Privacy policy

1. Introduction ¶

1.1 C W Harwood & Co Limited (trading as Harwood & Co and C W Harwood & Co) (the Firm) takes the privacy and security of all data, in particular personal data, extremely seriously and is committed to taking all necessary and reasonable steps to safeguard personal data at all times and in the best way possible.

1.2 The purpose of this privacy policy is to set out:

who the Firm is;
the personal data it collects;
how, when and why it collects, stores, uses and shares personal data;
the lawful bases on which it processes personal data;
how it keeps personal data secure;
for how long it keeps personal data;
the rights of a data subject in relation to their personal data; and
how to contact the Firm, or the relevant supervisory authority, in the event of a complaint.

1.3 To enable the Firm to advise you, provide legal services to you or take your instructions, the Firm needs to collect, use and process certain personal information about you. When it does so, it is subject to the data protection laws and professional regulation that apply in the United Kingdom. The principal legislation and regulation to which the Firm is subject in this regard includes:

the UK General Data Protection Regulation (UK GDPR);
the Data Protection Act 2018 (DPA 2018);
the Data (Use and Access) Act 2025 (DUA Act), which amends the UK data protection regime;
the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR);
the Network and Information Systems Regulations 2018; and
the SRA Standards and Regulations.

1.4 The Firm is a controller of personal data for the purposes of those laws. In other words, the Firm is primarily responsible for that data and is a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data (Article 4(7), UK GDPR).

1.5 The Firm's details are:

C W Harwood & Co Limited, trading as Harwood & Co and C W Harwood & Co;
Company number 10758849, registered in England and Wales;
Registered office: E8 Joseph's Well, Hanover Walk, Leeds, LS3 1AB;
Authorised and regulated by the Solicitors Regulation Authority (SRA ID 8013042);
VAT number GB371989696;
Registered with the Information Commissioner's Office (ICO) as a controller under registration number Z8032023.

1.6 The Firm has appointed a Data Protection Manager, Joe Addlestone. If you have any questions about the use to which your personal data is put, please email the Firm at [email protected], telephone 0113 245 7027, or write to the Data Protection Manager, Harwood & Co, E8 Joseph's Well, Hanover Walk, Leeds, LS3 1AB.

1.7 This policy applies in all circumstances, and in particular where you (or someone or an organisation on your behalf):

instruct the Firm to act on your behalf or to provide you with advice and/or information;
enquire about instructing the Firm;
are a person (including a defendant or potential defendant) whom the Firm has been instructed to pursue on behalf of a client, for example to recover money said to be owed, or in connection with other litigation, even though you are not a client of the Firm;
visit the Firm's website or use one of its online portals (see section 12);
submit an enquiry, make contact with the Firm or sign up to receive the Firm's newsletter;
request information from, or provide information to, the Firm;
make a payment to the Firm or to one of its clients through the Firm's payment portal; and
attend events or seminars hosted by the Firm.

1.8 This policy will also apply where the Firm:

conducts searches of public sources on you in connection with its marketing or business acceptance processes;
agrees to provide legal services to you or the organisation for whom you work; and
adds you to a mailing or marketing list.

1.9 In general the services provided by the Firm are not principally aimed at children, because children are usually represented by their parents or guardians. If you are a child and require further advice or explanation about how the Firm would use your data, or if you represent the interests of a child and would like the child to receive further advice and explanation, please contact the Firm using the details in section 1.6 above.

1.10 This policy covers the personal data of the Firm's clients and of other individuals the Firm deals with in the course of its work. This includes people the Firm has been instructed to pursue on behalf of a client — such as defendants and potential defendants in debt recovery or other litigation matters — who are not themselves clients of the Firm. Where the Firm obtains personal data about you from someone other than you (for example from its client or from the sources in section 2.4), it relies on this policy to provide you with the information required by Article 14 of the UK GDPR. The personal data of the Firm's own staff is dealt with in a separate internal staff privacy notice.

1.11 The Firm is committed to preserving the privacy of your data so that it can:

deliver services of a high quality to all of its clients;
at all times comply with the law and the various regulations to which it is subject;
preserve the confidentiality of your personal data in compliance with the SRA Standards and Regulations and its professional duty of confidentiality;
meet the expectations of clients, employees and third parties; and
protect the Firm's reputation.

1.12 In this policy, please note the use of the following terms:

"the Firm", "we", "us" or "our" refers to C W Harwood & Co Limited, trading as C W Harwood & Co or Harwood & Co;
"you" and "your" refers to the person whose data is processed;
"personal data" has the meaning given to it by the UK GDPR and DPA 2018, namely any information relating to an identified or identifiable individual (a "data subject");
"special category personal data" means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a person, and data concerning health, sex life or sexual orientation;
"processing" means any operation or set of operations performed on personal data — for example collection, recording, organisation, structuring, storage, alteration, deletion or otherwise using.

2. The personal data we collect ¶

2.1 The Firm may collect, store, use and share personal data relating to you in the course of acting for, or advising, you, or in the course of pursuing a matter against you on behalf of a client. The data the Firm may need to collect includes the following:

your name and contact details, including your address, telephone number, mobile telephone number, email address and DX address;
information about your gender;
where you are located;
information about your online presence (for example LinkedIn or X (formerly Twitter)) and whether you have linked to the Firm or its social media pages;
professional or trade-related information;
information required to check and verify your identity (for example for anti-money laundering purposes or to help prevent fraud), which may include passport details, driving licence details, date of birth, national identity card, or the MPAN number for your address;
information as to the matter in which the Firm is acting or advising, or the matter the Firm is pursuing against you;
information required to carry out a financial or credit check;
financial details, including your bank account details (where money is, or is likely to need to be, sent to you), payment card details and your billing information;
your National Insurance and/or tax details;
details of your spouse/partner and dependants or other family members, where for example you have instructed the Firm on a family matter or in connection with a will, trust or similar arrangement;
details of your employment status and related information, including salary and benefits and records relating to sickness and attendance, performance, disciplinary, conduct and grievances (including relevant special category personal data), where for example your matter relates to your employment or your employment status, income or records are relevant;
details of your racial or ethnic origin, gender and sexual orientation, and religious or similar beliefs, where for example you instruct the Firm in relation to a discrimination or similar claim;
details of your medical records and of any injuries and other personal physical, mental or medical details, where for example the Firm is acting for you and your medical records are relevant to a case;
where you are a person from whom the Firm is recovering money on behalf of a client, financial information about your income, outgoings, assets, liabilities and other creditors, and any information you choose to provide in support of an offer to pay (see section 12);
marketing and communications data, including (where relevant) your preferences in relation to receiving marketing and communications from the Firm;
transaction data, including details about any payments to and from you;
technical data, including internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technical data relating to your use of the Firm's website or portals; and
recordings of telephone calls you have with the Firm.

2.2 Details of your racial or ethnic origin, sexual orientation, religious or similar beliefs, health, genetic and biometric data are special category personal data, and your political opinions and trade union membership are also special category personal data. Information about criminal convictions and offences is subject to additional protection. The Firm will only process data of this nature where a condition under Article 9 or Article 10 of the UK GDPR and the DPA 2018 applies — for example where processing is necessary for the establishment, exercise or defence of legal claims, or where you have given your explicit consent.

2.3 Failure to provide the personal data requested may prevent the Firm from acting for you or delay the provision of services.

2.4 The Firm collects data about you directly from you — by letter, email, through a secure portal on its website, by phone or at a meeting — and, particularly where you are a person the Firm has been instructed to pursue, from its client or from other sources. The Firm may also acquire information about you:

from the Firm's client who has instructed it in relation to your matter;
from publicly available sources such as HM Land Registry, Companies House, professional records and other membership records;
from third-party services such as screening suppliers, credit reference agencies and due diligence suppliers;
from third parties with whom you have a relationship, including banks, building societies and other financial institutions, other professionals and advisers, employers, professional bodies, doctors, trade unions and debt collection agencies instructing us on your behalf; and
through information technology methods, including cookies on websites, CCTV systems, car parking access control systems, and email and instant messaging services.

2.5 It is important that the personal data the Firm holds about you is accurate and current. Please keep the Firm informed if your personal data changes during your relationship with it.

2.6 The Firm may also obtain personal data in relation to your use of its website and online portals, which may include your IP address and the operating system and web browser you use. This enables the Firm to produce statistical data on the use of the site and to enhance the user experience. The Firm's websites use cookies and similar technologies; for further details, please see the Firm's Cookie Policy (linked below) and section 12.

