Client, Third Party and Website Privacy Notice
1. Your Privacy at a Glance
1.1 Trowers & Hamlins LLP and its branch offices, subsidiaries and affiliates, including Trowers & Hamlins (Services) Limited (together, "Trowers & Hamlins", "we", "us" or "our") take the protection of your personal data seriously. This client, third party and website privacy notice ("Notice") explains how we collect, use, store and share personal data in connection with:
1.1.1 Our client engagement, the legal and professional services we provide;
1.1.2 Our engagement with suppliers, service providers and other business partners;
1.1.3 individuals attending events we host, individuals who sign up to our marketing and other updates
1.1.4 visitors to our premises; and
1.1.5 the use of our websites and related digital services.
1.2 We are committed to being transparent about how we use your personal data and to handling it responsibly and in accordance with applicable data protection laws.
1.3 The key things you need to know are:
1.3.1 Who we are: Trowers & Hamlins is the controller responsible for your personal data. You can find our contact details and those of our Data Privacy Team in Section 2.
1.3.2 What we collect: We collect information you provide may obtain personal information directly from you (such as when instructing us or registering for events), information we may also obtain information collect about you from third parties, and information collected automatically through your use of our website or from publicly available sources. See Section 3.
1.3.3 Why we collect it and the legal bases: We use your personal data to provide legal services, comply with our legal and regulatory obligations, market our services, and operate our business efficiently. See Section 4.
1.3.4 What happens if you do not provide it: Some information is essential for us to provide our services or to comply with our legal obligations. Where we are unable to proceed without it, we will make this clear. See Section 5.
1.3.5 Automated decisions and AI: We use automated processes in relation to some of our services, but we always ensure that such processes entail meaningful human involvement. We also may use AI and cloud technologies for limited purposes. See Section 6.
1.3.6 Who we share it with: We share your information personal data with colleagues involved in the relevant matter, and with carefully selected third parties such as counsel, experts, regulators and, technology and other service providers. See Section 7.
1.3.7 International transfers: As an international firm, we may transfer your data to jurisdictions outside your place of operation or where we obtained the data. Where we do, we ensure appropriate safeguards are in place. See Section 8.
1.3.8 How we protect it: We have implemented appropriate technical and organisational security measures in place to help protect your personal data. See Section 9.
1.3.9 How long we keep it: We retain your personal data only for as long as necessary. Our standard retention periods are set out in a table. See Section 10.
1.3.10 Your rights: You have a number of rights in relation to your personal data, including the right to access it, correct it or ask us to delete it. See Section 11.
1.3.11 How to raise a concern or complaint: If you have any questions or concerns about how we handle your data, please contact us at riskandcompliance@trowers.com. You may also have the right to complain directly to us as well as to the relevant data protection authority in your jurisdiction. See Section 12.
1.3.12 Status and changes to this Notice: We review this Notice regularly and will update it when necessary. See Section 13.
1.3.13 Specific Provisions for the Kingdom of Saudi Arabia: If you are located in the Kingdom of Saudi Arabia, please refer to the information in this section, as it will apply to how we process your personal data, in addition to the relevant sections of this Notice.
1.4 It is important that you read this Notice together with any other privacy notice or policy we may provide on specific occasions when we are collecting or processing personal data about you, so that you are fully aware of how and why we are using your data. This Notice supplements other privacy notices and policies and is not intended to override them.
1.5 This Notice is available in alternative formats on request. Please email riskandcompliance@trowers.com if you require this Notice in a different format or language.
If you have any questions about how we handle your personal data that are not addressed
2. Who we are
2.1 Trowers & Hamlins is made up of different legal entities. When we refer to "Trowers & Hamlins", "we", "us" or "our" in this Notice, we are referring to the relevant Trowers & Hamlins entity responsible for processing your personal data, this will generally be the entity that provides services to you or with which you have a relationship or the entity in communication with you.
2.2 Each Trowers & Hamlins entity responsible for processing your personal data as described in paragraph 2.1 above is e a "controller" in relation to your personal data for the purposes described in this Notice. This means that we are responsible for deciding how we hold and use your information.
Controller Details | |
|---|---|
Name | Trowers & Hamlins |
Locations | You can find our locations on our website: https://www.trowers.com/locations |
Data Protection Team | Data protection queries and complaints are handled by our General Counsel & Risk Team at: Trowers & Hamlins LLP, 3 Bunhill Row, London, EC1Y 8YZ, or emailing riskandcompliance@trowers.com |
3. What we collect
The categories of personal data we process depends on your relationship with us. To help you understand how your personal data is used, we have organised our processing activities into the following sub-sections:
3.1.1 Clients
3.1.2 Counterparties, Third Parties and Matter-Related Contacts
3.1.3 Suppliers and Service Providers
3.1.4 Event Attendees and Visitors to our Premises
3.1.5 Prospective Clients and Marketing Contacts
3.1.6 Website Users
You could fall into one or more of the categories, so please review the categories most relevant to you and how you interact with us or our services.
