Sarah Brown Charity Law – Privacy Policy
Who we are
Sarah Brown Charity Law is a trading name of Sarah Brown Charity Law Limited, Company number: SC820926, Registered Office: 17 Torwoodlee, Perth, Scotland PH1 1SY. Sarah Brown Charity Law WS is law firm practising in Scotland and regulated by The Law Society of Scotland.
Our website address is: https://sarahbrowncharitylaw.com.
Sarah Brown Charity Law provides legal services to individual clients and clients which are organisations, including those instructing us on behalf of public, private and third sector bodies.
In order to do this, we collect and use personal data about our clients, potential clients and other individuals when this is necessary to provide our legal services.
In relation to the provision of legal services, much of the personal data that we process is subject to an obligation we have to our clients to maintain their confidentiality and/or legal privilege. This means that sometimes we do not require to tell other individuals that we are processing their data or provide them with a copy of it.
This obligation of confidentiality does not apply to all of the personal data that we collect and use and so this notice provides information about how we process the personal data which is not subject to an obligation of confidentiality and/or legal privilege.
Types of personal information we have
Because of the nature of the services we provide, the types of data we process can be quite varied, but will usually include full name, contact details and information about you as a client.
We will ask our individual clients and those representing our organisation clients for copies of information identification documentation and other information in order to comply with our obligations under anti-money laundering laws. We may also require to carry out the same identity and anti-money laundering checks on others, for example, anyone providing funds to clients.
Depending on the nature of our relationship with you, we will process information about your:
- financial affairs;
- family, lifestyle and social circumstances;
- education and employment background.
In some circumstances, again depending on the nature of relationship with our client, we will process special categories of personal data, in which case we take particular care to process such data in accordance with the stricter legal requirements set out in Data Protection legislation, particularly in relation to security and confidentiality.
Special category data includes:
- information revealing your racial or ethnic origin;
- revealing your political opinions;
- information revealing your religious or philosophical beliefs;
- information revealing your trade union membership;
- genetic or biometric data for the purpose of uniquely identifying natural persons;
- information concerning your health; and
- information concerning your sex life or sexual orientation.
If we process information about criminal offences and convictions, the same considerations will be taken into account. Further information about how we do this is set out below.
Methods of data collection
We use different methods to collect data about you, including:
· Direct interactions. You may give us, for example, your identity, contact details and other data by filling in forms or by corresponding with us by post, phone, online, via email or otherwise. This includes personal data you provide, for example, when you contact us via our website.
· Automated technologies or interactions. As you interact with our website, we will automatically collect technical data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive technical data about you if you visit other websites employing our cookies.
· Third parties or publicly available sources. We may receive personal data about you from various third parties and public sources, such as technical data from analytics providers (such as Google) and search information providers, or identity and contact data from publicly available sources such as Companies House and the Electoral Register based inside the UK.
Data collection when using our website
Most data we collect are used only to help us better serve visitors to our website. Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). We may collect, use, store and transfer different kinds of personal data about you as follows:
· Identity Data. This includes your name and organisation.
· Contact Data. This includes your email address.
· Technical Data. This includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
· Usage Data. This includes information about how you use our website, products and services.
· Marketing and Communications Data. This includes your preferences in receiving marketing from us and our third parties, and your communication preferences.
Our lawful basis for processing
In relation to our individual clients, we have a contract to provide them with legal services and process their data as it is necessary to do, to provide them with our legal services.
In relation to our clients who are organisations, our contract is not with an individual, but we have a legitimate business interest in processing personal data as necessary to provide our legal services.
We have a legal obligation to process identification documentation and other information from our clients and to carry out checks to comply with anti-money laundering legislation.
We process the data of third parties because we have a legitimate business interest to do so, and it is necessary for us to do so, in order to provide our legal services.
Where we process any special category personal data or criminal offence data, we can rely one of the legal bases set out above, and because the processing is necessary for the establishment, exercise or defence of legal claims.
Sometimes to carry out Anti-Money Laundering checks when we have not met an individual face to face, we will use facial recognition technology which involves biometric data. We will only use this when it is necessary and will ensure that it is deleted as soon as it no longer required by us. This a regulatory requirement which we consider is necessary to comply with a substantial public interest.
What we do with the information and who we share it with
The data that we collect and use is to assist us in providing legal services to our clients, to comply with the legislation that regulates our profession and to keep our clients informed about our services.
