Privacy Policy

This draft privacy policy relates to the BREACH REDRESS legal aid data breach portal. “We”, “us” and “our” refer to the website operator.

TBC — confirm the data controller’s legal identity, registered address, contact details and applicable registrations before approving this policy.

This privacy policy gives you information about how we collect and use your personal data through your use of this website, including information you share when you contact us, submit a claim enquiry or use our document-signing journey.

We understand that the subject matter of this website is deeply personal. We are committed to protecting your privacy and take our responsibilities regarding the security and confidentiality of your information extremely seriously. This privacy statement sets out how we comply with UK data protection requirements, including the UK GDPR and the Data Protection Act 2018.

This website and our services are intended for adults seeking support in relation to the legal aid data breach. We do not knowingly collect data relating to children.

TBC — confirm who handles privacy enquiries and whether a data protection officer is required. For information about privacy enquiries and exercising your rights, see section 15 (Contact information).

TBC — approved data-breach fee wording, deductions, expenses and cancellation terms will be inserted once agreed.

Any fees for legal representation must be set out in the law firm’s written agreement before you decide whether to proceed. This draft does not set an agreed fee.

Under the UK GDPR, personal data is defined as: “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.

This privacy notice tells you how we will collect and use your personal data. We may use your personal data, for example:

• To contact you in response to a specific enquiry;
• To provide the support and referral services that you request from us;
• To send you communications relating to your enquiry or potential data breach claim via the contact details you have provided;
• To contact third parties on your behalf, only with your specific instruction and consent;
• To operate and manage any application, agreement or correspondence you may have with us;
• To collect proof of legal aid and the signing information you choose to submit;
• To carry out, monitor and analyse our business;
• To identify, prevent, detect or tackle fraud and other crimes;
• For audits, regulatory purposes, legal obligations, and compliance with industry standards;
• To perform other administrative and operational purposes including the testing of systems.

We will never sell your data. Given the sensitive nature of our service, we do not use your details for unsolicited marketing. See our Cookie Policy for browser-storage information and outstanding inventory checks.

We need to collect personal data in order to provide you with our service, to answer enquiries, to refer you (with your consent) to an independent firm of solicitors in connection with a potential data breach claim, and to maintain our records. We are committed to ensuring that the information we collect and use is appropriate for this purpose, is kept to the minimum necessary, and does not constitute an invasion of your privacy.

You are always in control of what you tell us. Please only provide documents and sensitive information necessary for your enquiry. You may choose to provide proof of legal aid later.

Identity Data

This includes first name, last name and date of birth.

Contact Data

This includes address including postcode, email address and telephone numbers.

Case Data

This includes information relevant to a potential data breach claim, such as your legal aid category, approximate year of use, any breach notification you received, whether you have already instructed another representative, and proof documents you choose to upload.

Signing Data

This includes your digitised signature, signing timestamps, document versions, consent and fee acknowledgements, signature-placement information and the practice claims pack you submit. The current practice pack is not an executed legal agreement.

Technical Data

This includes internet protocol (IP) address, browser type and version, time zone setting and location, operating system and platform, and other technology on the devices you use to access this website.

Usage Data

This includes information about how you interact with and use our website and services. TBC — confirm the hosting platform’s analytics and browser-storage inventory. We do not describe usage measurements as anonymous without verifying that they cannot identify you.

Marketing and Communications Data

This includes your preferences in how and when we contact you.

Aggregated Data

This includes statistical or demographic data. Aggregated Data may be derived from your personal data but is not considered personal data in law if it does not directly or indirectly reveal your identity. If we ever combine Aggregated Data with your personal data so that it can identify you, we treat the combined data as personal data used in accordance with this privacy notice.

Special Categories of Personal Data

Your legal aid history or proof documents may reveal information about your health, ethnicity, religion, sexual life or other sensitive matters. Documents may also contain criminal-offence information, which has separate legal protection. We will only ask for the level of detail needed to help you. TBC — confirm the applicable Article 9 condition and, where relevant, Article 10 and Data Protection Act 2018 conditions before processing this information in a live claims service.

We use different methods to collect data from and about you, including as follows:

When you voluntarily provide it to us

You may give us your Identity, Contact, Case and Signing Data by completing the enquiry form, uploading proof, reviewing and signing practice documents, or contacting us through the details on our Contact page. Proof documents are uploaded when selected; submitting the final enquiry stores your form and signing details.

