We have a specific Privacy Policy for Young People
STEPHENS SCOWN PRIVACY POLICY
1. INTRODUCTION AND TERMS
Stephens Scown LLP (“We” or “us”) are committed to protecting and respecting your personal data and privacy.
This privacy policy explains how we collect and use personal data when you use our website or mobile application, enquire about or receive our products or services, or otherwise interact with us.
It also explains how we use personal data that you provide to us by telephone, in written correspondence, including letters and emails, by SMS or in person.
Our website and mobile application are not intended for children under the age of 18, and we do not knowingly collect personal data from children through these channels. If we become aware that we have collected such data, we will take appropriate steps to address this in accordance with the Data Protection Laws.
Whenever you provide personal data, we are legally obliged to use your information in accordance with applicable data protection and privacy laws, including the UK General Data Protection Regulation, the Data Protection Act 2018, the Data (Use and Access) Act 2025 and the Privacy and Electronic Communications (EC Directive) Regulations 2003, where applicable (together, the “Data Protection Laws”).
This privacy policy should be read alongside our terms of business but does not override them. We may amend or update this policy from time to time, and the current version will be published at https://www.stephens-scown.co.uk/legal-notices/privacy-statement/.
2. WHO WE ARE AND HOW TO CONTACT US
2.1 For the purposes of the Data Protection Laws, the data controller is Stephens Scown LLP, registered in England and Wales with registered number OC356696. If you would like further information about this privacy policy, wish to exercise your data protection rights or have a question about how we use your personal data, please contact our Privacy Officer using the details below.
FAO: Robert Brooks (Privacy Officer)
Stephens Scown LLP, Curzon House, Southernhay West, Exeter, Devon, EX1 1RS
Email: privacyofficer@stephens-scown.co.uk
Telephone: 01392 210700 and ask to speak to the Privacy Officer.
If you wish to use an AI note-taking tool during a meeting or call, you must notify us before the tool is activated, identify the tool and confirm that you are responsible for its use. We may refuse or require the tool to be disabled where its use could compromise confidentiality, legal professional privilege, data protection or the interests of another participant.
We may use approved transcription tools during a call or meeting. Where we do so, we will tell participants before transcription begins and explain the purpose of the processing. Any transcript or AI-generated notes will be handled in accordance with this privacy policy, including the applicable access, security, sharing and retention arrangements.
Please note that the AI-generated notes will not be considered an accurate record of the meeting or discussion, as AI is not infallible and can produce inaccuracies.
Unless we have expressly agreed otherwise in advance, we do not permit visitors or meeting participants to make audio, image or video recordings in our offices or during online meetings. This restriction applies to wearable technology, mobile phones, cameras and any other recording-capable device. It does not prevent us from using an approved transcription tool where participants have been notified in accordance with the paragraph above.
3. THE DATA WE COLLECT ABOUT YOU
3.1 The personal data we collect and process depends on how you interact with us and the services we provide. It may include Identity Data, Contact Data, Financial Data, Employment Data, Transaction Data, Technical Data, Profile Data, Usage Data, Marketing and Communications Data and Monitoring Data, as described below.
3.1.1 Identity Data includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth, gender and images.
3.1.2 Contact Data includes billing address, delivery address, email address and telephone numbers.
3.1.3 Financial Data includes bank account and payment card details.
3.1.4 Employment Data includes details of your previous, current or prospective employment, professional qualifications, work history and information supplied in connection with recruitment or employment checks.
3.1.5 Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us.
3.1.6 Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
3.1.7 Profile Data includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.
3.1.8 Usage Data includes information about how you use our website, products and services.
3.1.9 Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
3.1.10 Monitoring Data includes images captured by CCTV when you visit one of our offices, together with related information such as the date, time and location of the recording. We use this data for security, safety and incident-management purposes.
3.2 Depending on the nature of our relationship with you or the legal services we provide, we may also collect and process other categories of personal data. Where required, we will provide further privacy information about that processing.
3.3 We also collect, use and share aggregated statistical or demographic information. Aggregated information is not personal data where individuals are no longer identifiable. If aggregated information can be linked with other information to identify you directly or indirectly, we will treat it as personal data and process it in accordance with this privacy policy.
3.4 We may collect special category personal data where it is relevant to the purpose for which we are acting, including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data used for identification, health data, and data concerning a person’s sex life or sexual orientation. We will only process this data where we have identified both an Article 6 lawful basis and an applicable Article 9 condition, together with any additional safeguards required by law.
3.5 We may process financial data and criminal offence data where this is relevant to a legal matter or necessary for recruitment or employment checks. Criminal offence data is subject to separate legal safeguards, and we will process it only where we have an Article 6 lawful basis and the processing is authorised by law, including where an applicable condition in Schedule 1 to the Data Protection Act 2018 is met.
3.6 We only collect data from you directly or via third parties (see the section Third Parties below).
4. IF YOU FAIL TO PROVIDE PERSONAL DATA
Where we need personal data to comply with a legal obligation, to enter into or perform a contract with you, or to provide legal services, we will tell you which information is required and the possible consequences of not providing it. If you do not provide required information, we may be unable to act for you, continue acting or provide the relevant service. We will explain the position to you before taking that step.
5. HOW YOUR DATA WILL BE USED
5.1 We use information held about you to:
5.1.1 carry out our obligations arising from any contracts entered into between you and us and provide our services;
5.1.2 carry out feedback and research on our services; and
5.1.3 notify you about changes to our services.
5.2 We never sell your data to third parties.
5.3 We share your data with third parties where there is a legal obligation for us to do so or we have identified a valid lawful basis as set out in the table below (please also see clause 7 below, lawful basis). We may process your personal data without your knowledge or consent where this is required or permitted by law.
5.4 You can ask us or third parties to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you.
5.5 We have set out below in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate. Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.
| Purpose/Activity | Type of data | Lawful basis for processing including basis of legitimate interest |
| To register you as a new user and customer | (a) Identity (b) Contact | Performance of a contract with you |
| To process your enquiry before you are registered as a customer | (a) Identity (b) Contact | Necessary for our legitimate interests (to keep a record of your enquiry to pass on to relevant legal advisors) |
| To process and deliver our services including: (a) Manage payments, fees and charges (b) Collect and recover money owed to us (c) Provide legal services | (a) Identity (b) Contact (c) Financial (d) Transaction (e) Marketing and Communications (f) Special Category | (a) Performance of a contract with you or taking steps at your request before entering into a contract. (b) Necessary for our legitimate interests in recovering debts due to us. (c) Necessary to comply with a legal obligation. Where we process special category data, we will also identify an applicable Article 9 condition and any required Schedule 1 condition. Where we process criminal offence data, we will identify an applicable Article 6 lawful basis and the authority or Schedule 1 condition required by law. |
| To manage our relationship with you which will include: (a) Notifying you about changes to our terms or privacy policy (b) Asking you to leave a review or take a survey | (a) Identity (b) Contact (c) Profile (d) Marketing and Communications | (a) Performance of a contract with you (b) Necessary to comply with a legal obligation (c) Necessary for our legitimate interests (to keep our records updated and to study how customers use our products/services) |
| To enable you to partake in a prize draw, competition or complete a survey | (a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications | (a) Performance of a contract with you (b) Necessary for our legitimate interests (to study how customers use our products/services, to develop them and grow our business) |
| To administer and protect our business, this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) and our mobile application. | (a) Identity (b) Contact (c) Technical | (a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise) (b) Necessary to comply with a legal obligation |
| To deliver relevant website and mobile application content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you – See Cookie Policy | (a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications (f) Technical | Consent |
| To use data analytics to improve our website, mobile application, products/services, marketing, customer relationships and experiences | (a) Technical (b) Usage | Consent |
| To make suggestions and recommendations to you about goods or services that may be of interest to you | (a) Identity (b) Contact (c) Technical (d) Usage (e) Profile (f) Marketing and Communications | Necessary for our legitimate interests (to develop our products/services and grow our business) Consent – Via website forms. |
| Employment (working for Stephens Scown) | (a) Identity (b) Contact (c) Financial (d) Health (e) Criminal Records (f) Credit Checks | We process employment-related personal data where this is necessary to take steps before entering into, or to perform, an employment contract; to comply with our legal obligations; or for our legitimate interests in managing recruitment and employment. Where we process health data, criminal offence data or other protected information, we will also identify the additional condition required by the Data Protection Laws. We will rely on consent only where it is freely given, specific, informed and capable of being withdrawn without detriment. |
6. NEW TECHNOLOGIES
6.1 We may use Microsoft Copilot within our Microsoft 365 environment to support the delivery of legal services, as explained in our terms of business. Its use is subject to our contractual arrangements, access controls, security measures and professional confidentiality obligations. We assess the purposes for which the tool is used, the personal data involved, any relevant international transfers and the safeguards required under the Data Protection Laws.
