Privacy Notice
Halliday Campbell WS
Last updated: 6 October 2026
1. Who we are
Halliday Campbell WS is a firm of solicitors in Edinburgh, regulated by the Law Society of Scotland. We are the controller of the personal information described in this notice. That means we decide how and why it is used, and we are responsible for it.
David Halliday, the proprietor of the firm, is responsible for data protection. You can contact him at:
7 Crawfurd Road, Edinburgh EH16 5PQ
david.halliday@hallidaycampbell.com
0131 668 3000
2. Who this notice covers
This notice explains how we use personal information about our clients and their representatives, about other people involved in the matters on which we act (such as other parties, their solicitors and representatives, witnesses and experts), about people who contact us, and about our suppliers and their staff.
If you are not our client, please see section 12 as well.
3. What information we collect
Depending on our dealings with you, we may hold:
• identity information, such as your name, title, date of birth and copies of your passport, driving licence or other identifying documents
• contact information, such as your addresses, telephone numbers and email addresses
• financial information, such as bank details and payments made by you and to you
• information about the legal services we provide, and anything obtained in connection with them
• communications, meaning the content of letters, emails and other communications between you and us, and between us and others in connection with a matter
• information about you that is publicly available, including on the internet
Where it is relevant to a matter, we may also hold more sensitive information. This can include information about health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation, and criminal allegations, proceedings or convictions. We use this kind of information only where it is necessary to give legal advice or to establish, exercise or defend legal claims, or where the law otherwise allows it.
4. Where we get it
We may obtain personal information from:
• you
• our clients, where the information is about someone else
• people who refer you to us, including other lawyers
• other parties to a matter and their solicitors or representatives
• courts, tribunals, arbiters and adjudicators
• solicitors, counsel, sheriff officers, messengers-at-arms, expert witnesses and others we engage, or who engage us, in connection with our services
• other professionals and businesses of whom you are also a client
• credit reference agencies
• publicly accessible sources, whether free or by subscription, such as the Registers of Scotland, Companies House and 192.com, and social networking sites such as LinkedIn, Facebook and X
5. Why we use it, and on what legal basis
Data protection law requires us to have a legal basis for each use we make of personal information. We use it:
- To provide legal services. Where you are our client, this is necessary to perform our contract with you. Where you are someone else involved in a matter, we rely on legitimate interests: our client’s interest in obtaining legal advice and in bringing or defending claims, and our interest in acting properly for them.
- To check identity and prevent money laundering. This is a legal obligation.
- To run the practice properly. This includes keeping matter files and records, recording our time and outlays, billing and recovering payment, keeping accounts, meeting our professional and regulatory obligations, dealing with complaints and claims, and arranging insurance. We rely on legal obligation and on our legitimate interest in running the practice efficiently and protecting ourselves.
- To report suspected crime. Where we must report suspected criminal activity, including money laundering, this is a legal obligation. Otherwise we rely on legitimate interests in preventing crime.
- To tell you about our services. We rely on legitimate interests in keeping in touch with clients and contacts, or on your consent where the law requires it, for example for some marketing emails. You can ask us to stop at any time.
6. Information you must give us
The law requires us to verify our clients’ identity before we act. If you do not give us the information and documents we need for that, we cannot act for you. Otherwise you are not obliged to give us information, but we may not be able to advise you properly without it.
7. Who will see it
Our staff will have access to your information where they need it for their work. We may also share it with:
• the other parties to a dispute, court case or transaction on which we act, and anyone acting for them
• courts, tribunals, arbiters and adjudicators
• people we engage in providing our services, such as counsel, Faculty Services, other solicitors, expert witnesses, law accountants, sheriff officers and messengers-at-arms, search agents, intermediaries, consultants and insurance brokers
• our IT, software and cloud service providers (see below)
• public registers, such as Companies House and the Registers of Scotland
• the police, HMRC and other public bodies, where the law requires it or it is necessary to provide our services
• regulators, such as the Law Society of Scotland, the Scottish Legal Complaints Commission and the Information Commission (the ICO)
• our auditors, insurers and professional advisers
• other professional advisers and agents engaged by you
• anyone else, with your clear, express and prior consent
Our IT, software and cloud service providers store and process information for us. They include providers of email and document storage, and providers of artificial intelligence tools that we use to help with tasks such as preparing draft time records and reviewing documents. At present they include Microsoft, OpenAI and Anthropic. They act on our instructions, under contracts that restrict how they may use the information.
We check what these tools produce. We do not use them, or anything else, to make decisions about people without meaningful human involvement.
8. Transfers outside the UK
Some of our service providers, including Microsoft, Open AI and Anthropic, may store or process information outside the UK, including in the United States. Where they do, the transfer is protected either by UK regulations recognising that the destination gives adequate protection, or by contract terms approved for that purpose under UK law, such as the International Data Transfer Addendum issued by the ICO. You can ask us for a copy of the relevant safeguards.
9. How long we keep it
We keep personal information only for as long as we need it for the purposes for which we obtained it, and to meet our legal and regulatory duties.
For client matters, we follow the Law Society of Scotland’s guidelines on keeping client files. We may keep matter files (or electronic copies), including personal information about clients and others in them, for 10 years or more from the date on which we last provided services or did work on the matter. We may keep some documents, such as court decrees, for longer.
Our service providers hold information only for the periods allowed by their contracts with us. In some cases these include short periods for security and the prevention of misuse.
If you would like to know how long we are likely to keep information about you in a particular matter, please contact us and we will tell you.
10. Your rights
You have the right to:
• ask whether we hold personal information about you and, if we do, to have a copy of it
• have inaccurate information corrected
• have information deleted, in some circumstances
• have our use of your information restricted, in some circumstances
• receive information you have given us in a portable form, where we use it on the basis of consent or contract
• withdraw consent, where we rely on it
These rights are not absolute. They may be limited where, for example, the information is protected by legal professional privilege (in Scotland, confidentiality of communications), where giving it to you would reveal information about someone else, or where we need it to establish, exercise or defend legal claims.
To exercise any of these rights, please contact us. We will respond without undue delay and in any event within the time the law allows, which is normally one month.
11. Your right to object
Where we use your information on the basis of legitimate interests, you have the right to object at any time, on grounds relating to your particular situation. We will then stop, unless we have compelling legitimate grounds that override your interests, or we need the information to establish, exercise or defend legal claims.
You can object to the use of your information for direct marketing at any time, and if you do we will stop.
12. If you are not our client
We often obtain information about people other than our clients, from our clients or from others in the course of a matter. We may not tell you directly that we hold it, where doing so would breach our professional duty of confidentiality to our client or undermine legal professional privilege (in Scotland, confidentiality of communications). We publish this notice so that the information about how we handle personal information is available to you.
13. Complaints
If you are unhappy with how we have handled your personal information, please tell us first, by email to david.halliday@hallidaycampbell.com or by post to the address in section 1. We will acknowledge your complaint within 30 days of receiving it. We will then look into it, keep you informed, and tell you the outcome without undue delay.
You also have the right to complain to the Information Commission (the ICO), the UK’s data protection regulator:
Website: ico.org.uk
Helpline: 0303 123 1113
Post: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
14. Changes to this notice
We review this notice regularly and will update it when the way we use personal information changes. The date at the top shows when it was last updated.
No comments:
Post a Comment