3. The purposes for which your information is used, and the lawful bases ¶

3.1 Data protection law requires the Firm to have a lawful basis for processing your personal data. The Firm relies on one or more of the following bases:

Consent — where you have given consent to the processing of your personal data for one or more specific purposes (Article 6(1)(a), UK GDPR). You may withdraw consent at any time.
Performance of a contract — where processing is necessary for the performance of our retainer with you, or to take steps at your request before entering into it (Article 6(1)(b)).
Legal obligation — where processing is necessary for compliance with a legal or regulatory obligation to which the Firm is subject (Article 6(1)(c)).
Vital interests — where processing is necessary to protect your vital interests or those of another person (Article 6(1)(d)).
Public task — where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority (Article 6(1)(e)).
Legitimate interests — where processing is necessary for the purposes of the Firm's legitimate interests or those of a third party (including the Firm's clients, for example in recovering money owed to them), except where those interests are overridden by your interests or fundamental rights and freedoms (Article 6(1)(f)). The DUA Act has introduced a non-exhaustive list of activities that may constitute a legitimate interest, and a category of recognised legitimate interest for certain processing in the public interest. Where the Firm relies on legitimate interests, it carries out and documents a balancing assessment.

3.2 The specific purposes for which the Firm may use your personal data are:

to provide you with legal services, advice or representation under our retainer, and to take any steps necessary before entering into it;
to pursue, on behalf of the Firm's clients, the recovery of money owed to them or other litigation against you, including taking and assessing offers to pay and collecting payments;
to prevent or detect fraud, whether against you or another person involved in your matter;
to carry out identity checks and undertake information gathering and audits as required by the SRA or other regulatory bodies, and to comply with legal and/or regulatory obligations to which you or the Firm is subject;
to carry out anti-money laundering checks;
to undertake financial, sanctions and other security checks and such other processing as is required for legal and regulatory compliance;
to gather and provide information required by or relating to audits, enquiries or investigations by your or the Firm's regulator(s);
to preserve the confidentiality of commercially sensitive information and to protect the Firm's, or another's, intellectual property and other commercially valuable information;
to comply with the Firm's legal and regulatory obligations, including the SRA Accounts Rules and HMRC requirements;
to comply with the Firm's internal business policies and for operational reasons such as security, confidentiality, competency and efficiency control, training and client care;
to operate and administer the Firm's telephone and IT systems and online portals (see section 12);
to carry out audits and external quality reviews in relation to standards adopted by the Firm;
to carry out statistical analysis to enable the Firm better to manage its business (for example in relation to financial performance, client base and range of services);
to maintain and update records, ensure accuracy of processing, prevent unauthorised access and modification to systems, and prevent and detect criminal activity;
to make information returns to regulators and legally constituted bodies;
to ensure safe working practices, staff administration and assessments;
to market the Firm's services to existing and former clients and third parties; and
for credit control and credit reference checks in relation to the services the Firm performs.

3.3 The Firm will only process special category personal data, or data relating to criminal convictions and offences, where a condition under Article 9 or Article 10 of the UK GDPR and the DPA 2018 applies. In most cases, this will be because the processing is necessary for the establishment, exercise or defence of legal claims (Article 9(2)(f)), or because you have given your explicit consent.

3.4 Artificial intelligence, automated decision-making and profiling.

AI tools. The Firm uses Thomson Reuters CoCounsel as its only artificial-intelligence tool. CoCounsel is an AI assistant used to support the Firm's solicitors in their legal work. It is used under the supervision of our solicitors and does not replace the professional judgement of the person responsible for your matter. The Firm does not use CoCounsel to make decisions about you by solely automated means.
Profiling in debt recovery. Where you complete an income and expenditure statement through the Firm's online portal (see section 12), the portal automatically calculates an advisory assessment of what you may be able to afford, based on the figures you provide and published national-average figures. This is a form of profiling (an automated evaluation of your economic situation). It is advisory only: a member of the Firm reads your statement and makes every decision. No decision about you is made solely by automated means that produces legal effects concerning you or similarly significantly affects you.

Other than as described above, the Firm does not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

4. Contacting you ¶

4.1 In addition to the matters dealt with above, the Firm may send you updates concerning legal and other relevant developments in relation to you, your matter, your personal, business or family interests, or other related matters which might concern or be of interest to you. This may be by post, telephone, email or text, and may include information about the legal and other services the Firm offers and changes to those services.

4.2 The Firm regards itself as having a legitimate interest in processing your personal data for these purposes, and it undertakes a legitimate interests assessment from time to time to balance its interests against your own. Where the Firm sends marketing by electronic means (email or text), it will comply with PECR, which may require your prior consent unless the "soft opt-in" exemption applies. Where consent is required, the Firm will obtain it in a clear and transparent manner.

4.3 The Firm will treat your personal data with the utmost respect and will never share it with others for their own marketing or promotional purposes without your consent. You have, at all times, the right to ask the Firm not to contact you for any purpose other than carrying out the matter on which it is instructed. The Firm may ask you to confirm your marketing preferences from time to time.

5.1 It may be necessary for the Firm to share your personal data with others in order to:

carry out legal services for you or for the Firm's clients;
provide advice, assistance and representation;
comply with its contractual obligations; or
comply with legal or regulatory obligations to which you or the Firm is subject.

5.2 Those with whom the Firm may share your personal data include:

professional advisers used in connection with the matter — for example accountants, experts, barristers, medical professionals, search agents and advocates;
the Firm's clients, where you are a person from whom the Firm is recovering money, or against whom the Firm is otherwise instructed, on their behalf (for example, a completed income and expenditure statement and offer to pay is shared with the client);
agents acting for the Firm's clients in connection with a matter, such as debt recovery agencies and other collection or enforcement agents, where the Firm passes your information to them on the client's behalf;
third parties involved in the matter — for example financial services providers, banks, building societies, insurers and registrars;
government and similar organisations such as HM Land Registry, Companies House and HM Revenue & Customs;
courts and other parties, where information is disclosed in the course of proceedings;
others within the Firm's business;
your and the Firm's regulator(s);
credit reference agencies in connection with the Firm's retainer;
the Firm's bank, insurers and insurance brokers;
external auditors in relation to the audits and external quality reviews referred to above;
the Firm's third-party service providers and processors, including its IT, hosting, cloud, document management, case management, payment, email-delivery and telephony providers who process personal data on the Firm's behalf and under its instructions (the main providers are listed in section 12);
suppliers of services required in relation to your matter; and
an agent providing us with instructions on your behalf (such as a debt collection agency or estate agency).

5.3 Where the Firm engages a third party to process personal data on its behalf, it puts in place a written contract that complies with Article 28 of the UK GDPR, requiring the processor to process the data only on the Firm's documented instructions, to keep it confidential and secure, and to assist the Firm in meeting its obligations. The Firm only allows others to handle your personal data if it is satisfied that their protective measures are satisfactory.

5.4 From time to time the Firm may be required to disclose personal data and exchange information about you with government, law enforcement and regulatory bodies in order to comply with its own legal and regulatory obligations.

5.5 During, and sometimes after, your instructions, the Firm may need to share your personal data with other third parties involved in a relevant transaction. The Firm will only share information that is necessary to do so.

5.6 The Firm may also need to share personal data with other parties, such as potential buyers of some or all of the Firm's business, or in connection with a restructuring. Usually information will be anonymised, but where this is not possible the recipient will be bound by confidentiality obligations.

5.7 The Firm does not sell your personal data, and does not share it for others' marketing purposes.

6. International transfers ¶

The Firm stores and processes personal data in the United Kingdom wherever it can. Its website, its case management system, its portals and its Microsoft 365 tenant are all hosted in the United Kingdom.

Some of the Firm’s service providers are based in, or use services in, the United States. Personal data may therefore be transferred there in the following cases:

Cloudflare, Inc. delivers the Firm’s website (harwood.law) and protects it from attack. When you visit the website, Cloudflare processes technical information such as your IP address and browser details.
Google LLC provides:
- reCAPTCHA, which protects the website’s forms (including the enquiry, submit a case, vacancies and make a payment forms) from spam and automated abuse. Google processes technical information about your visit and how you interact with the page.
- the web fonts used on the website. No cookies are set, but your IP address is sent to Google so that the fonts can be delivered.
- Google Tag Manager, which loads the Firm’s analytics and advertising tools on the website. Google Analytics and Google Ads (including DoubleClick) are fully enabled only if you agree to them through the cookie banner. Before you choose, Google receives only limited information without cookies, as explained in the Firm’s Cookie Policy.
Algolia, Inc. provides the website’s search. When you search, Algolia processes your search terms and technical information such as your IP address.
Mapbox, Inc. provides the maps on the website. When a page shows a map, Mapbox processes technical information such as your IP address. If you allow statistics cookies, it also processes information about how you use the map.
AC PM LLC (part of ActiveCampaign LLC) sends emails from the Firm’s portals, such as the link to complete a form and reminders. It processes your name, email address and the content of those emails, which never includes your financial information.

