Our Privacy policy

This Privacy Notice details the types of personal data we may collect about you when you interact with us. It also explains how we will store and handle that data and keep it safe.
We know that there is a lot of information here, but we want you to be fully informed about your rights, and how the Law Centres Network uses your data. We hope that the following sections will answer any questions you have. If not, please do get in touch with us.

When do we collect your data?

We normally collect your data when you provide it to us or when it is provided to us by others (for example, the Law Centre you are dealing with). You may give us your data by email; through an online web form; on a paper form; over the telephone; face to face; or by post.

What sort of data do we collect and how do we use it?

The type of data we collect depends on why we are processing your data. We typically collect your name and contact details
We only use your data for the purposes for which it was provided. For instance:

Supporters

We maintain a database of supporters. This includes contact information and is managed through MailChimp, for the purpose of sending e-bulletins about LCN's work and the work of Law Centres. You will have subscribed to or have opted in to being included in this database.

MailChimp is based in the US and therefore your data (name and email address) is transferred outside of the EU. However, we believe that, given the limited nature of the data being transferred, the US-EU Privacy Shield provides adequate data security and protection.

If you are no longer happy for us to hold your details, at any time you can stop receiving emails from us by unsubscribing from the list, or updating your mailing preferences. You can view the MailChimp Privacy here: https://mailchimp.com/legal/privacy/

Donors

We accept donations through PayPal. Donor data is stored by PayPal and we do not receive any personal data. However, we can log in to our PayPal account to view donor details, which only include the email address and name that you provide. Full details of the PayPal privacy policy can be found at: https://www.paypal.com/uk/webapps/mpp/ua/privacy-full.
When you visit the website

The Law Centres Network uses Google Analytics and cookies in order to analyse how the website is used and improve our service and your user experience. Aside from the approximate location (IP address), the information collected by Google Analytics is mostly anonymous and relates to site traffic, including browser information, device information and language.
You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.
When you browse our website, we do not collect additional information, such as your age, gender, interests, bank details or clickstream. However, when you contact us via the website, we do collect personal information about you.

The website contact form

If you have used the form on our website to submit an enquiry – for example, to request legal advice, ask about volunteering, a media enquiry, a general enquiry, ask about setting up a Law Centre or report issues with the website – then we may collect your first/last name, email address, telephone number and your nearest town, along with details of your enquiry.

We only ask what is required in order to provide assistance on what you have requested. We record the number and type of enquiries we receive in relation to legal advice, volunteering, media and setting up a Law Centre on our Salesforce database. This is anonymised in all cases except for enquiries relating to setting up a Law Centre. In this case, we retain the details you provided in order to assist you in your enquiry.
Queries submitted to ask for legal advice do often contain confidential and sensitive information. Copies of enquiries are retained by LCN for 18 months before being confidentially destroyed.

If you submit a query through the ‘contact your local Law Centre’ form, it will be confidentially forwarded to that Law Centre.

Any enquiries about volunteering will also be forwarded to the relevant Law Centre. If you are interested in volunteering with LCN, we will log the enquiry.

Legal advice enquiries information is deleted after 18 months. However, we do record and retain anonymised data about your enquiry on our Salesforce database. This data simply classifies what area of law your enquiry was about and your location (to the nearest town), to help us better understand legal need and provision of legal services across the country. You cannot be identified from this data.

Personal data in respect of sole traders and partnerships

Some freelance workers, consultants and service users fall into this category. We only collect as much data as needed to facilitate the agreement (typically provision of services to LCN or to render services to a customer by nature of our business relationship e.g. training and events) with them. We will hold this data until we no longer consider it relevant for the purpose it was originally collected. Until then we have a legitimate interest in keeping this information on our systems by nature of our business relationship.

Legal advice projects

Where we deliver, administer or lead on projects that are funded by other organisations, for example, the European Commission, we may be required to provide monitoring information to that funder to evidence how we have used the money and to what benefit. Similarly, where we work in partnership with other organisations we may share monitoring information between partners. In these cases, we may gather details, for example, of your age; ethnicity; gender etc. We keep this information securely and confidentially and we only use it for monitoring purposes and to evaluate the project. Where we disclose it to funders we do so anonymously. We will always let you know if we are sharing the data we collect from you with partners or funders and ask your permission before doing so.

Booking training and events

LCN uses Eventbrite for event management. LCN may also collect data about you when you register or pay for an event. We only collect details necessary for running the event, and typically use the information to provide you with the service to requested, and to monitor and evaluate the training we deliver. The Eventbrite privacy policy is at https://www.eventbrite.co.uk/support/articles/en_US/Troubleshooting/eventbrite-privacy-policy?lg=en_GB.

Payments made through our Website

Payments made to us via our website are securely processed by PayPal, so the Law Centres Network does not hold any card details. PayPal’s privacy policy is at https://www.paypal.com/uk/webapps/mpp/ua/privacy-prev.

Conditions for Processing Data

We are only entitled to hold and process your data where the law allows us to. The current law on data protection sets out a number of different reasons for which we may collect and process your personal data. These include:

Legitimate Interests

In most situations, we require your data to pursue our legitimate interests in a way which might reasonably be expected as part of running our business and which does not materially impact your rights, freedom or interests. This may include to satisfy our external quality auditors or our regulators, or to properly report to funders in cases where you have received services or advice obtained under a grant-funded service that we administer.

