Privacy Policy
Home > Privacy Policy
Privacy Notice to Step Legal’s Clients
This Privacy Notice explains who we are, how we collect, share and use personal information about you, and how you can exercise your privacy rights.
If you have any questions or concerns about our use of your personal information, then please contact us using the contact details provided below.
Key information:
| Our name and contact details: | Step Legal Solicitors 213 Nantwich Road Crewe Cheshire CW2 6DA |
| Our Information Officer/ Data Protection Officer | Abid Hussain |
| Personal data | Any information relating to an identified or identifiable individual. |
| Data Subject | The individual to whom the personal data relates. |
| Special Category data | Sensitive personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data (where used for identification purposes), data concerning health, sex life or sexual orientation. |
| Purposes of our processing data | In order to provide legal advice and services we obtain, record, store, organise, structure and use personal information about clients and others. |
| Legal basis for processing data | Under data protection law, we can only process personal data if we have a lawful basis for doing so. These lawful bases are set out in Article 6 of the UK General Data Protection Regulation (UK GDPR). The bases we are most likely to rely on are: Consent – the individual has given clear consent for us to process their personal data for a specific purpose Contract – the processing is necessary for a contract we have with the individual, or because they have asked us to take specific steps before entering into a contract Legitimate interest – the processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. Legitimate interests can include our business or commercial interests (such as marketing, IT security, ensuring our internal policies are being complied with, obtaining and maintaining accreditations) as well as wider societal benefits (such as fraud prevention). Note that there is a new ‘Recognised Legitimate Interest’ under the Data (Use & Access) Act 2025 (DUAA) which may apply in limited circumstances. Legal obligation – the processing is necessary for us to comply with the law, such as our anti-money laundering and sanctions-screening obligations, obligations to provide certain information to HMRC, such as employee salary details, or as ordered by a court. |
| Information security | We have implemented appropriate technical and organisational measures to keep your personal data confidential and secure from unauthorised access, use and disclosure. Within our firm, those processing your personal data will do so only in an authorised manner and are subject to a duty of confidentiality. We require our business partners, suppliers and other third parties to implement appropriate security measures to protect personal data from unauthorised access, use and disclosure. |
What personal information does Step Legal collect and why?
The personal information that we may collect about you broadly falls into the following categories:
Information that you provide voluntarily
We may ask you to provide personal information voluntarily: for example, we will ask you to provide your contact details to deliver the service we have agreed, to enable you to subscribe to marketing communications from us, and/or to enable us to respond to enquiries submitted to us. We may also ask you to provide other personal information. The personal information that you are asked to provide, and the reasons why you are asked to provide it, will be made clear to you at the point we ask you to provide your personal information.Some of the personal information that we ask you to provide may include sensitive personal information, such as health-related information or information about your race or ethnicity, which we may need in order to provide the service to you.
When you attend a meeting that is recorded and/ or transcribed, we may process your personal data. This may include your name, photo, business contact details and your contributions to the meeting such as opinions, questions and comments made verbally or using the chat or screen-sharing features. Video images and/ or audio recordings may also be captured when your camera and/ or microphone are enabled. Recordings of meetings are used solely to enable us to transcribe the meeting in order to maintain an accurate record of discussions, instructions, advice provided and agreed actions, and enable us to prepare file notes documenting the same. Once such file notes have been prepared and saved to the client file, the recording will be securely deleted within 3 months and will not be retained as part of the permanent file. The files notes and original transcription will be kept on the client file and retained in accordance with our file retention policy. We will always inform you before a meeting is recorded. You will also see a notification within most video-meeting platforms when recording begins.
Information that we collect automatically
If you visit our website, we may collect certain information automatically from your device. Specifically, the information we collect automatically may include information like your IP address, device type, unique device identification numbers, browser-type and other technical information. We may also collect information about how your device has interacted with our website, including the pages accessed and links clicked. You can see our Cookie Notice here.
Collecting this information enables us to better understand the visitors who come to our website, where they come from, and what content on our website is of interest to them. We use this information for our internal analytics purposes and to improve the quality and relevance of our website to our visitors.
