Hebble Law is a Licensed Body authorised and regulated by the Solicitors Regulation Authority.
We must comply with the General Data Protection Regulation. As Data Controllers and/or Processors, we must provide you with details of personal information we may collect about you, how we may use it and what we do to keep it secure. We also explain your rights in respect of your personal information and how to contact us should this become necessary.
Lawful Processing of Data – Personal Data
You have provided consent for your data to be passed directly or via your insurer, for the purpose of instructing Hebble Law to act for you with regards to bringing a legal claim or defending a claim made against you/your insurer. As Data Controllers, we will process and store your personal data on one or more of the following legal grounds:
- with your consent;
- processing is necessary for the performance of a contract with you or to take steps to enter into a contract with you;
- processing is necessary for compliance with a legal obligation;
- processing is necessary for the purposes of legitimate interests pursued by the data controller or a third party, except where such interests are overridden by your interests, rights or freedoms.
Lawful Processing – Special Category Data
Depending on the nature of your claim, we may need to process and/or store your medical and/or employment data, which, for the purposes of data protection, is classed as a “special category” of data. If so, the processing will be on one or more of the following legal grounds:
- with your explicit consent;
- processing is necessary for the establishment, exercise or in defence of legal claims or courts are acting in their judicial capacity;
- processing is necessary for the purposes of preventative or occupational medicine, for assessing the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or management of health or social care systems and services on the basis of Union or Member State law or a contract with a health professional.
We will obtain your signed consent to allow your medical records and data to be processed in line with our instructions. Data processing may be via electronic means and/or in paper format and will be stored for the purpose it has been obtained and for as long as it is needed for that purpose and to fulfill our regulatory and/or legal obligations.
In order to progress your legal claim or to defend a claim made against your/your insurer, we may have to share your data with third party organisations under the RTA Protocol. All of these third parties have a legal duty to comply with data protection legislation and will process your data on our behalf. These may include the following:
- Government backed motor data institutions such as the Motor Insurance Bureau and/or the Claims Portal;
- Fraud prevention bodies such as the Insurance Fraud Bureau or the Motor Insurer Anti-Theft Agency;
- Solicitors Regulation Authority, Financial Conduct Authority, Legal Ombudsman and quality auditors;
- Registered medical agencies and/or professional medical experts, hire and/or repair and/or engineer companies;
- Your insurer and the third party’s insurer;
In these circumstances, we will make all reasonable efforts to ensure that your information is properly protected and that it is only used in accordance with this privacy notice.
Retention of information
We keep personal information for as long as necessary to ensure we can fulfil to meet our legal and operational requirements in accordance with current Data Protection legislation and applicable regulation.
Your Individual Data Rights
You can ask us to update, remove, transfer or stop processing your personal data by contacting your claim handler by letter, email or by telephone. You also have the right to request a copy of the personal data that we hold about you – this is called a subject access request. We must comply within 30 days or explain why that may not be possible. We have the right to refuse or make a charge for manifestly unfounded or excessive requests. Please note that this process does not entitle you to a complete copy of your file.
You have the right to lodge a complaint with the Supervisory Authority which in the UK is the Information Commissioners’ Office with whom we are registered under reference Z4806754, via www.ico.org or via telephone 0303 123 1113. Our Data Protection Officer is Caroline Donnelly. We will take all reasonable steps to confirm your identity before complying with any requests in relation to your data.