Privacy Policy – Notice given under the UK General Data
Protection Regulation (“UK-GDPR”)
This notice is intended for all Clients in respect of whom personal data is collected or
accepted by Hackett & Dabbs LLP [“H&D”] in the ordinary course of legal representation.
Please read the following information carefully.

This Privacy Notice contains information about the data collected, stored and otherwise
processed about you and the reasons for the processing. It also tells you who we share this
information with; the security mechanisms we have in place to protect your data; and how to
contact me in the event that you need further information.

Who are we?
H&D collects, uses and is responsible for personal information about you. This makes us the
controller of this information for the purposes of the UK-GDPR and the Data Protection Act
2018.
If you need to contact us about your data or the processing carried out you can use the
contact details at the end of this Notice.
What does H&D do with your information?
Information collected
When carrying out the provision of legal services H&D may collect some or all of the
following personal information: –
(a) Name and usual address
(b) family details
(c) lifestyle and social circumstances
(d) goods and services
(e) financial details
(f) education, training and employment details
(g) physical or mental health details
(h) racial or ethnic origin
(i) political opinions
(j) religious, philosophical or other spiritual beliefs
(k) trade union membership
(l) sex life or sexual orientation
(m) genetic data
(n) biometric data for the purpose of uniquely identifying a natural person
(o) criminal proceedings, outcomes and sentences, and related security measures
(p) other personal data relevant to instructions to provide legal services, including data
specific to the instructions in question.
Information collected from other sources
The same categories of information may also be obtained from third parties, such as other
legal professionals or experts, members of the public, your family and friends, witnesses,
courts and other tribunals, investigators, government departments, regulators, public records
and registers.

How we use your personal information: Purposes
Hackett &Dabbs [“H&D”] may use your personal information for the following purposes:
(i) to provide legal services to our clients, including the provision of legal advice and
representation in courts, tribunals, arbitrations, and mediations;
(ii) to keep accounting records and carry out office administration;
(iii) to take or defend legal or regulatory proceedings or to exercise a lien;
(iv) to respond to potential complaints or make complaints;
(v) to check for potential conflicts of interest in relation to future potential cases;
(vi) to promote and market our services;
(vii) to carry out anti-money laundering and terrorist financing checks;
(viii) to train other barristers and when providing work-shadowing opportunities;
(ix) when procuring goods and services;
(x) to publish legal judgments and decisions of courts and tribunals;
(xi) as required or permitted by law.
Whether information has to be provided by you, and why
If H&D has been instructed by you or on your behalf in a case, your personal data has to be
provided, in part to enable us to supply the advice or representation which your case
requires; in part to comply with our professional obligations to our Regulator; in part to keep
adequate accounting records for the Inland Revenue; and in part so that we can comply with
the anti-money laundering and anti-terrorism laws of this country.
The legal basis for processing your personal information
We rely on the following as the lawful bases on which we collect and use your personal
information:-
 If you have given consent to the processing of your personal information, then we may
process that data for the Purposes set out above and to the extent to which you have
consented to us doing so.
 If you are a Client, data processing is necessary for the performance of our contract for
legal services, or in order to take steps at your request prior to entering into such a
contract.
 In relation to data which is in categories (g) to (o) above [categories which are
considered to include particularly sensitive information, and which include information
about criminal convictions or proceedings] we shall rely upon your consent for any
processing for the purposes set out in Purposes (ii) , (iv) , (vi) and (viii) above. We will
need your consent to carry out processing of this data for these purposes.
However, if you do not consent to processing for Purpose (iv) [responding to potential
complaints] H&D will be unable to take your case. This is because we need to be able to
retain all the material about your case until there is no prospect of a complaint.
 In relation to information in categories (g) to (o) above (these being categories which are
considered to be particularly sensitive information and include information about criminal
convictions or proceedings), H&D is entitled by law to process the information where the
processing is necessary for legal proceedings, legal advice, or otherwise for establishing,
exercising or defending legal rights.
 In relation to information which is not in categories (g) to (o) above, H&D relies upon its
legitimate interest and/or the legitimate interests of a third party in carrying out data
processing for the Purposes set out above.

