Types of personal data collected
Personal data, or personal information, means any information about a living individual from which that person can be identified, directly or indirectly. We may collect different kinds of personal data about you when you interact with us, including via the Website, social media, email, telephone, post or in person.
We may also receive this information from third parties (for example, a publicly available source or from someone who has recommended us to you and given us your contact details).
We have grouped this information together as follows:
- Identity Data, such as your first name and last name.
- Contact Data, such as your email address, telephone/fax number, address and other contact details.
- Enquiry Data, such as your enquiries.
- Correspondence Data, such as any correspondence between us and you about an enquiry.
- Technical Data such as information collected automatically through this Website (or third-party services employed in this Website), which can include: the IP addresses or domain names of your computer, the URI addresses (Uniform Resource Identifier), the time of the request, the method utilized to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server’s answer (successful outcome, error, etc.), the country of origin, the features of the browser and the operating system utilized by you, the various time details per visit (e.g., the time spent on each page within the Website) and the details about the path followed within the Website with special reference to the sequence of pages visited, and other parameters about the device operating system and/or your IT environment.
- Marketing and Communications Data, such as your communications preferences and how you have responded to our marketing communications.
- Tracking Data, such as information we or others collect about you from cookies and similar tracking technologies, such as web beacons, pixels, and other digital identifiers.
We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose.
Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Technical Data to calculate the percentage of users accessing a specific feature, or we may aggregate your Marketing and Communications Data to calculate the percentage of recipients who open our email newsletter. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy Policy.
We do not usually collect any special categories of personal Data about you, but you may choose to disclose this data to us. Special categories of personal Data include details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data. Unless we are required to do so to comply with a legal obligation, or as an integral part of providing the Service to you, we do not usually collect any personal data about you relating to criminal convictions or offences.
Use of personal data
Our core purposes for processing personal data are to promote and operate the business of being a marketing firm, to provide marketing services to our clients, to maintain our client and business records, to recruit, and to comply with the law and regulations.
We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:
- Where it is necessary for us in order to perform a contract which we are about to enter into, or have entered into, with you (for example, a contract between you and us for us to provide marketing services to you).
- Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests (for example, to monitor our IT systems and protect them).
- Where we need to comply with a legal or regulatory obligation (for example, the rules which require us to verify the identity of someone before they can become a client).
- Where we have your consent to do so (for example, if you are not a client and you ask us to sign you up for news and updates by email).
We may also use personal data as we believe to be necessary or appropriate: (a) to comply with applicable law, including laws outside your country of residence; (b) to comply with legal process; (c) to respond to requests from public and government authorities including those outside your country of residence; (d) to enforce our terms and conditions; (e) to protect our operations; (f) to protect our rights, privacy, safety or property, you or others; and (g) to allow us to pursue available remedies or limit the damages that we may sustain.
In any case, we will gladly help to clarify the specific legal basis that applies to the processing, and in particular whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract.
Lawful basis for the processing
This section sets out in more detail the lawful basis we rely on to process personal data, depending on the category of personal data and the reason we are processing it. Note that we may process your personal data for more than one lawful basis depending on the specific purpose for which we are using your data.
Purpose/activity Type of data Lawful basis for processing including basis of legitimate interest
- To provide the Website to you (a) Technical Data Legitimate interests (to promote our business and services via the web)
- To register you as a recipient of our newsletters and updates and to download our e-books (a) Identity Data (b) Contact Data (c) Technical Data (d) Marketing and Communications Data (a) Legitimate interests, including for any soft opt-in (to undertake direct marketing to promote our business and services) (b) In the limited circumstances where the Privacy and Electronic Communications Regulations mandate that consent is required for electronic marketing, and we are not relying on your opt-in, the lawful basis will be consent (See Advertising, marketing and your communications preferences below)
- To manage our relationship with you which will include: (a) Notifying you about changes to our terms or Privacy Policy (b) Asking for feedback (a) Identity Data (b) Contact Data (c) Enquiry Data (d) Correspondence Data (e) Marketing and Communications Data (a) Performance of a contract with you (b) Necessary to comply with a legal obligation (c) Necessary for our legitimate interests (to keep our records updated and to ensure we provide our services on our most recently updated terms)
- To register you as a new client and respond to your enquiry (a) Identity Data (b) Contact Data (c) Enquiry Data (d) Correspondence Data (a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise)(b) Necessary to comply with a legal obligation
- To administer and protect our business and our Website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) (a) Identity Data (b) Contact Data (c) Enquiry Data (d) Correspondence Data (e) Technical Data (f) Marketing and Communications Data (a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise)(b) Necessary to comply with a legal obligation
- To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you (a) Identity Data (b) Contact Data (c) Enquiry Data (d) Correspondence Data (e) Technical Data (f) Tracking Data (g) Marketing and Communications Data Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy)
- To use data analytics to improve our Website and the client experience (a) Identity Data (b) Technical Data (c) Tracking Data Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform and deliver our marketing strategy)
- To target potential new clients via social media and the web (a) Identity Data (b) Technical Data (c) Tracking Data Necessary for our legitimate interests (to engage with the new clients and potential new lawyers via social media and the web (for example, via LinkedIn))
Sharing your personal data
We may share your data with third parties to whom we have outsourced certain tasks, such as IT, business administration or marketing and analytics services.
We may share your personal data with our insurers, our professional advisors (lawyers, bankers, auditors, corporate financiers and brokers) in connection with services they provide to us.
We share personal data with the following third parties for advertising and analytics purposes:
- Facebook: we share your data with Facebook so that we can display adverts to you on Facebook. For more information on Facebook advertising, and how you can control your settings, see here.
- Google: we share your data with Google so that we can display adverts to you on the world wide web and make use of its Google Analytics product. For more information on Google, and how you can control your settings, see here.
For more information on personal data sharing connected to advertising and marketing, see Advertising, marketing and your communications preferences below.
We may also share data with third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Privacy Policy.
We require all third parties to respect the security of personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
We will not otherwise share personal information with any third party except where we are permitted to under data protection laws or required to by law.
Advertising, marketing and your communications preferences
We work with partners to try and promote the reach of our adverts and use analytics and retargeting for this reason. We use Tracking Data to deliver relevant online advertising, including via websites and social media. Tracking Data, and in particular cookies, help us to deliver website and social advertising that we believe is most relevant to you and to potential new clients and colleagues. The cookies used for this purpose are often placed on our website by specialist organisations – and this is also why when you have been on our Website, you might see an advert for us quite soon afterwards. The partners we work with are: Facebook, Google, Instagram, LinkedIn, Pinterest, Sign-Up.to, and Twitter.
Cookies can also tell us if you have seen a specific advert, and how long it has been since you have seen it. This is helpful, because it means we can control the effectiveness of our adverts and control the number of times people might be shown our adverts. Cookies also help us understand if you have opened a marketing email, because we prefer not to send you correspondence you prefer not to read.
If you want more information about Tracking Data, in particular cookies, see our Cookies Policy below.
Almost all the cookies that relate to advertising are part of third-party online advertising networks. If you would like to read about how you can control which adverts you see online, see opt-out programs established by the Digital Advertising Alliance (United States) and the European Interactive Digital Advertising Alliance (Europe).
Unfortunately, because the technical rules are not yet standardised, the Website currently does not respond to a Do Not Track signal.
International transfers
For data transfers taking place outside of the UK, we ensure that a similar degree of protection is afforded to it, either by making our own assessment of adequacy, or using one of the standard mechanisms available to us. These may include:
- Transfers to the EEA because these have been confirmed by the Information Commissioner’s Office as being adequate.
- Transfer to countries or organisations that have officially been deemed to provide an adequate level of protection for personal data by the Information Commissioner’s Office.
- Using specific contracts approved by the Information Commissioner’s Office.
Retention time
We will only keep your personal data for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
After a reasonable period of time, we will either delete or anonymize your information or, if this is not possible, then we will securely store your information and isolate it from any further use until deletion is possible.
We retain personal data that you provide to us where we have an ongoing legitimate business need to do so (for example, as needed to comply with our legal obligations, resolve disputes and enforce our agreements).
Your rights
You may exercise certain rights regarding your personal data. In particular, you have the right to do the following:
- Withdraw your consent at any time. You have the right to withdraw consent where you have previously given your consent to the processing of your personal data.
- Object to processing of your personal data. You have the right to object to the processing of your personal data if the processing is carried out on a legal basis other than consent. Further details are provided in the dedicated section below.
- Access your personal data. You have the right to learn if personal data is being processed by us, obtain disclosure regarding certain aspects of the processing and obtain a copy of the Data undergoing processing.
- Verify and seek rectification. You have the right to verify the accuracy of your personal data and ask for it to be updated or corrected.
- Restrict the processing of your personal data. You have the right, under certain circumstances, to restrict the processing of their personal data. In this case, you will not process their personal data for any purpose other than storing it.
- Have your personal data deleted or otherwise removed. You have the right, under certain circumstances, to obtain the erasure of their personal data from us.
- Receive your personal data and have it transferred to another controller. You have the right to receive your personal data in a structured, commonly used and machine-readable format and, if technically feasible, to have it transmitted to another controller without any hindrance. This provision is applicable provided that the personal data is processed by automated means and that the processing is based on your consent, on a contract which you are part of or on pre-contractual obligations thereof.
- Lodge a complaint. You have the right to bring a claim before your competent data protection authority.
Where personal data is processed for the purposes of the legitimate interests pursued by us, you may object to such processing by providing a ground related to their particular situation to justify the objection.
You must know that, however, should your personal data be processed for direct marketing purposes, you can object to that processing at any time without providing any justification.
How to exercise these rights
Any requests to exercise your rights can be directed to us through the contact details provided in this document. These requests can be exercised free of charge and will be addressed by us as early as possible and always within one month.
Additional information about your personal data
In addition to the information contained in this Privacy Policy, this Website may provide you with additional and contextual information concerning particular services or the collection and processing of personal data upon request.
System logs and maintenance
For operation and maintenance purposes, this Website and any third-party services may collect files that record interaction with this Website (System logs) use other personal data (such as the IP Address) for this purpose.
Information not contained in this policy
More details concerning the collection or processing of personal data may be requested from us at any time. Please see the contact information at the beginning of this document.
Changes to this privacy policy
We reserve the right to make changes to this Privacy Policy at any time by notifying you on this page and possibly within this Website and/or – as far as technically and legally feasible – sending a notice to you via any contact information available to us.
It is strongly recommended to check this page often, referring to the date of the last modification listed at the top.
Should the changes affect processing activities performed on the basis of your consent, we shall collect new consent from you, where required.
Contact
If you experience any technical problems during your interaction with the Website, please contact us here: hello AT bro.design.
Queries, concerns or complaints regarding your privacy or this Privacy Policy: If you have queries regarding this Privacy Policy please contact us by sending an email to the Data Protection Officer: hello AT bro.design.
