Your privacy is important to us.
- This privacy notice explains our approach to any information we may collect from you, and the purposes for which we process your personal data. Hickman & Rose is the data controller responsible for your personal data. Hickman & Rose is a partnership based in central London. If you have any questions about this policy, please contact us using the details below:
Address: Pennybank, 33-35 St John’s Street, London, EC1M 4DS
Telephone: +44 (0)20 7702 5331
- ‘Personal data’ is defined under the Data Protection Act 2018 (DPA 2018) and the UK General Data Protection Regulation (GDPR) as any information relating to an identified or identifiable natural person. This includes identifiable references such as matter numbers or ID numbers.
- This notice gives details of:
- the personal data that we collect
- how it is obtained and used
- the lawful basis upon which we use it
- the legal rights of the individuals whose personal data we are processing
- how long it may be retained
- who it may be shared with
- how we protect it
The personal data that we collect
- We collect various categories of personal data depending on the individual and the reason for collecting their data. We are likely to collect the following personal data in all cases:
- name, date of birth, contact details including email address, postal address and telephone number.
- If you are a prospective or existing client, we may also collect identification documents such as passport or driving licence, information relating to your reason for instructing us, financial data, medical records and any other information that is relevant to the provision of our services.
- If you are a third party connected to a case in which we are instructed to act, we may also collect information that is relevant to the provision of our services to our client.
- If you are a job applicant, we may also collect your CV, information concerning your employment history, anonymised equality and diversity monitoring form responses and any other information that is relevant to your application.
- If you are an employee, in addition to the above categories listed under ‘job applicant’, we will also collect your identification documents, proof of your right to work in the UK and any other relevant information provided to us by you or by third parties, with your consent.
How it is obtained and used
- The personal data we process is often provided to us directly by the data subject (for example, a prospective client providing details of their enquiry by telephone, email or post; a job applicant providing us with a copy of their CV by email or otherwise; an employee providing supplementary information during the course of their employment).
- This data is used by us to enable us to provide services to our clients or assess whether we are able to provide a service to a prospective client, process job applications and manage an employee during their time with us.
- Where the personal data we process is not given to us directly by the data subject, it may have been obtained in a variety of ways. It may have been given to us by a client (for example where you are a witness or a co-defendant in their matter), the police or a prosecuting agency in relation to a matter we are instructed on, former employers providing a reference for an employee or other third parties.
The lawful basis upon which we rely in processing personal data
- We are allowed to process personal data in certain circumstances as set out in the DPA 2018 and the GDPR.
- In the case of a prospective or existing client, it is necessary for us to use your personal data to enable us to assess whether we can assist you. While we are assessing whether we can assist you, it is in our legitimate interest to use your personal data to ascertain whether we can provide our services. We also need to process your personal data in order to perform a contract we are about to enter into or have entered into.
- In the case of any third parties whose personal data we may process during our contract with a client, it is in our legitimate interest to process that data in order to properly represent our client insofar as the interests and fundamental rights of the third party (the data subject) do not override our own interests.
- In the case of a job applicant or employee, your personal data is used to take steps at your request in relation to an employment contract we may enter into with you.
The legal rights of the individuals whose personal data we are processing
- Under data protection law, you have several rights, including:
- The right to ask us if we’re processing your personal data and access to it
- The right to ask us to rectify personal data you think is inaccurate. You also have the right to ask us to complete data you think is incomplete.
- In certain circumstances, you have the right to ask us to erase your personal data. Where this right applies, it relates only to personal data held by us at the time your request is made and not to any personal data subsequently provided to, or obtained by, us.
- In certain circumstances, you have the right to ask us to restrict the processing of your personal data.
- In certain circumstances, you have the right to object to our processing of your personal data.
- In certain circumstances, you have the right to ask that we transfer the personal data we are processing to another organisation, or back to you.
You will not be required to pay any charge for exercising these rights. If you make a request to us to exercise your rights, we will respond to you within one month unless you are notified otherwise.
How long we may retain personal data
- In the case of a client, unless we have agreed otherwise in our engagement letter, hard copy files held in storage and electronic material will be destroyed after the expiry of six years following the completion of your matter, or later where it is deemed necessary. This will be confirmed in your case ending advice letter. Once your file has been destroyed, we will retain your personal details and a description of your matter indefinitely to fulfil our regulatory obligations for the purposes of carrying out conflict checks.
- In the case of a prospective client, your personal data and information relating to your enquiry will be destroyed after the expiry of six years following your last contact with the firm.
- In the case of an unsuccessful job applicant not invited to interview, your personal data will be destroyed after the expiry of one year following the closing data of the vacancy. The personal data belonging to an unsuccessful job applicant invited to interview may be retained for up to six years.
- In the case of a speculative job applicant, we may use your personal data to contact you to make you aware of any specific vacancy within six months of receipt, after which it will be destroyed.
- In the case of an employee, your personal data will be destroyed after the expiry of six years following your final day of employment.
Deletion of personal data
- Where your personal data is deleted by us either following a request made under your right of erasure, or in line with our personal data retention policy above, it may be held in a backup system indefinitely. Any personal data held in our backup system is beyond use and will not be accessed for the purpose of informing any decision that affects you in any way. It will not be transferred to any other organisation and the same safeguards as apply to all personal data will be adopted – see the section below on ‘How we protect your personal data’.
Who we may share your personal information with
- We may share your personal data within Hickman & Rose but also with third parties as necessary when providing services to you including, without limitation, disclosures to other third parties (for example, experts or counsel) involved in the work we are undertaking for you. We outsource some of our support services such as dictation and IT. We may also need to share your personal information to comply with our Regulatory obligations (for example, to our insurers or the SRA). If you are a client, more information about this is provided in our Terms of Business which is provided to you at the outset of your matter.
How we protect your personal data
- We have in place appropriate safeguards to protect your personal data while it is processed by us and being transferred to you or to third parties. These safeguards are aimed at preventing your personal data from being accessed by unauthorised parties, lost or deleted. We deliver cyber security training to all staff to ensure they are aware of common threats to the security of your personal data.
- It may be necessary to transfer your personal data outside of the UK where necessary to deliver our services to you. Where it is necessary for us to make such transfers, we will seek confirmation that appropriate safeguards are in place to ensure an adequate level of protection for your personal information.
- All cookies used by this website are used in accordance with current UK laws.
- Before the website places cookies on your computer, you will be presented with a pop-up requesting your consent to set those cookies. By giving your consent, you are enabling Hickman & Rose to provide a better experience and service to you. You may, if you wish, decline consent to the placing of non-essential cookies.
- You can choose to enable or disable cookies in your internet browser. By default, most internet browsers accept cookies but this can be changed. For further details, please consult the help menu in your internet browser.
- You can choose to delete cookies at any time; however, you may lose any information that enables you to access the website more quickly and efficiently including, but not limited to, personalisation settings.
- It is recommended that you ensure that your internet browser is up-to-date and that you consult the help and guidance provided by the developer of your internet browser if you are unsure about adjusting your privacy settings.
If you have any concerns about our use of your personal information, you can make a complaint to us by contacting us.
You can also complain to the ICO if you are unhappy with how we have handled your data. The ICO’s contact details are:
Telephone: 0303 123 1113
We may make changes to this privacy notice from time to time. The latest version will be available on our website.
Our use of Google Analytics
We use Google Analytics to monitor how our website is being used so we can make improvements. Our use of Google Analytics requires us to pass your IP address (but no other information) to Google – Google uses this information to prepare site usage reports for us, but Google may also share this information with other Google services. Google may use the data collected to contextualise and personalise the advertisements of its own advertising network. Related information: