We want to bring this Privacy Statement to you at the time we are collecting your personal data. We want you to be fully aware that when we process your personal data that we are processing it in compliance with the General Data Protection Regulations.

Services Provided by Us

We are a law firm regulated by the Solicitors Regulation Authority.  Lupins provide assistance & legal advice with regards to the following areas of law:

• Immigration
• Human Rights
• Public Law

Roles & Responsibilities & Contact details

• Controller means: Lawrence Lupin. Contact: l.lupin@lupinslaw.com
• Joint controllers means: the employees of Lupins which can be contactable by

telephone: 0203-3503-0880

• Human Resources Manager: Sonya Redmond.

Contact: s.redmond@lupinslaw.com

Personal Data – Before we can deal with your enquiry we will require the following information from you:

Your full name, your email, phone number, details of the country of your origin and information relating to your legal matter or case comprising of sensitive data.

Will your Personal Data be shared with any Third Parties/Processors? As this is an initial enquiry made by you and we have not opened a file, your information will not be shared with any third party processor.

Principle 1 – Lawful Purpose (Article 5 of the GDPR) – Personal Data – We will be processing your personal data in order to ensure that

we can fulfil our contractual obligations with you if in the event you decide to instruct this firm.

Sensitive Data (Special Categories of Personal data) – We will be processing your sensitive data due to the fact: ‘processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity’

Principle 2 – Specific Purpose & Limited (Articles 5 & 6 of the GDPR) – We aim to process your personal data for specific, explicit and legitimate purposes. We require your name, email, phone number, country of your origin and any information relating to your matter or case. your email in order that we can ascertain whether we can assist you and fulfil any future contractual obligations with you.

Principle 3 – Adequate, Relevant & Limited – We only want to keep your personal data and sensitive data which is: adequate, relevant & limited

Retention Policy – As this is an initial enquiry, in the event that you do not instruct this firm we will retain your personal data for 12 months. After this period we will ensure that it is deleted from our automated systems and filing systems.

Principle 4 & 5 – Accuracy of your Personal Data – Principle 4 & 5 (Article 5 of

the GDPR) –We want to ensure that your personal data is kept up to date and therefore if any of your personal data changes please kindly update us by contacting the GDPR Management Team, a Joint Controller or the Controller.

Principle 6 – Ensuring Security – We have received assurances from the firm’s platform provider (processor) that the processing of your personal data (including sensitive data) on this platform is secure from any damage, accidental loss and if there are any risks the risks are low and that the platform provider will do everything to rectify any security breaches relating to the processing of your personal data.

Children under 18 years – For Information Society Services – With regards to children, if you are under 18 years of age and you make an enquiry relating to our services online then, we will require explicit, affirmative consent from your:

1. biological parent; or
2. legal guardian; or
3. a court order

We are unable to deal with any enquiry unless we receive the above information.

Your Rights – While we keep your personal data you have the following rights:

• Right to be informed

• Right to request access to your personal data, know as a ‘Subject Access Request’ (SAR)
• Right to rectification of your personal data
• Right to object to the processing of your personal data (see right to object notice)
• Right to erasure of your personal data
• Right not to be subjected to automated decision making processing
• Right to make a complaint

Subject Access Request requirements – A SAR can be requested verbally by you, however in order for us to ensure that we can verify your ID we will require you to:

1. complete a SAR Form. This form can be requested from the GDPR Management Team: redmond@lupinslaw.com
2. return the SAR Form with a certified copy of your ID and also your 2 month’s utility bills. You can also attend the offices in order to verify your ID;
3. We will not be under any obligation to provide you with any personal data unless your ID is verified.
4. A Subject Access Notice will accompany your personal data.

Subject Access Requests – Time-scale – We aim to process the SAR within 1 month from the point we receive verification of your ID, however as your personal data may also be with an external archiving company it may take a further 2 months to be retrieved.

We aim to provide your SAR in electronic form, unless you require this in a hard-copy format.

Marketing – Currently we do not send marketing material to anyone who makes an enquiry. In the event that we do we will obtain your written consent prior to sending you any marketing material.

If we do send the marketing material via email then there will be following in place:

• ‘an opt-in’ button; and
• ‘an opt-out’/’unsubscribe button’.

You have the right to withdraw your consent to receiving marketing material at any time. You will need to press the ‘opt-out/unsubscribe’ button.

Complaints – In the event that you wish to make a complaint about how your personal data is processed by Lupins (or any third party listed in the privacy notice) then please make your complaint to the following person(s):

Lawrence Lupin (Controller)

Email: l.lupin@lupinslaw.com

Mobile number: 07957977600

Sonya Redmond (Human Resources Manager)

Email: s.redmond@lupinslaw.com

You also have the right to make a complaint directly to the Information’s Commissioner’s Office.

The contact details of the ICO are as follows: Tel: 0303 123 1113

Please also request the firm’s ‘Complaint’s Policy’ from any member of the firm.