Legal compliance

If the law requires us to, we may need to collect and process your data. For example, we can pass on details of people involved in fraud or other criminal activity.

Consent

In some situations, we can collect and process your data with your consent. For example, when you tick a box to receive email newsletters, or if you consent when signing up for certain services or when making gifts and donations to us. When collecting your personal data, we will always make clear to you which data is necessary in connection with a particular service/purpose.

Contractual obligations

In some cases, we may provide you with legal services, either directly or through one of our Law Centres or partners. The main purpose for our holding your data is therefore to provide you with legal services under the agreement we have with you. This agreement is a contract between you and us, and the law allows us to process your data for the purposes of performing a contract (or for the steps necessary to enter in to a contract). We may also need to process your data to meet our contractual obligations to the Legal Aid Agency where you receive legal aid to fund your case or advice.

How we protect your data

We take protecting your data very seriously. The data you give us may be subject to Legal Professional Privilege and is often extremely sensitive and confidential.

With this in mind we will treat your data with the utmost care and take all appropriate steps to protect it. We have clear data protection and information security policies and procedures in place, along with Regulatory and other legal obligations to keep your data safe. These are regularly assessed as part of our Quality Standards and compliance processes.
We protect our IT system from Cyber Attack. Access to your personal data is password-protected, and sensitive data is secured by encryption.

We regularly monitor our system for possible vulnerabilities and attacks, and we carry out penetration testing to identify ways to further strengthen security.

IT Systems

LCN cares to ensure the security of personal data. When LCN collects information about you, we also make sure that your information is protected from unauthorized access, loss, manipulation, falsification, destruction or unauthorized disclosure. This is done through appropriate technical measures. For example, emails and our online forms are encrypted, our network is protected and routinely monitored, remote devices e.g. mobile phones and laptops are encrypted and there are password policies and 2-step authentication in place for staff to securely access the organisation’s IT systems. Our IT support company undertakes periodic review of our security to ensure we are protected.

Staffing and Internal Management

We undertake regular reviews of who has access to information that we hold, to ensure that your information is only accessible by appropriately trained staff, volunteers and contractors. Staff have access to personal information on a ‘need-to-know’ basis so, for example, highly sensitive data such as employment records are only available to managers with the designated permissions to access and process that data.

How long will we keep your data?

We only keep your data for as long as is necessary for the purpose(s) for which it was provided. For enquiries this will normally be 18 months after we receive your enquiry.

For supporters who have consented to be included on our supporter database we will hold the data until the individual unsubscribes or withdraws consent, or when it becomes clear that emails and other communications are no longer being delivered.

Where we have provided legal advice, and with data relating to contracts with third party consultants or trainers etc., we will normally keep the data for 6 years after the case, matter or contract ends.

For some matters/contracts we may decide that it is proper and appropriate to keep data for longer than 6 years. If we believe that your case/contract falls into this category, we will notify you.

Who do we share your personal data with?

We sometimes share your personal data with trusted third parties. We only do this where it is necessary for providing you services or for the effective operation of LCN.

For example, we may share your data with Law Centres; experts; translators; secure file storage and destruction companies; auditors; the companies that securely host our off-site cloud storage servers.

The policy we apply to those organisations to keep your data safe and protect your privacy is as follows:

•We provide only the information they need to provide their specific services;

•They may only use your data for the exact purposes we specify in our contract with them;

•We work closely with them to ensure that your privacy is respected and protected at all times;

•If we stop using their services, any of your data held by them will either be deleted or rendered anonymous.

Where is your data processed?

Unless we state otherwise, your data is stored and processed within the European Economic Area (EEA). The EEA includes all EU Member countries as well as Iceland, Liechtenstein and Norway.

As noted above, supporter lists are stored on MailChimp are processed in the US but we believe that, given the limited nature of the data being transferred, the US-EU Privacy Shield provides adequate data security and protection.

If we ever have to share your personal data with third parties and suppliers outside the EEA, we will ensure that it is sent and stored securely and, where appropriate, we will seek your specific consent to do so.

What are your rights?

You have the right to request:

•Access to the personal data we hold about you, free of charge in most cases.

•The correction of your personal data when incorrect, out of date or incomplete.

•The deletion of your personal data, for example when you withdraw consent; or object and we have no legitimate overriding interest; or once the purpose for which we hold the data has come to an end – although we are not required to delete your data where data where we are required to hold it for complying with our own legal obligations.

•That we stop any consent-based processing of your personal data after you withdraw that consent.

To ask for your information, please contact Alex Charles at alex@lawcentres.org.uk.

If we choose not to action your request, we will explain to you the reasons for our refusal. In order to comply with your request, we may ask you to verify your identity.

Your right to withdraw consent

Whenever you have given us your consent to use your personal data, you have the right to change your mind at any time and withdraw that consent.

Where we rely on our legitimate interest

In cases where we process your personal data on the basis of our legitimate interest, you can ask us to stop for reasons connected to your individual situation. We must then do so unless we believe we have a legitimate overriding reason to continue processing your personal data.

The Regulator

If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office. You can contact them by calling 0303 123 1113, or visit www.ico.org.uk/concerns (opens in a new window). Please note that we cannot be responsible for the content of external websites.