Privacy notice for legal services

At Good Law Project, we are committed to protecting your privacy. 

This privacy notice is applicable to individuals who engage us for legal representation. This privacy notice explains how we collect and process your personal information, and must be read with the letter of engagement and terms of business that you will have received if Good Law Project is providing you with legal advice and/or representation.

If you visit our website and/or take part in our campaigns, the General privacy notice may also apply to you.

If you are an individual reaching out to us for support, a whistleblower, or an existing or potential partner in litigation and campaigns, the Individuals privacy notice may also apply to you.

Background

When you make contact with Good Law Project, we follow a triage process to make sure that the cases we take forward align fully with our organisational mission and values. We are able to engage with only a small number of people who contact us seeking legal representation. Good Law Project may, however, store the data of all individuals in accordance with Good Law Project’s retention periods (please see below).

What personal data we collect about you

We may collect and process different types of personal data, including but not limited to:

• basic personal details such as your name and job title
• contact details such as your telephone number and postal or email address
• identification and other proof of address data such as copies of passports, driving licences, or utility bills
• financial data such as payment-related information or bank account details
• demographic data such as your address
• information regarding your legal case or claim
• any special categories of data shared with us, relating to your claim or otherwise

How and when do we collect such information from you?

Good Law Project collects information about you in the following ways:

• when you email us directly with your enquiry
• when you reach out to us on social media channels or call our organisation
• when we speak to you in calls or meetings or via email to discuss your enquiry 
• if we are able to represent you, during the course of this representation 

Sharing your information

• When you engage us to provide legal advice and representation to you, we shall be required to keep information you share with us confidential unless disclosure is required or permitted by law or unless you consent to us sharing that information with third parties.
• We engage with several third parties to process your personal data. These third parties act as data processors of your data. Good Law Project will either sign a data processor agreement with such processors or will review the terms and conditions of such processors’ agreements to ensure compliance with data protection legislation. 
• We may be required to share your information with third parties such as expert witnesses, other professional advisers, and our regulators.
• Further, where personal data is stored outside of the UK and the EEA, safeguards to protect personal data may include but are not limited to the UK addendum used in conjunction with the EU standard contractual clauses, or UK international data transfer agreement. Such safeguards will be subject to transfer risk assessments.
• Your information will be stored securely on Good Law Project’s internal systems such as Google Drive, Toggl, Quickbooks, or other UK GDPR-compliant platforms. 

What lawful bases do we use to process your data?

We use several lawful bases to process your information:

1. When we provide our services pro-bono, we rely on legitimate interests and contractual obligation.
2. When we provide our services for a fee, full or discounted, or on a no-win-no-fee basis, we rely on contractual obligation.
3. If we do not engage with you to represent you legally, we retain your information for our legitimate interests.
4. For sharing information with other advisors, insurers, expert witnesses, regulators, we rely on legitimate interest, contractual obligation and legal obligation.
5. For sharing information about you and the work we have done for you in our marketing materials, including on our website and social media channels, in funding applications and progress reports, and in legal directory submissions, we rely on your consent.

For processing any special categories of data, we rely on legal claims as our lawful basis. 

When we rely on legitimate interest, we will undertake a balancing assessment to ensure we process your data in line with your rights.

Keeping your information safe

Good Law Project limits access to the information you share with us for internal use only, unless the circumstances require that we share you data with advisors, insurers, expert witnesses and regulators. When this happens, we rely on an appropriate lawful basis (see “What lawful basis do we use to process your data?” above).

When we are provided with your personal information, steps are taken to ensure that it is treated securely. Electronic data is stored securely and accessed via password-protected computers used only by our employees.

We take looking after your information very seriously. We have put appropriate physical, technical and organisational measures in place to make sure that your personal information is secure when under our control, both online and offline, from improper access, use, alteration, destruction and loss.

How long do we store your information for?

If we are engaged by you to provide legal advice or representation, we will store your details for six years after our last engagement with you.

If we are not engaged by you to provide legal advice or representation, we will store your data for 12 months, in line with our retention periods.

In all other cases of your interaction with us, we will store your data in line with retention periods specified in Good Law Project’s retention policy.

Your rights

Under data protection laws in the UK and EU, you have certain rights over the personal information that we hold about you. If you would like to exercise your rights, please get in contact using the details listed below. Here is a summary of the rights we think may apply:

• Right to be informed
  You have the right to be informed as to how we use your data and under what lawful bases we carry out any processing. This privacy notice sets this information out. However, if you would like further information, please get in touch.
• Right of erasure – also known as the right to be forgotten
  You may ask us to delete some or all of the information we hold about you. Sometimes, for example where we have a legal obligation, we cannot erase your personal data.
• Right to object
  You have the right to object to processing where we are using your personal information, such as where the processing is based on legitimate interests.
• Right to correct inaccurate personal information
  Inaccurate or incomplete information we hold about you can be corrected.
• Right of restriction
  You have a right to restrict the processing of some or all of your personal information if there is a disagreement about its accuracy, or if we are not lawfully allowed to use it.
• Right to access your information
  You have a right to request access to a copy of the personal information that we hold about you, along with the information on what personal information we use, why we use it, who we share it with, how long we keep it for and whenever it has been used for automated decision-making. You can make a request for access free of charge, but we’ll need proof of your identity.
• Automated decision-making
  Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. You have the right to question the outcome of automated decisions that may create legal effects or create a similar significant impact on you.
• Right to withdraw consent
  Where you have provided consent to our use of your data, you also have the right to withdraw that consent at any time. This means that we will stop processing your data.

Making a complaint

If you think your rights have been breached or you are not happy with the ways we handle your data, you can raise a complaint by contacting our data protection officer on sofiya@hope-may.com.

Any questions or concerns that may not require a formal complaint can be passed on via our contact page.

You can also contact the Information Commissioner’s Office by writing to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, or by telephone on 0303 123 1113 (local rate) or 01625 545 745.

Changes to our privacy notices

This privacy notice is kept under regular review. If we make any changes to the way in which we process your data, we’ll make the required changes to this privacy notice and notify you by posting a banner on the Good Law Project website. If we make any very significant changes in the way we process data, we will inform you directly as well.

• This privacy notice was last updated on 25 November 2024.