If you provide us with personal data about another individual, for example, a family member, employee, counterparty or other third party, please ensure that person is aware of how their data will be used as described in this Notice, and that you are entitled to share their information with us for that purpose.
3.2 Clients
3.2.1 Information you provide directly to us:
Some of the categories of information described below are provided directly to us by you or your representative. This includes when your organisation seeks legal advice from us, when you correspond with us by any means, including phone, email, in person or using video conferencing platforms and when you otherwise interact with our staff, partners or consultants in connection with a matter or proposed matter.
3.2.2 Information we obtain from third parties in connection with your matter:
We also obtain your information about you from third parties, For example:
where you are a subject of, or otherwise referenced in, legal advice that we have been asked to provide to a third party client;
from counterparties to a transaction, rival bidders, litigants in legal proceedings and their advisors;
from executors and beneficiaries, and other consultants and professionals engaged in connection with a matter;
from your employer or colleagues, where they correspond or interact with us on your behalf.
3.2.3 Information we obtain from publicly available sources:
We obtain information from publicly available sources, such as Companies House, HM Land Registry, HMCTS and the Electoral Register.
3.2.4 Information we obtain from compliance and screening providers:
We obtain information from sanctions screening providers, fraud prevention agencies, identity checking services and credit reference agencies. In order to obtain results from these providers, we will need to share identity and contact data with them. Where credit reference agencies are involved in these checks, the Credit Reference Agency Information Notice (CRAIN), published jointly by the three main UK credit reference agencies will also apply to the processing of your personal data by those agencies. You can access the CRAIN at: [https://www.transunion.co.uk/legal/privacy-centre/pc-credit-reference]; [Credit Reference Agency Information Notice (CRAIN)| Equifax UK], [Credit Reference Agency Information Notice (CRAIN) | Experian].
3.2.5 Categories of personal data
The personal data we collect in connection with the provision of legal services can include:
Identity data: your full name, title, gender, job title or description, personal and/or work address, marital status, date of birth, passport or other identification details, photographic identification data, biometric data used for identity verification, and images or recordings of you from our CCTV system or from events and meetings.
Contact data: your personal and/or work email address, mobile phone number, telephone number, fax number, billing address and delivery address.
Due diligence and compliance data: information collected for client onboarding, Know Your Customer (KYC) procedures, anti-money laundering checks, source of funds, sanctions screening and conflict of interest checks. This includes identity and address verification documents (such as government-issued identification, utility bills and bank statements), photographs, place of birth, nationality, jurisdiction of residence, professional background and business connections (including directorships, memberships, management roles and shareholdings), family member information and relationships, and criminal convictions or related compliance information obtained directly from you or through third-party databases and screening services.
Risk assessment data: this includes information used to assess client and matter risk profiles, beneficial ownership information, politically exposed persons (PEP) status, adverse media references and sanctions list matches obtained through automated and manual screening processes.
Financial data: your bank account and payment card details, and information required to undertake a credit or other financial check on you.
Transaction data: details of payments to or from you.
Matter data: information relating to the matter for which we are instructed, and details of services provided to or obtained from you.
Profile data: your preferences, interests, feedback and survey responses.
Physical access data: details of your visits to our premises, which may be collected via CCTV systems and building access records.
Sensitive personal data: the provision of our legal services may in certain circumstances require us to process sensitive personal data, such as information about your racial or ethnic origin, political opinions, religious beliefs, trade union activities, physical or mental health, sexual life and sexual orientation, genetic or biometric data, or details of criminal offences or related compliance matters. We will treat such information with additional care and appropriate security measures and will only process it where a lawful basis and an additional condition for processing applies, as set out in Section 4.3.
3.3 Counterparties, Third Parties and Matter-Related Contacts
This section applies to individuals who are not clients of the firm but whose personal data we process in connection with a matter on which we are instructed, including counterparties to transactions, opposing parties or litigants in legal proceedings, rival bidders, executors and beneficiaries, witnesses, and other third-party individuals referenced in or relevant to a matter.
3.3.1 How we collect your information
We do not typically collect information directly from individuals in this category. We will generally obtain your personal data from:
our client or their representative, in the course of receiving instructions and conducting the matter;
counterpart legal advisors and other professional advisors engaged in connection with the matter;
publicly available sources, including Companies House, HM Land Registry, HMCTS, the Electoral Register and court records;
sanctions screening providers, fraud prevention agencies and identity checking services, where required for compliance purposes.
