�������ϲ�����

1. Introduction

2. Who are we?

3. Who does this privacy notice apply to?

4. What personal information do we collect?

5. How do we collect your personal information?

6. How do we use your personal information?

7. Who might we share your information with?

8. How can you change your marketing preferences?

9. How long we keep hold of your information?

10. How is your information kept secure?

11. What are your rights in respect of your data?

12. What can you do if you have concerns about our use of data?

13. How can you contact us?

14. Will there be changes to this notice?

Introduction

�������ϲ����� is committed to protecting and respecting your privacy. This privacy notice is designed to provide information about our practices concerning the collection, use and disclosure of your personal information in the course of providing legal, advisory and/or consultancy services, carrying out marketing and recruitment activities. This privacy notice sets out how we use and protect your personal information.

Who are we?

�������ϲ����� is made up of �������ϲ����� LLP, �������ϲ����� Ireland LLP, Mowbray Trustees Ltd and Mowbray Trust Corporation Ltd. When we mention ‘�������ϲ�����’, ‘we’, ‘us’ or ‘our’ in this privacy notice, we are referring to the relevant business responsible for processing your data. You will be informed which entity is processing your personal data however your personal data may be processed by the other business from time to time

We are committed to maintaining high standards of confidentiality in relation to the information provided to us in the course of our business. Our data security controls are certified under ISO 27001 and accredited in relation to the UK Government’s Cyber Essentials Plus security standards.

Please read this notice carefully and should you have any questions please contact us using the details outlined at the end of this document (How can you contact us?).

Who does this privacy notice apply to?

This privacy notice applies to everyone whose personal information we collect and process (excluding our existing or former workforce, to whom a separate HR Privacy Notice applies). This includes individuals in the categories below or who work for any of the following:

• our clients
• other lawyers and law firms, including barristers
• people who are involved in court or other legal proceedings (including legal claims, criminal actions, inquests, tribunals, arbitrations, mediations, investigations, and regulatory actions) or the provision of related or other legal, advisory and/or consultancy services, or people who are involved in insurance claims we are handling for clients. This may include claimants, defendants, witnesses, experts, and service providers related to such court or other legal proceedings, services, or claims, such as investigators, mediators and costs lawyers
• people who are involved in contracts and transactions we are working on, such as other businesses or individuals our clients are contracting with
• our regulators, insurers, auditors, professional advisers, and certification/accreditation bodies (such as for our ISO 27001 and Lexcel accreditations)
• prospective employees, consultants, and partners; and
• people whose details we process in connection with our marketing activities.

What personal information do we collect?

Personal data, or personal information, means any information about an individual from which that person can be identified.

In the course of our business, we will need to collect and process various types of personal information for various purposes. Given the nature of our business and the services we provide, it is impractical to list all the categories of personal information that may be collected and processed. We will however only process and collect personal information where we have a lawful basis to do so.

We most commonly collect and process the following kinds of personal data about you:

• contact information for individuals (such as full name, job title, organisation, date of birth, address, email address and telephone number). We may collect additional information to enable the identity of individuals to be verified
• financial information, including your bank account and payment card details
• employment records, including professional membership/registration, SRA checks, references, proof of eligibility to work, security checks, photos
• recruitment information, including CVs, interview notes and assessment material
• information regarding an individual’s legal requirements and personal or professional situation
• information about individuals employed by or associated with our clients, advisers or the organisations involved in a matter on which we are instructed
• medical records and health information as necessary for the provision of our services where the services we provide involve or relate to medical matters
• information obtained as a result of investigations carried out in relation to individuals which may involve surveillance conducted by third parties and/or by researching online activity, and accessing various subscription databases and open-source platforms where the services we provide relate to suspected crime including regulatory or disciplinary offences involving dishonesty
• criminal convictions and offences data may be processed if necessary, for the legal matter we are advising on
• special category personal data may be processed if necessary for the legal matter we are advising on, this includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation
• marketing and communications data, including your marketing preferences and interests and any feedback you provide to us (for example, by completing a survey). We also track when you receive and read marketing communications from us.

For details about information we collect automatically from your use of our website, please see our Cookie Notice.

How do we collect your personal information?

We use different methods to collect personal information from and about you including:

Direct interactions: You may voluntarily provide us with your personal information, for instance when you:

• fill out a form on our website, e.g., completing an online form sign up to our marketing list
• correspond with us by email or post
• speak to us in person or on the phone
• visit our offices
• give us feedback (for example, by completing a survey)
• give us your business card at an event or meeting; or
• register for one of our online learning tools, webinars, events and/or conferences.

Automated technologies or interactions

As you interact with our website, we will automatically collect information about your browsing activities and your equipment. We collect this information by using cookies. For full details about our use of cookies, please see our Cookie Notice.

Publicly available sources: We may collect personal information available publicly from the publicly accessible and online sources such as:

• online professional social networking services and applications, such as LinkedIn
• your company’s website
• the Land Registry; and
• Companies House.

Third party sources: we may collect personal information from the following third-party sources:

• our clients
• our agents
• professional advisers instructed by us
• fraud prevention and credit reference agencies
• subscription databases
• insurance databases; and
• government agencies.

How do we use your personal information?

Lawful basis on which we will use your personal data

We will only use your personal information when the law allows us to do so, i.e., where we have a lawful basis for processing. Most commonly, we will use your personal information in the following circumstances:

• Where we need to perform the contract, we are about to enter into or have entered into with you or take any steps you ask us to before entering into a contract with you.
• Where it is necessary to do so in order to comply with any legal obligations we have, such as under money laundering laws.
• On the basis of consent:
  • Where we rely on your consent for processing this will be brought to your attention when the information is collected from you.
  • You have the right to withdraw consent at any time, see the Your Rights section below for further information about how you may withdraw your consent.
  • We do not rely on or require your consent for the majority of our processing.
• Where the processing is necessary for our legitimate interests in:
  • providing legal, advisory and/or consultancy services
  • ensuring regulatory compliance and maintaining accreditations
  • providing our clients with the best service
  • promoting our services
  • receiving feedback; and
  • improving our services and identifying ways to grow our business.

and/or for the legitimate purposes of our clients or other third parties in receiving those services. We will only rely on this lawful basis where we consider that your interests and fundamental rights do not override such interests.

When processing your personal information, we comply with the provisions of this privacy notice and, in respect of the provision of legal services we are also bound by professional obligations of confidentiality. You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us using the ‘Contact Details’ section below. 

Special category data

In most cases, when we process special category data (see What personal information do we collect? for what data this includes) it is because it is necessary to do so for the establishment, exercise or defence of legal claims or whenever instructed by the courts acting in their judicial capacity. We may however process special categories of data with your explicit consent (for example for the purpose of providing legal advice), where it is necessary to protect your vital interests (for example in the event of an emergency where you are attending our offices) or where the data has been manifestly made public by you.

Criminal convictions and offences data

In some cases we need to process information about criminal convictions or offences where they are relevant to the legal advice being sought. For example, our Employment law team regularly advises clients on misconduct matters involving criminal offences and offences and convictions data may be processed in the course of litigation matters. We process this data on the basis that it is necessary for legal proceedings, obtaining legal advice or is otherwise necessary for the purpose of establishing, exercising, or defending legal claims.

Purposes for which we use your personal data

We may process your information for the following purposes:

Legal, advisory and/or consultancy services

Where we receive personal data in connection with the provision of legal, advisory and/or consultancy services, we process that data for the purposes of the provision of those services. This includes:

(a) Providing legal and related services, such as:

• managing court or other legal proceedings (including legal claims, criminal actions, inquests, tribunals, arbitrations, mediations, investigations and regulatory actions)
• providing legal advice
• providing consultancy services
• providing claims handling services
• providing wills and probate services including contacting beneficiaries
• advising on and negotiating legal contracts and transactions; and
• managing and running checks on insurance fraud, subscription and Intercept databases and processing and sharing information with our clients and other appropriate organisations for the purpose of preventing, detecting, or prosecuting criminal activity including cyber-enabled fraud and data theft, financial crime and insurance fraud.

• When we hold and use personal information in the course of providing legal, advisory and/or consultancy services to a client, that client is also entitled to access that personal information. They may in turn use that information in accordance with their own privacy notice or equivalent.

When we hold and use personal information in the course of providing legal, advisory and/or consultancy services to a client, that client is also entitled to access that personal information. They may in turn use that information in accordance with their own privacy notice or equivalent.

(b) Complying with our legal obligations or making disclosures to government, regulatory or other public bodies where in our reasonable opinion the disclosure is appropriate and permitted by law. This includes:

• performing checks of our clients and others as we are required to do by law or which are good practice, such as anti-money laundering and anti-terrorism checks. In undertaking such checks we may ask individuals to provide information and use publicly available information
• disclosures required by law or court order
• disclosures to the police, tax authorities, the National Crime Agency or other public or government authorities where in our reasonable opinion the disclosure is required in relation to any criminal investigation or prosecution; and
• disclosures to our regulators, ombudsman, or other government, public or regulatory authority, including any data protection supervisory authority or regulator of legal services, where in our reasonable opinion the disclosure is required or permitted by law.