 In certain circumstances data processing may be necessary in order that we can comply
with a legal obligation to which we am subject (including compliance with anti-money
laundering or terrorist financing regulations).
 The processing is necessary to publish judgments or other decisions of courts or
tribunals.
With whom will we share your personal information?
If you are a client, some of the information you provide will be protected by legal professional
privilege, unless and until such information becomes public in the course of any proceedings
or otherwise. As a firm of regulated lawyers H&D has an obligation to keep your information
strictly confidential save where it otherwise becomes public, or is disclosed as part of your
case or legal proceedings.
In the ordinary course of legal services it may be necessary to share your data with the
following persons:
 Interim data processors such as our case management software [Clio] and personal
identity/anti-money laundering compliance application provider [Amiqus]; IT support
contractors; and e-mail Server and data storage providers
 other legal professionals (the other side in a dispute, for instance);
 experts and other witnesses;
 prosecution authorities;
 courts and tribunals;
 trainee barristers or work-experience trainees;
 family and associates of the Client whose personal information we are processing;
 in the event of complaints, H&D’s Heads of Legal Practice and Financial Affairs, any
other members of the firm at the material time who deal with complaints, the Bar
Standards Board, and/or the Legal Ombudsman Service;
 other regulatory authorities;
 education and examining bodies with whom the Client has had dealings;
 current, past or prospective employers of the Client;
 business associates and professional advisers.
For the avoidance of any doubt, H&D may be required to provide personal data to
professional regulators such as the Bar Standards Board, and to statutory regulators such
as the Financial Conduct Authority or Information Commissioner’s Office.
In the case of the Information Commissioner’s Office there is always the risk that your data
may lawfully be disclosed by them for the purpose of any other civil or criminal proceedings,
without our consent or yours, which includes privileged information.
H&D might also be required to disclose your information to the police or intelligence services
where required or permitted by law.
Sources of information
The personal information we collect may include information which has been obtained from
the following sources:
 other legal professionals (e.g. the other side in legal proceedings);
 experts and other witnesses;
 prosecution authorities;
 courts and tribunals;
 trainee barristers under the supervision of counsel instructed in the Client’s case;

 family and associates of the Client whose personal information we are processing;
 in the event of complaints, the Heads of Legal Practice and Financial Affairs, any other
members of H&D who deal with complaints, the Bar Standards Board and/or the Legal
Ombudsman Service.
 other regulatory authorities;
 current, past or prospective employers of the Client;
 business associates, professional advisers and trade bodies, e.g. the Bar Council;
 data processors, such as H&D staff, IT support, e-mail telecoms and/or data storage
providers;
 public sources, such as the press, public registers, social media websites and law
reports.
Transfer of your information outside the United Kingdom
This Privacy Notice is of general application and as such it is not possible to state whether it
will be necessary to transfer your information out of the UK in any particular case or for a
reference.
However, if you reside outside the UK or your case involves persons organisations or courts
and tribunals outside the UK then it may be necessary to transfer some of your data to that
country for that purpose. If you are in a country outside the UK, or if the instructions you
provide come from outside the UK, then it is inevitable that data will be transferred to those
countries. If this situation applies to you and you wish additional precautions to be taken in
respect of your data then please indicate this when providing initial instructions.
Some countries and organisations outside the UK have been assessed by the European
Commission, and their data protection laws and procedures have been found to show
adequate protection. Most countries, however, do not. If your data has to be transferred
outside the European Economic Area then be aware that you may not have the same
protections and rights as you do within the EEA.
H&D may wish to transfer your personal data to the following third parties which are located
outside the European Economic Area (EEA) and for the following purposes:
 “cloud” data storage services based in the USA who have agreed to comply with the EU-
U.S. Privacy Shield code of practice, so that H&D can store your data and/or backup
copies of that data (so that we can access it when needed).
 The USA does not have the same data protection laws as the UK; but the Privacy Shield
protocol was recognised by the European Commission as providing adequate protection,
and the UK’s ICO accepts that recognition.
H&D will not otherwise transfer personal information outside the UK except as necessary for
providing legal services or for any legal proceedings, as described above.
If you would like any further information please use the contact details at the end of this
document.
How long will H&D store your personal data?
H&D will typically store your data for a maximum of fifteen (15) years. This is considered to
be the maximum necessary under the Limitation Act 1980, and is a period recommended by
H&D’s professional indemnity insurers, the Bar Mutual Indemnity Fund.
At the end of this period any need for further retention will be considered and the data will be
marked for deletion or for retention for a further period. The further retention period is likely
to be required only where the data is needed for legal proceedings, regulatory matters or
active complaints. Deletion of data will be carried out without further notice to you as soon as
reasonably practicable after the data is marked for deletion.