The United Kingdom has decided that personal data is adequately protected when it is sent to US organisations certified under the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”). The US providers above are certified under it and the Firm relies on that certification. Where it does not apply, the Firm relies on the standard data protection clauses approved for UK transfers: the UK International Data Transfer Agreement, or the EU standard contractual clauses with the UK Addendum.

Microsoft, which provides the Firm’s email and document storage, may occasionally access data from outside the United Kingdom, for example to provide technical support. When it does, it is bound by its data protection terms with the Firm, which include the same safeguards.

The Firm’s cookie consent tool, Cookiebot, is provided by Usercentrics A/S, which is based in the European Union. It records the choices you make on the cookie banner. The United Kingdom has decided that personal data is adequately protected when it is sent to the European Economic Area.

You can ask for more information about these transfers, or a copy of the safeguards the Firm relies on, using the contact details in section 10.

7. How your personal data is kept, and for how long ¶

7.1 Your personal data will be kept secure at all times. Some of it will be held at the Firm's offices and some by the third-party service providers, representatives and agents referred to in this policy. Some data may be held on servers hosted by third-party providers; where this takes place outside the UK, the provisions of section 6 apply.

7.2 Personal data processed by the Firm will not be retained for any longer than is necessary for the purpose for which it was collected, or for related purposes. Where personal data is retained after the Firm has finished providing its services to you, or after the retainer has otherwise ended, this will generally be so that the Firm can:

respond to any questions, complaints or claims made by you or on your behalf;
demonstrate that your matter was dealt with properly and that you were treated fairly; and
comply with legal and regulatory requirements.

7.3 The Firm retains personal data as follows:

personal data relating to litigation matters is retained for six years from closure of the relevent file;
personal data relating to property matters (including litigation matters involving a charge on a property) is retained for twelve years;
contact details (so that the Firm can inform you of updates and relevant developments), accounts data, anti-money laundering checks data and your documents are retained for twelve years; and
data held in the Firm's online portals is retained for the periods set out in section 12.

7.4 Personal data may be held for longer where this is necessary for compliance with a legal obligation to which the Firm is subject, or in order to protect your vital interests or those of another person. In some circumstances the Firm may anonymise your personal data, in which case it may use that information indefinitely without further notice to you.

8. Your rights in relation to your data ¶

8.1 The UK GDPR and DPA 2018 give you various rights in relation to your personal data. These rights are generally exercisable without charge, and the Firm is subject to time limits for responding. Your rights are, in the main, set out in Articles 12–23 of the UK GDPR and are as follows:

A right of access — to obtain confirmation of whether your personal data is being processed and, if so, access to that data and other information, including the purposes of processing, the recipients, the retention period, and the existence of your other rights (commonly known as a subject access request).
A right to rectification — to have inaccurate personal data corrected and incomplete data completed, without undue delay.
A right to erasure (the "right to be forgotten") — to ask the Firm, in certain circumstances, to delete personal data relating to you.
A right to restrict processing — to ask the Firm, in certain circumstances, to restrict the processing of your data.
A right to data portability — in certain circumstances, to receive the personal data you have provided to the Firm in a structured, commonly used and machine-readable format, and to have it transmitted to another controller.
A right to object — in certain circumstances, to object to the processing of your personal data, including processing for direct marketing (an absolute right) and processing based on legitimate interests.
A right to withdraw consent — where the Firm relies on consent, to withdraw that consent at any time, without affecting the lawfulness of processing carried out beforehand.
A right not to be subject to automated decision-making — not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

8.2 Some of the information the Firm holds may be subject to legal professional privilege (for example, the Firm's own assessment and notes prepared in connection with recovering a debt or pursuing a claim). The Firm may not have to disclose privileged material in response to a subject access request. Some information may also be withheld where disclosing it would be likely to prejudice the client's claim or another exemption under the DPA 2018 applies.

8.3 You will not usually have to pay a fee to exercise your rights. However, the Firm may charge a reasonable fee, or refuse to act, if your request is manifestly unfounded, repetitive or excessive. The Firm may need to request specific information to confirm your identity before responding.

8.4 The Firm will respond to your request within one month. Occasionally it may take longer if your request is particularly complex or you have made a number of requests; in that case, the Firm will notify you and keep you updated.

8.5 You may exercise any of these rights by:

contacting the Firm using any of the methods in section 10, including in writing, by telephone, by text, or electronically;
completing a form which the Firm can supply to you for this purpose; or
through a third party whom you have authorised for this purpose.

8.6 There are some restrictions on these rights, and in some cases exercising them may mean the Firm is unable to continue acting for you, in which case the Firm may need to cease to act. Full details of your rights can be found in the UK GDPR or in guidance produced by the ICO.

9. Keeping your data secure ¶

9.1 The Firm has put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered or disclosed, as required by Article 32 of the UK GDPR. Access to your personal data is restricted to those with a business need to know, who are subject to a duty of confidentiality and who process the data only on the Firm's instructions.

9.2 These measures apply to both electronic and physical data. The Firm's premises are access-controlled and its electronic systems require login and password authentication. The Firm's online portals use further measures appropriate to the data they handle (see section 12), including encrypted connections (HTTPS/TLS), multi-factor authentication for staff access, encryption of sensitive data, access restricted by role, and regular security testing.

9.3 All of the Firm's directors, partners, staff and third-party service providers who have access to your personal data are subject to confidentiality obligations.

9.4 The Firm has procedures in place to deal with any suspected personal data breach. It will notify you and any applicable regulator (including the ICO) of a breach where it is legally or contractually required to do so.

9.5 The transmission of information via the internet is not completely secure. Although the Firm will do its best to protect your personal data, it cannot guarantee the security of any data transmitted to or from it via its websites or by email; any such transmission is at your own risk.

10. Contact details ¶

10.1 If you have any questions about this privacy policy, or about the acquisition, use, storage or disposal of any personal data relating to you, or if you want to exercise your rights, please contact the Firm:

Email:[email protected]

Telephone: +44 (0)113 245 7027, asking for the Data Protection Manager, Joe Addlestone

Post: The Data Protection Manager, Joe Addlestone, Harwood & Co, E8 Joseph's Well, Hanover Walk, Leeds, LS3 1AB

11. Making a complaint ¶

11.1 If you are unhappy with any aspect of how the Firm has used or protected your personal data, you have the right to make a complaint to the Firm. The Firm has a process in place for handling data protection complaints and will acknowledge and respond to your complaint. Please contact the Firm using the details in section 10, and a complaint form can be provided to you on request.

11.2 You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. The Firm would, however, be grateful for the opportunity to resolve your concerns before you approach the ICO, and the ICO will ordinarily expect you to have raised your complaint with the Firm first. The ICO may be contacted:

in writing at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF;
by telephone on 0303 123 1113; or
online at https://ico.org.uk/make-a-complaint/.

12. Our online portals and specific services ¶

The Firm operates a number of online services. This section gives more detail about the personal data each one handles, who it is shared with, and how long it is kept. The Firm is the controller of the personal data processed through each of these portals. Where a service has its own more detailed privacy notice, that notice applies in addition to this policy.

12.1 Hosting and common providers ¶

The Firm’s website (harwood.law) is hosted by Bit Breakfast Ltd, trading as Servd Hosting, a UK company, on cloud servers provided by DigitalOcean in London, in the United Kingdom, with the site delivered through Cloudflare. The Firm’s portals (forms.harwood.law and pay.harwood.law) are hosted by Krystal Hosting Ltd (ISO 27001 and Cyber Essentials Plus certified), on its own network in London, in the United Kingdom. The Firm’s internal systems run on its own servers, which it manages itself in Leeds, United Kingdom. Staff sign in to the portals using the Firm’s Microsoft 365 accounts (Microsoft), and certain documents are stored in the Firm’s own Microsoft 365 / SharePoint tenant. Emails from the portals are currently sent through Postmark (operated by AC PM LLC, part of ActiveCampaign). Cloudflare. Google, and Postmark are US companies; see section 6 on international transfers.

