UCL/HJA Personal Injury Advice Clinic Privacy Notice

1. This Privacy Notice sets out how and why the UCL Centre for Access to Justice (“UCL CAJ”, “we”, “us”, or “our”) collects, stores, uses, shares, and processes any personal information that you provide to us, or that we collect from you for the UCL/HJA personal injury clinic. It also explains your rights and how to contact us if you have any concerns with how we deal with your personal information.  

2. We are required to deal with your personal information in accordance with the General Data Protection Regulation (GDPR). We are the Data Controllers of your personal information for the purposes of the GDPR. 

3. Please read this Privacy Notice carefully – it describes why and how we collect and use personal data and provides information about your rights.  It applies to personal data provided to us, both by individuals themselves or by third parties and supplements any other UCL privacy notices which may apply, for example the privacy notice applicable when you visit UCL’s website (see here for further information: www.ucl.ac.uk/legal-services/privacy). 

4. We keep this Privacy Notice under regular review. It was last updated on 28 November 2023 

5. Please note that because this project is run in partnership with Hodge Jones & Allen (‘HJA’), they will also have access to your data and will have their own rules about how your data is processed which you can find here: https://www.hja.net/privacy/ .  

6. The UCL Centre for Access to Justice is part of the UCL Faculty of Laws, a department of University College London (“UCL”). We are working with Hodge Jones & Allen (‘HJA’) to deliver a pro bono personal injury clinic.  

7. UCL is registered as a Data Controller with the Information Commissioner’s Office (registration number Z6364106). 

8. UCL has charitable status, and is a company incorporated by Royal Charter with registration number RC000631. UCL is regulated by Research England, and the Office for Students.  

9. UCL CAJ is located at Bentham House, 4-8 Ensleigh Gardens, London WC1H 0EG.   

10. Our website is: https://www.ucl.ac.uk/access-to-justice/.We are responsible for this website.  

11. Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). 

12. In order to support with your enquiry, we may collect, use, store and transfer different kinds of personal information about you. This may include:  

• Your name, address, telephone number, and email address;
• Identity and biographical information such as your nationality, date of birth, passport or driver’s licence details, National Insurance Number, and employment status  
• Information about our meetings and telephone conversations, and other information relating to the provision of our service to you and the outcomes of your case;
• The names and other details about third parties who are involved in the issues we are helping you with; and 
• Any other information relating to the matter for which you are seeking our advice.  

13. Some of the information that we collect from you may be special category information, which is personal information that is more sensitive, including information relating to: your racial and ethnic origin, religious beliefs, trade union membership, health, and/or information relating to criminal convictions and offences.  

14. If we are collecting special category information we will always ask for your explicit consent, and we will only collect and process such information where there is a valid reason for doing so. 

15. We will only ask you to provide personal data insofar as it is relevant to the matter that we are assisting you with. If you choose not to provide us with any specific personal data that we request, this may affect our ability to act for or advise you.  

16. We may ask you for your personal information, or you may provide it to us through various means, including: 

• When you complete the online form to make an enquiry or book an appointment; 
• When you communicate with us via telephone, post, email, or any other form of electronic communication;
• During the normal course of providing legal advice to you.       

17. We will only use your personal information when the law allows us to. 

18. We may use your personal information for the following purposes: 

• To provide legal advice and services to you; 
• To deal with any complaints or feedback that you might have; 
• To monitor and evaluate our service so that we can improve on it; 
• To manage our relationship with you, including record-keeping; 
• To ensure compliance with our legal and regulatory obligations; 
• For safeguarding purposes, and to ensure the safety of our staff and clients;   

19. We may also use pseudonymised data, meaning data from which you cannot be directly identified, for the purposes of: 

• Education and research (subject to ethical approval processes); 
• Service evaluation; 
• Fundraising and promotional purposes; and/or 
• Published reports or presentations at conferences 

20. Your personal data will be collected and processed primarily by our staff as well as HJA Lawyers and UCL students working on your case. 