(c) Providing access to our files for audit, review, or other quality assurance checks, by our clients, regulators, auditors, professional advisers, and certification/accreditation bodies.

(d) Processing required in connection with the day-to-day operation of our business such as billing and payments, complaints handling and internal record keeping. For this we may use third party service providers such as IT service providers.

(e) Processing required in connection with any actual or proposed reorganisation, merger, sale, joint venture, assignment, transfer, or other transaction relating to all or any portion of our business or assets.

Marketing

We process personal information in connection with marketing or communications purposes, including so that we can:

• send you invitations to our online learning tools, webinars, events, and/or conferences as and when we think they might interest you
• register and manage your attendance at one of our webinars, events, or conferences
• on occasion, organise necessary travel or hotel arrangements for your attendance at an event
• if you are a speaker at one of our events, promote your participation via platforms such as Twitter, LinkedIn, our website and in our marketing communications (NB: external platforms may continue to store and use your personal information after the event has ended)
• archive event attendance information and other personal information at the end of every business year (please see our retention schedules for more information about how long we store personal information)
• share with you news and offers about our products and services
• email you with legal updates and newsletters relevant to sectors and specialisms that you are interested in
• ask you for feedback (for instance, in a survey) about our client or visitor services, and to manage, review and act on the feedback
• manage any changes to your marketing preferences or comply with any unsubscribe requests; and
• monitor our website usage and improve our services, please see our Cookie Notice below for further information on how we use cookies to do this.

Recruitment

We process personal information in connection with our recruitment practices for the following purposes:

• recruiting new employees, consultants and partners
• verifying immigration status and/or eligibility to work
• undertaking pre-employment checks; and
• obtaining references.

Research

We may process your personal information in connection with research projects. Where we do so, we will only process information that is necessary for the purposes of the research.

7. Who might we share your information with?

For the purposes set out in the ‘How we use your personal information’ section above, we may share your personal information with the following categories of third parties, some of whom we appoint to provide services, including:

• our clients, as part of the provision of legal services to them;
• professional advisors, suppliers, and sub-contractors in the course of the provision of legal or other services or in the performance of any contract we enter into with you. This will depend on the legal work we are instructed to carry out but includes parties such as other law firms, barristers, expert witnesses, investigators, courts, registries and regulators;
• �������ϲ����� associated companies such as Mowbray Trustees Limited which provides trustee services;
• Other companies within the business;
• third parties who have a right to access information through legal disclosure rules as part of litigation;
• event venues, webinar hosts and training providers to provide you with access to our events and training;
• providers of business support services including technology, banking, insurance, litigation support and security;
• analytics and search engine providers that assist us in the improvement and optimisation of our site;
• providers of business development and marketing support services;
• universities and other research partners;
• survey or quality assurance providers in order to receive feedback and improve our services.

Additionally, we will disclose your personal information to the relevant third party:

• in the event that we sell or buy any business or assets, in which case we will disclose your personal data where relevant to the prospective seller or buyer of such business or assets;
• if we are acquired by a third party, in which case personal data about you held by us will be one of the transferred assets; and
• if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements; or to protect the rights, property, or safety of our customers, our regulator, or others.

Where we share your personal information with third parties, as described above, we will only do so where in our reasonable opinion that information will be adequately protected. The terms on which we provide information to barristers, experts and investigators can be found here:

How we use your information

In providing wills and probate services we will process information about beneficiaries under an obligation of professional confidentiality to the testator. Upon the death of the testator, we will contact beneficiaries and share with them the data relevant to their entitlement.

Any other service providers with whom we share information are approved by us and subject to contractual obligations designed to ensure that those providers comply with data protection legislation.

Transferring personal information outside the United Kingdom ("UK") or European Economic Area (“EEA”)

We may transfer personal data outside the UK or the EEA where adequate protection measures are in place in compliance with data protection laws. 

We share your personal data within the business. This will involve transferring your data outside the UK or the EEA, as applicable.

Whenever we transfer your personal data outside the UK or EEA, as applicable, we ensure that at least one of the following safeguards is in place, as applicable:

• Adequacy decision, as approved by the European Commission or the UK government, as applicable;
• Permitted derogation for specified circumstances;
• Processor binding corporate rules;
• Standard contractual clauses, as approved by the European Commission or the UK government, as applicable.

