Privacy Notice

The personal information we collect and use depends on our relationship with you and the activities being carried out.

The majority of the personal information we process is collected and used when delivering and administering our legal, insurance and claims-related services, and may relate to our customers and other individuals connected with a claim, legal matter or service. 

We also collect and use personal information as part of our wider business activities. This includes managing enquiries, operating our websites and offices, supporting recruitment and employment activities, complying with legal and regulatory obligations, and administering our business. 

The following sections explain the different ways in which personal information may be collected, used, shared and protected.

Depending on the nature of the matter and services being provided, we may collect, use and store the following categories of personal information. Not every category will apply to every individual or matter.

The type and amount of information we collect will depend on the nature of the matter, the services being provided and your involvement in the matter.

Due to the varied nature and complexity of the legal, insurance and claims services we provide, we may collect and process information throughout the lifecycle of a claim, legal matter or service.

Further information about the categories of personal information we may process can be found in the section Types of Personal Information.

Where relevant to a claim, legal matter or service, we may ask for your authority or consent to obtain information from healthcare providers, experts, public authorities, regulators or other third parties.

If you choose not to provide your authority or consent, we may be unable to obtain information needed to progress a claim, legal matter or service.

Once information has been obtained, we may need to retain and use that information in connection with the services being provided, compliance with legal or regulatory obligations, or the establishment, exercise or defence of legal claims.  In these circumstances, the ongoing use of that information may be based on a different lawful basis and may continue even if you later withdraw the consent that enabled us to obtain the information.

Information will only be obtained, used and retained where necessary and in accordance with applicable legal, professional and confidentiality requirements.

The way in which we use personal information depends on the nature of the matter, the services being provided and your relationship with Carpenters.

The examples below describe how we may use personal information and the lawful basis we commonly rely upon. Depending on the circumstances, more than one lawful basis may apply.

Additional Information

The lawful basis relied upon for a particular activity will depend upon the nature of the service being provided and our relationship with the individual concerned.

Where we process special category information or criminal offence information, we will identify an appropriate additional condition as required by data protection legislation.

Further information about the lawful bases and conditions we rely upon is provided in the section Our Lawful Basis for Using Personal Information.

Data protection law requires organisations to identify a lawful basis before using personal information.

The lawful basis we rely upon will depend on the nature of the service being provided, our relationship with the individual concerned, and the purpose for which the information is being used. In some circumstances, more than one lawful basis may apply to the same processing activity.

Contract

We may process personal information where it is necessary to enter into, perform or manage a contract, or to take steps at your request before entering into a contract.

This includes activities such as delivering legal services, managing claims, providing services you have requested and communicating with you in connection with those services.

Legal Obligation

We may process personal information where necessary to comply with our legal, regulatory or professional obligations.

This includes complying with legislation, court orders, regulatory requirements, fraud prevention obligations, accounting requirements, and obligations imposed by professional or regulatory bodies.

Legitimate Interests

We may process personal information where it is necessary for our legitimate interests, or those of a third party, provided those interests are not overridden by your rights and freedoms.

Examples include managing claims and legal matters, communicating with individuals involved in a matter, maintaining information security, preventing fraud, improving our services, undertaking audits, resolving complaints and supporting the efficient operation of our business.

Consent

In limited circumstances, we ask for your consent before carrying out a specific activity or obtaining particular information where this is required by law or professional requirements.

You are free to withdraw your consent at any time. If you do so, we will explain whether this affects the services we are able to provide or any activities we are able to continue on your behalf.

Additional Requirements for Sensitive Information

Certain types of personal information are subject to additional protections under data protection law because they are considered particularly sensitive.

This includes information relating to health, disability, racial or ethnic origin, biometric data, criminal offences and other sensitive information relevant to a claim, legal matter or service.

Where we process this type of information, we must identify both a lawful basis for processing the personal information and an additional condition that permits us to use that information in accordance with data protection legislation.

Special Category Information

Some of the information we process is subject to additional protection under data protection law because it is considered particularly sensitive. This includes information relating to health, disability, racial or ethnic origin, biometric data and other special category information relevant to a claim, legal matter or service.

Where we process special category information, we will identify both a lawful basis for processing personal information and an additional condition required by data protection legislation.
Depending on the circumstances, these conditions may include:

• Your explicit consent.
• The establishment, exercise or defence of legal claims.
• Compliance with legal or regulatory obligations.
• Reasons of substantial public interest.
• The provision of health, treatment or rehabilitation-related services.
• Protecting individuals who require support, safeguarding or reasonable adjustments.

