Privacy Policy

1. Introduction

Your privacy is important to us. This Privacy Policy provides important information about how Hughes Paddison Limited handles your personal information.

Hughes Paddison Limited is a data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). This Policy applies to personal information which we process through the company’s website and the services we provide. Please read this policy carefully and contact us if you have any questions about our privacy practices or your information choices.

2. How we collect and use your data

For clients and prospective clients (including our employees or personal representatives of our clients) we will collect, process and store personal information so that we can provide our services to you. We may also collect, store and process special category data that you give to us (we will only request this type of data where it is necessary to provide services to you.)

For non-clients and other third parties, we will only collect, process and store information given to us where we are satisfied we have identified a lawful process to do so. For example, we may have been given your details because you are in a dispute with a client of this firm. We may also collect, store and process special category data relating to you, but we will only do so where we have identified a lawful basis to do so.

We will only process personal data (including special category data) where it is necessary:

for the performance of a contract with you;
in order to take steps before we enter into a contract with you;
where it is in the legitimate interest of our business;
for the establishment, exercise or defence of legal claims;
to comply with our legal or regulatory obligations; or
where we have the consent of the data subject.

3. Others who may see or have access to your data

The company shares or discloses personal information when necessary to provide services or conduct our business operations as described below. We do not sell any personal information to third parties. Below are the parties with whom we may share personal information and why.

• Within the company: Our business is supported by a variety of people who are part of the company’s teams and functions, and personal information will be made available to them if necessary for the provision of services, account administration, sales and marketing, customer and technical support, and business development, for instance. All of our employees and contractors are required to follow our data privacy and security policies when handling personal information.

• Other professional advisers and intermediaries: In the course of giving legal advice we may be required to work with other solicitors, tax advisers, accountants, barristers, estate agents, surveyors and other professional advisers and intermediaries. Subject always to our professional duty of confidentiality, we may share your personal information with these professional advisers and intermediaries in order to provide our services to you.

• Our business partners: We occasionally partner with other organisations to deliver services, provide content, or to host events, conferences, and seminars. As part of these arrangements, you may be a client of both the company and our partners, and we and our partners may collect and share information about you. The company will handle personal information in accordance with this policy, and we encourage you to review the privacy policies of our partners to learn more about how they collect, use, and share personal information.

• Our third-party service providers: We partner with and are supported by service providers in the UK and European Union. Personal information will be made available to these parties only when necessary to fulfil the services they provide to us, including (without limitation):

software, system and platform support;
direct marketing services; document management and dictation services, cloud hosting services; advertising; data analytics;
anti-money laundering checks; accountancy; insurance; and order fulfilment and delivery.

Our third-party service providers are not permitted to share or use personal information we make available to them for any other purpose than to provide services to us.

• For legal reasons: We will share personal information when we believe it is required, such as (without limitation):

to comply with legal and regulatory obligations and respond to requests from government agencies, regulators, law enforcement and other public authorities;
in the event of a merger, sale, restructure, acquisition, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings);
to protect our rights, users, systems, and services.

4. How long we will keep your personal data

Your personal data will usually be retained for 15 years after conclusion of a matter so that we can review the file if any complaints or issues arise after completion of the contract. Where we are advising our clients on their Will, holding title deeds to property or some other personal matters, we may retain the file for up to 99 years.

5. Where your data is stored

Your data is stored within the UK or the EEA. In some cases, we may need to disclose or transfer your personal information within the company or to third parties in areas outside of your home country, but we will not transfer your data outside of the European Union unless there is a an adequacy decision in place or we have your consent.

6. How we keep your data secure

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality. The company holds Cyber Essentials Plus accreditation which is a government-backed certification scheme that helps keep personal data safe from cyber-attacks.

We have put in place procedures to deal with any suspected personal data breaches and will notify you and any applicable regulator of a breach where we are legally required to do so.

7. Cookies

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. For more information about the cookies we use, please see our Cookie Policy.

8. Your data privacy rights

We respect your right to access and control your information and we will respond to requests for information and, where applicable, will correct, amend, or delete your personal information. In some cases, exemptions apply to the following rights. If for any reason, we are unable to fulfil your request we will explain the reason to you:

• Access to personal information: You have the right to request access to your personal data (known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it. If you request access to your personal information, we will gladly comply, subject to our obligations not to disclose information which is subject to legal professional privilege and any other relevant legal requirements and exemptions. Before providing data to you, we may ask for proof of identity and sufficient information about your interaction with us so that we can locate any relevant data.

• Object to processing: of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes.

• Request erasure: of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see above), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law.

• Request restriction of processing: of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the accuracy of the data; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

• Request the transfer: of your personal data to you or to a third party. We will provide to you, or a third party chosen by you, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

• Correction of your data: You have the right to request that we correct your personal information if it is inaccurate or requires updating or complete your personal information if the information we hold is incomplete.

• Withdrawal of consent: If we are processing your personal information on the basis that you have given your consent to us processing that personal information, you have a right to withdraw your consent at any time by using the “Contact Us” option on our website or let us know in writing, by email or by telephone.

• Marketing preferences: To opt out of email marketing, you can use the unsubscribe link found in the email communication you receive from us or you can use the “Contact Us” option on our website or let us know by telephone.

9. Making a complaint:

If you are not satisfied with how the company manages your personal data, you have the right to make a complaint to the Information Commissioner’s Office .

10. Changes to this policy

It is important that you check back often for updates to this Policy. If we make changes, we consider to be important, we will let you know by placing a notice on our website and/or contacting you using other methods such as email.

This Policy was last updated on 17 January 2025.

11. Contact us

If you have any queries about this policy, or wish to exercise any of your data privacy rights, please contact us in one of the following ways:

By Email: info@hughes-paddison.co.uk

By Post:

Attn: Compliance Manager
Hughes Paddison Solicitors
9-10 Royal Crescent
Cheltenham
Gloucestershire
GL50 3DA

By Telephone:

01242 574244