21. We can only process your personal information if we have a lawful reason for doing so.   

22. We may collect, use and process your personal information for the purposes set out above on the basis of one (or more) of the following lawful bases: 

• You have consented to the processing; 
• We need to process the information in order to perform legal services for you or represent you;  
• We need to process the information in order for us to comply with our legal and regulatory obligations; and/or 
• The processing is necessary for our legitimate interests (including the operation of pro bono personal injury clinic, and the provision of professional services. 

23. If we need to collect, use or process special category information, we will only do so when you have given us explicit consent or where it is necessary for the establishment, exercise or defence of legal claims.  

24. We will share your personal information with HJA in order for them to process your enquiry.  

25. We may be required by law to disclose certain information to the police or another relevant authority in some circumstances for example where we think you or someone else is at serious risk of harm.  

26. If we share your personal information, we will do this as securely as possible. If we share your information electronically, the email subject headings will be limited to your initials unless the recipient requires your name to be in the heading (for example in emails to the Court).  

27. We may transfer your personal data outside the EEA, e.g. where we use a third party cloud services provider based outside the EEA to store that data. Please note that many countries outside the EEA do not have data protection legislation, or have different data protection or privacy regimes, and so may not always protect their personal data to the same standard as within the EEA. 

28. Whenever we or our suppliers transfer your data outside the EEA, to ensure that your personal data is treated by those third parties securely and in a way that is consistent with UK data protection law, we require the relevant third parties to agree to put in place safeguards, such as the EU model clauses or equivalent measures. For further information on the measures in place, please contact us using the details set out in section 18 below. 

29. We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We have established procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. 

30. We store electronic copies of your personal information securely on servers within UCL Sharepoint and UCL Teams. These are operated using Microsoft 365. 

31. We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. 

32. We will retain details of your enquiry for 6 years after we receive your enquiry, after which it will be destroyed.  

33. We will keep your personal information for these time frames for the following reasons: 

• To respond to any questions, complaints, or claims made by you; 
• To show that we have handled your case fairly; and 
• To ensure that we are providing a good service.  

34. Under the GDPR you have the right to: 

• Ask for access to, and copies of, the personal information we hold about you, and information about how and why we are processing it; 
• Require us to correct any inaccuracies in the personal information we hold about you; 
• In some circumstances, to require us to erase your personal information; 
• In some circumstances, to require us to restrict our data processing activities; 
• Ask for us to provide the personal information we hold about you in a reasonable format as requested by you, or send that information to a third party; 
• Object to us using your personal information; and  
• Withdraw your consent, where our use of your personal information is based on that consent. 

35. Please note that these rights are not absolute, and we may be entitled to refuse requests where exceptions apply. 

36. You also have the right to complain to the Information Commissioner’s Office, which can investigate whether we are complying with data protection law and has enforcement powers, if you are not happy with how we are collecting and processing your personal information. For further information on your rights and how to complain to the ICO, please refer to the ICO website at https://ico.org.uk.

37. If you have any questions about this Privacy Notice, or how we collect, use, or process your personal information, you can contact us by email: accesstojustice@ucl.ac.uk; or by post: Bentham House, Endsleigh Gardens, WC1H 0EG.  

38. You can contact UCL by telephoning: +44 (0)20 7679 2000, or by writing to: University College London, Gower Street, London WC1E 6BT. 

39. Please note that UCL has appointed a Data Protection Officer. If you have any questions about this Privacy Notice, including any requests to exercise your legal rights, you may also contact our Data Protection Officer using the details set out below: 

Data Protection Officer 

data-protection@ucl.ac.uk  

+44 (0)20 3108 8726   

40. If you wish to complain about our use of personal data, please send an email with the details of your complaint to data-protection@ucl.ac.uk so that we can look into the issue and respond to you.  

41. We may update this Privacy Notice from time to time. We will publish any new versions of this Privacy Notice on our website, and will provide you with a copy where practicable.