We will process certain personal data about clients who are individuals.
Types of personal data we collect
To engage and serve you as a client, we will need to collect personal data about you, including your name, position, address, contact details and business details. We may also collect data on the industry in which you operate and your business and personal interests.
In some countries, we may be required by law to collect certain identifying information about you. This may include your name, address, identification or business numbers. We may also be required to view or take a copy of your passport or identity documents.
In the course of your matter, we may collect other personal data about you that is relevant to the matter - see section 6.3 below for further information about this.
Generally, we will obtain this personal data directly from you. Sometimes, we may obtain personal data about you from third parties (for example, a doctor may provide a report about your health) or public sources (for example, we may obtain data about your directorships from a company search).
Purposes of processing
(a) We will process your personal data for the purpose of providing legal and other professional services to you and for other purposes related to that purpose (for example, to carry out conflict checks, to comply with anti-money laundering and terrorism financing laws, and to send you invoices).
(b) We may also use your contact details and interests to manage and develop our relationship with you and to send you communications about our services and firm events – see section 6.4 below for further information about this.
Legal basis for processing under the GDPR
When you become a client, you enter into a contract with Kennedys for the provision of services. The processing described in paragraph (a) above is necessary for taking steps to enter into that contract, or for the performance of that contract. Some of that processing is necessary to comply with applicable laws (for example, legal practice rules or anti-money laundering and terrorism financing laws).
The processing described in paragraph (b) above is necessary for the purposes of Kennedys’ legitimate interests in developing and growing its business. See section 7 below for more details about Kennedys’ legitimate interests.
Recipients or categories of recipients
We may disclose your personal data to third parties who provide administrative, storage, telecommunications, information technology and other services to us in support of our business. However, we will ensure that all such suppliers are subject to obligations not to use or disclose that data.
For the purposes of your matter, we may disclose your personal data to third parties who provide services which assist us with your matter and to third parties who are involved in the matter - see section 6.3 below for further information about this.
In some countries, we are required by law to provide your personal data to government authorities.
In exceptional circumstances, we may be required or permitted by law to disclose personal data, for example to law enforcement authorities or to prevent a serious threat to public safety.
We may transfer your personal data overseas.
The information systems of Kennedys Group are hosted on central servers located in the United Kingdom and Singapore. Any personal data that we store on our systems will be transferred to one of those locations.
Kennedys Group’s information systems, including electronic matter files, client information and finance systems are accessible by Kennedys offices around the world. This means your personal data may be accessed by Kennedys personnel overseas.
When a client matter involves obtaining legal or other professional advice from another country, we may need to transfer details about the client matter, including your personal data, to a Kennedys office or third party in that country.
See section 8 below for information about the safeguards Kennedys adopts when transferring personal data overseas.
Kennedys will only retain personal data for as long as it has a legitimate purpose to do so. Kennedys will need to retain personal data for commercial and legal purposes. How long it will need to retain personal data for these purposes will depend on the specific personal data.
Kennedys generally retains client documentation and matter files for at least 6 years after the end of the matter, in case a dispute arises in relation to the matter. It may retain some client matter files for longer than this (for example, property related matters).
Kennedys is required to retain certain client and matter information for a specified period by corporate and tax laws, legal industry regulations and our insurance providers.
Once Kennedys has no legal or commercial reasons to retain personal data, it will be securely deleted or destroyed.
Requirement to provide personal data
As a client, it is mandatory to provide us with basic personal data such as your name and contact details. If you do not provide this data, we will not be able to act for you.
In some countries, we are required by law to collect certain personal data about you. If you do not provide this data, we will not be able to act for you.
It is optional to provide most other personal data. However, in many cases, if you do not provide that data, the advice and services we can provide to you may be limited or may not take into account your particular circumstances.