Privacy Policy
Privacy Policy
We take your privacy very seriously. Please read this Privacy Policy carefully as it contains important information on who we are and how and why we collect, store, use and share your personal data. It also explains your rights in relation to your personal data and how to contact us or the Information Commissioner’s Office (ICO) if you have a complaint.
This Privacy Policy does not apply to any third-party websites that may have links to our website.
Clients of this firm should read this Privacy Policy alongside our General Terms and Conditions, which provide further information regarding confidentiality.
When we use your personal data, we are regulated under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Hand Morgan & Owen Solicitors is responsible as the data controller for the personal data we process. Our use of your personal data is subject to your instructions, the UK GDPR, the Data Protection Act 2018, other relevant UK legislation and our professional duty of confidentiality.
Key Terms
The following terms are used throughout this Privacy Policy.
Hand Morgan & Owen Solicitors (“we”, “us”, “our”)
The organisation responsible for processing your personal data.
Data Protection Officer
Victoria Follows, Hand Morgan & Owen Solicitors, 17 Martin Street, Stafford ST16 2LF.
Personal Data
Any information relating to an identified or identifiable individual.
Special Category Personal Data
Special category personal data includes personal data revealing:
- racial or ethnic origin;
- political opinions;
- religious or philosophical beliefs;
- trade union membership;
- genetic data;
- biometric data;
- data concerning health;
- data concerning an individual’s sex life or sexual orientation.
Data Subject
The individual to whom the personal data relates.
Personal Data We Collect About You
The personal data we collect will depend upon the nature of the legal services we provide to you.
Personal data we will collect
We will usually collect:
- your name, address and telephone number;
- information to enable us to check and verify your identity (for example, your date of birth or passport details);
- electronic contact details, including your email address and mobile telephone number;
- information relating to the matter in which you are seeking our advice or representation;
- information to enable us to undertake credit or other financial checks where appropriate;
- your financial details where relevant to your instructions (for example, the source of your funds in a property transaction);
- information about your use of our IT, communication and other systems, together with other monitoring information, including CCTV images, audio recordings and access control information where applicable.
Personal data we may collect depending on why you have instructed us
Depending upon the nature of your matter, we may also collect:
- your National Insurance and tax details;
- your bank and/or building society details;
- details of your professional online presence (for example, your LinkedIn profile);
- details of your spouse, partner, dependants or other family members (for example, where you instruct us in relation to a family matter or a Will);
- your employment status and employment details, including salary and benefits;
- your nationality and immigration status together with information contained in supporting documents such as your passport or other identification documents;
- details of your pension arrangements;
- your employment records, including (where relevant) sickness records, attendance records, performance information, disciplinary records, conduct records and grievance records;
- your racial or ethnic origin, gender and sexual orientation, religious or similar beliefs where relevant to your matter;
- your trade union membership where relevant to your matter;
- personal identifying information, such as eye colour or parents’ names, where relevant;
- your medical records where relevant to your instructions (for example, in a personal injury claim).
This personal data is required to enable us to provide our services to you. If you do not provide the personal data we ask for, it may delay or prevent us from providing legal services.
How Your Personal Data Is Collected
We collect most of this information directly from you.
However, we may also collect information from other sources where appropriate.
Publicly available sources
For example:
- Companies House;
- HM Land Registry;
- other publicly available registers and databases.
Third parties
Including:
- sanctions screening providers;
- credit reference agencies;
- client due diligence providers.
Third parties with your authority or where appropriate
For example:
- your bank or building society;
- another financial institution or adviser;
- consultants and other professionals engaged in relation to your matter;
- your employer;
- your trade union;
- professional bodies;
- pension administrators;
- your doctors, medical professionals or occupational health advisers.
Through our information technology and security systems
Including:
- case management systems;
- document management systems;
- time recording systems;
- reception logs;
- website monitoring systems;
- computer networks and connections;
- communications systems;
- email systems;
- instant messaging systems;
- CCTV systems (including video and audio recording where applicable);
- access control systems.
These systems help us provide legal services, protect our business, maintain the security of our premises and information, and comply with our legal and regulatory obligations.
How and Why We Use Your Personal Data
Under data protection law, we can only use your personal data if we have a proper reason for doing so, for example:
- to comply with our legal and regulatory obligations;
- for the performance of our contract with you or to take steps at your request before entering into a contract;
- for our legitimate interests or those of a third party; or
- where you have given your consent. Where we rely on your consent, we will ask for it separately from this Privacy Policy and you may withdraw your consent at any time.
A legitimate interest is where we have a business or commercial reason to use your information, provided that this is not overridden by your own rights and interests.
We use your personal data for the following purposes.
Providing Legal Services
What we use your personal data for
- Providing legal services to you.
Our lawful basis
- Performance of our contract with you, or taking steps at your request before entering into a contract.
Preventing and Detecting Fraud
What we use your personal data for
- Preventing and detecting fraud against you or us.
Our lawful basis
- Our legitimate interests, namely minimising fraud that could be damaging to you and/or us.
Client Identification and Regulatory Compliance
What we use your personal data for
- Conducting checks to identify our clients and verify their identity.
- Screening for financial and other sanctions or embargoes.
- Other processing necessary to comply with professional, legal and regulatory obligations that apply to our business.
Our lawful basis
- Compliance with our legal and regulatory obligations.
Regulatory Audits and Investigations
What we use your personal data for
- Gathering and providing information required by, or relating to, audits, enquiries or investigations by regulatory bodies.
Our lawful basis
- Compliance with our legal and regulatory obligations.
Business Policies and Internal Procedures
What we use your personal data for
- Ensuring business policies are adhered to, including policies covering security and internet use.
Our lawful basis
- Our legitimate interests in ensuring that our internal procedures are followed so that we can provide the best possible service.
Operational Management
What we use your personal data for
- Improving efficiency.
- Staff training.
- Quality control.
- Managing and improving the operation of our practice.
Our lawful basis
- Our legitimate interests in operating our business efficiently and providing the best possible service.
Protecting Confidential Information
What we use your personal data for
- Ensuring the confidentiality of commercially sensitive information.
Our lawful basis
- Our legitimate interests in protecting commercially valuable and confidential information.
- Compliance with our legal and regulatory obligations.
Practice Management
What we use your personal data for
- Statistical analysis to help manage the practice, including financial performance, client base, work type and operational efficiency.
Our lawful basis
- Our legitimate interests in operating and improving our business.
Protecting Our Systems
What we use your personal data for
- Preventing unauthorised access to, and modification of, our systems.
Our lawful basis
- Our legitimate interests in preventing and detecting criminal activity that could be damaging to us and our clients.
- Compliance with our legal and regulatory obligations.
Maintaining Client Records
What we use your personal data for
- Updating and enhancing client records.
Our lawful basis
- Performance of our contract with you.
- Compliance with our legal and regulatory obligations.
- Our legitimate interests in maintaining accurate client records.
Safe Working Practices
What we use your personal data for
- Ensuring safe working practices.
- Staff administration.
- Staff assessments.
Our lawful basis
- Compliance with our legal and regulatory obligations.
- Our legitimate interests in ensuring our business operates safely and efficiently.
Marketing
What we use your personal data for
- Marketing our services to:
- existing and former clients;
- third parties who have previously expressed an interest in our services; and
- third parties with whom we have had no previous dealings.
Our lawful basis
- Our legitimate interests in promoting our business and services.
Credit Reference Checks
What we use your personal data for
- Carrying out credit reference checks through external credit reference agencies.
Our lawful basis
- Our legitimate interests in credit control and assessing whether clients are likely to be able to pay for our services.
External Audits and Quality Assurance
What we use your personal data for
- External audits.
- Quality assurance checks.
- Accreditation schemes such as ISO or Investors in People.
- Audit of our accounts.
Our lawful basis
- Our legitimate interests in maintaining recognised standards and demonstrating that we operate to a high standard.
- Compliance with our legal and regulatory obligations.
Security of Our Premises (CCTV)
What we use your personal data for
- Operating CCTV systems (including audio recording where enabled) to protect our premises, employees, clients, visitors and property.
- Preventing and detecting unauthorised access.
- Investigating security incidents.
- Assisting in the prevention and detection of crime.
Our lawful basis
- Our legitimate interests in protecting our premises, employees, clients, visitors, confidential information and property, and in maintaining the security of our business.
The above does not apply to special category personal data, which we will only process where we have an appropriate lawful basis and satisfy an additional condition for processing under UK data protection legislation.
CCTV and Audio Recording
We operate CCTV systems at our premises for the purposes of protecting our employees, clients, visitors, confidential information and property, preventing and detecting unauthorised access, investigating security incidents and assisting in the prevention and detection of crime.
Our CCTV system records video images and, where enabled, audio recordings.
CCTV cameras are positioned, so far as reasonably practicable, to monitor only those areas where surveillance is necessary for security purposes and to avoid unnecessary monitoring of neighbouring properties or public areas.
Recordings are only accessed by authorised personnel where there is a legitimate business or security reason to do so.
Where appropriate, recordings may be disclosed to:
- law enforcement agencies;
- insurers;
- professional advisers; or
- other third parties where disclosure is required or permitted by law, or where necessary in connection with the investigation of criminal activity or the establishment, exercise or defence of legal claims.
Appropriate signage is displayed in areas where CCTV operates to ensure individuals are informed that surveillance is taking place.
Further information regarding our use of CCTV, including how long recordings are retained and your rights in relation to personal data captured by our CCTV system, may be obtained by contacting our Data Protection Officer.
Marketing
We may use your personal data to send you updates (by email, text message, telephone, post or social media channels) about legal developments that might be of interest to you and/or information about our services, including exclusive offers, promotions or new services.
We have a legitimate interest in processing your personal data for marketing purposes (see How and Why We Use Your Personal Data above). This means we do not usually need your consent to send you marketing information. However, where consent is needed, we will ask for this consent separately and clearly.
We will always treat your personal data with the utmost respect and will never sell or share it with other organisations outside the firm for their own marketing purposes.
You have the right to opt out of receiving marketing communications at any time by contacting our Practice Manager.
We may ask you to confirm or update your marketing preferences if you instruct us to provide further services in the future, or if there are changes in the law, regulation or the structure of our business.
Who We Share Your Personal Data With
We routinely share personal data with:
Service Providers
Third parties who help us deliver our legal services, including:
- providers of our case management and finance systems;
- IT service providers, including cloud service providers and data storage platforms;
- shared service centres;
- financial institutions in connection with invoicing and payments.
Professional Advisers
Professional advisers whom we instruct on your behalf or refer you to, including:
- barristers;
- medical professionals;
- accountants;
- tax advisers;
- estate agents;
- surveyors;
- mortgage brokers;
- local counsel;
- technology service providers;
- other experts involved in your matter.
Third Parties Necessary to Carry Out Your Instructions
Where necessary, we may share your personal data with organisations involved in your matter, including:
- your mortgage lender and their solicitors’ panel administrators;
- HM Land Registry;
- HM Treasury;
- Scheme Administrators in property transactions;
- Companies House;
- HM Revenue & Customs;
- the National House Building Council.
Other Organisations
We may also share personal data with:
- credit reference agencies;
- our insurers and insurance brokers;
- external auditors (for example, in relation to ISO accreditation or financial audits);
- our banks;
- external service suppliers, representatives and agents who help us operate our business efficiently, including typing services, marketing agencies, search providers and document collation or analysis suppliers.
We only allow our service providers to handle your personal data where we are satisfied that they take appropriate measures to protect it. We also impose contractual obligations on service providers to ensure they only use your personal data to provide services to us and, where appropriate, to you.
We may also share your personal data where appropriate with:
Professional Advisers
Our own professional advisers (including solicitors, accountants and other advisers), who are subject to duties of confidentiality.
Auditors
Our external auditors, where necessary in connection with auditing our business.
Law Enforcement and Regulatory Bodies
Law enforcement agencies, courts, tribunals and regulatory bodies where necessary:
- to comply with our legal and regulatory obligations;
- in connection with legal proceedings;
- to establish, exercise or defend legal claims; or
- where necessary to investigate security incidents, criminal activity or damage to our premises.
Where relevant, this may include disclosure of CCTV footage or audio recordings where such disclosure is lawful and appropriate.
Business Transactions
Other parties who have, or may acquire, control or ownership of our business in connection with a merger, acquisition, restructuring, sale of assets or insolvency.
Where possible, information will be anonymised before it is shared. Where this is not possible, recipients will be subject to appropriate confidentiality obligations.
We may also disclose and exchange information with law enforcement agencies and regulatory bodies where required to comply with our legal and regulatory obligations.
Where Your Personal Data Is Held
Information may be held at:
- our offices;
- the offices of third-party agencies;
- service providers;
- representatives;
- agents.
as described above under Who We Share Your Personal Data With.
Some of these organisations may be located outside the United Kingdom. For more information about how we protect your personal data when this occurs, please see Transferring Your Personal Data Abroad below.
How Long Your Personal Data Will Be Kept
We will keep your personal data after we have finished advising or acting for you where it is necessary to do so, including:
- to respond to any questions, complaints or claims made by you or on your behalf;
- to demonstrate that we treated you fairly;
- to comply with legal, regulatory or professional record-keeping requirements.
We will not retain your personal data for longer than is necessary for the purposes set out in this Privacy Policy.
Different retention periods apply to different categories of personal data. When it is no longer necessary to retain your personal data, it will be securely deleted or anonymised.
Where applicable, CCTV recordings will be retained in accordance with our CCTV retention procedures and will be securely deleted once they are no longer required for the purposes for which they were collected, unless they are required in connection with an investigation, legal proceedings or the establishment, exercise or defence of legal claims.
Transferring Your Personal Data Abroad
To deliver legal services to you, it may sometimes be necessary for us to transfer your personal data outside the United Kingdom.
This may include countries that do not provide the same level of protection for personal data as the UK.
Where this happens, we will only transfer your personal data where:
- the UK Government has determined that the recipient country provides an adequate level of protection for personal data;
- appropriate safeguards are in place (such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the European Commission’s Standard Contractual Clauses, or other approved safeguards), together with enforceable rights and effective legal remedies; or
- another lawful exception under UK data protection legislation applies.
These transfers are subject to specific requirements under UK data protection law.
You may contact us if you would like further information about transfers of your personal data outside the United Kingdom or the safeguards we apply when doing so.
Your Rights
Under UK data protection law, you have a number of rights in relation to your personal data. These rights are free of charge, although some may only apply in certain circumstances.
Right of Access
You have the right to be provided with a copy of the personal data we hold about you.
Right to Rectification
You have the right to require us to correct any inaccurate or incomplete personal data that we hold about you.
Right to Erasure (“Right to be Forgotten”)
You have the right to ask us to delete your personal data in certain circumstances.
Right to Restrict Processing
You have the right to ask us to restrict the processing of your personal data in certain circumstances, for example where you contest the accuracy of the information we hold.
Right to Data Portability
Where applicable, you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and to request that it be transferred to another organisation.
Right to Object
You have the right to object:
- at any time to your personal data being processed for direct marketing (including profiling); and
- in certain other circumstances, to our continued processing of your personal data where we rely on our legitimate interests, unless we can demonstrate compelling legitimate grounds for continuing the processing or the processing is necessary for the establishment, exercise or defence of legal claims.
Rights Relating to Automated Decision-Making
You have the right not to be subject to a decision based solely on automated processing (including profiling) where that decision produces legal effects concerning you or similarly significantly affects you.
Right to Withdraw Consent
Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time.
Withdrawing your consent will not affect the lawfulness of any processing carried out before your consent was withdrawn.
For further information about your rights, please contact us or refer to the Information Commissioner’s Office (ICO) guidance on individual rights under the UK GDPR.
Exercising Your Rights
If you wish to exercise any of your rights, please contact our Data Protection Officer.
To help us deal with your request, please provide:
- your full name, address and, where applicable, your client or matter reference;
- sufficient information to enable us to identify you;
- proof of your identity and address (for example, a copy of your passport or driving licence together with a recent utility bill or bank statement); and
- details of the right you wish to exercise and the information to which your request relates.
Keeping Your Personal Data Secure
We have appropriate technical and organisational security measures in place to protect personal data against accidental loss, unauthorised access, unlawful use, alteration or disclosure.
Access to personal data is restricted to those members of staff, consultants and service providers who have a genuine business need to access it. Anyone processing your personal data on our behalf is required to do so only in an authorised manner and is subject to appropriate confidentiality obligations.
We also maintain procedures for identifying, investigating and responding to suspected personal data breaches. Where required by law, we will notify affected individuals and the Information Commissioner’s Office (ICO) of any personal data breach.
If you would like further information about protecting your personal information online, please visit Get Safe Online, which is supported by HM Government and leading businesses.
How to Complain
If you have any questions or concerns about how we use your personal data, please contact us using the details below. We hope that we will be able to resolve any concerns you may have.
If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection.
Changes to This Privacy Policy
This Privacy Policy was first published on 1 November 2017 and was last reviewed on 10 July 2026.
We may update this Privacy Policy from time to time to reflect changes in legislation, regulatory guidance, our business practices or the services we provide. Any updated version will be published on our website.
Updating Your Personal Data
We take reasonable steps to ensure that the personal data we hold about you remains accurate and up to date.
Please let us know if any of your personal information changes during your relationship with us, for example your name, postal address, email address or telephone number.
How to Contact Us
If you have any questions about this Privacy Policy, the personal data we hold about you, or you wish to exercise any of your rights under data protection law, please contact us.
Data Protection Officer: Victoria Follows
Email: vfollows@hmo.co.uk
Post: Hand Morgan & Owen Solicitors, 17 Martin Street, Stafford, ST16 2LF
Telephone: 01785 211411