3.3.2 Categories of personal data
The categories of personal data we collect about individuals in this group are generally more limited than those collected from clients, and will typically include identity data, contact data, matter data and sensitive data (where relevant), as described in Section 3.2.5, together with any information relevant to the specific matter in which you are involved.
3.4 Suppliers and Service Providers
This section applies to individuals who work for, or represent, organisations that provide products or services to Trowers & Hamlins, including technology providers, facilities management providers, professional advisors engaged by the firm (as opposed to by clients), and other contractors and business partners.
3.4.1 How we collect your information
We collect information about supplier contacts in the following ways:
directly from you or your colleagues when entering into, managing or renewing a supplier or service agreement with us;
from your organisation (for example, from your firm's website or marketing materials);
from publicly available sources (for example, Companies House), where we conduct due diligence on a supplier organisation;
from sanctions screening and fraud prevention providers, where required.
3.4.2 Categories of personal data
The personal data we collect about individuals in this category will generally include:
Identity data: your full name, title, job title and employer.
Contact data: your work email address, telephone number and business address.
Contract and services data: details of the products or services your organisation provides to us, correspondence in connection with the supply relationship, and records of any service issues, performance reviews or contractual variations.
Financial data: invoicing and payment information, including bank account details where payments are made to individuals (rather than to a corporate entity).
Due diligence data: where we are required to conduct supplier due diligence for compliance purposes, identity and address verification information and, where applicable, sanctions screening results.
3.5 Event Attendees and Visitors to Premises
This section applies to individuals who attend events hosted or co-hosted by Trowers & Hamlins (whether in person or virtually), and to individuals who visit our offices or other premises.
3.5.1 How we collect your information
We collect information about event attendees and visitors in the following ways:
directly from you when you register for or attend an event, complete a registration or sign-in form, or otherwise correspond with us in connection with your attendance;
from your employer or a colleague who registers you for an event on your behalf;
automatically, through CCTV and building access systems at our premises.
3.5.2 Categories of personal data
Identity data: your full name, title, employer and job title.
Contact data: your email address and telephone number, used for registration and event communications.
Profile data: your preferences, feedback and survey responses, and, where the event is catered, any dietary, allergen or accessibility requirements you provide to us. We use this information only to facilitate your attendance at the event and do not use it for any other purpose.
Physical access data: details of your visit to our premises, including entry and exit records. Where applicable, building access passes may be issued and the data collected recorded.
Images and recordings: if an event is recorded, or if our CCTV system captures your image whilst you are on our premises or at an event we host, we will collect images and/or recordings of you. Where an event is recorded, we will make this clear in advance. For more information about our use of CCTV, please contact us by emailing riskandcompliance@trowers.com.
Sensitive personal data: we may also collect limited sensitive data in relation to health or religious beliefs, where you choose to share this with us. We use this solely to facilitate your attendance or visit.
3.6 Prospective Clients and Marketing Contacts
This section applies to individuals who have not yet formally instructed the firm, but who have expressed an interest in our services, signed up to receive our publications, legal updates or event invitations, or otherwise made contact with us for a purpose that has not yet given rise to a matter.
3.6.1 How we collect your information
We collect information about prospective clients and marketing contacts in the following ways:
directly from you when you complete a subscription or registration form on our website or at an event;
from your employer or a colleague who provides your details in connection with a business introduction;
from publicly available sources, where you are identified as a potential contact for business development purposes.
3.6.2 Categories of personal data
Identity data: your full name, title, employer and job title.
Contact data: your email address, telephone number and business address.
Profile data: your areas of interest, subscription preferences, and any feedback or survey responses you provide to us.
Once you instruct us on a matter, your personal data will be handled in accordance with Section 3.2 (Clients) from that point onwards.
3.7 Website Users
This section applies to all individuals who visit or interact with our website at trowers.com and any related digital services.
3.7.1 How we collect your information
When you visit our website, we automatically collect certain technical and usage data about your device and your interactions with the site. We collect this data using cookies, server logs and other similar tracking technologies. For further information about the cookies we use, how to manage them and your choices, please refer to our Cookie Policy.
If you submit a form on our website, for example, a contact, enquiry, event registration or subscription form, the personal data you provide will be handled in accordance with Section 3.6 of this Notice
3.7.2 Categories of personal data
Technical data: your IP address, browser type and version, operating system, device type, time zone setting, browser plug-in types and versions, and the device you use when logging into our guest Wi-Fi service.
Usage data: information about how you use our website, including the pages you visit, the links you click, the time you spend on each page, the times you enter and leave the site, referring URLs, and other browsing patterns.
Cookie and tracking data: data collected through first and third-party cookies and similar technologies, including session data and analytics identifiers. Where non-essential cookies require your consent, we will ask for your permission before setting them. Please refer to our Cookie Policy for full details.
3.8 Aggregated Data
We collect, use and share aggregated or anonymised data for purposes such as improving our services, internal analytics, and business planning. Aggregated data does not constitute personal data in law as it does not directly or indirectly reveal your identity. However, if we combine or connect aggregated data with your personal data so that it can identify you, we will treat the combined data as personal data and use it in accordance with this Notice.
3.9 Children
We do not knowingly collect personal data relating to children unless this arises incidentally in the course of providing our services, for example where it is relevant to the atter on which we are advising or where a child is otherwise connected to a transaction or dispute. Where this arises, we will handle such data with care, collect only what is strictly necessary, and where practicable take appropriate steps to ensure that the child or their parent or guardian is made aware of how that data is being used.
4. Why we collect it and the legal bases
4.1 We will only use your personal data fairly and where we have a lawful reason to do so. The most common lawful bases that apply are:
4.1.1 Contract: to perform our obligations under a contract with you or our client, or to take steps at your request before entering into a contract. For example, to provide the legal services set out in our engagement letter or to administer your account with us.
4.1.2 Legal obligation: to comply with a legal duty. For example, to conduct anti-money laundering and Know Your Client checks, to carry out sanctions screening, and to comply with other regulatory and professional obligations that apply to our services business.
4.1.3 Legitimate interests: where it is in our legitimate business interests (or those of a third party) to do so, provided those interests are not overridden by your rights and freedoms. For example, to manage our business operations, to market our services to existing clients and contacts, to defend legal claims, to improve our website, and to ensure the confidentiality and security of our systems and information.
4.1.4 Vital interests: in rare circumstances, where it is necessary to protect someone's life.
4.1.5 Consent: where we have asked for and received your permission. For example, before sending certain marketing communications, before setting non-essential cookies, or before processing biometric data used for identity verification purposes.
4.2 We do not generally rely on consent as a legal basis for processing personal data in connection with the provision of legal services. Where we do rely on consent, you have the right to withdraw it at any time by contacting us at riskandcompliance@trowers.com.
4.3 Where we process special categories of personal data or criminal offence data, we need an additional justification in addition to the lawful basis in section 4.1 above. We may rely on the following:
4.3.1 Explicit consent: where we have asked for and received your explicit permission. You may withdraw your consent at any time by emailing riskandcompliance@trowers.com.
4.3.2 Legal claims: where processing is necessary for the establishment, exercise or defence of legal claims.
4.3.3 Vital interests: where processing is necessary to protect the vital interests of an individual who is physically or legally incapable of providing consent.
4.3.4 Substantial public interest: where processing is necessary for reasons of substantial public interest which are proportionate to the aim pursued.
4.4 The table below sets out in more detail the specific purposes for which we process your personal data, the categories of data involved, and the legal bases we rely on. If you have any questions about why we use your personal data or the legal bases we rely on, please contact us by emailing riskandcompliance@trowers.com.
Purpose | Applies to | Categories of personal data | Lawful basis | Additional condition (special/criminal data only) |
|---|---|---|---|---|
Client onboarding and matter set-up, including opening a file, undertaking conflict checks and issuing engagement letters | Clients | Identity data; contact data | Contract; Legal obligation | — |
Anti-money laundering (AML), Know Your Client (KYC) and identity verification checks | Clients; Counterparties and third parties (where required) | Identity data; contact data; due diligence and compliance data; risk assessment data; criminal offence data (where applicable); biometric data (where used for identity verification) | Legal obligation (applicable Anti-Money Laundering legislation) | Explicit consent for biometric data used for AML/KYC purposes; |
Sanctions and embargo screening | Clients; Counterparties and third parties; Suppliers and service providers | Identity data; contact data; due diligence and compliance data; risk assessment data | Legal obligation | Substantial public interest in preventing or detecting unlawful acts (where criminal offence data arises). |
Credit checks, source of funds, identity verification, and fraud prevention | Clients; Suppliers and service providers | Identity data; contact data; financial data; due diligence and compliance data | Legal obligation; Legitimate interest in protecting the firm and its clients from financial risk and fraud | Substantial public interest in preventing fraud and in preventing or detecting unlawful acts (where criminal offence data arises). |
Providing legal advice and services in connection with client matters | Clients; Counterparties and third parties | All categories of data relevant to the matter | Contract (in respect of clients); Legitimate interest in providing high-quality legal services and acting for our clients effectively (in respect of counterparties and third parties, who have no direct contractual relationship with us) | Legal claims (where special category or criminal offence data is relevant to the matter) |
Billing, invoicing and payment processing | Clients; Suppliers and service providers | Identity data; contact data; financial data; transaction data | Contract; Legal obligation | — |
Maintaining client files and matter management records | Clients; Counterparties and third parties | Identity data; contact data; matter data; due diligence and compliance data | Contract; Legal obligation; Legitimate interest in maintaining accurate and complete records of our work | Special category or criminal offence data contained in the file may be processed in relation to legal claims. |
Managing supplier and service provider relationships, including entering into, renewing and administering supplier agreements | Suppliers and service providers | Identity data; contact data; contract and services data; financial data | Contract; Legitimate interest in managing our supplier relationships effectively | — |
Supplier due diligence | Suppliers and service providers | Identity data; contact data; due diligence data | Legal obligation; Legitimate interest in ensuring our supply chain meets appropriate standards | Where criminal offence data arises, it may be processed for substantial public interest in preventing or detecting unlawful acts. |
Supporting internal business development activities, including proposal management, experience capture and credentials management | Clients; Prospective clients and marketing contacts; Counterparties and business contacts | Identity data; contact data; matter data; profile data | Legitimate interests in improving our business development processes and maintaining accurate credentials and experience records |
|
Marketing our services to corporate clients, contacts and prospective clients, including newsletters, legal updates and event invitations | Existing and prospective corporate clients; Counterparties and business contacts | Identity data; contact data; profile data | Legitimate interest in promoting our services to businesses and organisations. | — |
Marketing our services to individual contacts and prospective clients (sole traders and small partnerships) | Individual contacts, sole traders and small partnerships | Identity data; contact data; profile data | Consent or soft opt-in | — |
Managing marketing preferences and opt-outs | All data subjects | Identity data; contact data; profile data | Legal obligation; Legitimate interest in respecting your preferences and complying with direct marketing rules | — |
Hosting and managing events, training sessions and networking events | Event attendees and visitors; Clients; Prospective clients and marketing contacts | Identity data; contact data; profile data (including dietary and accessibility requirements); images and recordings | Legitimate interest in hosting and promoting events for legal and business development purposes | Explicit consent where dietary or accessibility information reveals health or other special category data. |
Recording meetings, calls and events for training, know-how and matter record purposes | Clients; Event attendees and visitors | Identity data; images and recordings | Legitimate interest in maintaining accurate records of advice provided and for training and know-how purposes | — |
Operating and managing physical access to our premises, including CCTV | Event attendees and visitors; Clients; All visitors | Identity data; physical access data; images and recordings | Legitimate interest in protecting the security of our offices, staff and visitors | — |
Operating, maintaining and improving our website and digital services | Website users | Technical data; usage data | Legitimate interest in improving the user experience and functionality of our digital services | — |
Website analytics and tracking (including through cookies) | Website users | Technical data; usage data; cookie and tracking data | Legitimate interest; Consent (where required for non-essential cookies under applicable cookie law) | — |
Responding to regulatory enquiries, investigations and audits | Clients; Counterparties and third parties; Suppliers and service providers | Any personal data relevant to the enquiry | Legal obligation; Legitimate interest | Where special category or criminal offence data arises, this may be disclosed in relation to legal claims or for substantial public interest in preventing or detecting unlawful acts. |
Complying with professional, legal and regulatory obligations (including SRA obligations) | All data subjects | Any personal data required to comply with the applicable obligation | Legal obligation | Where special category or criminal offence data is involved, this may be processed for substantial public interest in meeting regulatory requirements relating to unlawful acts and dishonesty. |
Managing and responding to complaints and disputes | All data subjects | Identity data; contact data; any other relevant data | Legitimate interest in managing complaints and resolving disputes fairly and efficiently; Legal obligation | Legal claims |
Ensuring information security and preventing unauthorised access to our systems | All data subjects | Technical data; identity data | Legal obligation; Legitimate interest in protecting firm and client data and ensuring system integrity | — |
Statistical analysis and business management | All data subjects (in aggregated or anonymised form) | Aggregated and anonymised data; matter data | Legitimate interest in effectively managing our business and improving our services | — |
Establishing, exercising or defending legal claims | All data subjects | Any personal data relevant to the claim or proceedings; any special category or criminal offence data relevant to the claim | Legitimate interest in retaining data necessary to establish, exercise or defend legal claims; Legal obligation | Legal claims |
4.5 Change of purpose: We will only use your personal data for the purposes for which we collected it. If we need to use your personal data for a purpose that is not related to the original purpose, we will notify you and explain the legal basis which allows us to do so. We may process your personal data without your knowledge or consent where this is required or permitted by law.
