a claim might still be brought against the firm under the Limitation Act 1980, and the retention periods imposed by the money laundering regulations and by tax law.

• Enquiries that do not lead to an engagement. Retained for a limited period sufficient to answer you, to document the conflicts position and to protect the firm against a later assertion that we acted or failed to act, then deleted or reduced to a minimal conflicts record.
• Conflicts records. Names of parties and the general nature of the matter are retained on a long-term basis, because a conflicts system that forgets is not a conflicts system.
• Client matter files. Retained in accordance with our engagement terms and with the professional record-keeping obligations that apply to a firm of solicitors in England and Wales, including the obligation to be able to account to a client and to answer a complaint or a claim for a substantial period after the matter has closed. Our engagement terms state the retention period that applies to your file.
• Server and security logs. Retained for a short period for diagnostic and security purposes, then overwritten or deleted.

Where we are required to keep information, we restrict access to it rather than keeping it in active use.

7. Security

We take the security of information seriously, as a matter of both professional duty and self-interest. Our measures include encryption of traffic in transit using current TLS, encryption of data at rest on firm systems, role-based access controls so that files are visible only to those working on them, multi-factor authentication on firm accounts, logging and monitoring, vetting of service providers, and staff training on confidentiality and information handling.

We must nonetheless be honest with you: no method of transmission over the internet and no method of electronic storage is completely secure. We cannot guarantee the security of information you send to us over the internet, and you send it at your own risk. This is one of several reasons why we ask you not to send confidential or privileged material through the enquiry form. If a matter is genuinely sensitive, write to counsel@blackwoodandslaughter.com saying only that you wish to speak, and we will arrange a secure channel.

8. Your rights under the UK GDPR

You have the following rights in relation to your personal data:

• Access. To be told whether we hold personal data about you and to receive a copy of it, together with the supplementary information the UK GDPR requires. This is often called a subject access request.
• Rectification. To have inaccurate personal data corrected and incomplete personal data completed.
• Erasure. To ask us to delete personal data we no longer have a proper basis to keep.
• Restriction. To ask us to suspend processing while a question about accuracy or lawfulness is resolved.
• Portability. To receive personal data you provided to us, where we process it by automated means on the basis of consent or of a contract, in a structured, commonly used, machine-readable format, and to have it sent to another controller where technically feasible.
• Objection. To object to processing carried out on the basis of our legitimate interests, and to object at any time and without giving a reason to processing for direct marketing.
• Withdrawal of consent. To withdraw any consent you have given, at any time, without affecting the lawfulness of what was done before you withdrew it.

We do not carry out automated decision-making producing legal effects concerning you, and we do not profile visitors to the site.

These rights are not absolute. In particular, we may be unable to erase or restrict personal data where our professional obligations, our conflicts system, an applicable retention rule, or the establishment, exercise or defence of legal claims requires us to keep it, and material covered by legal professional privilege is exempt from disclosure under Schedule 2 to the Data Protection Act 2018. Where we decline a request in whole or in part, we will tell you why and remind you of your right to complain to the Information Commissioner.

How to exercise your rights

Write to privacy@blackwoodandslaughter.com or to the postal address in section 12, marked for the attention of the Privacy Contact. Please describe clearly what you are asking for. We may ask for information sufficient to satisfy us of your identity before we act, because disclosing personal data to the wrong person would be a worse outcome than a short delay. We will respond within one month of receiving your request and the information we need to identify you. Where a request is complex, or where you have made a number of requests, we may extend that period by up to two further months, and if we do we will tell you within the first month and explain why. There is no charge for making a request unless it is manifestly unfounded or excessive. You may act through a representative; we will require written proof of the authority.

9. The UK GDPR and the Data Protection Act 2018

This section supplements the rest of this policy and sets out, in one place, the framework we work within. The law that applies to our processing is the UK GDPR as supplemented by the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 in relation to cookies and electronic marketing.

Categories of personal data we process

Through the site we process the following categories of personal data:

• Identity and contact data, such as your name, your email address and any telephone number you choose to give us;
• Professional data, such as your employer or organisation and your role;
• Technical data, such as your IP address, the pages you view, the referring URL and your user agent string; and
• Matter data, being whatever you volunteer in the free-text summary of your enquiry, which may include special category data or criminal offence data if you choose to include it. We ask that you do not, at least until an engagement is in place.

We collect this data from you directly and from your interaction with the site. We use it for the purposes set out in section 3, on the lawful bases identified there, and disclose it only as described in section 4.

Cookies and electronic marketing

Because the site sets no analytics, advertising or tracking cookies, we do not need to ask you for cookie consent, and there is no cookie banner to dismiss. We do not send marketing emails to people who have merely visited the site or made an enquiry, and we do not sell or rent contact details to anyone.

What we do not do

We do not sell personal data. We do not share personal data for behavioural advertising. We do not build profiles of visitors, and we take no automated decision that produces a legal effect concerning you.

10. Complaints to the Information Commissioner

If you consider that our processing of your personal data infringes data protection law, please raise it with us first at privacy@blackwoodandslaughter.com. We would be grateful for the chance to put it right. That is a courtesy, however, and not a precondition.

You have the right to complain at any time to the Information Commissioner’s Office, the supervisory authority for data protection in the United Kingdom:

• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom
• Online: ico.org.uk, where you will find the complaints process and the current contact details for the ICO helpline

The ICO operates a telephone helpline. We do not reproduce the number here, because a number published on a website goes out of date; please take it from ico.org.uk, which is authoritative.

If you are located in the European Economic Area, you may instead have the right to complain to the supervisory authority in your country of residence or work.

11. Children’s privacy

The site is directed at businesses, professional advisers and adults seeking legal representation. It is not directed at children. In the United Kingdom a child can consent to information society services from the age of 13, and we do not knowingly collect personal data from anyone below that age. In practice we do not expect to hear from any child through this site. If you believe a child has provided us with personal data through the site, please contact us and we will delete it promptly, subject to any legal obligation to retain it.

12. Changes to this policy and how to contact us

We may amend this policy from time to time to reflect changes in our practices, our technology or the law. The date at the head of this page shows when it was last revised. Material changes will be announced on this page; your continued use of the site after a revision is published constitutes acceptance of the revised policy. Where the law requires your consent to a change, we will ask for it.

Questions, requests and complaints about this policy or about our handling of personal data should be addressed to:

• Email: privacy@blackwoodandslaughter.com
• General enquiries: counsel@blackwoodandslaughter.com
• Post: Privacy Contact, Blackwood & Slaughter, 1 Mayfair Place, Mayfair, London W1J 8AJ, United Kingdom

The firm publishes no telephone number; please write to us by email or by post. We have not appointed a statutory data protection officer, as we are not required to do so, and the Privacy Contact answers for these matters.

See also our Terms of Use and our Legal Disclaimer.