Criminal Offence Information

We may process information relating to alleged or actual criminal offences, convictions, legal proceedings, fraud investigations, motoring offences and other unlawful conduct where this is relevant to a claim, legal matter, service or legal obligation.

Where criminal offence information is processed, we will ensure that an appropriate lawful basis and applicable legal condition are identified before the information is used.

To provide our services and meet our legal, regulatory and professional obligations, we may share personal information with organisations and individuals involved in a claim, legal matter or service.

The organisations we share information with will depend on the nature of the matter and the services being provided. We only share information where there is a legitimate reason to do so and where appropriate safeguards are in place.

Examples of the organisations we may share information with are set out below. This list is not exhaustive and may vary depending on the circumstances of the matter.

Depending on the services being provided, Carpenters may process personal information on behalf of another organisation or may be responsible for processing personal information in our own right.

In some circumstances, responsibility for the processing of personal information may be shared between Carpenters and another organisation, or may change as a claim, legal matter or service progresses.

Where another organisation is responsible for the processing of your personal information, further information about how your information is used will normally be available within that organisation's privacy notice.

If you would like further information about the role Carpenters or another organisation plays in relation to your personal information, please contact us using the details provided in this notice.

Employment and Recruitment Activities

Carpenters also processes personal information in connection with recruitment, employment and former employment relationships.

This information is used to recruit, employ, support, manage and meet our legal, regulatory and contractual obligations relating to current employees, former employees, applicants and other employment-related individuals.

Additional information about how we collect, use, store and retain employment-related information is contained within our Employee Privacy Notice.

As this notice is not publicly available, individuals who require further information or wish to obtain a copy should contact Risk & Compliance using the contact details provided in this notice.

Visiting Our Website

When you visit our website, we may collect and use personal information to operate the website, respond to enquiries, maintain security and improve our services.

Visiting Our Offices

When you visit our offices, we may collect and use personal information to manage access, maintain security, support your visit and comply with health and safety obligations.

Business Administration and Operational Management

In addition to the activities described elsewhere in this notice, Carpenters processes personal information to support the day-to-day operation, security, governance and administration of our business.

Where possible, information used for these activities may be anonymised, aggregated or limited to the information necessary to achieve the intended purpose.

Carpenters uses a range of systems and communication methods to manage information and deliver services.
This includes case management systems, document management systems, telephony services, email and other technologies that help us maintain records, communicate with individuals and administer our services.

Depending on the services being provided, some individuals may also have access to MyClaim or other online services that enable secure communication, document exchange and access to relevant information.

We may use these systems and trusted service providers to send correspondence, provide updates, request information and support the delivery of our services.

Protecting Your Information

We take appropriate technical and organisational measures to protect personal information against accidental loss, unauthorised access, misuse, disclosure or alteration.

Carpenters maintains independently certified Information Security Management and Business Continuity Management Systems aligned to recognised international standards, including ISO 27001 and ISO 22301. These frameworks help ensure that information remains protected, secure and available to support the services we provide.

Retaining Your Information

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, meet legal, regulatory and professional obligations, resolve disputes and protect our legal rights.

Retention periods vary depending on the nature of the information, the services being provided and the obligations that apply. Generally, information relating to legal, insurance and claims services is retained for a minimum of six years after the end of our relationship with you. Some information may be retained for longer where required by law, regulation, contractual obligations or the nature of the matter, including claims involving children or protected parties.

If you would like further information about our retention practices, please contact us using the details provided in this notice.

We primarily process personal information within the United Kingdom.
However, in some circumstances it may be necessary to share information with organisations, service providers or individuals located outside of the United Kingdom.

Where this occurs, we will ensure appropriate safeguards are in place to protect personal information and maintain an equivalent level of protection. These safeguards may include adequacy regulations, contractual measures or other safeguards recognised under applicable data protection legislation.

Carpenters may use technology and automated tools to help support our services, process information more efficiently, identify potential risks and assist with decision-making activities.

However, we do not currently make decisions about individuals using solely automated processing where those decisions have a legal or similarly significant effect on the individual.

If this position changes, we will update this notice and provide additional information where required.

Data protection legislation provides individuals with specific rights in relation to their personal information. Further information about these rights is available from the Information Commissioner's Office (ICO). For the public | ICO.

Your Right to be Informed

You have the right to be informed about how your personal information is collected, used, shared, retained and protected.

This Privacy Notice forms part of how Carpenters meets that obligation. In some circumstances, we may provide additional privacy information when personal information is collected or used for a specific purpose.

Additional Privacy Information

In some circumstances, we may provide additional privacy information at the point personal information is collected or used for a specific purpose. That information supplements this Privacy Notice and provides information relevant to the particular activity, service or interaction taking place.
Examples include:

• Cookie notices and website banners.
• Telephone call recording announcements.
• Visitor or event registration notices.
• Guest Wi Fi terms and notices.
• Recruitment or employment-related privacy information.
• Service-specific or activity-specific privacy notices.

Where additional privacy information is provided, it should be read alongside this Privacy Notice.

Your Other Data Protection Rights 

Data protection legislation provides individuals with a number of rights in relation to their personal information.

Understanding How Your Rights Apply

We are committed to helping individuals understand and exercise their data protection rights. However, those rights do not apply in the same way in every circumstance and may be affected by the nature of the information, the services being provided and our legal, regulatory and professional obligations. 

Withdrawal of Consent

Where we rely on your consent, you have the right to withdraw that consent at any time.

However, withdrawal of consent will not affect processing already carried out before consent was withdrawn. In some circumstances, information obtained with your consent may continue to be processed where another lawful basis applies and the processing remains necessary for the services being provided, compliance with legal or regulatory obligations, or the establishment, exercise or defence of legal claims. 

Information We May Provide in Response

When you exercise your data protection rights, we aim to provide information that is clear, meaningful and relevant to your request.

Data protection rights provide access to your personal information, rather than necessarily providing copies of original documents, recordings, CCTV footage or other records in their original format. Where information is provided in an alternative format, we will seek to ensure that it remains meaningful, intelligible and relevant to your request.

Depending on the circumstances, personal information may be provided in an alternative format where this is necessary to protect the rights of others, comply with legal obligations, manage confidential information or provide the information in a more accessible way. For example, information contained within documents, audio recordings, CCTV footage or other records may be provided through extracts, transcripts, summaries, screenshots, still images, redacted copies or other appropriate formats.

Restrictions, Limitations and Exemptions

Data protection rights are not absolute and may be limited in certain circumstances.

As a provider of legal and insurance-related services, Carpenters is subject to legal, regulatory and professional obligations, including duties of confidentiality. These obligations may affect how and when certain rights can be exercised.

For example, we may process personal information about individuals who are not our customer, including information provided by other parties involved in a claim, legal matter or investigation. In some circumstances, this may occur without the individual's knowledge where the information is relevant to the services being provided or where we are required to do so by law or professional obligations.

Where permitted by data protection legislation and other applicable laws, we may be unable to:

• confirm whether personal information is being processed;
• provide access to certain information;
• delete information;
• restrict processing; or
• comply with certain rights requests in full.

This may occur where doing so would prejudice the rights and freedoms of others, breach confidentiality obligations, interfere with legal proceedings, fraud prevention activities, regulatory requirements or other legal obligations.

Where a request cannot be fulfilled in full, or information cannot be disclosed, we will explain the reasons for any limitation, restriction or exemption applied unless we are prevented from doing so by law or another applicable obligation.

Understanding Our Response

When responding to your request, we will explain, where appropriate:

• how we have assessed and fulfilled your request;
• the information that has been provided;
• any limitations, restrictions or exemptions that have been applied; and
• any further rights or options available to you.

Our aim is to ensure that responses are clear, proportionate and provide sufficient context to help you understand how your personal information has been processed.

Where appropriate, we may also explain the lawful basis for the processing activity, the source of the information, the recipients of the information and any retention periods that apply.

Making an Information Request

You can exercise your data protection rights in relation to your own personal information, or on behalf of another individual where you have their authority or are otherwise legally entitled to act for them.

Requests can be made in any format and may be submitted to any employee of Carpenters. However, to help us manage your request efficiently, we recommend contacting us at riskandcompliance@carpentersgroup.co.uk

Once we receive your request, we may ask for additional information to confirm your identity or to help us locate the information you are requesting.

We aim to respond within one month. Where permitted by law, and where a request is particularly complex or involves a large volume of information, we may require additional time to respond. If this applies, we will inform you and explain the reasons.

If you have a question about this Privacy Notice, would like further information about how we use your personal information, have a concern about our processing activities, or are dissatisfied with how we have handled your personal information or an information rights request, please contact us so that we can investigate and try to resolve the matter.

You can contact our Data Protection Officer at riskandcompliance@carpentersgroup.co.uk

We will review your query, concern or complaint and, where appropriate, explain how your information has been used, the steps we have taken, and any relevant limitations, restrictions or exemptions that may apply.

You also have the right to raise a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator. Further information about the ICO's complaints process is available at   https://ico.org.uk/make-a-complaint/ Make a complaint | ICO