Property 0131 337 1800Personal Legal 0131 555 5800

Blair Cadell LLP Privacy Policy

1. Who we are

Blair Cadell LLP is a solicitors’ firm based in Edinburgh, Scotland. We are a limited liability partnership registered at Companies House under number SO307518. Our registered office is at The Bond House, 5 Breadalbane Street, Edinburgh EH6 5JH.

2. What information we collect

We collect personal information from you directly (for example, when you contact us, complete forms, or meet with us) and sometimes from third parties such as:

  • Other solicitors, estate agents, lenders, surveyors and professional advisers involved in your matter
  • Public registers, credit reference agencies, and sanctions screening providers
  • Courts, regulators, and government bodies

The types of personal data we collect include:

  • Identity data: name, title, date of birth, gender, family or marital status, nationality
  • Contact data: postal address, email address, telephone numbers, emergency contact details
  • Financial data: bank account and payment details, salary or income information, credit history
  • Transaction data: details of the legal services requested, property details, transaction values, contract terms
  • Document data: copies of identification documents (passport, driving licence), utility bills, mortgage offers, title deeds, and other documents you provide in relation to your matter
  • Communication data: records of emails, letters, telephone calls and meetings
  • Technical data: IP address, browser type, website usage data where you access our website or secure client portal
  • Employment data (if you are a staff member): payroll information, performance records, training records

Where we collect special category personal data (for example, health information, racial or ethnic origin) we do so only where it is necessary for the purposes of your legal matter or where you have given explicit consent. We apply enhanced safeguards to any such data.

3. How and why we use your personal information

We process your personal information on the basis of one or more of the following lawful grounds under UK GDPR:

3.1 Performance of a contract
To take instructions from you, open a file, carry out conflict checks, verify your identity (including anti‑money laundering and sanctions screening), provide legal advice and representation, draft documents, correspond with counterparties and other professionals, progress your transaction or matter, manage appointments and communications, and handle billing and payment.
Lawful basis: Performance of a contract for legal services; legitimate interests in operating our practice efficiently and protecting our rights.

3.2 Legal and regulatory obligations
To comply with:

  • Anti‑money laundering and financial crime legislation (Money Laundering Regulations 2017)
  • Tax and financial record‑keeping requirements (Income Tax Act 2007, Corporation Tax Act 2009, VAT Act 1994)
  • Professional conduct rules and standards (Law Society of Scotland Practice Rules, Solicitors Regulation Authority Standards and Regulations where applicable)
  • Court orders, regulatory requests, and requests from law enforcement and supervisory bodies
  • Data protection, freedom of information, and other statutory obligations
  • Client account and file management requirements

We are required by law to keep certain records and may be required to disclose personal data to regulators, courts, and law enforcement where legally obliged to do so.
Lawful basis: Compliance with legal obligations; legitimate interests in meeting regulatory requirements and defending legal claims.

3.3 Legitimate interests
To:

  • Manage our business operations, IT systems, security and fraud prevention
  • Conduct quality assurance, file audits, and complaints handling
  • Recruit, train and manage our staff (approximately 20 employees)
  • Send you targeted updates on legal developments, firm news or events (only to existing clients and with your ability to opt out)
  • Monitor and improve our services
  • Protect our rights, defend claims, and pursue remedies
  • Maintain and back up our systems and data

Lawful basis: Legitimate interests in running a sustainable legal practice, protecting our business, and maintaining appropriate professional standards.

3.4 Consent
We may process personal information on the basis of your explicit consent in limited circumstances, for example to send you marketing communications. Where processing is based on consent, you have the right to withdraw your consent at any time by contacting us.
Lawful basis: Consent (freely given, specific, informed, and unambiguous).

4 Sharing your personal information

We may share your personal information with:

  • Other legal and professional advisers involved in your matter (other solicitors, accountants, tax advisers, financial advisers, surveyor, estate agent, lender)
  • Third parties essential to service delivery (courts, Land Register of Scotland, Registers of Scotland, HM Revenue & Customs, Companies House, local authorities)
  • Service providers and contractors (IT support providers, cloud storage and case management software providers, document storage providers, insurance providers, accountants and auditors, HR and payroll providers)
  • Regulators and law enforcement (Law Society of Scotland, Financial Conduct Authority, Serious Fraud Office, Police Scotland, HMRC) where we are legally required to disclose information
  • Other parties with your consent or where necessary to progress your matter (lenders, insurers, employers, government agencies)

All recipients of personal data are bound by confidentiality or contractual obligations, and we only disclose information that is necessary for the stated purpose.

4.1 Transfers outside the UK
If any personal data is transferred outside the United Kingdom (for example, to a professional adviser or service provider based overseas), we will ensure that an appropriate safeguard is in place, such as an adequacy regulation, standard contractual clauses, or your explicit consent. Further information about transfers can be provided on request.

