PRIVACY POLICY

The above table does not by itself identify the additional condition required for special-category personal data. This includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership, genetic or identifying biometric data, health data (including care, vulnerability or abuse information where applicable), and data about sex life or sexual orientation. We require both an Article 6 lawful basis and an Article 9 condition. For ordinary legal work, we commonly rely on Article 9(2)(f) where processing is necessary for legal advice or to establish, exercise or defend legal claims. We use explicit consent only where it is valid and the processing genuinely depends on it; otherwise another applicable Article 9 condition, necessity, minimisation and appropriate safeguards are required.

Criminal-offence data is not special-category data. We process it only with an Article 6 lawful basis and where Article 10 of the UK GDPR and an applicable Data Protection Act 2018 Schedule 1 condition or other legal authority permit. Routine external-funder reporting avoids substantive criminal-offence evidence. Any exceptional use or disclosure for legal claims, fraud prevention or regulatory purposes is separately assessed for necessity and safeguards. We maintain an Appropriate Policy Document where legally required.

Promotional communications

​

We may use your personal data to send you updates by email or post about legal developments and our services where we have determined this is in our legitimate business interests for maintaining client relationships and business development. For existing clients, this may include updates relevant to previous services we have provided. For electronic marketing communications, we will obtain consent where required by the Privacy and Electronic Communications Regulations (PECR). We reserve the right to modify or discontinue such communications at any time.

​You have the right to opt out of receiving promotional communications at any time by:

​

• contacting us by emailing Bolanle Fakoya, our COLP at bola@net-solicitors.co.uk  

• We may ask you to confirm or update your marketing preferences if you instruct us to provide further services in the future, or if there are changes in the law, regulation, or the structure of our business.

We will always treat your personal data with the utmost respect and never sell or share it with other organisations for marketing purposes.

​

Who we share your personal data with

​

We routinely share personal data with:

​

• professional advisers who we instruct on your behalf or refer you to, eg barristers, medical professionals, accountants, tax advisors or other external advisors or experts;

• other third parties where necessary to carry out your instructions, eg your mortgage provider or HM Land Registry in the case of a property transaction or Companies House;

• our insurers and brokers;

• external auditors;

• our banks

• external service suppliers (both inside and outside of the UK), representatives and agents that we use to help deliver our services and / or make our business more efficient, eg case management system providers, typing services, photocopying service, marketing agencies, document collation;

• companies providing services for money laundering checks and other crime prevention purposes and companies providing similar services.

Providers that act solely on our documented instructions are processors and are bound by appropriate Article 28 terms, confidentiality and security requirements. Other recipients may act as independent controllers where they determine their own purposes and means; we assess the factual role in each arrangement. Where personal data is transferred outside the UK, we apply the UK transfer requirements described below. We periodically review relevant providers and safeguards.

​We may disclose and exchange information with law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations. 

​We may also need to share some personal data with other parties, such as potential buyers of some or all of our business or during a re-structuring. Usually, information will be anonymised, but this may not always be possible. The recipient of the information will be bound by confidentiality obligations. 

​

​We will not share your personal data with any other third party unless required or permitted by law, necessary to provide our services, or based on another applicable lawful basis. Any such sharing will be subject to appropriate confidentiality and data protection obligations.

​

External funders and their representatives

Where costs associated with your matter are supported by external funding, we may share personal data with the relevant funder and its authorised administrators, auditors, professional advisers and service providers. This may be necessary for pre-funding due diligence, underwriting, onboarding, deployment verification, funding administration, reporting, monitoring, verification, reconciliation, audit, compliance, fraud prevention or investigation, and the establishment or exercise of rights under the funding arrangement.

​

The information shared will depend on the matter and the relevant funding purpose. It may include identity and contact details; matter references; the type, stage and status of your matter; dates and milestones; information about checks, documents, material events and outcomes; offers, awards, settlements and recoveries; fees, funding and payment information; and other information reasonably required for the funding arrangement.

​

Where reasonably necessary, we may also provide copies of, extracts from or controlled access to relevant client-care and retainer documents, authorities, questionnaires, chronologies, statements, application documents, care, residence or medical records, supporting evidence and information about previous applications, offers, awards or payments. Complete documents may be provided where we consider them reasonably required. We may instead use an extract, summary, redaction, sampling or controlled inspection where appropriate.

​

These documents may contain sensitive or private information, including information about abuse, health, care, vulnerability, finances or alleged criminal conduct. Routine live or case-management-system reporting is designed to avoid substantive sensitive evidence and is limited to approved fields. Any broader disclosure or controlled access involving sensitive information is considered for the relevant funding purpose and is subject to the applicable lawful basis, additional data-protection condition and appropriate confidentiality, security and access controls.

Information may be provided through secure reports or transfers, restricted reporting connections, approved case-management fields or controlled access to relevant records. Net controls what is disclosed and how. Access may be restricted, read-only, time-limited, logged, monitored or supervised. A funder does not receive unrestricted access to your file and cannot control your matter, your instructions, Net’s legal advice, evidence, strategy or professional judgment.