Collected automatically

As you interact with our website, hosting and security systems may collect Technical Data about your equipment and requests through server logs and similar technologies. See our Cookie Policy for browser storage and outstanding inventory checks.

Provided by third parties

Where you authorise a referral, the law firm may provide relevant updates so that we can support you, in line with its own privacy notice and your instructions. Address lookup services may receive the postcode you submit to return address suggestions.

The law requires us to have a legal basis for collecting and using your personal data. We rely on one or more of the following legal bases, as applicable:

• Performance of a contract with you: where we need to perform the contract we are about to enter into or have entered into with you, including steps you ask us to take before entering into a contract;
• Legitimate interests: where it is necessary to conduct our business and pursue our legitimate interests — for example, to prevent fraud and to give you the best and most secure experience. We balance any potential impact on you and your rights before processing on this basis;
• Legal obligation: where processing is necessary for compliance with a legal obligation we are subject to;
• Consent: where we have obtained your active agreement to use your personal data for a specified purpose.

Examples include registering and responding to your enquiry, helping to identify whether you may have a data breach claim, referring you to an independent firm of solicitors at your request, and keeping records required by our regulator.

TBC — finalise the purpose-by-purpose lawful-basis assessment and additional conditions for special-category and criminal-offence data. A general enquiry consent is not a substitute for those requirements.

We may share your personal data with the following parties, only where necessary and subject to appropriate safeguards:

• An independent firm of solicitors, where you have asked us to refer you in connection with a potential data breach claim. TBC — confirm any referral partners and their details before sharing information;
• Service providers who support the operation of our website, hosting, address lookup and document storage, including Base44 for this application;
• Professional advisers including lawyers, auditors and insurers;
• Regulators and other authorities, such as the Financial Conduct Authority and the Information Commissioner’s Office, where required.

We require third parties processing personal data for us to respect its security and to treat it in accordance with the law. TBC — confirm the full processor list, contracts and access permissions before the live claims service is launched. Any solicitor you instruct will also provide its own privacy notice.

If any of our service providers process data outside the UK, the transfer must have an appropriate lawful basis and safeguards recognised in UK data protection law, such as adequacy regulations or the applicable UK international data-transfer agreement or addendum.

TBC — confirm hosting and storage locations, subprocessors and transfer safeguards for this service. This draft does not promise that all information is stored only in the United Kingdom.

We are committed to protecting personal data against accidental loss, unauthorised access, alteration and disclosure. Access should be limited to people who have a business need to know and who are subject to a duty of confidentiality.

Proof uploads, signature files and generated practice documents use private file storage rather than permanent public download links. Submitted enquiry information is stored in application records. TBC — verify the complete access-control configuration, retention settings and security procedures before using this service for live claims.

We will notify you and any applicable regulator of a personal data breach where we are legally required to do so. Please do not send passwords, bank details or unnecessary sensitive documents in an initial email.

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. In some circumstances we will anonymise your personal data (so that it can no longer be associated with you), in which case we may use this information indefinitely without further notice to you.

If you contact us but decide not to proceed, we will keep your details only for as long as needed to respond to you and meet our regulatory obligations, after which they will be securely deleted.

TBC — approve specific retention periods and deletion procedures for enquiries, proof uploads, signatures, practice documents and incomplete uploads.

Under data protection law, you have rights in relation to your personal data, including the right to:

• Request access to your personal data (a “subject access request”);
• Request correction of the personal data that we hold about you;
• Request erasure of your personal data;
• Object to processing of your personal data;
• Request restriction of processing of your personal data;
• Request the transfer of your personal data to you or to a third party;
• Withdraw consent at any time where we are relying on consent to process your personal data.

These rights are subject to the conditions and exceptions set out in data protection law. You will not normally have to pay a fee to exercise them, and we aim to respond within one month. If you wish to exercise any of them, please contact us using the details in section 15. You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns first.

This website uses browser storage to support sign-in and requested services. Full details, including the outstanding published-site inventory checks, are in our Cookie Policy.

Clearing browser storage does not delete records or documents already submitted to us.

We keep this privacy policy under regular review. Any changes will be posted on this page. It is important that the personal data we hold about you is accurate and current, so please keep us informed if your personal data changes during your relationship with us.

For privacy questions or requests to exercise your legal rights, please use our Contact page.

TBC — confirm the data controller’s identity, privacy contact, postal address and any applicable registrations before this draft is approved.