When we say 'Brodies', 'we' or 'us' in this statement, it means Brodies LLP. Brodies LLP is the 'controller' of your personal information.

When we may carry out Identity and Verification (IDV) checks

We may carry these out in the following situations:

  • Where we are taking you on as a client (or any person acting with delegated authority or under a power of attorney);
  • Where you are a director, officer, partner, other person with executive authority, secretary, member, shareholder, beneficial owner, other owner, person with significant control or senior person responsible in a company, other body corporate, or an organisation which we are taking on as a client (e.g. partnerships and other unincorporated businesses);
  • Where you are a settlor, trustee, protector or other person with a power to appoint or remove trustees, named beneficiaries of a trust or any person entitled to receive a distribution from the trust which we are taking on as a client;
  • Where you are not a client and we are receiving a payment from you or making a payment to you;
  • Whether or not you are a client, where we are involved in facilitating an arrangement / contract and you are making or receiving a payment in relation to that arrangement or contract, whether or not that payment is being received into or made via our client account;
  • Where we are updating or refreshing IDV checks previously carried out.

How we may carry out IDV checks

Our preference is to use a third party, Amiqus, which provides an electronic IDV platform. This platform allows us to arrange for a link to be sent directly to you to allow you to upload the necessary information we need via an online portal. Amiqus uses facial recognition technology to verify your identity against the photograph contained in your ID document, such as a passport or driving licence.

For the purposes of data protection law, Amiqus acts as our processor. Please click on this link for a description of the data that Amiqus will collect and with whom it will be shared.

If we offer Amiqus to assist in carrying out the IDV check, at the start, you will be asked to provide your consent to your data being processed before accessing the Amiqus IDV service.

If you do not consent to using Amiqus, Brodies can carry out the IDV check manually, which may involve you being asked to provide us with certified copies of your identification documents and us verifying who you are via online or in person meetings.

As part of our IDV checks, your name, address history and date of birth will be provided to TransUnion Information Group companies (“TransUnion”).

TransUnion will use your name, address history and date of birth to carry out the IDV check. If you use Amiqus (or we do the check with Amiqus on your behalf), then Amiqus will provide your data to TransUnion and Amiqus’ data subject terms will apply. Otherwise, we will provide that data to TransUnion via Creditsafe (another of our electronic IDV and AML screening providers).

You can find out how TransUnion uses your personal data (and the results of their checks using that data) in the TransUnion Bureau Privacy Notice at https://www.transunion.co.uk/legal/privacy-centre.

Types of personal information we collect for IDV purposes

Types of personal information Description
Identity Data

ID information including your name, marital status, title, date of birth, gender and National Insurance Number, ID document number
Contact Data Where you live
Publicly Available Data

Details about you that are publicly available, such as on Companies House or elsewhere on the internet


If you have agreed to use Amiqus, we will in addition collect:

  • A record of your consent to the use of Amiqus; and
  • Special Category Data; namely biometric data for the purposes of identification.

How we use your information

The table below outlines how we use your personal information and our reasons. Where these reasons include legitimate interests, we explain what these legitimate interests are.

What we use your information for Our reasons Our legitimate interests
  • To carry out identity verification
  • Legal obligation
  • Legitimate interests
  • To engage you or your organisation as a client and allow us to provide you or your organisation with legal services
  • To protect our reputation
  • To ensure that we can lawfully receive payments from, or make payments to, you
  • To carry out ongoing monitoring of any changes to the data which you have provided
  • Legal obligation
  • Legitimate interests
  • To continue to be able to provide legal services to you
  • To ensure that we can continue lawfully to receive payments from, or make payments to, you
  • To protect our reputation
  • To prevent crime
  • Legal obligation
  • Legitimate interests
  • To manage the risk of crime (including fraud) for us, our employees and our clients
  • To develop and improve how we deal with crime
  • To report criminality or the suspicion of criminality for the wider benefit of society
  • To be efficient about how we fulfil our responsibilities generally


Where Amiqus is used to carry out the IDV check, we rely on your explicit consent as the legal basis for processing of your biometric data for the purposes of identification.

Where we collect your personal information from

We may collect personal information about you from the following sources:

  • Directly from you;
  • From Amiqus, where you have consented to using Amiqus for the IDV check;
  • Organisations or other businesses that introduce you to us, such as referrals from other law firms, professional advisors, and financial institutions;
  • Credit reference agencies and fraud prevention agencies, including Creditsafe and (via Amiqus and Creditsafe) TransUnion;
  • Public registrars and public information repositories, such as Companies House and Registers of Scotland;
  • The internet and social networking sites such as LinkedIn;
  • Intermediaries with whom you are also a client;
  • Other solicitors, intermediaries, expert witnesses, courts, adjudicators, arbiters and others that we engage (or have engaged us) in connection with the products and services that we provide to you.