Information that we obtain from third party sources
From time to time, we may receive personal information about you from third party sources (including client due diligence providers, sanctions screening providers, credit reference agencies, your bank or building society or other financial institution or advisor, consultants and other professionals we may engage in relation to your matter, your employer and/ or trade union, professional body or pension administrators, your doctors, medical and occupational health professionals), but only where we have checked that these third parties either have your consent or are otherwise legally permitted or required to disclose your personal information to us.
The types of information we collect from third parties include information obtained from third party sources such as financial information or credit history, health information, pension records and such information as required to maintain accurate records about clients and we use the information we receive from these third parties to maintain and improve the accuracy of the records we hold about you.
We may also collect information from publicly accessible sources, such as Companies House, HM Land Registry etc.
How we use your information
Our use of your information is subject to your instructions (where applicable), the Data Protection Act 2018, the UK GDPR, the Data (Use and Access) Act 2025 and our duty of confidentiality to you (where you are a client). We will collect information about you and keep this electronically, including on our computers, our case management/ document management/ time recording systems, in our email and instant messaging systems, in cloud storage, in our reception logs and on paper for a certain period of time. Under data protection law, we can only use your personal data if we have a proper reason for doing so. See the ‘Legal basis for processing personal information’ section below for further details. The main reasons for using/ processing your information/ data are to:
- deliver the legal services we have agreed in contract to provide to you. For example, we may use your information to write letters/ emails etc on your behalf or prepare legal documents to help you with your matter;
- comply with the law. For example, as solicitors we have to perform ‘conflicts of interest’ checks for new cases against a list of current and former clients. We also have a legal duty to report suspicious activity to the National Crime Agency (‘NCA’) if we suspect money laundering or terrorist financing.
We use cloud storage providers to store data and we ensure that our contracts with such providers are compliant with applicable law. If you do not wish your files and/ or other information to be stored in this way, please let us know as soon as possible.
In some cases we may hold more ‘sensitive’ information about you, such as about health, race, ethnicity and religious beliefs. This may be necessary to pursue your legal matter. We are permitted to use such information to provide legal advice to you or in connection with equality legislation. However, we will endeavour to be transparent with you about how such information is used and seek agreement to this information being used in this way wherever possible.
Except for the provision of legal services where we rely on other legal conditions to process your data, if we have obtained your consent to use your information in a particular way, you can withdraw such consent but this may limit what more we can do for you (if anything). In such cases we will explain to you any limitations that may apply to the service we provide to you.
Any personal data that we receive from you for the purposes of complying with our anti money laundering obligations will be processed only for the purposes of preventing money laundering and terrorist financing or as otherwise permitted by law or with your consent.
As a client we may also in the future send you a newsletter or similar (such as legal updates or updates in relation to our legal services). We find that most clients find this helpful. We rely upon the ‘legitimate interest’ we have in maintaining contact with former clients to do this in data protection law and your agreement for the purposes of the Privacy & Electronic Communications Regulations (which can be implied under these Regulations). However, we will never share your information with third parties to market to you and will not contact you about non-legal services. We will make it quick and easy to ‘opt out’ of future communications in every communication sent. If you already know that you don’t want to receive these communications, then you can opt out now by emailing abidhussain@steplegal.co.uk or contacting us via our website Step Legal Solicitors Crewe – Taking you forward the right way
Your information may be kept on computer servers within the UK or European Economic Area (EEA). The UK has been granted adequacy status by the EU so no additional safeguards are required when data is stored in any EEA country (which includes the EU countries). If at any point information is stored on computer servers outside of the UK/ EEA we have taken appropriate safeguards to require that your personal information will remain protected in accordance with this Privacy Notice.
We do not use your personal information to make ‘automated decisions’ which affect you.
Will you share my information with anyone else?
We will not share your information with third parties unless this is part of the work on your legal matter. For example, we may need to send certain information about you to other lawyers working on the case, or representing others in the proceedings, witnesses, experts and other professionals we may engage in relation to your matter, official bodies with whom legal documents must be lodged, such as the Courts/ Tribunals or government bodies, such as the Land Registry. We do also work with some trusted contractors or consultants who may have access to your information, such as IT service and software providers, including our client due diligence and screening providers, and cloud service provider, these are (ECOS, Armalytix, Third Fort and Obsidian,) suppliers of photocopying services and file archive storage providers. We may also share certain information about you with external auditors, such as Lexcel, CQS, SQM etc and the Solicitors Regulation Authority (SRA) or other relevant professional body, or independent organisations in order to comply with our money laundering, terrorist financing and financial crime prevention obligations, as well as our professional indemnity insurers and their advisers.
