When we say 'Brodies', 'we' or 'us' in this notice, it means the entity which you or your organisation are supplying, being either Brodies LLP or Brodies Middle East LLP (ADGM Branch) which is Brodies Middle East LLP's branch in the Abu Dhabi Global Market. That entity (either Brodies LLP or Brodies Middle East LLP (ADGM Branch)) is the 'controller' of your personal information.

We collect, use and store different types of personal information about you, which we have grouped together as follows:

Types of personal information Description                                                             
Identity Data  ID information including your name, marital status, title, date of birth, gender and National Insurance Number 
Contact Data Where you live and how to contact
Financial Data Your financial position and history, including bank details and credit rating
Transactional Data Details about payments to and from and other details about services you purchase from us 
Communications Data What we learn about you from letters, emails, call recordings and conversations between us 
Publicly Available Data Details about you that are publicly available, such as on Companies House or elsewhere on the internet 
Consents Data Any permissions, consents or preferences that you give us 

How we use your information

The table below outlines how we use your personal information and our reasons. Where these reasons include legitimate interests, we explain what these legitimate interests are.

What we use your information for  Our reasons  Our legitimate interests 
  • To receive the products or services you provide to us 
  • Contractual performance 
  • Legal obligation
  • Legitimate interests
  • For firm management
  • To maintain access and control records
  • For incident/breach reporting, management and investigate
  • To fulfil our contractual obligations
  • Contractual performance
  • Legitimate interests
  • To comply with our contractual obligations to you and your organisation
  • To properly manage the risks and liabilities associated with the contracts we are party to 
  • To comply with laws and regulations that apply to us 
  • To protect our reputation 
  • To enforce the terns if our contract with you 
  • Contractual performance
  • Legitimate interest
  • To ensure that we benefit from the terms of the contract we have entered into and properly manage the risks and liabilities associated with them 
  • For procurement purposes, including supplier due diligence, background checks and the assessing of tenders
  • To carry out credit checks 
  • Contractual performance
  • Legitimate interests
  • Our legal duties 
  • To meet our contractual obligations to you or your organisation
  • To ensure that we benefit from the terms of the contracts we have entered into and properly manage the risks and liabilities associate with them
  • To comply with laws and regulations that apply to us
  • To establish, enforce and defend legal claims 
  • Consent
  • Contractual performance
  • Legitimate interests
  • To manage our business efficiently and properly in accordance with normal business practices, legal requirements and to optimise its value for shareholders
  • To ensure that we run our business in accordance with good business principles and meet corporate governance, accounting and audit standards 
  • For prevention of crime and public safety, including through the use of CCTV
  • Legal obligation
  • Legitimate interests
  • To manage the risk of crime and safety for us, our employees and our clients
  • To develop and improve how we deal with crime
  • To report criminality or the suspicion of criminality for the wider benefit of society
  • To be efficient about how we fulfil our responsibilities generally 

Where we collect your personal information from

We may collect personal information about you from the following sources:

  • Directly from you or the organisation for whom you work
  • Companies or individual that tell you about us
  • Publicly available resources, such as Companies House and Registers of Scotland
  • The internet and social networking sites such as LinkedIn
  • Third parties with whom we deal with during the course of carrying on our business
  • Market researchers
  • Intermediaries such as other professional firms who know you

Who we share your information with:

We may share your personal information with the following third parties:

  • If you are a supplier (or work for one) to Brodies Middle East LLP (ADGM Branch), personal data will be shared with Brodies LLP whicho will act as a processor in relation to its provision of human resource, IT, finance and other services to Brodies Middle East LLP (ADGM Branch)
  • Agents and service providers that we use during the course of providing legal services, including Mimecast and Concep 
  • Our professional advisors
  • Other suppliers to the firm
  • The police and other law enforcement agencies
  • Relevant regulators, including the Information Commissioner's Office in the event of a persoanl data breach
  • a) Subsidiaries or affiliates of Brodies LLP, (b) Brodies Middle East LLP (ADGM Branch), or any of its subsidiaries or affiliates, and (c) Brodies & Co (Trustees) Limited and any of its subsidiaries or affiliates  
  • Potential or actual purchasers of any part of our business or assets, or other third parties in the context of a possible transfer or restructuring of our business

If you choose not to give your personal information

If you choose not to give us your personal information, it may delay or prevent us from being able to comply with our own legal obligations. It may also result in us being unable to, or refusing to, engage you or your organisations a supplier.

Automated decisions

We do not envisage taking any decisions about you based solely on automated processing (i.e. without human involvement), which have a legal or similarly significant effect on you.

How long we keep your personal information

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

In general terms, we will hold your personal information for so long as you or the organisation for whom you work continue to provide us with products and services and for an additional period of 10 years thereafter.

International transfers

Brodies LLP

We use ancillary IT systems hosted outside the United Kingdom or where data is backed up in a data centre outside the United Kingdom.

If your information is to be processed outside the United Kingdom, then we will ensure that it is protected to the same standards as if it were being processed within the United Kingdom by using appropriate safeguards, which may include:

  • ensuring that your information is only transferred to countries that have been recognised under data protection law as adequately protecting personal information to the same standards as the United Kingdom (for example, the European Union or European Economic Area).
  • putting in place a contract with the recipient of your information which requires them to protect that information to the same standards as if the information were being processed within the United Kingdom.

The safeguards we use will depend on the location of the recipient, the function they are performing and the personal information being transferred.

Brodies Middle East LLP (ADGM Branch) 

Where Brodies Middle East LLP (ADGM Branch) is the controller of your personal data under our notices, personal information will be held within the Abu Dhabi Global Market. We will only send your personal data outside of the Abu Dhabi Global Market to Brodies LLP within the United Kingdom (see Who we share your information with). The United Kingdom is considered an 'adequate jurisdiction' by the Abu Dhabi Global Market Office of Data Protection.