Privacy Policy

Rothera Bray Privacy Information Policy

Rothera Bray are a firm of Solicitors providing legal services as detailed on our website.

We are a data controller (see contact details below). This means we decide how your personal data is processed and for what purposes.

Rothera Bray has created this Privacy Information Policy because we take your privacy very seriously. We always treat any personal details you give us as confidential.

The policy sets out who we are, what information we collect from you, how we use it and your data rights.

Introduction

We are committed to being transparent about how we handle your personal information, to protecting the privacy and security of your personal information and to meeting our data protection obligations under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

The purpose of this privacy notice is to make you aware of how and why we will collect and use your personal information during and after your working relationship with us. We are required under Data Protection Legislation to notify you of the information contained in this privacy notice.

This privacy notice applies to:

• Current and former clients
• Individuals making enquiries
• Current and former employees
• Workers and contractors

Rothera Bray has a Data Protection Team to oversee compliance with this Privacy Policy.

For further information please contact us at dataprotection@rotherabray.co.uk or ring (0115) 9100600 and ask to speak to a member of our Data Protection Team.

Richard Hammond r.hammond@rotherabray.co.uk has overall responsibility for Rothera Bray’s Privacy Information Policy.

Data protection principles

Under the data protection legislation, there are six data protection principles that Rothera Bray must comply with.

1. Processed lawfully, fairly and in a transparent manner.
2. Collected only for legitimate purposes clearly explained to you and not further processed in a way incompatible with those purposes.
3. Adequate, relevant and limited to what is necessary in relation to those purposes.
4. Accurate and, where necessary, kept up-to-date.
5. Kept in a form which permits identification for no longer than necessary.
6. Processed in a way that ensures appropriate security of the data.

We are responsible for, and must be able to demonstrate compliance with, these principles. This is called accountability.

What is personal data?

Personal data relates to any living individual who can be identified from that data.
Identification can be by the information alone or in conjunction with other information.

Personal data can include:

• Name
• Date of birth
• Address and IP address
• National Insurance number
• Medical records
• Information retained on file

Our basis for processing your personal data

Our legal basis for collecting and storing your personal data is to provide legal advice.
Our right to retain that data is based on legitimate interest, specifically to establish,
exercise or defend our legal rights in relation to legal advice provided.

How we store your data

Electronic client data is stored within our file management system, InTouch and Actionstep,
which contains all file details including personal data, letters, documents, emails and ledgers.
This system is situated within the European Economic Area (EEA).

Paper-based data is kept securely in lockable filing cabinets at the office where work is carried out.

How do we protect your data?

All paper and electronic data is stored securely and destroyed securely.
We protect personal data from loss, misuse, unauthorised use and disclosure through:

• Internal policies
• Staff training
• Technical security measures
• A dedicated Data Protection Policy

Our servers are stored in a secure on-site room and protected within a secure MPLS network environment with firewall protection and Sophos security administration.

Destruction of data

Paper waste is destroyed securely on site by a confidential waste company.

Archived paper files stored off-site are securely destroyed by the hosting third-party company.

Enquiries

If you provide personal data through our website, it will only be used to respond to your enquiry.

Enquiry-related personal data will be retained on our File Management System for 6 years prior to destruction.

We do not share your personal data with third parties except where necessary to answer your enquiry and with your written consent where required.

Legal advice clinics

As part of our legal services, we attend legal advice clinics providing free initial advice.
Personal data collected is limited to information necessary to provide that advice.

This data is retained for 6 years prior to destruction on the basis of legitimate interest.

Clients (lawful processing)

Rothera Bray processes client personal data for the duration of instructions under a signed Terms of Business letter.

Our Terms of Business and Service Commitments Leaflet details:

• Confidentiality obligations
• Your data protection rights
• Information sharing requirements with third parties

Communicating with third parties for clients

We may need to share personal data with third parties in order to represent your legal interests appropriately.

Examples include:

• Barristers
• Costs draftsmen
• Experts
• Courts and online legal portals

All third parties are required to provide satisfactory evidence of secure data handling.

Personal data retention policy for clients

We reserve the right to retain file records and data for the establishment, exercise or defence of legal claims.

• Conveyancing purchases – 15 years
• Family cases – 7 years
• Children cases – 15 years
• Trusts – 15 years
• Wills/Enduring Powers of Attorney – Never destroyed
• All other matters – 6 years

Storage of deeds

Rothera Bray will retain deeds in our deeds storage system until requested for release.

Storage of Wills

Rothera Bray will retain Wills in our Wills storage system until requested for release.

Marketing

Individuals attending Rothera Bray events provide express informed consent for us to hold relevant personal data through a “Double Opt-in” process.

Clients only receive service information where they have specifically requested it or provided express informed consent.

Data protection

Our legal basis for collecting, processing and storing personal data is legitimate interest for:

• Provision of legal services
• Client record management
• Practice analysis and administration
• Statutory returns
• Legal and regulatory compliance
• Anti-money laundering and anti-terrorist financing obligations

You have the right of access under GDPR to the personal data we hold about you.

Marketing communications can be opted out of at any time using unsubscribe links or by contacting: marketing@rotherabray.co.uk

Our Data Protection Team can be contacted at: dataprotection@rotherabray.co.uk

Marketing data is managed using Mailchimp under an EEA-compliant data processing agreement.

Marketing data retention policy

Marketing personal data is retained in accordance with express consent and reviewed every 12 months.

Client satisfaction questionnaires are retained for 6 months before secure destruction.

Employees and former employees

Rothera Bray maintains a separate employee privacy notice available internally and on request for former employees.

Employee data

Paper data is stored securely in lockable filing cabinets.
Electronic data is stored within the People HR cloud-based portal hosted within the EEA.

Retention of employee data

• General employee data – 6 years after employment ends
• Payroll data – 3 years
• Specific medical data – up to 40 years

Retention of applicant data

Applicant data is retained for 3 months and then securely destroyed.

Your rights and your personal data

You have the right to request a copy of your personal data through a Data Subject Access Request (DSAR).

Other statutory rights include:

• Right to rectification
• Right to erasure (“right to be forgotten”)
• Erasure of children’s personal data
• Right to restrict processing
• Right to portability
• Right to object to processing

Breach of your data rights

If you believe your data rights have been breached, please contact our Data Protection Team.

Cookie policy

Cookies are small files placed on your device to help websites function and analyse traffic.

We use cookies to:

• Analyse website traffic
• Improve website performance
• Tailor services to customer needs

Cookies do not provide access to your computer or personal information beyond what you choose to share.

You can accept or decline cookies through your browser settings.

Contact Details

Data Protection Team
Rothera Bray
2 Kayes Walk, Stoney Street
The Lace Market
Nottingham
NG1 1PZ

Email: dataprotection@rotherabray.co.uk

Telephone: 0115 9100600

Lodging a complaint with the ICO

You have the right to contact the Information Commissioner’s Office (ICO):

• Telephone: 0303 123 1113
• Website: https://ico.org.uk/global/contact-us/
• Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Further processing

If we wish to use your personal data for a new purpose not covered by this policy,
we will provide a new notice explaining the processing and seek consent where necessary.

Changes to Privacy Information Policy

Internet and data privacy practice continually evolves. We reserve the right to revise this policy at any time.

Updated versions will be posted on this page.

By using this website, you consent to the collection and use of personal information as set out above.

Updated February 2025