12.2 Payment portal (pay.harwood.law) ¶

What it is. A web page where people pay money by debit or credit card — mainly people from whom the Firm is recovering money on behalf of a client, and occasionally clients paying the Firm's own bills.
Data collected. The matter reference, amount, name on the card, email address (used to send a receipt) and billing address, which you enter; your IP address, the date and time, and a generated payment reference, which are recorded automatically; and the card brand, the last four digits of the card, an approval code, a gateway transaction reference and (if a payment fails) a failure reason, which are returned by the payment gateway. The Firm never receives or stores your full card number, card expiry date or security code. You enter those on a page hosted and operated by Lloyds Bank Cardnet, the Firm's payment gateway and acquirer, which handles your card details under its own privacy terms.
How it is used and shared. To take and record your payment, send you a receipt, and account for the money received. A notification is sent to the Firm on each payment, and a daily summary is sent internally to the Firm's accounts team. Payment records are shared with the relevant client where the payment is of money owed to that client. No payment data is used for marketing or profiling.
Lawful basis. Performance of a contract and/or the Firm's and its client's legitimate interests in collecting payment, and compliance with a legal obligation for the accounting and anti-money-laundering records that follow.
Retention. Payment records are kept for six years, consistent with the SRA Accounts Rules and HMRC requirements, and so that the Firm can deal with any query, complaint or chargeback. Application logs that record access to the portal are kept for 365 days. Backups taken by the hosting provider are retained on its schedule.
Security. The portal uses modern encrypted connections only, with no card data held on the Firm's systems at any point. Staff access requires a password and a one-time code from an authenticator app. The staff area cannot be used to alter or refund payments. Further measures include verified gateway callbacks, rate limiting, strict security headers, regular vulnerability scanning and annual PCI DSS self-assessment.

12.3 Income and expenditure portal (forms.harwood.law) ¶

What it is. A separate website where a person from whom the Firm is recovering money on a client's behalf can complete an income and expenditure statement and make an offer to pay. There is a version for individuals and a shorter one for companies.
Who the data is about. The person completing the form; people connected to them whom the form or their free-text answers may mention (for example members of their household, a partner, or other creditors); and, for the business form, the company representative completing it.
Data collected. For individuals: name, date of birth, contact details and address; housing, household, vehicle, employment, income, outgoings, savings and other-creditor information; and the details of any offer to pay. For companies: company and representative details, trading and financial information, other creditors, and the offer. The forms do not ask for health or other special category data, but you may choose to provide such information in free-text boxes, for example to explain your circumstances.
How it is used and shared. To assess what you may be able to afford and to agree an arrangement to pay. On submission, the portal produces a document (a PDF) which is stored in the Firm's own Microsoft 365 / SharePoint tenant and shared with the relevant client (the creditor). It may also be disclosed in court proceedings or in response to a subject access request. The Firm's own assessment and notes within that document are legally privileged. The portal calculates an advisory assessment of affordability (see section 3.4); this is advisory only and every decision is made by a member of the Firm.
Lawful basis. The Firm's and its client's legitimate interests in recovering the debt and agreeing an affordable arrangement, balanced against your interests; and, for any special category data you volunteer, the establishment, exercise or defence of legal claims (Article 9(2)(f)).
Retention. While you fill in the form, nothing is saved on the server. If you save a draft to finish later, it is encrypted using a code and PIN known only to you, and is automatically deleted after 14 days. Once you submit the form and the document has been stored in the Firm's system, the detailed answers (including your income, outgoings, creditors, contact details, address and IP address) are deleted from the portal server, and at the latest within 72 hours. A limited record is kept on the portal (the matter reference, your name, the form type, the offer and the affordability ratings, and which member of staff created the link). The completed statement held in the Firm's own systems is retained for six years. Application logs are kept for 14 days.
Security. Encrypted connections throughout; draft answers encrypted end-to-end so that the Firm cannot read a saved draft; submitted answers encrypted and then deleted once stored; access links stored only in scrambled form and expiring after a set period; and staff access only through Microsoft 365 with multi-factor authentication.

13. Changes to this policy ¶

13.1 The Firm keeps this privacy policy under regular review, and its terms may be changed, updated or amended from time to time. Where the Firm makes a material change while it is providing you with services, it will inform you of that change by an appropriate method. It is important that the personal data the Firm holds about you is accurate and current, so please keep the Firm informed if your personal data changes.