5. How long we keep your personal information

We retain personal information for as long as necessary to:

  • Provide legal services and manage your matter
  • Comply with legal, regulatory, professional, accounting and tax requirements
  • Defend potential claims or litigation

Typical retention periods:

  • Active client files: retained for the duration of the retainer and for 6–10 years after the matter is closed
  • Closed files: retained in accordance with Law Society of Scotland guidance and professional standards (6–10 years minimum)
  • Financial and accounting records: retained for 6 years in accordance with tax law
  • Employment records: retained for 6 years after employment ends
  • Website usage data: retained for up to 12 months

Where data is no longer required, it will be securely deleted or anonymised. We may retain anonymised data for statistical and business improvement purposes.

6. Security of personal information

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure or destruction. These measures include:

  • Secure IT systems with access controls, passwords and multi‑factor authentication
  • Encryption of data in transit and at rest where appropriate
  • Secure document storage and disposal procedures
  • Staff confidentiality obligations and data protection training
  • Segregation of client information and confidential data
  • Regular monitoring and testing of security systems
  • Incident response and breach notification procedures

Despite our best efforts, no system is completely secure. If you have concerns about the security of your personal data, please contact us immediately.

7. Your rights under UK data protection law

Under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, you have the following rights:

7.1 Right to be informed
You have the right to be given clear, transparent information about how your personal data is processed. This Privacy Policy serves that purpose.

7.2 Right of access (Subject Access Request)
You have the right to request a copy of the personal data we hold about you and information about how it is processed. We will respond within one calendar month of receipt of your request (or within two months if the request is complex). We may charge a reasonable fee if requests are manifestly unfounded or excessive, or if you make repeated requests.
To submit a Subject Access Request, please email: office@blaircadell.com and provide sufficient information to identify yourself and your matter.

7.3 Right to rectification
If personal data we hold about you is inaccurate or incomplete, you have the right to request correction or completion. We will take steps to correct inaccurate data without undue delay.

7.4 Right to erasure (“right to be forgotten”)
In limited circumstances, you have the right to request the deletion of personal data, for example where data is no longer necessary, or processing is unlawful. However, we may not be able to delete data where we are required to retain it by law, professional standards, or to defend legal claims.

7.5 Right to restrict processing
You have the right to request that we limit how we use your personal data in certain circumstances, for example if you dispute the accuracy of data or the lawfulness of processing.

7.6 Right to data portability
Where we process personal data based on your consent or to perform a contract, and processing is carried out by automated means, you have the right to request your data in a structured, commonly used and machine‑readable format and to transmit it to another controller.

7.7 Right to object
You have the right to object to processing based on legitimate interests (including direct marketing). If you object to direct marketing, we will cease that processing immediately. For other objections, we will consider your request and may need to balance your interests against ours.

7.8 Rights related to automated decision‑making
We do not use automated decision‑making or profiling in a way that produces legal or similarly significant effects unless you consent.

7.9 How to exercise your rights
To exercise any of these rights, please email office@blaircadell.com. Please provide:

  • Your full name and any matter or file reference number
  • Details of the right you wish to exercise
  • Any information that helps us identify you and the personal data in question
  • A preferred contact method (email, post, telephone)

We will respond within one calendar month (or two months for complex requests) and will notify you if we cannot comply with your request or can only partially comply, with reasons.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (see section 9 below).

8. Confidentiality, legal professional privilege and professional duties

As a solicitors’ firm, we owe our clients a duty of confidentiality. Personal data relating to legal advice and information you provide to us in the course of seeking legal services is protected by legal professional privilege and is subject to the strictest confidentiality safeguards.
We will not disclose confidential client information except:

  • Where you give explicit consent
  • Where required by law, court order or regulatory requirement
  • Where necessary to prevent crime or serious harm
  • In limited circumstances as permitted by Law Society of Scotland Professional Practice Rules
  • As necessary to manage complaints, regulatory investigations or legal proceedings

All our employees and contractors are subject to confidentiality obligations and are trained to respect legal professional privilege and client confidentiality.

9. Complaints and contact

9.1 How to contact us
Compliance Partner: Andrew Macdonald
Email: office@blaircadell.com
Telephone: 0131 555 5800
Address: The Bond House, 5 Breadalbane Street, Edinburgh EH6 5JH

9.2 How to make a complaint
If you believe we have not complied with data protection law, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK independent authority for data protection:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 8QG
Telephone: 0303 123 1113
Website: https://www.ico.org.uk
Email: casework@ico.org.uk

You have the right to lodge a complaint at any time, but we would appreciate the opportunity to address your concerns directly first. Please contact us using the details above.

10. Changes to this Privacy Policy

This Privacy Policy may be updated from time to time to reflect changes in our business, legal requirements or technology. The version number and effective date appear at the top of this document. We will notify you of any material changes by email or post, or by displaying a prominent notice on our website.

Your continued use of our services following changes to this Privacy Policy constitutes your acceptance of the updated terms. We recommend you review this policy periodically.