5. What happens if you do not provide it:
5.1 Where we need to collect personal data by law, or under the terms of our engagement with you, and you fail to provide that data when requested, we may not be able to perform the services described in our engagement letter or to continue our business relationship with you.
5.2 For example, we are required by law to collect and verify identity information for the purposes of anti-money laundering and Know Your Client checks. If you are unable or unwilling to provide this information, we may not be able to act for you.
5.3 Where we are entering into or managing a supplier relationship with you, certain information, including contact details and payment information must be provided in order for us to administer the relationship and make payments to you. If you do not provide such information, we may not be able to enter into or continue the supply arrangement.
5.4 Where specific information is required, we will make this clear at the time of collection and explain the consequences of not providing it.
6. Automated decision-making and Artificial Intelligence
6.1 We use AI and automated technologies to support our work, for example, in legal research, document review, compliance screening and drafting. We do not use them to make decisions that have a legal or similarly significant effect on you; all such decisions are made by qualified members of our team.
6.2 Where AI tools process your personal data, we ensure the following:
6.2.1 we carry out appropriate due diligence on technology suppliers before use;
6.2.2 suppliers are not permitted to use your personal data to train their AI models;
6.2.3 any AI-generated output is reviewed by an appropriately experienced team member before it is relied upon; and
6.2.4 where AI is used for compliance purposes, such as sanctions or AML screening, results are validated by a qualified member of staff before any action is taken.
6.3 If you have any questions about how we use AI-assisted tools, please contact us by emailing riskandcompliance@trowers.com.
7. Who We share Personal Data With
7.1 Internal disclosures
Your personal data will be accessed by members of our team who require access in order to carry out their role or to work on your matter. Access is granted on a strictly need-to-know basis, and all internal personnel handle your personal data in accordance with our data protection policies.
7.2 External disclosures
7.3 We will only disclose your personal data to third parties outside Trowers & Hamlins where it is lawful and consistent with this Notice to do so. The third parties with whom we share personal data, and the groups of data subjects whose data is typically involved, are set out below.
Recipient | Applies to | Reason |
|---|---|---|
Lawyers in any of our international offices | Clients; Counterparties and third parties | Where we require advice or input from that office in connection with your matter |
Professional advisers we instruct (barristers, medical professionals, enquiry agents, accountants, tax advisers and other experts) | Clients; Counterparties and third parties | Where necessary to carry out the services we are providing |
Other third parties necessary to carry out our instructions (Companies House, HM Land Registry, HMCTS, other consultants or professional advisers) | Clients; Counterparties and third parties | To progress and complete legal matters on which we are instructed |
Our clients or those to whom we owe a professional duty | Counterparties and third parties | Where disclosure is necessary in connection with the matter on which we are instructed |
Our insurers and brokers | All data subjects | In connection with our professional indemnity and other insurance arrangements |
External auditors (ISO, Lexcel, accounts) | Clients; Suppliers and service providers | In relation to our professional accreditations and the audit of our accounts |
Regulatory bodies, law enforcement agencies and government authorities | All data subjects | Where we are required or permitted to do so by law |
IT hosting providers, system operators, cloud service providers and other technology partners | All data subjects | To support the operation of our systems and the delivery of our services. All such processors are subject to appropriate written contractual safeguards |
Credit reference agencies and business information services | Clients; Suppliers and service providers | To conduct credit reference, identity verification and fraud prevention checks. The CRAIN published jointly by the three main UK credit reference agencies explains how they collect and use personal data: [Transunion — https://www.transunion.co.uk/legal/privacy-centre/pc-credit-reference ]; [Equifax — Credit Reference Agency Information Notice (CRAIN) | Equifax UK]; [Experian — Credit Reference Agency Information Notice (CRAIN) | Experian] |
Sanctions screening, fraud prevention and identity checking service providers. [This includes app-based digital identity verification platforms through which individuals are asked to verify their identity using their device. Such platforms may use AI-assisted facial recognition, liveness detection and automated screening against sanctions and PEPs registers.] | Clients; Counterparties and third parties; Suppliers and service providers | To comply with our AML, KYC and sanctions obligations |
Third parties hosting or co-hosting events with us | Event attendees and visitors; Prospective clients and marketing contacts | To manage and administer events to which you are invited |
Individuals contributing feedback to our legal ranking services | Clients | In connection with independent legal directory submissions |
Our bank | Clients; Suppliers and service providers | On occasions where required for financial transactions |
Prospective or actual buyers or sellers of a business or asset | All data subjects | Where we are involved in a merger, acquisition, restructuring or sale of all or part of our business, personal data may be disclosed to the relevant parties as part of that transaction. |
7.4 We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our documented instructions.
8. International Transfers of Personal Data
8.1 As an international law firm, we may transfer your personal data to recipients located outside the United Kingdom, including our overseas offices and third-party processors. Our offices outside the UK are located in Abu Dhabi, Bahrain, Dubai, Malaysia, Oman, Saudi Arabia, Singapore and the United Arab Emirates.
