1. Shoosmiths is committed to protecting your privacy and personal data. This notice explains when and why any Shoosmiths entity processes personal data collected from you or provided to us by third parties, how this data is used, the conditions under which it may be disclosed to others, and how it is kept secure. It also provides you with information regarding various rights you may have in respect of processing of your personal data by Shoosmiths.
2. This notice may be updated from time to time in accordance with changing privacy and data protection laws. Where any changes materially affect how we process your personal data, we will take appropriate steps to inform you, in addition to updating this notice.
Who we are
3. Where this notice refers to “Shoosmiths”, “we”, “our” or “us” , unless it mentions otherwise, it is referring to the particular company that processes your personal data. Shoosmiths entities include Shoosmiths LLP (Z3279355), Shoosmiths (Northern Ireland) LLP (ZA219732), Shoosmiths Europe LLP (ZB617965), Shoosmiths Privacy Services Limited (ZA808941), Project Apollo Limited (ZC003448).
4. As a law firm, in most situations Shoosmiths is a data Controller. This means that Shoosmiths determines why and how the personal data it holds, is processed. In very limited circumstances and depending on the nature of the services being provided, a Shoosmiths entity may act as a data Processor, in which case it will process personal data only on documented instructions of another Controller.
Contact details
5. If you wish to contact us with any queries about this notice or about the way we process your personal data, you can write to our Data Protection team at Shoosmiths LLP, The XYZ Building, 2 Hardman Boulevard, Spinningfields, Manchester M3 3AZ. Alternatively, you can contact us by e-mail at dataprotection@shoosmiths.com
6. When we refer to “personal data”, we mean information that could identify you directly or indirectly. Processing includes collection, storage, disclosure or any operation performed using personal data.
Information that you give to us
7. We may receive information about you from you or third parties when we are acting for you or a client and we are required to obtain information about you, for example if you are employed by or are a representative of a client company, a beneficiary of an estate or trust, or a party or a witness in a litigation case.
8. You give us information about yourself when you make an enquiry to Shoosmiths, or engage us to provide legal services, or when entering information via our website, apps or by communicating with us by phone, post, e-mail, live chat, social media or otherwise. It includes additional information that you provide to us during the course of any legal matter.
Information we receive from you or other sources
9. Where we receive information about you from a third party, we will only use that information for the purposes of the legal matter and to comply with any regulatory or legal obligations we are subject to.
10. The information we may receive about you from third parties, include:
Personal data
- your contact details;
- identification information;
- financial or billing information;
- employment information; or
- any details from correspondence and information regarding a matter on which we advise our client.
This information may be provided:
In transactional matters
11. Law firms, accountants and other professional advisors acting on your behalf where our client is a party to, or otherwise involved in, the matter, for example:
- a corporate transaction (where your details may be placed in an online data room by us or other advisers);
- a commercial or domestic property transaction;
- due diligence.
In dispute resolution
12. Witnesses, law firms, counsel, experts and other professional advisors acting for you or for us on your behalf, or for third parties, where you or our client is a party to or otherwise involved in the matter, for example:
- mediation, arbitration and other forms of alternative dispute resolution;
- potential or actual litigation;
- disclosure, preparation or exchange of witness or expert evidence; or
- obtaining records such as employment, financial, health or education.
By customers of financial institutions
- Banks, building societies and finance companies who are our clients and where you are their customer/debtor, from whom we receive or request information.
By clients acting in a representative capacity
-
Personal representatives, attorneys, trustees, deputies and litigation friends who may provide us with information in connection with a matter including litigation which we are conducting for a client.
-
Friends, family members or colleagues who may provide information to us about you as part of the work we undertake for them, for example where you are or may be:
- a beneficiary of an estate or trust;
- appointed by them in some representative capacity, such as executor; or
- a party in or a witness to a dispute.
Our people
- Recruitment consultants who may provide information about you to us in relation to a potential job at Shoosmiths.
- Employers who may provide a reference on you to us.
- Court agents, court officers (i.e. sheriffs and enforcement officers) or trace agents.
From regulators
- Regulatory bodies when making regulatory enquiries.
- Enforcement authorities including, when making enquiries into potential criminal offences, the Police.
Through referrals
- Professional advisers who may refer your case or matter to us.
- Any other introducer of a case or matter to us.
13. We may supplement the personal data collected from you with information from publicly available sources, such as information to validate your identity or address, or to perform a credit or an identity check.
Information we automatically collect about you
14. We may automatically collect information about you without directly asking you to provide the information to us. This will mainly include information gathered automatically through your use of our website or online services, subject to your preferences. The settings on our website allow you to accept or reject the non-essential cookies. Further information about the cookies we deploy is available in the section “Cookies” of this notice.
Mandatory information
15. Please note that your provision of documents for identity verification purposes is necessary for us to comply with our legal and statutory obligations. Failure to provide these documents will mean that we are unable to comply with our various legal and regulatory obligations including those contained within the Money Laundering Regulations and may not be able to act for you.
16. As a law firm dealing with cases and matters, we may process a range of personal data about you. To make it easier to understand the information that we use about you, we have divided this information into categories in the table below and provided a short explanation of the type of information each category covers (please note that not all categories may be applicable to you):
Category: Personal data included in this category See below
- banking/billing - information used to send/receive funds to/from you or that appears on your bills
- behavioural - your activities, actions and behaviours
- biographical - your life experiences and circumstances
- cardholder - your payment card details
- contact - information which can be used to address, send or otherwise communicate a message to you (i.e. email address, postal address, employer name and job title)
- correspondence - information contained in our correspondence or other communications with you or about you, or about our products, services or business
- employment - your previous, current or future employment details
- financial - information of financial transactions, history, standing and forecasts including credit and other references
- geo-location - information which contains or reveals the location of your electronic device
- identification - information contained in a formal identification document or social security or other unique reference relating to you
- insurance - your insurance applications, policies and any information relating to your insurance claim
- legal - information from public and other records including Companies House, Land Registry, HM Courts & Tribunals Service, Government and Local authorities, Regulators and Enforcement agencies including relating to legal claims made by you or against you or the claims process
- monitoring - in some areas we may record phone or video calls and retain meeting transcripts for our records, or enable AI-assisted transcription as a temporary support tool for generating notes or meeting minutes. If you visit one of our offices, your image may be recorded on CCTV for security purposes
- sensitive/Special Categories of Personal Data - in some circumstances we may process special categories of personal data such as your racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as information that relates to your health, sexual orientation, criminal offences, or genetic or biometric data that identifies you
17. We may use the information we collect about you in the following ways.
Where it is necessary for us to perform a CONTRACT with you
18. We may process your personal data where we have supplied you (or continue to supply you) with any legal services, where we have arranged for the supply of another firm’s services to you, or where you are in discussions with us about a particular matter on which you are considering taking advice.
19. We will process your information in connection with the contract for the provision of services when it is needed to carry out that contract or for you to enter into it.
20. We may also process your personal data in connection with our recruitment activities, if you apply for a position with us (whether directly or through a third party) or send your details to us on a speculative basis (for further details, please refer to our Applicant Privacy Notice.
Where we have a LEGITIMATE INTEREST
21. We may process your personal data where it is necessary for us to pursue our legitimate interests as a business for the following purposes;
- to carry out our conflict checks to ensure that we are able to provide services to you;
- to enter into and perform the contract we have with a business which you own or are an employee of;
- to carry out work when instructed by another firm who is representing you;
- to assess and improve our service to clients or our clients’ customers (where applicable) through recordings of any calls and livechat sessions;
- to pursue a legal claim on behalf of our clients (including debt recovery);
- for the prevention of fraud and other criminal activities;
- to verify the accuracy of the data that we hold about you and to create a better understanding of you as a client and our clients’ customers (where applicable);
- to undertake marketing and business development activities to promote our legal and professional services. This may include sending you newsletters, legal updates, marketing communications, inviting you to events, and other information that may be of interest to you;
- to undertake analysis to inform our business and marketing strategy (this may include the use of your data once it has been anonymized)
- to inform you about relevant events, products, news updates and announcements you may be interested in;
- to publicise our events where you have been invited to speak or have chosen to attend;
- to manage and deliver internal projects for business improvement;
- for network and information security purposes to enable us to take steps to protect your personal data against loss or damage, theft or unauthorised access;
- to comply with a request from you in connection with the exercise of your rights (e.g. where you have asked us not to contact you for marketing purposes, we will keep a record of this on our suppression lists in order to be able to comply with your request);
- to assist in the management of queries, complaints or claims;
- to notify you or your business of changes in the law that might affect you or your business; and
- for the establishment, exercise or defence of our legal rights.
Where required by LAW
22. Where you engage us to provide legal services to you, we will need to process your personal data and the personal data of third parties in order to comply with our legal obligations under the SRA’s Codes of Conduct, the Law Society of Scotland, and the Law Society of Northern Ireland.
23. We also have a legal requirement to verify your identity in connection with anti-money laundering and criminal financing legislation. We will use that information for the purpose of complying with the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, as amended, including Money Laundering and Terrorist Financing (Amendment) (EU Exit) Regulations 2020 and The Money Laundering and Terrorist Financing (High-Risk Countries) (Amendment) Regulations 2024 or such other legislation that may replace or supersede these Regulations from time to time. Where matter relates to litigation we must comply with the Civil Procedure Rules.
24. We may process your personal data in order to comply with other legal obligations to which we are subject, as follows:
- to maintain a register of corporate gifts and hospitality to comply with anti-bribery laws;
- to maintain a record of undertakings where you are either a beneficiary of an undertaking or the person obliged to perform it;
- to maintain a record of undertakings where Shoosmiths is the giver or receiver of an undertaking;
- to comply with our other legal and regulatory obligations, e.g. undertaking conflict checks; and
- for the prevention of fraud and other criminal activities.
In the VITAL INTERESTS of the individual
25. In limited circumstances where we may represent individuals who are unable to exercise their rights or due care for their own safety or where we genuinely believe there is an immediate risk of harm to an individual, we may use information about our client, or a person connected with them or a client’s customer in order to take action to protect them.
26. We may need to share your personal data in case of any emergency where you attend our premises. Further information can be found in the Visitor Privacy Notice located in our offices.
Where you have provided CONSENT
27. We will seek consent from you where we wish to feature your identity in a published case study, press release, advertisement or testimonial or wish to include your image in a photograph or video in connection with public relations or promotional activities.
28. You have the right to withdraw your consent at any time. Please see Withdrawing your consent section for further details.
Special categories of personal data
29. We may process more sensitive personal data (known as “special categories of personal data”) about you or others associated with you. We will only use this kind of information where:
- we have your explicit consent; or
- it is necessary for us to use this information to protect your vital interests or those of another person where it is not possible to obtain consent; or
- it is necessary for us to do so in connection with the establishment, exercise or defence of legal claims; or
- in exceptional circumstances, another of the grounds for processing special categories of personal data are met, such as protecting the economic well-being of an individual at economic risk.
Use of anonymised data
30. We may use data derived from the personal data we process for our legitimate business purposes, including commercial research, after it has been anonymised.
31. Anonymised data is data from which individuals cannot be identified or made identifiable neither by us nor anyone else. Anonymised data is not subject to data protection laws.
Our suppliers and service providers
32. Our work for you may require us to provide information to third parties who will use your information for the purposes of providing services to us or directly to you on our behalf. Such third parties may include for example insurers, payment processing, software providers and mailing services.
33. When we use third party service providers, we only disclose to them any personal data that is necessary for them to provide their services and we have an agreement in place that requires them to keep your data secure and not to use it other than in accordance with our specific instructions.
Others involved in your case or matter
34. Our work for you may require us to provide information to third parties such as law firms, accountants, counsel, expert witnesses and other professional advisers who will use your information in connection with your case or matter (see paragraphs 9 to 12 for a list of third parties we deal with). They may provide their own services directly to you.
35. Where we are engaged by a third party such as a bank or lender in connection with your contract with them, we may share information you provide to us with that third party about the progress of the case.
36. Any third party to whom we disclose information about you will be under an obligation to keep your information secure and not to use it for any purpose other than that for which it was disclosed unless you agree with them otherwise.
Credit/debit card payment processors
37. When you make a payment to us by credit or debit card, whether over the telephone or online, it is processed through a secure, encrypted third-party payment processor specialising in card transactions. Shoosmiths does not view, handle, or store your card payment details.
Direct debit payments
38. If you set up a direct debit, we will share your name, bank account number and sort code with your bank or building society and a third-party processor to establish the mandate. We will retain a copy of the mandate to administer and track payments in accordance with our retention policy. You may cancel a direct debit at any time by notifying us and contacting your bank or building society.
Other ways in which we may share your personal data
39. We may transfer your personal data to a third party as part of a sale of some or all of our business and assets to any third party or as part of any business restructuring or reorganisation. We may also transfer your personal data if we are under a duty to disclose or share it in order to comply with any legal obligation, to detect or report a crime, to protect your vital interests, to enforce or apply the terms of our contracts or to protect the rights, property or safety of our visitors and clients. However, we will always take steps to ensure that your privacy rights continue to be protected.
40. All information you provide to us for our use is stored on our secure servers which are located within the UK or EU/EEA. The third parties listed under Others who may receive and have access to your personal data may be located outside of the UK or they may transfer your data outside of the UK. Those countries may not have the same standards of data protection and privacy laws as in the UK, which means additional safeguards must be put in place.
41. We will not transfer your personal data to other countries unless we have in place appropriate safeguards, such as:
- the countries where the data is transferred are covered by the UK adequacy regulations. These countries have been assessed and approved by the UK government as having adequate protection of personal data;
- the transfer is based on standard contractual clauses (SCCs) or the International Data Transfer Agreement (IDTA) as applicable, ensuring appropriate safeguards. This may include requiring the recipients of the data to protect your personal data to the same standard required in the UK;
- the transfer is based on a derogation for specific situations, as permitted by the data protection law; or
- where the recipient subscribed to a UK approved international framework, intended to enable secure international transfers.
43. You have a number of rights in relation to your personal data under data protection legislation. In relation to certain rights, we may ask you for information to confirm your identity or clarification to enable us to find your personal data. Except in rare cases, we will respond to you as soon as possible and within one calendar month from either (i) the date that we have received your clarification; or (ii) we have confirmed your identity; or (ii) from the date we received your request.
Accessing your personal data
44. You have the right to request a copy of the personal data we hold about you. This right may be subject to certain limitations, including the need to verify your identity or clarify your request. We may charge a reasonable fee where you request additional copies of information already provided, or where a request is manifestly unfounded or excessive. In some circumstances, we may be unable to provide certain personal data, for example where it cannot reasonably be separated from information relating to other individuals, or where an exemption applies or we are otherwise entitled by law to withhold it.
Correcting and updating your personal data
45. The accuracy of your data is important to us, therefore if you change your name or address/email address, or you discover that any of the other data we hold is inaccurate or out of date, please let us know by contacting us in order that we can update these for you.
Withdrawing your consent
46. Where we rely on your consent as the lawful basis for processing your personal data, as set out under How we use your personal data, you may withdraw your consent at any time by emailing or writing to us at the address at the end of this notice. (Please use “Withdrawal of consent” as the subject heading of your email).
47. If you withdraw your consent, our use of your personal data up until that date is still lawful.
Objecting to our use of your personal data
48. You may object to us processing your personal data. Any objections are reviewed on a case-by-case basis. If we agree that your objection is justified in accordance with your rights under data protection legislation, we will permanently stop using your data for those purposes. Where our interests, or that of our client, override your interests (e.g. in debt recovery matters) we may refuse your request and provide you with explanation together with further information about your rights.
49. You may object to us processing your personal data for direct marketing purposes. See paragraph 62 for details.
50. You may also contest a decision made about you based on automated processing by emailing or writing to us at the address at the end of this notice.
Erasing your personal data or restricting its processing
51. You may request to have your personal data deleted from our systems. Please note that this is not an absolute right. Provided we do not have any continuing lawful basis to continue processing your personal data, we will make reasonable efforts to comply with your request.
52. You may also request a restriction of your processing of your personal data where you believe our processing is unlawful, you contest its accuracy, you have objected to its use and our investigation is pending, or you require us to keep it in connection with legal proceedings. If we agree with your request, we will only process your personal data if we have your consent or are legally permitted to do so, for example for storage purposes, to protect the rights of another individual or company or in connection with legal proceedings.
Transferring your personal data in a structured data file
53. Where we rely on your consent or process your data in connection with a contract, you may request a copy of your personal data in a structured, commonly used and machine-readable format (such as a CSV file) and, where technically feasible, you may ask us to transfer it directly to another service provider. We may be unable to provide some data where it relates to other individuals, or we have another lawful basis to withhold it.
Complaining about the use of your personal data
54. If you wish to complain about the way we use your personal data, you have the right to complain directly to us. You can do so by sending us an e-mail or a letter outlining your complaint and using the details above or you can use the form located at the end of this notice.
55. We will acknowledge your complaint within 30 calendar days of receiving your complaint. We will also endeavour to respond to your complaint within the same timeframe and if this is not possible, we will keep you updated of our progress. We will contact you if we require any further information.
56. If you are dissatisfied with our response, you will have the right to complain to the Information Commissioner’s Office (ICO) or seek to enforce your rights through a judicial remedy. Further information is available on the ICO website (www.ico.org.uk)
How we protect your personal data
57. The transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our website and any transmission is at your own risk. Once we have received your personal data, we have in place reasonable and appropriate controls to ensure that it remains secure against accidental or unlawful destruction, loss, alteration, or unauthorised access.
58. Where we collect any special categories of personal data about you, we will apply additional security controls to protect it.
59. Where we have given you (or where you have chosen) a password which enables you to access any of our online or electronic resources, you are responsible for keeping this password confidential. We advise you not to share your password with anyone.
Links to other websites
60. Our website may contain links to third-party websites, and this privacy notice does not apply to those sites. We are not responsible for the privacy practices, policies, or security of any third-party website, whether you access it through a link on our website or use a third-party website to access ours, and we recommend that you review their privacy notices before providing any personal data.
61. You may receive tailored marketing information from Shoosmiths (including information about our products and services, relevant insights, webinar and event invitations and other news or announcements) if we believe it is in your interest to receive the communication.
62. If you would like to withdraw your consent or opt-out of receiving any Centralised Communications, you can do so using our Unsubscribe tool. Alternatively, you can also access our online preference management centre at any time where you can alter your preferences. You will receive an email from us at intervals of no less than 2 years where you will be asked to confirm your contact details to ensure we keep accurate records.
63. Unsubscribing from our marketing information will not remove our right to contact you regarding the work we carry out for you or on behalf of our clients.
64. We may contact you in response to an article or social media promotion that you have carried out.
65. We may contact you personally to notify you of changes in the law that might affect you or your business, or specific events/information that may benefit you or your business.
66. Where applicable, we may occasionally receive and share personal data with trusted third parties, for example, where we are delivering a joint event.
67. Please see Objecting to our use of your personal data and automated decisions made about you above for further details on how you can do this.
Use of 'cookies'
68. Like many other websites, our website uses digital cookies to obtain information on how visitors interact with our website. 'Cookies' are small pieces of information sent to your computer and stored on its hard drive to allow our website to recognise you when you visit. When you first visit our websites, you will be able to choose whether to “Accept All” or “Refuse All” non-essential cookies, alternatively you will also be able to “Manage Preferences”.
69. It is also possible to block cookies by setting your browser preferences. Please note that this may impact functionality of some webpages and your browsing experience. For more information on how we use cookies and how to switch them off, please see our Cookies Notice below.
70. While you have a choice of which cookies are used when you browse our websites, some of the cookies are strictly necessary for the functioning and security of our websites and therefore will still be used in your browser even after you select the “Refuse All” option in our banner. The cookies which will be used by us and their purpose are presented below:
Essential cookies (these cookies will still be deployed if you select 'Refuse all'):
- OptanonAlertBoxClosed: This cookie is used to determine whether a visitor should be shown the cookies opt-in banner after the first visit to our sites. 1 year retention period.
- OptanonConsent: This cookie enables us to know which cookies you consented to when you interacted with our banner. 1 year retention period.
- Affinity: This cookie ensures that when using our site your requests are consistently routed to the same backend server during a session. Retained for length of session.
Non-essential cookies (these cookies will also be deployed if you select 'Accept all'):
- AMCV_xxxxxAdobeOrg: This cookie is used to identify a unique visitor for tracking purposes by Adobe Experience Cloud. It stores a unique visitor identifier, and uses an organisation identifier to allow a company to track users across their domains and services. 1 year retention period.
- kndctr_68CC1D91674A5B060A495F8C_AdobeOrg_identity: This cookie is set by Adobe Experience Platform to store a unique visitor identifier and related identity information. It helps us recognise visitors across sessions and devices, enabling consistent analytics, personalisation, and audience targeting. 1 year retention period.
- kndctr_68CC1D91674A5B060A495F8C_AdobeOrg_cluster: This cookie is set by Adobe Experience Platform to store information about the regional data centre (cluster) that handles the visitor’s requests. It ensures that data is processed in the correct geographic region for performance and compliance purposes. 30 mins retention period.
- kndctr_68CC1D91674A5B060A495F8C_AdobeOrg_consent: Stores user consent preferences for Adobe Experience Platform Web SDK. 180 days retention period.
- intEmailHistoryId: This cookie is used to identify visits and time spent on our sites through links sent by Vuture Direct Marketing. 1 year retention period.
- _ga: This cookie identifies unique users for Google Analytics reports about the session. 2 years retention period.
- _ga_VLJ0G6FP4R: This is a Google Analytics cookie which tracks individual sessions and stores and counts pageviews for reporting purposes. 1 year retention period.
- _Secure-ROLLOUT_TOKEN: Manages feature rollouts and user experimentation on YouTube. 180 days retention period.
- _clck: This is a Microsoft cookie which remembers a unique ID assigned to the visitor and their preferences. It helps recognise returning visitors and keep their settings consistent. 1 year retention period.
- _clsk: This is a Microsoft cookie which combines multiple page views into a single session. This provides a comprehensive view of the user's visit. 1 day retention period.
- MUID: This is a Microsoft user identifier used to identify unique web browsers visiting Microsoft sites. These cookies are used for advertising, site analytics, and other operational purposes. 1 day retention period.
- _gat_UA-1853482-1: This is a Google Analytics cookie which is used to identify users’ unique identity number for reporting purposes. 1 min retention period.
- _gid: Used to generate statistical data on how the user uses the websites. 1 day retention period.
Cookies set by Third Party sites
71. To improve your website experience, we sometimes embed video content from websites like YouTube and photos from Flickr or utilise sharing tools to enable users to easily share our articles. When you visit a page with content embedded, you may be presented with cookies from these websites. Shoosmiths do not control these cookies. This can also happen when you use our ‘share’ buttons. More information about this can be found below. You should check the relevant third-party website for more information about their cookies when applicable.
Last updated: July 2026