Third party links

Our website may include links to third-party websites, plug-ins and applications, for example when you click the link to register for on one of our webinars, you will be taken to the third-party website of our webinar provider. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

How can you change your marketing preferences?

We strive to provide you with choices around what marketing communications you receive from us. To ensure that we continue to provide you with the most relevant information, you can review and update your marketing preferences at any time by clicking ‘unsubscribe’ or ‘manage preferences’ in any of our emails.

To request that we stop processing your personal information for marketing purposes, you can opt-out of all communications at any time by clicking ‘unsubscribe’ or ‘manage preferences’ in any of our emails, or by emailing compliance@brownejacobson.com, and we shall stop processing your information for those purposes.

If you have consented to receive marketing communications from us, you can withdraw this consent at any time by clicking ‘unsubscribe’ or ‘manage preferences’ in any of our emails, or by emailing compliance@brownejacobson.com, and we Will stop processing your information for those purposes.

See Your Rights section below for further information about your rights to withdraw consent and opt-out.

How long we keep hold of your information?

We retain personal data in accordance with our retention and destruction policy here.

If you unsubscribe from our marketing emails or withdraw your consent for us to contact you, we will store your information for a period of two years to ensure that you no longer receive emails from us.

How is your information kept secure?

We are strongly committed to data security and take reasonable appropriate steps to protect the personal information we hold from unauthorised access, loss, misuse, alteration or corruption. We have put in place physical, electronic and managerial procedures to safeguard and secure that information, controls for which are certified under ISO 27001 and accredited in relation to the UK Government’s Cyber Essentials Plus security standards.

What are your rights in respect of your data?

If we process your personal data, you have the following rights. You can exercise these rights at any time by emailing us at compliance@brownejacobson.com or by using the other contact details given in the ‘Contact details’ section below.

You have the right:

• to ask us not to process your personal data for marketing purposes (either by clicking ‘unsubscribe’ or ‘manage preferences’ in any of our emails, or by emailing compliance@brownejacobson.com).
• to ask us not to process your personal data where it is processed on the basis of legitimate interests provided that there are no compelling reasons for that processing;
• to withdraw your consent at any time, you can do this by emailing compliance@brownejacobson.com. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent;
• to ask us not to process your personal data for scientific or historical research purposes, where relevant, unless the processing is necessary in the public interest;
• to request from us access to personal data we hold about you;
• to ask for the information we hold about you to be rectified if it is inaccurate or incomplete;
• to ask for data to be erased provided that the personal data is no longer necessary for the purposes for which it was collected, you withdraw consent (if the lawful basis for processing is consent), you exercise your right to object, set out below, and there are no overriding legitimate ground for processing, the data is unlawfully processed, the data needs to be erased to comply with a legal obligation or the data is children’s data and was collected in relation to an offer of information society services;
• to ask for the processing of that information to be restricted if the accuracy of that data is contested, the processing is unlawful, the personal data is no longer necessary for the purposes for which it was collected, or you exercise your right to object (pending verification of whether there are legitimate grounds for processing); and
• to ask for data portability if the processing is carried out by automated means and the legal basis for processing is consent or contract.

What can you do if you have concerns about our use of data?

Should you have any issues, concerns or problems in relation to your data, or wish to notify us of data which is inaccurate, please let us know by contacting the Data Protection Manager in the first instance by using the contact details below. If we are unable to resolve your concerns and you remain dissatisfied, you have the right to complain to the relevant supervisory authority.  

In the UK the relevant supervisory authority is the Information Commissioner’s Office (ICO). The ICO’s contact details are available here:

In Ireland the relevant supervisory authority is the Data Protection Commission (DPC).  The DPC’s contact details are available here: www.dataprotection.ie.

How can you contact us?

Please read this notice carefully and contact us if you have any queries by emailing us at compliance@brownejacobson.com, or by writing to:

Data Protection Manager
�������ϲ����� LLP
Castle Meadow Road
Nottingham
NG2 1BJ

Representatives 

Our UK representative is �������ϲ����� LLP. You may contact our representative at:

Data Protection Manager
�������ϲ����� LLP
Castle Meadow Road
Nottingham
NG2 1BJ

or by emailing compliance@brownejacobson.com.

Our EU representative is �������ϲ����� Ireland LLP. You may contact our representative at:

Jeanne Kelly, Partner
jeanne.kelly@brownejacobson.com
�������ϲ����� Ireland LLP

2 Hume Street

Dublin 2

D02 FT82

Will there be changes to this notice?

This privacy notice may change from time to time, so we recommend that you review it periodically. This version of the privacy notice was last updated in October 2024.

Download PDF