Our principal Article 6 basis for proportionate funding administration, reporting, monitoring, verification, reconciliation, due diligence and audit is legitimate interests. Net has an interest in obtaining and administering funding, and the relevant funder has an interest in assessing and administering the arrangement, verifying performance and protecting its rights. We assess whether the processing is necessary and balance those interests against your rights using purpose limitation, data minimisation, controlled access, confidentiality and oversight.

We rely on contract only where processing is objectively necessary to perform your retainer, on legal obligation only for a specific applicable duty, and on consent only where processing genuinely depends on it. Net and the relevant funder generally act as separate controllers for their respective purposes, subject to their actual roles. Providers acting solely on a controller’s instructions act as processors under appropriate terms.

Legally privileged material and Net’s internal legal advice are not routinely disclosed. Any proposed disclosure of privileged material is considered separately, including the potential effect on privilege and whether separate authority is required.

​

You may object to processing based on legitimate interests, request restriction where the statutory conditions apply, or ask Net to restrict future disclosure or access. These requests do not undo information already lawfully disclosed or affect lawful retention, legal obligations, compelling legitimate grounds or processing for legal claims.

Further information about any funding arrangement applicable to your matter, including the identity of the funder, the information that may be shared and the safeguards applying to that arrangement, will be provided in your matter-specific client-care documentation.

​​​

​Where your personal data is held

​

Information may be held at our offices, third party agencies, service providers, representatives and agents as described above (see ‘Who we share your personal data with’). All data storage locations are subject to appropriate security measures.

​

Some of these third parties may be based outside the UK. While we take reasonable steps to ensure appropriate safeguards are in place, you acknowledge that data transferred outside the UK may be subject to different regulatory requirements. For more information on how we protect your data in these circumstances, see below: ‘Transferring your personal data out of the UK'.

​

​Transmission of information to us by email

In accordance with Article 32 of UK GDPR, we implement appropriate technical and organisational measures including encryption, access controls, regular security testing, staff training, and incident response procedures. While we maintain robust security measures, please be aware that no method of transmission over the internet or electronic storage is completely secure. Despite our best efforts to use encryption and secure protocols, we cannot guarantee the absolute security of data transmission over the internet. By submitting information to us electronically, you acknowledge and accept these inherent risks.

​

 While we implement reasonable security measures, you acknowledge and agree that we cannot be responsible for any costs, expenses, loss of profits, harm to reputation, damages, liabilities or any other form of loss or damage suffered by you as a result of your decision to transmit information to us by electronic means..

​

​How long your personal data will be kept

​

We will keep your personal data after we have finished advising or acting for you. We will do so for one of these reasons:

• to respond to any questions, complaints or claims made by you or on your behalf;

• to show that we treated you fairly;

• to keep records required by law.

​

In accordance with Article 5(1)(e) of UK GDPR (storage limitation principle), we will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, regulatory, accounting or reporting requirements. We maintain a detailed data retention schedule that sets specific retention periods for different categories of data based on:

- Legal and regulatory requirements

- The purpose(s) of processing

- Legitimate business needs

- Risk assessment and data minimization principles

​

The main retention periods are:

- Client matter files: 6 years from matter conclusion, except where:

  • Longer retention is required by specific legal/regulatory obligations

  • The matter involves minors (retained until the child reaches age 21)

  • The matter involves wills, trusts or deeds (retained for 12 years)

  • Ongoing litigation or disputes require extended retention

- Client identification and due diligence records: 5 years after the end of the business relationship

- Financial records: 6 years from the end of the financial year

​

In accordance with Article 5(1)(e) of UK GDPR, when we determine that retaining your personal data is no longer necessary for the purposes for which it was collected or processed, we will:

- Securely and permanently delete it using industry-standard methods

- Anonymise it in accordance with ICO guidelines so that it can no longer be associated with you

- Or pseudonymise it in accordance with Article 4(5) of UK GDPR where complete deletion is not technically possible, maintaining appropriate technical and organisational measures to prevent re-identification

These processes are documented in our internal data retention and destruction procedures and are regularly audited for compliance with UK GDPR requirements.

Further details on this are available in our client care letter/terms of business, which form part of our contractual relationship with you. We reserve the right to modify our retention periods based on legal, regulatory, or business requirements, subject to applicable law and appropriate notice.

​

Transferring your personal data out of the EEA

To deliver services and operate our business, it may be necessary to transfer personal data outside the UK, for example:

• where your or our service providers are located outside the UK;

• if you or another relevant person is based outside the UK;

• where there is an international dimension to the matter in which we are advising you;

• where an approved provider or an authorised representative of a relevant external funder accesses information from outside the UK.

Before a restricted transfer, we identify an applicable UK Chapter V mechanism. Depending on the destination and recipient, this may be UK adequacy regulations (including a partial or sectoral route where applicable), the UK International Data Transfer Agreement, the UK Addendum to approved EU standard contractual clauses, or another lawful mechanism. Where required, we carry out a transfer risk assessment and apply supplementary technical, organisational and contractual safeguards. You may contact us for information about the relevant safeguard, subject to necessary redactions.

​

Your rights

​

​Under UK GDPR Articles 15-22, you have the following rights, which you can exercise free of charge (subject to applicable exemptions):

​​