1. The Firm
   1. Lawcabinet Partnership LLP (Firm) is a limited liability partnership and Edmond J Curtin is a member of the Firm.
   2. The Firm is a law firm authorised and regulated by the Solicitors Regulation Authority (SRA). It is subject to the SRA Code of Conduct. See the SRA's website (https://www.sra.org.uk) for details.
2. This Privacy Notice
   1. This notice is addressed to you if you are a natural person (that is, an individual) who is a data subject for the purpose of the Global Data Protection Regulation (as incorporated into English law, GDPR) and the Firm processes personal data about you. This notice may be updated from time to time.
   2. In this notice:
      • References to you are to you, the data subject, and references to I are to Edmond J Curtin, acting for and on behalf of the Firm.
      • References to your information are to the personal data (if any) about you (the data subject) that I process for and on behalf of Firm.
      • References to personal data are to any information relating to an identified or identifiable natural person (data subject).
3. Purpose and legal basis
   1. I process information for the purposes of conducting myself as a lawyer on behalf of the Firm's clients and managing the Firm's business in a manner that is consistent with the SRA Code of Conduct.
   2. This includes processing information for the purpose of applying of client due diligence measures, such as
      • identity verification,
      • screening for politically exposed persons, and
      • screening for persons subject to sanctions.
   3. This is the legal basis on which I rely in order to do this: GDPR Article 6(1)(f) (processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party).
   4. I have a legitimate interest in conducting myself as a lawyer on behalf of the Firm's clients and managing the Firm's business in a manner that is consistent with the SRA Code of Conduct, and the Firm's clients have a legitimate interest in the same.
   5. When processing information for the purpose of applying client due diligence measures, I also rely on this legal basis: GDPR Article 6(1)(c) (processing is necessary for compliance with a legal obligation to which the controller is subject).
4. Firm's website
   1. I do not ask you, or allow you, to provide your information to me via the Firm's website. In addition, that website neither records your visit nor uses cookies.
   2. The Firm's website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. I do not control these third-party websites and I am not responsible for their privacy notices.
5. Obtaining your information
   1. In the ordinary course, I ask you for your information only if you are a client (actual or potential) of the Firm or the representative of such a client.
   2. At the time I ask you for your information, I inform you whether (or to what extent) the provision of the information is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether you are obliged to provide the information and of the possible consequences of failure to provide the information.
   3. I also obtain your information from third parties, including publicly-accessible sources. In the ordinary course, I only do this when conducting client matters or applying client due diligence measures.
   4. The publicly-accessible sources on which I rely include
      • Companies House (the registrar of companies in the United Kingdom),
      • registrars of companies in other jurisdictions, and
      • LinkedIn and other social media platforms.
   5. The other third parties on whom I rely on include
      • persons involved in the matter concerned,
      • aggregators of publicly-accessible sources, and
      • providers of services relating to compliance with laws on money-laundering, politically exposed persons, and sanctions.
6. Recipients of your information
   1. If you are a client of the Firm, the persons with whom I share your information are disclosed in the terms of engagement between us.
   2. If you are not a client of the Firm, and your information is relevant to a matter on which I am engaged, I share it with other persons if it is necessary to do so in connection with that matter. These persons include:
      • clients of the Firm,
      • counterparties to clients of the Firm and their advisors,
      • the Firm's service providers, and
      • public bodies (such as courts, tribunals, regulatory authorities, and law enforcement authorities).
7. Transfers of your information abroad
   1. The persons with whom I share your information may be within the European Economic Area (EEA). There are no restrictions on the transfer of personal data to EEA countries.
   2. Alternatively, those persons may be in a country (third country) outside the EEA. In the latter case, this general rule applies: a transfer of personal data to a third country may take place where the European Commission has decided that the third country, a territory or one or more specified sectors within that third country, ensures an adequate level of protection. There are exceptions to, and derogations from, this general rule, on which I may rely from time to time.
8. Retention of your information
   1. Clients of the Firm should refer to the terms of engagement between us for disclosure on my approach to information retention.
   2. Subject to this, I retain your information for an initial period of up to seven years. When this initial period ends, I review the information. Following this review, I delete the information or mark it for further review after a period of time.
9. Special category data
   1. Subject to applicable exceptions, there is a general prohibition in GDPR on the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.
   2. If you wish to give me any such special category data, you must first give your explicit consent to the processing of the data for one or more specified purposes.
10. Your information rights
    1. Under GDPR, you have certain rights in respect of my processing of your information. See the Information Commissioner's website (https://ico.org.uk) for details. These information rights include: access, rectification, erasure, restriction on processing, objection to processing, and portability. I explain these information rights further in the Annex to this notice.
    2. If you would like to exercise any of those rights, please contact me. These are my contact details:
       
       Edmond J Curtin
       Lawcabinet Partnership LLP
       10 Fitzroy Square, London W1T 5HP
       + 44 20 7489 2013
    3. Under GDPR you have the right to lodge a complaint with a supervisory authority if you consider that my processing of your information infringes GDPR.
    4. The supervisory authority in the UK is the Information Commissioner. See the 'Report a concern' section of its website (https://ico.org.uk/concerns).
    5. Certain GDPR provisions do not apply to personal data that consists of information in respect of which a claim to legal professional privilege could be maintained in legal proceedings (Privilege Exemption). I am a lawyer and much of the information that I process is subject to legal professional privilege. This notice and your information rights are subject to this Privilege Exemption.
    6. Certain GDPR provisions do not apply to information in respect of which a duty of confidentiality is owed by a professional legal adviser to a client of the adviser (Confidentiality Exemption). Under the SRA Code of Conduct, I am subject to a professional obligation to keep my client's affairs confidential. This notice and your information rights are subject to this Confidentiality Exemption.

Request access to your personal data (commonly known as a data subject access request). This enables you to receive a copy of the information I hold about you and to check that I am lawfully processing it.

Request rectification of the data that I hold about you. This enables you to have any incomplete or inaccurate information I hold about you corrected, though I may need to verify the accuracy of the new information you provide me.

Request erasure of your personal data. This enables you to ask me to delete or remove your information where there is no good reason for us continuing to process it. You also have the right to ask me to delete or remove your information where you have successfully exercised your right to object to processing, where I may have processed your information unlawfully or where I am required to erase your information to comply with local law. Note, however, that I may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Request restriction on processing of your personal data. This enables you to ask me to suspend the processing of your information in the following scenarios: (a) if you want me to establish the information's accuracy; (b) where my use of the information is unlawful but you do not want me to erase it; (c) where you need me to hold the information even if I no longer require it as you need to establish, exercise or defend legal claims; or (d) you have objected to my use of your information but I need to verify whether I have overriding legitimate grounds to use it.

Object to processing of your personal data where I am relying on a legitimate interest (or those of a third party) and there is something about your particular situation that makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where I am processing your information for direct marketing purposes. In some cases, I may demonstrate that I have compelling legitimate grounds to process your information that override your rights and freedoms.

Request the transfer of your personal data to you or to a third party. I will provide to you, or a third party you have chosen, your information in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for me to use or where I used information to perform a contract with you.

Withdraw consent at any time where I am relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, I may not be able to provide certain services to you. I will advise you if this is the case at the time you withdraw your consent.