8.2 Where we do so, we ensure that appropriate safeguards are in place, either because the destination country has been assessed as providing an adequate level of data protection, or because we have put in place appropriate data transfer agreements approved for use in the UK (such as International Data Transfer Agreements (IDTAs)). You may request details of the transfer mechanism applicable to any specific transfer by contacting us by emailing riskandcompliance@trowers.com.
9. How We Protect Your Personal Data
9.1 We have put in place appropriate technical, organisational and contractual measures to prevent your personal data from accidental loss, unauthorised access, alteration or disclosure. These measures include encryption, access controls, regular security assessments, and staff training on data protection. Any access by our employees and partners to personal data is done only in an authorised manner and subject to confidentiality obligations.
9.2 We have procedures in place to respond to any actual or suspected personal data breach. Where we are legally required to do so, we will notify you and the relevant supervisory authority.
9.3 This firm is accredited with Cyber Essentials Plus and ISO 27001 and is Lexcel accredited.
10. How Long We Keep Personal Data:
10.1 We retain your personal data for as long as necessary to achieve the purposes set out in this Notice. Our standard retention periods are set out in the table below. Where personal data is relevant to an actual or reasonably anticipated legal claim, we may retain it for longer than the periods set out below, for as long as is necessary for the purposes of establishing, exercising or defending that claim.
Data Category | Applies to | Retention Period | Reason |
|---|---|---|---|
Client files and matter records | Clients; Counterparties and third parties | 6–16 years from file closure (period varies depending on the nature and complexity of the matter) | Statutory limitation periods; regulatory requirements; professional indemnity obligations |
AML and KYC records | Clients; Counterparties and third parties | 5 years from the end of the business relationship or one-off transaction | Anti-Money Laundering Regulations |
Sanctions screening records | Clients; Counterparties and third parties; Suppliers and service providers | 5 years from the date of the check | Regulatory requirement |
Billing, invoicing and financial records | Clients; Suppliers and service providers | 6 years | HMRC statutory requirement |
Supplier agreements and correspondence | Suppliers and service providers | Duration of the relationship + 6 years | Statutory limitation period for contractual claims |
Marketing contact data (consent-based) | Prospective clients and marketing contacts | Until withdrawal of consent, then deleted promptly | Consent-based retention |
Marketing contact data (legitimate interests) | Clients; Counterparties and third parties (existing contacts) | Until opt-out, then deleted promptly | Right to object to direct marketing |
Event attendance records | Event attendees and visitors | 12 months following the event | Event administration and follow-up communications |
CCTV recordings | Event attendees and visitors; All visitors to premises | 30 days (unless retained for a specific reason such as an incident investigation) | Security purposes; proportionality |
Correspondence and general enquiries | All data subjects | 6 years from the date of correspondence | Limitation period |
Website analytics and cookie data | Website users | As set out in our Cookie Policy (typically up to 25 months) | Website analytics and improvement |
10.2 Personal data will be securely deleted or anonymised at the end of the applicable retention period, in accordance with applicable laws.
11. Your Rights
Under certain circumstances, you may have the following rights in relation to your personal data:
11.1 Right of access. You have a right to receive a copy of the personal data we hold about you and information about how it is used. We may ask you to verify your identity before fulfilling the request. This right is not absolute and may not apply where we are legally or professionally prevented from disclosing information or where a statutory exemption applies.
11.2 Right to rectification. This enables you to have any incomplete or inaccurate information we hold about you corrected.
11.3 Right to erasure. You may ask us to delete your personal data where there is no good reason for us to continue processing it, where you have successfully objected to processing, or where we are required to erase it by law. This right is not absolute and may not apply to the extent we need to retain your information in compliance with our legal or regulatory obligations or in connection with legal proceedings.
11.4 Right to object. You may object to processing based on our legitimate interests. You also have the right to object where we are processing your personal data for direct marketing purposes. To opt out of direct marketing communications, you can follow the unsubscribe link in any marketing email we send you, or contact us directly at riskandcompliance@trowers.com. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.
11.5 Right to restrict processing. You can ask us to suspend the processing of your personal data, for example if you want us to establish its accuracy or the reason for processing it.
11.6 Right to data portability. Where the processing is based on consent or contractual necessity, and carried out by automated means, you can request the transfer of your personal data to another party. This right only applies to personal data that you have provided directly to us.
