When we say 'Brodies', 'we' or 'us' in this statement, it means Brodies LLP. Brodies LLP is the 'controller' of your personal information.

We collect, use and store different types of personal information about you, which we have grouped together as follows:

Types of personal information  Description 
Identity data Your name 
Contact data Where you live and how to contact you 
Transactional data  The amount you are paying and the reference number

We do not collect or store your financial data, i.e. details of the payment card that you use to make payment.

How we use your information

We use your personal information to allow performance of the contract of payment.

Where we collect your personal information from

We collect your personal information directly from you, when you populate the fields to make a payment.

Who we share your information with

We share your personal information with Worldpay, who will process the payment. 

We and Worldpay act as independent controllers of your personal data. 

Worldpay is the controller in relation to the payment card details that you provide and processing the payment. Worldpay's privacy statement can be found by clicking here.

Where you are making a DART Online Payment in relation to the recovery of a debt due to our client, we will share information on your payment with our client. We and our client act as independent controllers of your personal data. You should contact the relevant organisation if you are unsure how they use your personal information.

If you choose not to give your personal information

If you choose not to give us your personal information, we will not be able to process the payment. 

Automated decisions

We do not envisage taking any decisions about you based solely on automated processing (i.e. without human involvement), which have a legal or similarly significant effect on you.

How long we keep your personal information

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

In relation to matters in which we act for clients, we follow the guidelines issued by our regulators concerning the retention of client files. This means that we will retain those files (and your personal information within them) for a minimum period of 10 years from the date on which the matter on which you have instructed us has completed. In some areas of practice, such as real estate or wills, trusts and executries, the nature of the matters on which we are instructed, may require us to hold client files (and your personal information) for longer periods because the time periods for which legal claims can arise are much longer than 10 years. The rules that apply to determine how long it is appropriate to hold records for particular matters can be complex and varied. If you wish to know how long we may hold your particular personal information as a record of a particular matter then please email privacy@brodies.com.

International transfers

Some of the IT systems or services that we use are hosted or provided from outside the United Kingdom or may be supported by teams located outside the United Kingdom.

Where this is the case, we will usually use IT systems or services where personal information is hosted in or accessed only from countries or territories that are recognised under data protection law as providing an adequate level of protection for personal information (an approved destination) but we may process personal information in other countries or territories as well.

In all cases where we process personal information outside the United Kingdom or an approved destination then we will use appropriate safeguards in accordance with the requirements of data protection law, such as a contract with the recipient that requires them to protect that information to the same standards as if the information were being processed within the United Kingdom.

The safeguards we use will depend on the location of the recipient, the function they are performing and the personal information being transferred.

Complaints

We seek to resolve directly all complaints about how we handle personal information. If you have a complaint about how your personal information has been handled, please follow our complaints process outlined here.

In your complaint, please include your name and contact details, whether you are a client or not, the nature of the complaint and any relevant documents and background information to help us make appropriate enquiries. Please also tell us the outcome you are seeking. Please note that in appropriate cases, we may need to ask you to verify your identity as part of this process, especially if you are not an existing client.

If you submitted a complaint, we will acknowledge receipt of your complaint within 2 working days and provide you with a unique customer number to quote in future correspondence.

We aim to provide you with a substantive response to your complaint within 28 days of receiving all of the information we need to understand and investigate with your complaint. If we are unable to respond within 28 days we will advise you of this as soon as possible and explain why it has not been possible to respond within that timescale.

If you remain dissatisfied, you also have the right to lodge a complaint with the UK's Information Commissioner's Office: