Privacy Policy

About this notice

1 We take your privacy very seriously. The purpose of this privacy notice is to explain to you the information collected, stored and otherwise processed about you and the reasons for the processing. It also tells you who Astraea Group Limited shares this information with, the security mechanisms we have put in place to protect your information and how to contact us in the event you need further information. This policy also explains your rights in relation to your personal data and how to contact us or supervisory authorities if you have a complaint. Please read this privacy policy carefully as it contains important information.

2 This privacy policy does not apply to any third-party websites that may have links to our own website.

3 Clients of the firm should read this policy alongside our general Terms and Conditions as updated from time to time which provide further information on confidentiality and our use of your personal data.

About us

4 Astraea Group Limited is a private limited company registered in England & Wales with company number 12558573, authorised and regulated by the Solicitors Regulation Authority under number 806283.

What do we do with your personal information?

5 We collect, use and are responsible for certain personal data about you. When we do so, we are subject to the UK General Data Protection Regulation (UK GDPR). We are also subject to the EU General Data Protection Regulation (EU GDPR) 2016/679/EU (as may be amended from time to time) in relation to services we offer to individuals and our wider operations in the European Economic Area.

6 We use the following key terms in this policy (“Key Terms”):

Personal data

Any information relating to an identified or identifiable individual

Special category personal data

Personal data revealing racial or ethnic origin, political opinions, religious beliefs, philosophical beliefs or trade union membership

Genetic data

Biometric data (where used for identification purposes)

Data concerning health, sex life or sexual orientation

Data subject

The individual who the personal data relates to

7 Astraea Group Limited collects some or all of the following personal data that you provide:

a) Name, address and telephone number

b) Information to enable us to check and verify your identity, e.g. your date of birth or passport details

c) Electronic contact details, e.g. your email address and mobile phone number

d) Information relating to the matter in which you are seeking our advice or representation

e) Information to enable us to undertake credit or other financial checks on you

f) Financial details so far as relevant to your instructions, e.g. the source of your funds

g) Information about your use of our IT, communication and other systems, and other monitoring information

h) National Insurance and tax details

i) Bank and/or building society details and any other financial details

j) Details of your professional online presence, e.g. LinkedIn profile

k) Details of your spouse/partner and dependants or other family members, e.g. if you instruct us on a family matter or a will

l) Your education, training and employment details; your employment status and details including salary and benefits, e.g. if you instruct us on matter related to your employment or in which your employment status or income is relevant.

m) Your nationality and immigration status and information from related documents, such as your passport or other identification, and immigration information, if relevant.

n) Details of your pension arrangements, if you instruct us on a pension matter.

o) Your employment records including, where relevant, records relating to sickness and attendance, performance, disciplinary, conduct and grievances, e.g. if you instruct us on a matter related to your employment or in which your employment records are relevant.

p) Your racial or ethnic origin, gender and sexual orientation, religious, political, philosophical or similar beliefs, e.g. if you instruct us on a discrimination claim.

q) Your trade union membership, for example, if you instruct us on a discrimination claim or your matter is funded by a trade union.

r) Your medical records – including as to your physical and mental health and any genetic information if relevant to a claim.

s) Biometric information for the purpose of uniquely identifying a natural person

t) Criminal proceedings, outcomes and sentences, or related security measures

u) Details about your lifestyle and social circumstances

v) Details of any goods and services provided to you

w) Other personal information relevant to your instructions to us to provide you with legal services

8 We collect and use this personal data to provide services to you. If you do not provide personal data we ask for, it may delay or prevent us from providing these services.

9 The same categories of information may also be obtained from third parties, such as other professional experts, members of the public, your family and friends, witnesses, courts and other tribunals, suppliers of goods and services, investigators, government departments, regulators, public records and registers. By way of example, we may collect information:

a) from publicly accessible sources, e.g. Companies House or HM Land Registry;

b) directly from a third party, e.g.:

i. sanctions screening providers;

ii. credit reference agencies;

iii. client due diligence providers;

c) from a third party with your consent, e.g.:

i. your bank or building society or another financial institution or advisor;

ii. your employer and/or trade union, professional body or pension administrators;

iii. your doctors and/or other medical and occupational health professionals;

d) via our website—we use cookies and similar technologies on our website (for more information on cookies, please see our policy on cookies below)

e) via our information technology (IT) systems, e.g.:

i. via our case management, document management and time recording systems;

ii. from door entry systems and reception logs; and

iii. through automated monitoring of our websites and other technical systems, such as our computer networks and connections, CCTV and access control systems, communications systems, email and instant messaging systems.

How and why we use your personal data

10 Under data protection law, we can only use your personal data if we have a proper reason, e.g.:

a) you have given consent—where we need your consent, we will ask for it separately from this privacy policy and you can withdraw consent at any time. When you instruct us, we ask for your consent in our Terms of Business (which may be updated from time to time whilst we act for you and which with our Engagement Letter forms the legal contract between us);

b) to comply with our legal and regulatory obligations;

c) to fulfil our contract with you or take steps at your request before entering into a contract; or

d) for our legitimate interests or those of a third party.

A “legitimate interest” is when we have a business or commercial reason to use your personal data, so long as this is not overridden by your own rights and interests. We will carry out an assessment when relying on legitimate interests, to balance our interests against your own. You have the right to object to processing based on legitimate interests. We must then stop the processing unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms or the processing is required to establish, exercise or defend legal claims.

11 The table below explains what we use your personal data for and why.

What we use your personal data for	Our reasons
Providing services to you	To fulfil our contract with you or to take steps at your request before entering into a contract
Preventing and detecting fraud against you or us	For our and/or your legitimate interests, i.e. to minimise fraud that could be damaging for you and/or us
Conducting checks to identify our clients and verify their identity To carry out anti-money laundering and terrorist financing checks Screening for financial and other sanctions or embargoes Other activities necessary to comply with professional, legal and regulatory obligations that apply to our business, e.g. under health and safety law or rules issued by our professional regulator	Depending on the circumstances: • to comply with our legal and regulatory obligations • for our legitimate interests
To enforce legal rights or defend or take legal proceedings	Depending on the circumstances: • to comply with our legal and regulatory obligations • for our legitimate interests, i.e. to protect our business, interests and rights
Gathering and providing information required by or relating to audits, enquiries or investigations by regulatory bodies	Depending on the circumstances: • to comply with our legal and regulatory obligations • for our legitimate interests
Ensuring internal business policies are complied with, e.g. policies covering security and internet use	For our legitimate interests, i.e. to make sure we are following our own internal procedures so we can deliver the best service to you
Operational reasons, such as improving efficiency, training and quality control	For our legitimate interests, i.e. to be as efficient as we can so we can deliver the best service to you at the best price
Ensuring the confidentiality of commercially sensitive information	Depending on the circumstances: • for our legitimate interests, i.e. to protect trade secrets and other commercially valuable information • to comply with our legal and regulatory obligations

Statistical analysis to help us manage our business, e.g. in relation to our financial performance, client base, services range or other efficiency measures	For our legitimate interests, i.e. to be as efficient as we can so we can deliver the best service to you at the best price
Protecting the security of systems and data used to provide services, preventing unauthorised access and changes to our systems	Depending on the circumstances: • for our legitimate interests, i.e. to protect trade secrets and other commercially valuable information • to comply with our legal and regulatory obligations
Updating and enhancing client records	Depending on the circumstances: • to fulfil our contract with you or to take steps at your request before entering into a contract • to comply with our legal and regulatory obligations • for our legitimate interests, e.g. making sure we can keep in touch with our clients about existing and new services
Statutory returns	To comply with our legal and regulatory obligations
Ensuring safe working practices, staff administration and assessments	Depending on the circumstances: • to comply with our legal and regulatory obligations • for our legitimate interests, e.g. to make sure we are following our own internal procedures and working efficiently so we can deliver the best service to you
To promote and market our services and those of selected third parties to existing and former clients and third parties including by way of directory submissions and when procuring goods and services in relation to such promotion and marketing	Depending on the circumstances: • for our legitimate interests, i.e. to promote our business • you have consented
Credit reference checks via external credit reference agencies	For our legitimate interests, i.e. to ensure our clients are likely to be able to pay for our services
External audits and quality checks, e.g. for ISO or Investors in People accreditation and the audit of our accounts to the extent not covered by ‘activities necessary to comply with legal and regulatory obligations’ above	Depending on the circumstances: • for our legitimate interests, i.e. to maintain our accreditations so we can demonstrate we operate at the highest standards • to comply with our legal and regulatory obligations
To share your personal data with members of our group (as and when there are any) and third parties that will or may take control or ownership of some or all of our business (and professional advisors acting on our or their behalf) in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale or in the event of our insolvency In such cases information will be anonymised where possible and only shared where necessary	Depending on the circumstances: • to comply with our legal and regulatory obligations • in other cases, for our legitimate interests, i.e. to protect, realise or grow the value in our business and assets

12 Where we process special category personal data (see above ‘Key terms’), we will also ensure we are permitted to do so under data protection laws, e.g.:

a) we have your explicit consent;

b) the processing is necessary to protect your (or someone else’s) vital interests where you are physically or legally incapable of giving consent;

c) the processing is necessary to establish, exercise or defend legal claims; or

d) the processing is necessary for reasons of substantial public interest.

13 We may use your personal data to send you updates (e.g. by email, text message, telephone, post or social media channels) about our services, including exclusive offers, promotions or new services.

14 We have a legitimate interest in using your personal data for marketing purposes (see above ‘How and why we use your personal data’). This means we do not usually need your consent to send you marketing information. Where this is not the case, we will always ask for your consent.

15 In relation to personal information collected for marketing purposes, the personal information usually consists of:

a) names, contact details, and name of organisation;

b) the nature of your interest in our marketing;

c) your attendance at any events.

16 This will be processed so that you can be provided with information about Astraea Group Limited, its partners and employees and to invite you to events.

17 In all cases, you have the right to opt out of receiving marketing communications at any time by:

a) contacting us using the ‘Contact details” below;

b) unsubscribing by email from any marketing emails from Astraea Group Limited, by emailing info@astraea-group.com (subject line ‘unsubscribe’). It may take up to one week for this to become effective;

c) using the ‘STOP’ number in texts.

18 We may ask you to confirm or update your marketing preferences if you ask us to provide further services in the future, or if there are changes in the law, regulation, or the structure of our business.

19 We will always treat your personal data with the utmost respect and we will never sell it to other organisations for marketing purposes.

Who we share your personal data with

20 We routinely share personal data with:

a) third parties we use to help deliver our services to you, e.g. providers of our case management and finance system, IT service providers including cloud service providers such as data storage platforms, shared service centres and financial institutions in connection with invoicing and payments;

b) third party external advisors or experts engaged in the course of providing services to you, e.g. barristers, tax advisors, experts and other witnesses, local counsel and technology service providers including, without limitation, document review platforms;

c) companies providing services for money laundering checks and other crime prevention purposes and companies providing similar services, including financial institutions and credit reference agencies;

d) other third parties we use to help promote our business, e.g. marketing agencies and consultants;

e) third parties approved by you, e.g. social media sites you choose to link your account to or third party payment providers;

f) our insurers and brokers;

g) our banks; and

h) the courts, tribunals, prosecution authorities.

21 We only allow those organisations to handle your personal data if we are satisfied that they take appropriate measures to protect your personal data. We ensure all outsourcing providers operate under service agreements that are consistent with our legal and professional obligations, including in relation to confidentiality.

22 We or the third parties mentioned above may occasionally also share personal data with:

a) our and their external auditors, e.g. in relation to the audit of our or their accounts, in which case the recipient of the information will be bound by confidentiality obligations;

b) our and their professional advisors (such as lawyers and other advisors), in which case the recipient of the information will be bound by confidentiality obligations;

c) law enforcement agencies, courts, tribunals and regulatory bodies to comply with our legal and regulatory obligations;

d) other parties that have or may acquire control or ownership of our business (and our or their professional advisers) in connection with a significant corporate transaction or restructuring, including a merger, acquisition or asset sale or in the event of our insolvency—usually, information will be anonymised but this may not always be possible and the recipient of any of your personal data will be bound by confidentiality obligations

23 Astraea Group Limited may also be required to provide your information to regulators, such as the Solicitors Regulation Authority, the Bar Standards Board, the Financial Conduct Authority or the Information Commissioner’s Office. In the case of the Information Commissioner’s Office, there is a risk that your information may lawfully be disclosed by them for the purpose of any other civil or criminal proceedings, without our consent or your consent, which includes privileged information.

24 We may also be required to disclose your information to the police or intelligence services, where required or permitted by law.

25 If you would like more information about who we share our data with and why, please contact us (see ‘Contact details’ below).

Where your personal data is held

26 Personal data may be held at our offices and those of our third party agencies, service providers, representatives and agents as described above (see ‘Who we share your personal data with’).

27 Some of these third parties may be based outside the UK. For more information, including on how we safeguard your personal data when this occurs, see below: ‘Transferring your personal data abroad’.

Transferring your personal data abroad

28 This privacy policy is of general application and as such it is not possible to state whether it will be necessary to transfer your information out of the UK or the EEA in any particular case. However, if you reside outside the UK or the EEA or your case involves persons or organisations or courts and tribunals outside of the UK or the EEA then it may be necessary to transfer some of your information to that country outside of the UK or the EEA for that purpose. If you are in a country outside the UK or the EEA or if the instructions you provide come from outside the UK or the EEA then it is inevitable that information will be transferred to those countries. If this applies to you and you wish additional precautions to be taken in respect of your information please indicate this when providing initial instructions.

29 Some countries and organisations outside the UK and the EEA have been assessed by the UK government or the European Commission and their information protection laws and procedures found to show an adequate level of protection of personal data (known as an adequacy decision). Most countries do not have the benefit of an adequacy decision. If your information has to be transferred outside the UK or the EEA, then it may not have the same protections and you may not have the same rights as you would within the UK or the EEA. Where we are not required to transfer your personal data outside the UK or the EEA, we will only transfer your personal data outside the UK and EEA where:

a) the UK government or European Commission has decided that the recipient country benefits from an adequacy decision;

b) there are appropriate safeguards in place (e.g. standard contractual data protection clauses published or approved by the relevant data protection regulator), together with enforceable rights and effective legal remedies for you;

c) a specific exception applies under data protection law; or

d) necessary for the conduct of any legal proceedings.

30 You can contact us (see ‘Contact details” below) if you would like a list of countries benefiting from a UK or European adequacy decision or for any other information about protection of personal data when it is transferred abroad.

31 Cloud information storage services based in the USA (who have agreed to comply with the EU-US Data Privacy Framework (DPF) in order to enable us to store your information and/or backup copies of your information) may access your information when they need to. The USA does not have the same information protection laws as the UK and EU but the DPF has been recognised by the European Commission and the UK as providing adequate protection.

32 Cloud information storage services based in Switzerland, in order to enable us to store your information and/or backup copies of your information may access your information when they need to. Switzerland does not have the same information protection laws as the UK and the EU but has been recognised by the UK and the European Commission as providing adequate protection.

33 If you would like any further information please use the ‘Contact details” below at the end of this document.

How long will Astraea Group Limited store your personal information?

34 We will not keep your personal data for longer than we need it for the purpose for which it was collected or as required by law.

35 As a general rule, we will keep your personal data for at least twelve years from the conclusion of your matter, in case you, or we, need to bring or defend any complaints or claims. However, different retention periods apply for different types of personal data and for different services, e.g.:

a) we will need to keep information relating to a trust for the duration of that trust and for a minimum of seven years thereafter;

b) in probate matters where there is a surviving spouse or civil partner, personal data may be retained until the survivor has died, to deal with the transferable inheritance tax allowance;

c) wills and related documents may be kept indefinitely;

d) deeds related to unregistered property may be kept indefinitely as they evidence ownership.

36 Following the end of the of the relevant retention period, we will delete or anonymise your personal data.

37 Equality and diversity data may be retained for 10 years in pseudonymised form for the purpose of research and statistics and complying with regulatory obligations in relation to the reporting of equality and diversity data.

38 Names and contact details held for marketing purposes will be stored indefinitely or until we become aware or are informed that an individual has ceased to be a potential client.

Your rights

39 You have the following rights, which you can exercise free of charge:

Access	The right to be provided with a copy of your personal data
Rectification	The right to require us to correct any mistakes in your personal data
Erasure (also known as the right to be forgotten)	The right to require us to delete your personal data—in certain situations
Restriction of processing	The right to require us to restrict processing of your personal data—in certain situations, e.g. if you contest the accuracy of the data
Data portability	The right to receive the personal data you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations
To object	The right to object: • at any time to your personal data being processed for direct marketing (including profiling); • in certain other situations to our continued processing of your personal data, e.g. processing carried out for our legitimate interests unless we demonstrate compelling legitimate grounds for the processing which override your interests or for establishing, exercising or defending legal claims
Not to be subject to automated individual decision making	The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you
The right to withdraw consent	If you have provided us with a consent to use your personal data you have a right to withdraw that consent at any time You may withdraw consents by emailing us using the “Contact Details” below Withdrawing consent will not affect the lawfulness of our use of your personal data in reliance on that consent before it was withdrawn

40 If you want more information about your rights under the UK GDPR please see the Guidance from the Information Commissioners Office on Individual’s rights under the UK GDPR.

41 If you want to exercise any of these rights, please:

a) contact us using the ‘Contact details” below;

b) provide enough information to identify yourself (e.g. your full name, address and client or matter reference number) and any additional identity information we may reasonably request from you; and

c) let us know what right you want to exercise and the information to which your request relates.

42 We will respond to you within one month from when we receive your request.

Cookies

43 Cookies are small pieces of data which are stored for you on your computer by your web browser. Their purpose is to improve your online experience and they are used by almost every website.

44 We aim to keep cookies to a minimum, and we only use the following cookies:

45 Google Analytics: these cookies are called __utma __utmb __utmc and __utmz. We use Google’s cookies to collect information about how visitors use our site and we use that information to help us improve the site. The cookies collect information in an anonymous form, including the number of visitors to the site, from where visitors have come to the site and the pages they visited. You can find further information here: https://policies.google.com/technologies/types.

46 Social Sharing & Add This: these cookies are called __atuvc and __atuvs; loc, mus, ouid uid, uvc and xtc. These cookies allow the user to share content via their own social channels. You can find further information here: https://cookiepedia.co.uk/cookies/__atuvc.

47 LinkedIn: these cookies are called lidc. These cookies allow the user to share content via LinkedIn. You can find further information here: https://www.linkedin.com/legal/cookie-table.

48 If you are not happy with the cookies that we use, you should either not use our website, or you should delete cookies after having visited the site. Alternatively, you should browse our website using your browser’s anonymous usage setting.

Keeping your personal data secure

49 We have implemented appropriate technical and organisational measures to keep your personal data confidential and secure from unauthorised access, use and disclosure. We limit access to your personal data to those who have a genuine business need to access it. Those processing your personal data will do so only in an authorised manner and are subject to a duty of confidentiality.

50 We require our business partners, suppliers and other third parties to implement appropriate security measures to protect personal data from unauthorised access, use and disclosure.

51 We also have procedures to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are required to do so.

How to make a complaint?

52 Please contact us if you have any queries or concerns about our use of your personal data (see below ‘Contact details”). We hope we will be able to resolve any issues you may have.

53 The UK GDPR gives you the right to lodge a complaint with the Information Commissioners’ Office if you are in the UK or under the EU GDPR with the supervisory authority of the relevant Member State/EEA member country. You may be able to lodge a complaint with another relevant supervisory authority in your jurisdiction or other jurisdiction where you work, normally live or where the alleged infringement of data protection laws occurred. The Information Commissioner’s Office can be contacted at http://ico.org.uk/concerns/

Future Processing

54 Astraea Group Limited does not intend to process your personal information except for the reasons stated within this privacy policy. If this changes, this privacy policy will be amended and placed on our website.

Updating your personal data

55 We take reasonable steps to ensure your personal data remains accurate and up to date. To help us with this, please let us know if any of the personal data you have provided to us has changed, e.g. your surname or address—see below ‘Contact details’.

Changes to this privacy notice

56 This privacy notice was published on 12 September 2024.

57 Astraea Group Limited continually reviews its privacy practices and may change this policy from time to time. When it does, an amended privacy policy will be placed on our website. We will ask for your consent to the changes if legally required.

Do you need extra help?

58 If you would like this policy in another format (for example audio, large print, braille) please contact us (see ‘Contact details’’ below).

Contact Details

59 If you have any questions about this privacy policy or the information Astraea Group Limited holds about you or you wish to exercise a right under data protection law or to make a complaint, please contact:

(a) in the case of individuals in the UK

James Ramsden KC
7 Down Street, London, W1J 7AJ
T 020 3875 9057
M 07852 297 138
james.ramsdenkc@astraea-group.com

(b) in the case of individuals in the EEA

We have appointed Lionheart Squared (Europe) Ltd to be our data protection representative within the EEA. Their contact details are:

Lionheart Squared (Europe) Ltd (marked for the attention of Astraea Group Limited)
2 Pembroke House, Upper Pembroke Street 28-32 Dublin, D02 EK84, Republic of Ireland
Astraea@LionheartSquared.eu

Individuals within the EEA can contact us direct (see above) or contact our European representative.