In order to do this, we share this information with third parties on a regular basis. Often when we share personal data clients and other third parties will be aware of this but occasionally personal data will be shared confidentially.
- The Scottish Charity Regulator (OSCR)
- Financial Conduct Authority (FCA)
- The Registrar of Companies
- Revenue Scotland
- HMRC
- Solicitor for the other party
- Solicitor providing other services
- Advocates
- Accountants
- Legal searching agents
If you are a client, you will usually know when we share your data and who we share it with.
Marketing communications
From time to time we send updates about our services and events we are hosting, and legal updates by email. If you do not want to receive these messages, please contact us. You can also click on the unsubscribe link in any emails we send.
We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.
We may use your identity, contact information, technical, usage and profile data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you.
We will get your express opt-in consent before we share your personal data with any third party for marketing purposes.
You can ask us or third parties to stop sending you marketing messages at any time by contacting us at any time.
Where you opt out of receiving marketing messages, this will not apply to personal data provided to us as a result of other interactions with us for other legitimate purposes.
The personal data we process will also be shared with third parties who assist us to provide our services but who do not use this data for their own purposes. There is more information on this below.
For example, for all individual clients and individuals representing related to organisations:
- we use a third party to assist us to verify our clients’ identity and to ensure that there are no money laundering concerns that we need to be aware of.
- we have a written contract with this organisation who will only do what we instruct them to do with the data provided to them; they will keep the data secure and will only gather personal data and use it on our instructions to carry out these checks.
How we store your information
Your information is securely stored on our IT systems which are hosted on a secure cloud server. We also use third party software to help us manage the information we use to provide our legal services.
We have contracts with these providers to ensure that the data is secure and that it will not be used by them for their own purposes.
If the data is stored outwith the EEA, we will ensure that there is adequate protection in place to ensure the same data protection standards are maintained1.
We have procedures to deal with any suspected data security breach and will notify you and the ICO of a suspected breach where data protection legislation requires us to do so.
We keep personal data for as long as it is necessary for our requirements, including the regulatory requirements placed upon all law firms. After this time we will delete the data securely or anonymise it.
If you wish further information about our retention policy then please contact us
External websites
This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We have no control over and are not responsible for the privacy policies of any websites other than our own.
Cookies
Our website may use cookies to enhance your online experience. Use of cookies makes web surfing easier by performing certain functions, such as saving your personal preferences and completing your basic site login to access content.
In addition, small anonymous cookies are installed in your web browser. These are in place to allow our database modules to operate correctly.
If you would prefer not to receive cookies, you can alter the configuration of your browser to refuse cookies. If you choose to refuse cookies, it is possible that some areas of our website will not function fully or may be slower than you are used to.
We do not share cookies with any third parties and do not use them to participate in any external linking or tracking.
Your data protection rights
Under data protection law, you have rights including:
- Right of access – You have the right to ask us for a copy of your personal information. Unless you are a client, we will have to consider whether the personal data about you is subject to a duty of confidentiality we owe to our client or whether other exemptions may apply. You also have the right to information about how we use your data. This notice should answer most of your questions but you should contact us if you have further queries.
- Right to rectification – You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
- Right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
- Right to restriction of processing – You have the right to ask us to restrict the processing of your information in certain circumstances.
- Right to object to processing – You have the right to object to the processing of your personal data in certain circumstances. You have an absolute right to ask us to stop sending you marketing material and updates about our services.
There is no charge for exercising these rights unless the request is manifestly unfounded or excessive. If it is, we will charge a reasonable fee or refuse to deal with the request.
Once a request is made, it will be acknowledged and we may ask for confirmation of identification from the requester and seek clarification of this request.
We will do our best to respond without undue delay and within one month of receiving a request. However, if the request is complex we can extend that by another two months. If we do need more time, we will provide information as to why.
Please make any request by e-mail to info@sarahbrowncharitylaw.com
Consequences of failing to provide data
If you are a client and you do not provide us with the information we require to provide you with legal services, or if you ask us to cease processing your data or to erase your data, then we may not be able to provide you with the all of the legal services that you have asked for.
How to complain
If you have any concerns about the way that we collect and use your data then please contact us and we will do our best to address these concerns.
However, you can also complain to the ICO if you are unhappy with how we have used your data and their contact details can be found here
Changes to this privacy policy
We keep our privacy notice under review and will require to make changes from time to time. We will highlight any substantial updates on our website.
This privacy policy was last updated on 18th January 2025.