We sometimes need to make reports of suspicious activity to the National Crime Agency (NCA), which may contain personal data and we may have to disclose the identity of the people for whom we hold client money in our pooled client account if requested to do so by our bank.
All contractors have a contract with us which requires that your information be accessed appropriately and kept confidential (among other data protection requirements). If you have any concerns about our work with trusted sub-contractors, you must inform us before agreeing to these terms.
If you instruct us jointly with another client then it will be necessary to share certain information relevant to you with the corresponding joint client in order to fulfil your instructions to us.
Legal basis for processing personal information
Our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it. However, we will normally collect personal information from you only where we have your consent to do so, where we need the personal information to perform a contract with you, or where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms. In some cases, we may also have a legal obligation to collect personal information from you or may otherwise need the personal information to protect your vital interests or those of another person.
If we ask you to provide personal information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your personal information is mandatory or not (as well as of the possible consequences if you do not provide your personal information, such as not being able to act in your matter without receiving the necessary information).
Similarly, if we collect and use your personal information in reliance on our legitimate interests (or those of any third party), we will make clear to you at the relevant time what those legitimate interests are.
If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us using the contact details provided under the “What if I have other questions or concerns” heading below.
How long will you keep my information?
We retain personal information we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements) We are legally obliged to retain any personal data that we receive from you for the purposes of complying with our anti-money laundering obligations for five years from the end of our business relationship with you. We will retain those data for longer than the five-year statutory period in accordance with our Archiving Policy (available on request), unless you instruct us otherwise. We will also always keep a small amount of information after file closure to do conflicts of interest searches in the future to comply with our professional duties.
As a general rule, we will keep paper client files, including personal data, for at least 7 years from the conclusion of your matter, in case you, or we, need to bring or defend any complaints or claims. However, different retention periods apply for different types of personal data and for different services as set out in our Archiving Policy further details of which are available on request.
We also have a right in relation to client files to retain papers in order to exercise a lien (the right to withhold papers due to unpaid fees) and to demonstrate a legally admissible record at a later date of the work we have performed should it be necessary to do so.
When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.
Can I see what information you hold about me?
You have the following data protection rights:
- If you wish to access, correct, update or request deletion of your personal information, you can do so at any time by contacting us using the contact details provided below.
- In addition, if you are a resident of the United Kingdom (or the EEA), you can object to processing of your personal information, ask us to restrict processing of your personal information or request portability of your personal information. Again, you can exercise these rights by contacting us using the contact details provided below.
- You have the right to opt-out of marketing communications we send you at any time. You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing e-mails we send you. To opt-out of other forms of marketing (such as postal marketing or telemarketing), then please contact us using the contact details provided below.
- Similarly, if we have collected and process your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.
We reserve the right to make a charge for storage of your documents and for copying your file or producing any of your documents from storage if requested by you, and we do normally have a right to payment of any outstanding costs before releasing a whole file, but you do have a separate right under the data protection rules to access your ‘personal data’ without charge. This may include having it in a particular electronic format (‘portable’ format). Please contact Abid Hussain on abidhussain@steplegal.co.uk or 01270 254064 if you would like to request a copy of your personal data.
What if I have other questions or concerns?
Our general contact details are set out in our covering letter and our Data Protection Officer is: Abid Hussain, email: abidhussain@steplegal.co.uk. Contact this individual if you want to exercise one of your data protection ‘rights’ and in particular if you:
- wish to complain about how your personal data is being used;
- wish to request that our records about your personal information be corrected or deleted;
If you have a complaint about how your personal information is being used which we have not been able to address to your satisfaction under our Complaints Policy Contact Us – Step Legal Solicitors, please note that you may be able to make a complaint to the Information Commission (IC) directly. You can learn more about the IC and personal data rights at: www.ico.org.uk and specifically about complaints in relation to the use of your personal data at: https://ico.org.uk/make-a-complaint/data-protection-complaints/.
