Good Law Project Privacy Notice for Individuals

At Good Law Project, we are committed to protecting your privacy and have a Privacy Notice for everyone who visits our site, campaigns alongside us or shares information with us in other ways. But we take particular care when we work with whistleblowers, people in difficult circumstances, people asking us for help, or claimants taking part in litigation that we support. This privacy notice applies to these people, who we’ll call “Individuals”.

We take looking after your information very seriously. This privacy notice explains how we collect and process your personal information.

Who are Individuals in this privacy notice?

Good Law Project refers to Individuals as: 

• people who reach out to us seeking our help and support. 
• people who get in touch to bring our attention to specific instances of wrongdoing within an organisation.
• people who we reach out to in relation to our litigation or because they may act as claimants in litigation we support.

When Individuals reach out to Good Law Project, we follow a triage process to make sure that the cases we take forward align fully with our organisational mission and values. We are likely to engage with only a small number of people who contact us as claimants or informants. Good Law Project may however store the data of all Individuals in accordance with Good Law Project’s retention periods (see “How long do we store your information for?” below).

What personal data does Good Law Project collect from me?

Your personal data is defined as any information that can directly or indirectly identify you. The personal information collected by Good Law Project is any information you provide us with, including your name, contact details, place of work if relevant and any information that you share in your enquiry. 

Your enquiry may include special category data such as information regarding race, ethnicity, health data, or criminal records data.

When Good Law Project reaches out to you in relation to our litigation or because you may act as a claimant in litigation we support, we collect similar information.

How and when do we collect such information from you?

Good Law Project collects information about you in the following ways:

• when you reach out to us through the contact form on our website.
• when you email us directly with your enquiry.
• when you reach out to us on social media channels.
• when you call us by phone or get in touch with one of our staff members via applications such as WhatsApp or Threema.
• when we reach out to you in relation to our litigation programme or because you may act as a claimant in litigation we support.
• when you express an interest to become involved in litigation we support.

If we’re working with you on potential litigation, actual litigation or as part of our wider work, we will collect further information as the work develops.

Sharing of information

At Good Law Project, we handle your data with utmost care and take all necessary steps to keep it confidential. We will never sell your details to any third party.

If we decide to work with you on a legal issue, we may share your information with an external partner law firm. We would share such information only with your consent. 

We may discuss naming you in our legal campaigns. You would be part of this decision and we would only name you after you have given us your consent.

We engage with several third parties to process your personal data. These third parties act as data processors of your data. Good Law Project will either sign a data processor agreement with such processors or will review the terms and conditions of such processors’ agreements to ensure compliance with Data Protection legislation.

Further, where personal data is stored outside of the UK and the EEA, safeguards to protect personal data may include but are not limited to the UK Addendum used in conjunction with the EU Standard Contractual Clauses (SCCs), or UK International Data Transfer Agreement (IDTAs). Such safeguards will be subject to Transfer Risk Assessments (TRAs).

We will engage the following third parties for our activities:

• CRM: Salesforce is our CRM, which would help us store data of our claimants,  stakeholders, partners, supporters and those involved in our wider work. 
• Communications: We use Mailchimp to communicate en masse with individuals, e.g. where we have to contact a large number of individuals who’ve expressed an interest to become a claimant in litigation we support. We use Front to manage incoming emails from individuals and to reach out to individuals on an one-to-one basis. 
• Expression of interest: We use Typeform, WordPress, and Front to collect expressions of interest from individuals who wish to take part in litigation we support. 
• ID verification and eSignatures: Where an individual wishes to come on board as a claimant in litigation we support, we use DocuSign to verify their identity and to ask them to sign any legal documents, such as their agreement to assign their legal claim to Good Law Project. 
• Integrations: We sometimes use Zapier to integrate platforms and automate data flows between systems. For example, we may use Zapier to send relevant information from Typeform to Salesforce. 
• Cookies: For how we use cookies, please see the section on cookies in our privacy notice for those who visit our website. 

What lawful basis do we use to process your data?

• When we decide to work with you, we rely on our legitimate interest in supporting you, as we only take forward matters that align with our organisational goals.
• When you reach out to Good Law Project but we are unable to support you, we rely on our legitimate interest to retain your data in line with our retention periods (see “How long do we store your information for?” below).
• When we share your data with our partner law firms, we rely on your consent for sharing such data.
• To process any special category data or to share such data, we rely on Article 9(2)(d), “not for profit condition”. 

When we rely on legitimate interest, we will undertake a balancing assessment to make sure that we process your data in line with your rights (see “Your rights” below).

Keeping your information safe

Good Law Project limits access to information you share with us for internal use only unless you have consented otherwise (see “What lawful basis do we use to process your data?” above).

When we are provided with your personal information, steps are taken to ensure that it is treated securely. Electronic data is stored securely and is accessed via password-protected computers that are used only by our employees.

We take looking after your information very seriously. We have put appropriate physical, technical and organisational measures in place to make sure that your personal information is secure when under our control, both on and offline, from improper access, use, alteration, destruction and loss.

How long do we store your information for?

If we proceed to work with you in relation to our litigation or because you may act as a claimant in litigation we support, we will store your details for six years after our last engagement with you.

If we do not proceed to support you with your matter, we will store your data for 12 months in line with our retention periods.

In all other cases of your interaction with us, we will store your data in line with retention periods specified in the Good Law Project Retention Policy.

Your rights

Under data protection laws in the UK and EU, you have certain rights over the personal information that we hold about you. If you would like to exercise your rights, please get in contact using the details listed below. Here is a summary of the rights we think apply:

Right to be informed
You have the right to be informed as to how we use your data and under what lawful basis we carry out any processing. This privacy notice sets this information out. However, if you would like further information, please get in touch.

Right of erasure – also known as the right to be forgotten
You may ask us to delete some or all of the information we hold about you. Sometimes, where we have a legal obligation, we cannot erase your personal data.

Right to object
You have the right to object to processing where we are using your personal information, such as where the processing is based on legitimate interests.

Right to correct inaccurate personal information
Inaccurate or incomplete information we hold about you can be corrected.

Right of restriction
You have a right to restrict the processing of some or all of your personal information if there is a disagreement about its accuracy, or if we are not lawfully allowed to use it.

Right to access your information
You have a right to request access to a copy of the personal information that we hold about you, along with the information on what personal information we use, why we use it, who we share it with, how long we keep it for and whenever it has been used for automated decision-making. You can make a request for access free of charge, but we’ll need a proof of your identity.

Automated decision-making
Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. You have the right to question the outcome of automated decisions that may create legal effects or create a similar significant impact on you.

Right to withdraw consent
Where you have provided consent to our use of your data, you also have the right to withdraw that consent at any time. This means that we will stop processing your data.

Making a complaint

If you think your rights have been breached or you are not happy with the ways we handle your data, you can raise a complaint by contacting our Data Protection Officer at sofiya@hope-may.com.

Any questions or concerns that may not require a formal complaint can be passed on via our contact page.

You can also contact the Information Commissioner’s Office by writing to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF or by telephone on 0303 123 1113 (local rate) or 01625 545 745.

Changes to our privacy notices

This privacy notice is kept under regular review. If we make any changes to the way in which we process your data, we’ll make the required changes to this privacy notice and notify you by posting a banner on the Good Law Project website. For any very significant changes in the way we process data, we will inform you directly as well.

This privacy notice was last updated on 8 October 2024.