H&D will store some of your basic data so that we can carry out conflict checks when
approached by new clients (we are not permitted to act for past opponents of yours unless
you give specific consent). However, this data is likely to be limited to your name and
contact details and the formal name of any litigation in which you were involved. This basic
data will not include any information falling within categories (g) to (o) above.
Data related to anti-money laundering checks will be retained until five years have passed
after the completion of the relevant transaction or other business relationship, whichever is
the later.
Names and contact details held for marketing purposes will be stored indefinitely or until we
become aware or informed that you have ceased to be a client or potential client.
Consent
As explained above, H&D is relying on your express consent to process your data in
categories (g) to (o) above. You are deemed to have provided this consent when you
retained H&D to provide legal services. You have the right to withdraw this consent at any
time; but this would not affect the lawfulness of any processing H&D has already carried out
prior to withdrawal of consent. Where H&D relies also on other bases for processing your
data you may not be able to prevent processing by withdrawing consent: for example, if you
instructed us to work on your behalf and later you fail to pay fees lawfully due – in which
instance H&D would be entitled to use personal data in order to recover any debt which is
owed.
If there is an issue with the processing of your data, please contact H&D’s Data Protection
Manager (David Dabbs) using the contact details at the end of this notice.
Your Rights
Under the UK-GDPR, you have a number of rights that you can exercise in certain
circumstances. The exercise of such rights are free of charge. In summary, you may have
the right to:
 Ask for access to your personal data and other supplementary information;
 Ask for correction of mistakes in your data or to complete missing information;
 Ask for your personal data to be erased (“the right to be forgotten”), in certain
circumstances;
 Receive a copy of the personal data you have provided to H&D, or have this information
sent to a nominated third party. This data will be provided to you or the third party in a
structured, commonly-used and machine-readable format, e.g. a Word or Adobe file;
 Object at any time to processing of your personal data for direct marketing;
 Object in certain other situations to the continued processing of your personal data;
 Restrict H&D’s processing of your personal data in certain circumstances;
If you want more information about your rights under the GDPR please see the Guidance
from the Information Commissioners Office on Individual's rights under the GDPR.
If you want to exercise any of these rights, please:
 Use the contact details at the end of this document;
 Provide a contact address so that you can be contacted to request further information to
verify your identity;
 Provide proof of your identity and address;
 State the right or rights that you wish to exercise.
H&D will respond to you within one month from when your request is received.

Marketing E-mails
Please note if you wish to unsubscribe from any marketing emails that you have signed up
for, you can do so by informing us at the contact details given at the end of this notice.
How to make a complaint
The UK-GDPR also gives you the right to lodge a complaint with the Information
Commissioners’ Office if you are in the UK, or with the supervisory authority of the Member
State where you work, normally reside or where the alleged infringement of data protection
laws occurred.
The Commissioner’s Office can be contacted at http://ico.org.uk/concerns.
Future Processing
We do not intend to process your personal data except for the reasons stated within this
Privacy Notice. If any aspect of those reasons changes, this Notice will be amended (see
below).
Changes to this Privacy Notice
This Privacy Notice was published in January 2020.
H&D continually reviews its privacy practices and may change this policy from time to time.
When we do the revised version will be placed on our website and inserted into the next
written correspondence or electronic communication.
Contact Details
If you have any questions about this Privacy Notice or the information we hold about you,
please contact the Data Protection Manager.
The best way to contact the Data Protection Manager is to write to him at the office address
or by email at david.dabbs@hackettdabbs.co.uk or by telephone on 02393 878797.

July 2021 Hackett and Dabbs LLP