Who we share your information with

We may share your personal information with the following third parties:

  • Our electronic IDV service providers (a) Amiqus and/or Creditsafe for the purposes of carrying out IDV checks, including photo ID and address verification, adverse media, sanctions and Politically Exposed Person screening, ongoing monitoring and to allow for technical support in relation to IDV checks and screening; and (b) TransUnion (via Amiqus or Creditsafe) for the purpose of address checking; 
  • The police and other law enforcement agencies, HMRC and other government bodies where we have a legal or regulatory obligation to do so;
  • Public registrars and public information repositories, such as Companies House and Registers of Scotland;
  • Relevant regulators, including the Information Commissioner's Office, the Scottish Legal Complaints Commission, the Law Society of Scotland and the Solicitors Regulation Authority;
  • Our insurers or insurance brokers in the event of an actual or potential claim;
  • Credit reference agencies and fraud prevention agencies;
  • Subsidiaries or affiliates of Brodies LLP and Brodies & Co (Trustees) Limited and any of its subsidiaries or affiliates;
  • Potential or actual purchasers of any part of our business or assets, or other third parties in the context of a possible transfer or restructuring of our business.

If you choose not to give your personal information

Where we need to collect personal information from you to meet our legal obligations – for example to carry out anti-money laundering checks, or comply with sanctions rules – or under the terms of a contract we have with you, and you fail to provide that data when requested, it may delay or prevent us from being able to perform the contract we have entered into with you, or to make a payment to you, and/or comply with our own legal obligations. If you are an actual or prospective client, in some cases, we may be unable to act for you or may have to withdraw from acting.

Automated decisions

We do not envisage taking any decisions about you based solely on automated processing (i.e. without human involvement), which have a legal or similarly significant effect on you.

How long we keep your personal information which we collected for the IDV checks

If you are…

We will retain your personal information for...
A client or an individual within a client organisation and the IDV check was for the purposes of our client onboarding checks 5 years from completion of the service for which we were instructed

An individual (who is not a client) from whom we received a payment or to whom we made a payment

 5 years from completion of the service for which we were instructed in relation to which the payment was received or made
An individual (whether or not a client), where we are involved in facilitating an arrangement / contract and you are making or receiving a payment in relation to that arrangement or contract, whether or not that payment is being made via or received into our client account 5 years from completion of the service for which we were instructed in relation to which you made or received the payment


Further information

Further information about how we handle your personal information, including our use of your personal data for other purposes, the reasons we rely on to do so and the rights you have under Data Protection Law can be found in our privacy statement which is accessible here brodies.com/privacy-notice.

International transfers

Some of the IT systems or services that we use are hosted or provided from outside the United Kingdom or may be supported by teams located outside the United Kingdom.

Where this is the case, we will usually use IT systems or services where personal information is hosted in or accessed only from countries or territories that are recognised under data protection law as providing an adequate level of protection for personal information (an approved destination) but we may process personal information in other countries or territories as well. In all cases where we process personal information outside the United Kingdom or an approved destination then we will use appropriate safeguards in accordance with the requirements of data protection law, such as a contract with the recipient that requires them to protect that information to the same standards as if the information were being processed within the United Kingdom.

The safeguards we use will depend on the location of the recipient, the function they are performing and the personal information being transferred.

Complaints

We seek to resolve directly all complaints about how we handle personal information. If you have a complaint about how your personal information has been handled, please follow our complaints process outlined here.

In your complaint, please include your name and contact details, whether you are a client or not, the nature of the complaint and any relevant documents and background information to help us make appropriate enquiries. Please also tell us the outcome you are seeking. Please note that in appropriate cases, we may need to ask you to verify your identity as part of this process, especially if you are not an existing client.

If you submitted a complaint, we will acknowledge receipt of your complaint within 2 working days and provide you with a unique customer number to quote in future correspondence.

We aim to provide you with a substantive response to your complaint within 28 days of receiving all of the information we need to understand and investigate with your complaint. If we are unable to respond within 28 days we will advise you of this as soon as possible and explain why it has not been possible to respond within that timescale.

If you remain dissatisfied, you also have the right to lodge a complaint with the UK's Information Commissioner's Office: