Privacy Policy overview
This Privacy Policy explains the personal data we collect on you, how we store and handle that data to keep it safe, and who we may share that information with. The policy also sets out your rights as a data subject, including how to complain if you feel that LCN has not handled your data correctly.
About Us
The Law Centres Network is the trading name of the Law Centres Federation, a registered charity (no. 1088588) and company limited by guarantee registered in England and Wales (no. 2433492).
We want you to be fully informed about your rights and how the Law Centres Network uses your data. We hope that the following sections will answer any questions you have. If not, you can contact us using the following details:
Telephone: 0203 637 1330
Email: info@lawcentres.org.uk
Address: 1 Lady Hale Gate, Gray's Inn, London WC1X 8BS.
When do we Collect Your Data
We collect your data when you provide it to us or if it has been shared with us by other agencies (e.g. if you make a donation via our Just Giving page). You may give us your data when you visit our website and online platforms; send us an email; complete an online web form or paper form; over the telephone; face to face; or by post. The systems and tools we use to collect data are listed below.
Owned and managed by Law Centres Network
LCN website: When you visit our website and use our web forms
Members platform: When personnel from across the Law Centres Network access our internal Members' platform
LCN Conference Platform: When you access our online Annual Conference platform.
Law for All Campaign website: When you visit the campaign page for the Law Centres 50th Anniversary.
Law Centre Design System (no data is collected): This guide acts as a reference for the design of common styles, components, and patterns for Law Centre digital projects and products.
EnquiryDesk: When you submit an enquiry through our online web forms, email or telephone.
SMS Tool: Used by Law Centres to communicate with clients.
Third Party Tools used by the Law Centres Network to collect data
Eventbrite (Eventbrite Privacy Policy): When you sign up to our events and training
Form Assembly (Form Assembly Privacy Policy
): When you contact LCN using online forms and surveys
MailChimp (MailChimp Privacy Policy): When you sign up to receive our Supporters e-newsletter and update your mailing preferences
Just Giving (Just Giving Privacy Policy): When you make a donation to LCN or any associated campaigns
PayPal (PayPal Privacy Policy): When you make a donation to LCN or any associated campaigns
Microsoft 365 (Microsoft Privacy Policy): When you email LCN staff or general emails e.g.info@lawcentres.org.uk
Processing your data
What sort of data do we collect and how do we use it?
The type of data we collect depends on why we are processing your data. This may include:
Name
Email
Information about your enquiry to LCN (e.g. volunteering, setting up a Law Centre, asking for legal advice, media enquiries, other)
Address (e.g. when providing donations)
Payment Amount (e.g. when making donations)
Marketing preferences (e.g. for newsletters and LCN communications).
Tracking and Analytics (e.g. when accessing our websites and online platforms).
We only use your data for the purposes for which it was provided. For instance:
Website visitors
When you visit our website and online platforms, some tracking and analytic information is captured by third-party tools we have adopted to help monitor usage of our systems. This includes:
Technical data – this may include your login data, internet protocol addresses, browser type and version, browser plug-in types and versions, time zone setting and location, operating system and platform and other technology on the devices you use to access this site
Usage Data: this may include information about how you use our website, products and services
Hotjar
Hotjar is a technology service that helps us better understand our users’ experience (e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc.). Hotjar enables us to build and maintain our service with user feedback. Hotjar uses cookies and other technologies to collect data on our users’ behaviour and their devices. This includes a device's IP address (processed during your session and stored in a de-identified form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), and the preferred language used to display our website. Hotjar stores this information on our behalf in a pseudonymized user profile. Hotjar is contractually forbidden to sell any of the data collected on our behalf.
For further details, please see the ‘about Hotjar’ section of Hotjar’s support site.
Google Analytics and Cookies
The Law Centres Network also uses Google Analytics and cookies in order to analyse how the website is used and improve our service and your user experience. Aside from the approximate location (IP address), the information collected by Google Analytics is mostly anonymous and relates to site traffic, including browser information, device information and language.
You can choose to accept or decline cookies.
For more information about website cookies, please see our Cookies Policy.
When you browse our website, we do not collect additional information, such as your age, gender, interests, bank details or clickstream. However, when you contact us via the website, we may collect personal information about you.
Contacting LCN (website, phone, email)
If you have used the form on our website to submit an enquiry – for example, to request legal advice, ask about volunteering, a media enquiry, a general enquiry, ask about setting up a Law Centre or report issues with the website – then we may collect your first/last name, email address, telephone number and your nearest town, along with details of your enquiry.
We only ask what is required in order to provide assistance on what you have requested. We record the number and type of enquiries we receive in relation to legal advice, volunteering, media and setting up a Law Centre using a tool we have built called EnquiryDesk, and on our Salesforce database where we track and monitor our work.
Legal Advice Queries
Queries submitted asking for legal advice often contain confidential and sensitive information. Your enquiry is initially handled by our Enquiry Desk Tool which helps us assign the relevant member of staff to deal with your request. Copies of enquiries are retained by LCN for 18 months before being confidentially destroyed. After 18 months, we will retain anonymised data about your enquiry on our databases. This data classifies what area of law your enquiry was about, your location (to the nearest town) and your contact with us to help us better understand legal need and provision of legal services across the country. You cannot be identified from this data.
If you submit a query through the ‘contact your local Law Centre’ form, it will be confidentially forwarded to that Law Centre.
Because legal advice enquiries often contain sensitive information, we will ask for your consent to process this information.
Volunteering Enquiries
Any enquiries about volunteering will be logged anonymously on our internal database. If you are contacting us about volunteering at a Law Centre, we may also forward your enquiry to the relevant Law Centre.
Setting up a Law Centre
When you contact us about Setting up a Law Centre the information is recorded on our database. We collect your contact details and information about your enquiry. We will hold this data until we no longer consider it relevant for the purpose it was originally collected.
Supporters
We maintain a database of supporters through MailChimp for the purpose of sending e-bulletins about LCN's work and the work of Law Centres. To be included on this database, you will have subscribed to the e-bulletin by opting in to receive it.
MailChimp is based in the US and therefore your data (name and email address) is transferred outside of the EU. However, we believe that, given the limited nature of the data being transferred, the Standard Contractual Clauses contained within the MailChimp Data Protection Addendum provides adequate data security and protection for processing your personal data.
If you are no longer happy for us to hold your details, at any time you can stop receiving emails from us by unsubscribing from the list or updating your mailing preferences.
For further details, please see MailChimp’s Privacy Policy.
Donors
LCN is registered with the Fundraising Regulator and is bound by the Code of Fundraising Practice. This sets the standards that apply to fundraising carried out by all charitable institutions and third-party fundraisers in the UK, which includes how we communicate with you on fundraising.
We accept donations through Just Giving and PayPal. When you make a donation to LCN or any of its associated campaigns, we receive your contact information and information about your donation. We do not receive or have access to any of your financial details e.g. credit card details. These are held securely by Just Giving and PayPal. We will not contact you on other issues unless you have given consent for us to do so.
For further details, please see PayPal’s Privacy Policy and Just Giving Privacy Policy.
Personal data in respect of sole traders, partnerships, professional advisors and consultants
We collect only as much data as needed to facilitate agreements with sole traders and partners who provide services to LCN. We will hold this data until we no longer consider it relevant for the purpose it was originally collected. Until then, we have a legitimate interest in keeping this information on our systems by nature of our business relationship.
Legal advice projects
Where we deliver, administer or lead on projects that are funded by other organisations, for example, the European Commission, we may be required to provide monitoring information to that funder to evidence how we have used the money and to what benefit. Similarly, where we work in partnership with other organisations, we may share monitoring information between partners. In these cases, we may gather details, for example, of your age; ethnicity; gender etc. We keep this information secure and confidential, and we only use it for monitoring purposes and to evaluate the project. Where we disclose it to funders and/or partners we do so anonymously. We will always let you know if we are sharing the data we collect from you with partners or funders and ask your permission before doing so.
Booking training and events
LCN uses Eventbrite for event management. LCN may also collect data about you when you register or pay for an event. This typically includes your name, email. We may also ask if you have any specific dietary or access requirements. We only collect details necessary for running the event, and typically use the information to provide you with the service requested, and to monitor and evaluate the training we deliver. We log details of those attending our events on our internal database.
Eventbrite is based in the US and therefore your data (name and email address) is transferred outside of the EU. However, we believe that, given the limited nature of the data being transferred, the Standard Contractual Clauses contained within the Eventbrite privacy policy provides adequate data security and protection for processing your personal data.
For further details, please see Eventbrite’s Privacy Policy.
Client Files
It is a legal requirement to keep client files for six years from the date the file is closed. In the event of a Law Centre’s closure, LCN may be asked to hold any client files on behalf of that Law Centre for the minimum legal statutory period. LCN uses a file storage company for this purpose. Data is processed and destroyed in accordance with statutory agreements. The Law Centre will notify you that it is closing and that your files will be transferred. If your files are transferred to LCN and you want access to them, you can get in touch using the contact details at the top of this document.
We may also process information relating to:
job applicants
complainants
Unless we obtain your permission, information that is identifiable as relating to you (i.e. it has not been edited to make it anonymous) is not sold to other organisations for commercial or other purposes. We may share data with our partners who sign data protection or data sharing agreements with us in order to deliver, monitor, evaluate and report the outcomes of our services. More information on this is available under “Transferring information to third parties”.
Conditions for Processing Data
We will only collect and process your personal information in accordance with current data protection laws. When collecting your personal data, we will always make clear to you which data is necessary for us to collect and the legal basis for collecting it. Our legal bases for processing your personal information are as follows:
Legitimate Interest
In most situations, we require your data to pursue our legitimate interests in a way which might reasonably be expected as part of running our business and which does not materially impact your rights, freedom or interests. This may include to satisfy our external quality auditors or our regulators, or to properly report to funders in cases where you have received services or advice obtained under a grant-funded service that we administer.
Consent
In some cases we may rely on Consent to process your personal information. This includes information that is considered ‘special category’ data, or sensitive data e.g. ethnicity, faith, sex, religion, sexual preference, immigration status, enquiries about legal advice etc. This also applies to marketing and communications, for example, we will only send you certain marketing emails that you have given permission to receive, including marketing information relating to donations. We may also ask for your consent to process personal data when signing up to access services, or to share your data with third parties. We will always let you know when we are seeking consent and will never share your data without explicit consent to do so. You can read more about your rights to withdraw consent in the section below.
Legal compliance
If the law requires us to, we may need to collect and process your data. For example, we can pass on details of people involved in fraud or other criminal activity.
Contractual obligations
The processing may be necessary for a contract that we hold with you. For example, if we are awarding a grant to you there may be data that is required such as bank details in order to enter into that contract. We may require you to share data with us as part of the contracting terms.
This may also include processing your personal data through third-party websites or hosting platforms to deliver services to you, in which case you would be notified of such processing.
How we protect your data
We will treat your data with the utmost care and take all appropriate steps to protect it.
We have clear data protection and information security policies and procedures in place, along with Regulatory and other legal obligations to keep your data safe. These are regularly assessed as part of our compliance processes.
We protect our IT system from Cyber Attack. Access to your personal data on systems we utilise is password-protected, and sensitive data is secured by encryption.
We regularly monitor our system for possible vulnerabilities and attacks, and we carry out penetration testing to identify ways to further strengthen security.
IT Systems
LCN cares to ensure the security of personal data. When LCN collects information about you, we also make sure that your information is protected from unauthorised access, loss, manipulation, falsification, destruction or unauthorized disclosure. This is done through appropriate technical measures. For example, emails and our online forms are encrypted, our network is protected and routinely monitored, remote devices e.g. mobile phones and laptops are encrypted and there are password policies and 2-step authentication in place for staff to securely access the organisation’s IT systems. Our IT support company undertakes periodic review of our security to ensure we are protected.
Staffing and Internal Management
We undertake regular reviews of who has access to information that we hold, to ensure that your information is only accessible by appropriately trained staff, volunteers and contractors. Staff have access to personal information on a ‘need-to-know’ basis so, for example, highly sensitive data such as employment records are only available to managers with the designated permissions to access and process that data.
How long will we keep your data?
We only keep your data for as long as is necessary for the purpose(s) for which it was provided. We have a legitimate interest in retaining records about our work; however, we will anonymise any special category data relating to enquiries after 18 months.
For supporters who have consented to be included on our supporter database, we will hold the data until the individual unsubscribes or withdraws consent, or when it becomes clear that emails and other communications are no longer being delivered.
There are statutory requirements we must adhere to for keeping some data e.g. financial records. Typically, this is six years. For some matters/contracts we may decide that it is proper and appropriate to keep data for longer than six years. If we believe that your case/contract falls into this category, we will notify you.
Who do we share your personal data with?
We sometimes share your personal data with trusted third parties. We only do this where it is necessary for providing you services or for the effective operation of LCN.
For example, we may share your data with Law Centres; experts; translators; secure file storage and destruction companies; auditors; the companies that securely host our off-site cloud storage servers.
The policy we apply to those organisations to keep your data safe and protect your privacy is as follows:
We ensure we have the relevant data processing and data sharing agreements in place.
We provide only the information they need to provide their specific services;
They may only use your data for the exact purposes we specify in our contract with them;
We work closely with them to ensure that your privacy is respected and protected at all times;
If we stop using their services, any of your data held by them will either be deleted or rendered anonymous.
Where is your data processed?
Unless we state otherwise, your data is stored and processed within the UK or the European Economic Area (EEA). The EEA includes all EU Member countries as well as Iceland, Liechtenstein and Norway.
Personal data we collect through some third-party tools we use is processed in the US. However, we believe that, given the limited nature of the data being transferred, the Standard Contractual Clauses contained within the privacy policies and data processing agreements of those providers, give adequate data security and protection for processing your personal data.
If we ever have to share your personal data with third parties and suppliers outside the UK or the EEA, we will ensure that it is sent and stored securely and, where appropriate, we will seek your specific consent to do so.
What are your rights?
You have the right to request:
Access to the personal data we hold about you, free of charge in most cases.
The correction of your personal data when incorrect, out of date or incomplete.
The deletion of your personal data, for example when you withdraw consent; or object and we have no legitimate overriding interest; or once the purpose for which we hold the data has come to an end – although we are not required to delete your data where data where we are required to hold it for complying with our own legal obligations.
That we stop any consent-based processing of your personal data after you withdraw that consent.
To ask for your personal information you should submit a Subject Access Request. Details of how to do so can be found on the Information Commissioners Office website. LCN will respond to your request within one month from the date it was received. Please contact Alex Charles at alex@lawcentres.org.uk.
If we choose not to action your request, we will explain to you the reasons for our refusal. In order to comply with your request, we may ask you to verify your identity.
Your right to withdraw consent
Whenever you have given us your consent to use your personal data, you have the right to change your mind at any time and withdraw that consent.
Where we rely on our legitimate interest
In cases where we process your personal data on the basis of our legitimate interest, you can ask us to stop for reasons connected to your individual situation. We must then do so unless we believe we have a legitimate overriding reason to continue processing your personal data.
Resolving complaints
If you have concerns about the way LCN is handling your personal information, please let us know immediately. You may contact us by emailing us directly at alex@lawcentres.org.uk with the subject line “Privacy Concern”. We will respond within 30 days at the latest.
The Regulator
If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office. You can contact them by calling 0303 123 1113, or visit www.ico.org.uk/concerns. Please note that we cannot be responsible for the content of external websites.
Changes to this policy
LCN may periodically update this policy. We will notify you about significant changes in the way we treat personal information by placing a prominent notice on this site.
Questions
Any questions about this Privacy Policy should be sent to alex@lawcentres.org.uk
This policy was last reviewed on 27 October 2021.