11.7 Right not to be subject to solely automated decision-making. As set out in Section 6, we do not make decisions through solely automated means that produce significant effects. If you have any concerns about how automated processing has been applied to your personal data or believe that an automated screening result relating to you is incorrect, you may contact us at riskandcompliance@trowers.com to request that it is reviewed by a member of our team.
11.8 Right to withdraw consent. Where we have requested your consent in relation to any processing of your personal data, you can withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing before withdrawal. Please note that if you withdraw your consent, we may not be able to provide certain services to you; we will advise you if this is the case.
11.9 Right to request information about the specific transfer mechanism applicable to any international transfer of your personal data.
11.10 Right to complain. As further described in Section 12.
If you would like to exercise any of these rights, please contact us using the contact details set out in Section 12.2 below.
12. How to raise a concern or complaint
12.1 If you wish to raise a complaint about how we have handled your personal data, we encourage you to contact us in the first instance so we can try to resolve the matter. You also have a right to complain to the supervisory authority, as outlined in Section 12.3 below.
12.2 Complaints to us
To raise a complaint with us, you can:
12.2.1 Use the Trowers & Hamlins Data Protection Complaints Form;
12.2.2 Write to our General Counsel & Risk Team at: Trowers & Hamlins LLP, 3 Bunhill Row, London, EC1Y 8YZ; or
12.2.3 Email RiskAndCompliance@trowers.com.
We will acknowledge your complaint within five working days and provide a substantive response within the timelines set out by applicable laws.
12.3 Complaints to the Supervisory Authority
If you are not satisfied with our response or believe we are not processing your personal data in accordance with applicable law, you may raise your concerns with the relevant supervisory authority at any time. The relevant authority in the UK is the UK Information Commissioner. Further details can be found at www.ico.org.uk or by contacting the ICO on 0303 123 1113.
13. Status and changes to this notice:
13.1 This Notice does not form part of any contract and does not create contractual rights or obligations. We may amend this Notice at any time.
13.2 We review this Notice regularly and will update it as necessary to reflect changes in our processing activities or applicable law. The date at the top of this document indicates when it was last updated.
13.3 Where we make material changes, we will take reasonable steps to inform affected individuals. This may be by posting an updated Notice to our website or by email, where appropriate.
14. Specific provisions — Kingdom of Saudi Arabia
14.1 In addition to the provisions outlined above, the following provisions apply in respect of our processing of personal data within the Kingdom of Saudi Arabia (KSA) or of residents in, or those who have a connection to, KSA, in accordance with Article 2 of the PDPL.
14.2 These additional provisions are made in accordance with the KSA Personal Data Protection Law implemented by Royal Decree No. M/19 of 09/02/1443H (16 September 2021) and amended by Royal Decree No. M/147 of 05/09/1444H (27 March 2023) (PDPL), the Implementing Regulations of the PDPL (Implementing Regulations), along with the amendments to the Data Transfer Regulations issued on September 1, 2024 (Data Transfer Regulations).
14.3 To the extent that any of the personal data that we collect includes sensitive data (as defined in the PDPL) — which is personal data revealing racial or ethnic origin, or religious, intellectual or political belief, data relating to security criminal convictions and offences, biometric or genetic data for the purpose of identifying the person, health data, and data that indicates that one or both of the individual's parents are unknown, we will obtain your explicit consent before processing such sensitive data in accordance with PDPL requirements, unless another legal basis under the PDPL applies.
14.4 In addition to the parties set out in paragraph 7 of this Notice, we may share your personal data with Competent Authorities in the KSA, including the Saudi Data and Artificial Intelligence Authority (SDAIA).
14.5 We have appointed a specific Data Protection Officer (DPO) in KSA who can be contacted at NAlissa@trowers.com.
14.6 If you have any questions or concerns about your data, including requests to exercise your rights, or if you are not satisfied with our use of your data, you may contact our Data Protection team at dataprotection@trowers.com or our KSA DPO at NAlissa@trowers.com.
14.7 If you wish to submit a Data Subject Access Request, please refer to our Request Form which can be found here.
14.8 If you have made a complaint to us and you are not satisfied with how we have handled it, or if we fail to respond to you within 60 calendar days (occasionally it could take us longer if your request is particularly complex or you have made a number of requests, in which case we will notify you and keep you updated), you have the right to raise complaints directly with the SDAIA via the National Data Governance Platform (NDGP — dgp.sdaia.gov.sa). We encourage you to raise your concerns with our KSA DPO in the first instance. Additionally, you may have the right to compensation for material or moral damage if you are harmed as a result of any violation by us stipulated in the PDPL and its Implementing Regulations.