Privacy Policy

Serle Court – Privacy Policy

1. Introduction        

1.1 Serle Court is a set of Barristers’ Chambers, constituted as a Trade Protection Association by its barrister members (“Members”) to assist them in the conduct of their practices at the independent Bar.

1.2 In order to perform the functions of a set of barristers’ Chambers, Serle Court needs to collect and hold personal information. This may be personal data or information relating to our applicants for pupillage and employment, permanent and temporary staff, Members and pupils, the spouses and next of kin of staff and Members, consultants, suppliers, visitors or contracting parties, or it may come from Members’ clients if, for example, they make a complaint to Chambers.

1.3  We will take all reasonable and proportionate steps to protect personal information. We will ensure that we do not do anything that may infringe your rights or undermine your trust.

1.4. This Privacy Policy describes the information Chambers collects about you, how it is used and shared, and your rights regarding it.  

2. Data controller details

2.1 Each Member is the data controller in relation to the processing of personal information relating to their own client work. They accordingly have their own Data Protection and Privacy Policies, and ancillary documentation, as well as their own bases for processing. For ease of reference, Members can be contacted about their own processing activities using the details below:

2.1.1 Address: FAO: [insert name of the relevant Member], Serle Court, 6 New Square, Lincoln's Inn, London, WC2A 3QS.

2.1.2 Telephone number: +44 (0) 20 7242 6105.

2.1.3 Email address: either to the email address of the Member, or to data@serlecourt.co.uk (please include “Personal Data enquiry– [insert name of relevant Member]” in your subject heading to ensure it receives the correct attention).

2.2 Chambers is the data controller in relation to the processing of the personal information that is referred to in paragraph 4.2 below. Chambers is registered with the Information Commissioner’s Office (ICO) as a Data Controller for such personal data under registration number ZA694225.

2.3 Chambers also acts as data processor insofar as it processes client data on behalf of its Members in the course of administering their legal practices.

2.4 Chambers does not have or need to have a Data Protection Officer, but the Chambers Director is our nominated Data Protection Lead (“DPL”).  The DPL can be contacted about this Policy or about your data using the details below:

2.4.1 Address: Serle Court, 6 New Square, Lincoln's Inn, London, WC2A 3QS.

2.4.2 Telephone number: +44 (0) 20 7242 6105.

2.4.3 Email address: data@serlecourt.co.uk (please include “Personal Data Request - Chambers” in your subject heading to ensure it receives the correct attention).

3. Data Collection

3.1 The vast majority of the information that we hold about you has been provided to us by you or your agents.

3.2  In addition to the information you may provide to us, we obtain information from other sources as follows: 

3.2.1 Information that is available publicly, for example in registers, online or in the media 

3.2.2 Chambers staff or Members

3.2.3 Regulatory, public or administrative bodies 

3.3. The data we collect is for the most part digitally held and is kept within our Microsoft 365 tenant on cloud servers in the United Kingdom and the EU. If you supply physical data to Chambers the appropriate staff member will store it and take reasonable steps to store it securely.

4. Our Processing as Data Controllers 

4.1 To make this information clear, we have created a Data Processed Register, which is also set out in Schedule 1 and gives the particular category of information we collect and retain; where we obtain the information from; the purpose and legal basis of processing and to whom we will (if applicable) disclose the information.

4.2 The Data Processed Register is divided into 5 sections:

Section 1                     Data about individuals who apply for employment, pupillage or work experience with Chambers.

Section 2                     Data about Members and staff of Chambers, consultants, secondees, those on work experience, temporary staff, former Members and staff, next of kin, spouses, beneficiaries.

Section 3                     Data about suppliers and supplier personnel.

Section 4                     Data about visitors to Chambers’ offices.

Section 5                     Data supplied in the course of a complaint under our Complaints Policy including data within any case if relevant to the complaint

Section 6                     Data about our marketing contacts

5. International transfers

We will not transfer personal data relating to you to a country which is outside the European Economic Area (EEA) unless it is necessary to do so and:

5.1 the country or recipient (if a separate controller or processor, which is legally distinct from us) is covered by current UK adequacy regulations; or

5.2 appropriate safeguards have been put in place under Article 46 of the UK GDPR and that the risk assessment first required shows that for the data subjects of the transferred data, either the relevant protections of UK GDPR will not be undermined or one of the exceptions of Article 49 applies.

The Article 49 derogationsinclude(in summary):

5.2.1 the transfer is necessary to perform, or to form, a contract to which we (as applicable) are a party:

• with you; or
• a third party where the contract is in your interests;

5.2.2 the transfer is necessary for important reasons of public interest or the establishment, exercise or defence of legal claims

5.2.3 you have provided your explicit consent to the transfer; or

5.2.4 the transfer is a one-off transfer, and is necessary to meet our compelling legitimate interests.

6. Retention of personal data

Our Data Retention and Deletion policy can be found at Schedule 2.

7. Your rights in respect of your personal data

7.1 We are not required to give you information in certain circumstances – for the detailed position, reference is made to our Subject Rights Request Policy.

7.2 Generally, however, you have certain rights under data protection laws, including the right to (upon written request) obtain a copy of your personal data that we are processing. Our Subject Rights Request Policy is available on request, but in accordance with the GDPR and subject to the Exemptions:

7.2.1 you will have the following rights:

• right to access: the right to access and receive a copy of the personal information about you that we (as applicable) are holding (please note that you are entitled to request one copy of the personal information that we (as applicable) hold about you at no cost, but for any further copies, we (as applicable) reserve the right to charge a reasonable fee based on administration costs); an

• right to rectification: the right to have your personal information rectified if it is inaccurate or incomplete, subject to some exceptions and limitations; and

7.2.2 in certain circumstances, you will also have the following rights:

• right to erasure/“right to be forgotten”: the right to withdraw your consent to our processing of the data (if the legal basis for processing is based on your consent) and the right to request that we (as applicable) delete or erase your personal information from our systems (however, this will not apply if we are required to hold on to the information for compliance with any legal obligation or if we (as applicable) require the information to establish or defend any legal claim);
• right to restriction of use of your information: the right to stop us from using your personal information or limit the way in which we (as applicable) can use it;
• right to data portability: the right to request that we (as applicable) return any information you have provided in a structured, commonly used and machine-readable format, or that we (as applicable) send it directly to another company, where technically feasible; and
• right to object: the right to object to our use of your personal information including where we (as applicable) use it for our legitimate interests or for marketing purposes.

7.3 Please note that if you withdraw your consent to the use of your personal information for purposes set out in our Privacy Policy, we may not be able to carry out our contractual obligations to you or process your data for the purposes for which you have supplied it.

7.4 If you consider our use of your personal information to be unlawful, you have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office. Please see further information on their website: www.ico.org.uk.

8. Automatic decision making

8.1 We do not make decisions based solely on automated data processing, including profiling.

9. Security

9.1 We keep your information protected by taking appropriate technical and organisational measures to guard against unauthorised or unlawful processing, accidental loss, destruction or damage. Full details are contained in our Information Security Policy but for example:

9.1.1 where appropriate, data is encrypted when transiting on our system or stored on our databases;

9.1.2 we have implemented safeguards in relation to access and confidentiality in order to protect the information held within our systems; and

9.1.3 we frequently carry out risk assessments and audits to monitor and review threats and vulnerabilities to our systems to prevent fraud.

9.2 However, whilst we will do our best to protect your personal information, we cannot guarantee the security of your information which is transmitted via an internet or similar connection. If you have credentials for accessing our IT environment it is critical that these are kept confidential by you and should not be disclosed to or shared with anyone.

10. Changes to this Privacy Policy

We may amend this Privacy Policy from time to time for any reason, but most typically, to keep it up to date, to implement minor technical adjustments and improvements or to comply with legal requirements. We will always update this Privacy Policy on our website, so please try to read it when you visit the website (the “last updated” reference below tells you when we last updated our Privacy Policy).

Last updated: June 2025