Attree Estates Ltd t/as Attree & Co Privacy Notice

Date of last revision: 9 May 2018

We ask that you read this privacy notice carefully as it contains important information on who we are, how and why we collect, store, use and share personal information, your rights in relation to your personal information, and how to contact us. It also contains information on the correct body to contact in the unlikely event that you have a complaint we cannot address.

   1. Who we are

For the purposes of data protection law, the “controller” is Attree Estates Ltd (“we”). We are a. limited liability company incorporated in England and Wales under number 02037498 and with registered office address At the Offices of Laytons, Fifth Floor, 2 More London Riverside, London SE1 2AP

Our Data Protection Officer is Rebecca Attree

We are responsible for, and control the processing of, your personal data.

If you would like to contact us in relation to this notice, please send an email to rebecca@attree.co

   2. Information collected by us

“Personal data” is any information relating to an identified or identifiable individual. The table below sets out some examples of the types of personal data we will or may collect in the course of doing business with you.

Personal data we will collect

Personal data we may collect depending on why we are doing business with you

Your name, address and telephone numbers Information to enable us to check and verify your identity, e.g.  i.e. your date of birth or passport details Electronic contact details, e.g. your email address and mobile phone number Information relating to the matter in which you are seeking our mediation services, training or mediation advocacy representation Your financial details so far as relevant to your matter Information about your use of our IT, communication and other systems, and other monitoring information

Your National Insurance and tax details Your bank and/or building society details Details of your professional online presence, e.g. LinkedIn profile Details of your spouse/partner and dependants or other family members, e.g. if you have a contentious probate or family business dispute. Your employment status and details including salary and benefits, e.g. if your dispute relates to your employment or in which your employment status or income is relevant Your nationality and immigration status and information from related documents, such as your passport or other identification, and immigration information, e.g. if your dispute relates to an immigration matter Details of your pension arrangements, e.g. if your dispute relates to financial arrangements following breakdown of a relationship Information to enable us to undertake a credit or other financial checks on you Your employment records including, where relevant, records relating to sickness and attendance, performance, disciplinary, conduct and grievances (including relevant special category personal data), e.g. if your dispute relates to your employment or in which your employment records are relevant Your racial or ethnic origin, gender and sexual orientation, religious or similar beliefs, e.g. if your dispute relates to a discrimination claim Your trade union membership, e.g. if your dispute relates to a discrimination claim or your matter is funded by a trade union Your medical records, e.g. if your dispute relates to a personal injury claim

This personal data is required to enable us to provide our service to you. If you do not provide personal data we ask for, it may delay or prevent us from providing services to you.

   3. How your personal data is collected

We collect most of this information from you. However, we may also collect information:

• from publicly accessible sources, e.g. Companies House or HM Land Registry;
• directly from a third party, e.g.:
  – credit reference agencies;
  – referrers of mediation;
  – training organisations through whom we provide training.
• from a third party with your consent, e.g.:
  – your bank or building society, another financial institution or advisor;
  – consultants and other professionals we may engage in relation to your matter;
  – your employer and/or trade union, professional body or pension administrators;
  – your doctors, medical and occupational health professionals.
• via our website—we use cookies on our website
• via our information technology (IT) systems, e.g.:
  – case management, document management and time recording systems;
  – automated monitoring of our websites (such as Google Analytics) and other technical systems, such as our computer networks and connections, communications systems, email and instant messaging systems;

   4. How and why we use your personal data

Under data protection law, we can only use your personal data if we have a proper reason for doing so, e.g.:

• to comply with our legal and regulatory obligations;
• for the performance of our contract with you or to take steps at your request before entering into a contract;
• for our legitimate interests or those of a third party; or
• where you have given consent.

A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests.

The table below explains what we use (process) your personal data for and our reasons for doing so:

What we use your personal data for	Our reasons
To provide mediation, mediation advocacy and training services to you	For the performance of our contract with you or to take steps at your request before entering into a contract
Conducting checks to identify our clients and verify their identity Screening for financial and other sanctions or embargoes Other processing necessary to comply with professional, legal and regulatory obligations that apply to our business e.g. under health and safety regulation or rules issued by our professional regulator	To comply with our legal and regulatory obligations
Gathering and providing information required by or relating to audits, enquiries or investigations by regulatory bodies	To comply with our legal and regulatory obligations
Ensuring business policies are adhered to e.g. policies covering security and internet use	For our legitimate interests or those of a third party, i.e. to make sure we are following our own internal procedures so we can deliver the best service to you
Operational reasons, such as improving efficiency, training and quality control	For our legitimate interests or those of a third party, i.e. to be as efficient as we can so we can delivery the best service for you at the best price
Ensuring the confidentiality of commercially sensitive information	For our legitimate interests or those of a third party, i.e. to protect our intellectual property and other commercially valuable information To comply with our legal and regulatory obligations
Statistical analysis to help us manage our practice, e.g. in relation to our financial performance, client base, work type or other efficiency measures	For our legitimate interests or those of a third party, i.e. to be as efficient as we can so we can delivery the best service for you at the best price
Preventing unauthorised access and modifications to systems	For our legitimate interests or those of a third party, i.e. to prevent and detect criminal activity that could be damaging for us and for you To comply with our legal and regulatory obligations
Updating and enhancing client records	For the performance of our contract with you or to take steps at your request before entering into a contract To comply with our legal and regulatory obligations For our legitimate interests or those of a third party, e.g. making sure that we can keep in touch with our clients about existing and new services
Statutory returns	To comply with our legal and regulatory obligations
Ensuring safe working practices, staff administration and assessments	To comply with our legal and regulatory obligations For our legitimate interests or those of a third party, e.g. to make sure we are following our own internal procedures and working efficiently so we can deliver the best service to you
Marketing our services to: —existing and former clients; —third parties who have previously expressed an interest in our services; —third parties with whom we have had no previous dealings.	For our legitimate interests or those of a third party, i.e. to promote our business to existing and former clients
Credit reference checks via external credit reference agencies	For our legitimate interests or a those of a third party, i.e. for credit control and to ensure our clients are likely to be able to pay for our services
External audits and quality checks by auditors, regulators and providers of accreditation	For our legitimate interests or a those of a third party, i.e. to maintain our accreditations so we can demonstrate we operate at the highest standards To comply with our legal and regulatory obligations

   5. Who we share your personal data with

We may provide your personal information to the following recipients for the purposes set out in this notice:

• our employees, consultants, agents, insurers and brokers, banks, external auditors and service providers
• law enforcement agencies in connection with any investigation to comply with our legal and regulatory obligations.

   6. Where your personal data is held

Information may be held at our offices, third party agencies, service providers, representatives and agents as described above (see ‘Who we share your personal data with’).

Some of these third parties may be based outside the European Economic Area. For more information, including on how we safeguard your personal data when this occurs, see below: ‘Transferring your personal data out of the EEA’.

How long your personal data will be kept

We will keep your personal data after our business relationship with you has ended. We will do so for one of these reasons:

• to respond to any questions, complaints or claims made by you or on your behalf;
• to show that we treated you fairly;
• to keep records required by law.

We will not retain your data for longer than necessary for the purposes set out in this policy. Different retention periods apply for different types of data. Further details on this are available on request.

When it is no longer necessary to retain your personal data, we will delete or anonymise it.

   7. Marketing

We may store your contact details, and carry out marketing profiling activities, for direct marketing purposes. If you have given your consent, or if we are otherwise permitted to do so, we may contact you about our products or services that may be of interest to you. If you prefer not to receive any direct marketing communications from us, you can opt out at any time by sending an email to rebecca@attree.co

   8. Transferring your personal data outside the EEA

While we are based in England, we may transfer your personal information to a location (for example to a secure server) outside the European Economic Area, if we consider it necessary or desirable for the purposes set out in this notice. In such cases, to safeguard your privacy rights, transfers will either be made to recipients to which a European Commission adequacy decision applies (this is a decision from the Commission confirming that adequate safeguards are in place for the protection of personal data), or who meet the requirements of the EU General Data Protection Regulation.

   9. Keeping your personal information secure

We have appropriate security measures in place to prevent personal information from being accidentally lost, or used or accessed in an unauthorised way.

Your information rights

We draw your attention to your following rights under data protection law:

• the right to be informed about the collection and use of your personal data;
• the right of access to your personal data, and to request a copy of the information that we hold about you and supplementary details about that information;
• the right to have inaccurate personal data that we process about you rectified;
• the right (in certain circumstances) to have personal data that we process about you blocked, erased or destroyed;
• the right to object:
  – to processing of personal information concerning you for direct marketing;
  – to decisions being taken by automated means which produce legal effects concerning you or that similarly significantly affect you;
  – in certain other situations, to our continued processing of your personal information;
• the right of portability of your data in certain circumstances;
• rights in relation to automated decision-making.

These rights are subject to certain limitations that exist in law. Further information about your information rights is available on the ICO’s website: https://ico.org.uk/.

If you would like to exercise any of those rights, please:

• complete a data subject request form; or
• email, call or write to our Data Protection Officer; and
• let us have enough information to identify you including full name, address and client or matter reference number if available);
• let us have proof of your identity and address (a copy of your driving licence or passport and a recent utility or credit card bill); and
• let us know what right you want to exercise and the information to which your request relates.

   10. Changes to this privacy notice

We may change this notice from time to time. You should check this notice on our website regularly to ensure you are aware of the most recent version.

   11. How to complain

If you have a complaint about the way we handle your personal data, please contact us at the address in paragraph 1 of this policy. In addition, should you find it necessary, you have a right to raise a concern with the information regulator, the Information Commissioner’s Office: https://ico.org.uk/.