6.2 Copilot is used as a supporting tool and does not replace legal analysis, professional judgement or supervision. Outputs may be inaccurate or incomplete and are reviewed by an appropriately authorised person before they are relied upon. Client materials and approved outputs are managed through our document-management and security controls. We disclose personal data to third parties only where necessary for an identified purpose and subject to appropriate contractual, confidentiality and data protection safeguards.
7. LAWFUL BASIS FOR PROCESSING
7.1 We process personal data only where an applicable lawful basis permits us to do so. Depending on the purpose, we may rely on consent, performance of a contract or steps requested before entering into a contract, compliance with a legal obligation, protection of vital interests, performance of a task in the public interest or exercise of official authority, legitimate interests, or a recognised legitimate interest where the statutory requirements are met. We identify and document the applicable basis before processing begins:
7.1.1 Consent – We rely on consent where you have made a freely given, specific, informed and unambiguous choice for a defined purpose. You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn. We do not use consent where another lawful basis is more appropriate or where you do not have a genuine choice.
7.1.2 Contractual – Where processing is necessary for the performance of a contract with you.
7.1.3 Legal obligation – Where processing is necessary to comply with the law (e.g. safeguarding).
7.1.4 Legitimate Interests – We may rely on legitimate interests where the processing is necessary for a legitimate purpose and those interests are not overridden by your interests, rights or freedoms. Before relying on this basis, we assess and document the purpose, necessity and balancing tests. Examples may include operating CCTV for security, obtaining feedback, and sending appropriate business-to-business legal updates or event invitations, subject to the separate requirements of the Privacy and Electronic Communications Regulations 2003.
7.1.5 The remaining lawful bases are:
7.1.6 Vital interests – Where processing is necessary to protect someone’s life.
7.1.7 Public task – Where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
8. THIRD PARTIES AND SHARING INFORMATION
8.1 We will keep your information within the organisation except where disclosure is required or permitted by law or when we use third party service providers (data processors) to supply and support our services to you
8.2 Where we appoint a processor to process personal data on our behalf, we put written contractual terms in place requiring it to act only on our documented instructions, apply appropriate security measures, assist us with relevant compliance obligations and delete or return personal data at the end of the services unless the law requires retention. Processors may use approved sub-processors where the contractual and legal requirements are met.
8.3 Please see below the list which sets out the categories of recipients of personal data.
| SERVICE PROVIDERS WHO MAY RECEIVE YOUR PERSONAL DATA |
| IT Support Services |
| Email Provider |
| Secure document disposal service |
| Banks |
| Online payment providers |
| Driver and Vehicle Licensing Agency |
| Driver and Vehicle Standards Agency |
| Accountants |
| Solicitors |
| Feedback aggregators and collectors |
| 3rd party professionals (e.g. medical professionals) |
| Identification and verification providers |
| DBS Checks |
| Telephony ‘call back’ providers |
8.4 In addition third parties may provide us with personal data and they should only do so where the law allows them to.
8.5 Where your data is held
We and our service providers may process personal data in the UK and in other countries. Where a restricted transfer is made under the UK GDPR, we will use an applicable transfer mechanism, such as UK adequacy regulations, the International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses or another safeguard permitted by law. Where required, we will also carry out a transfer risk assessment and apply supplementary technical and organisational measures.
9. APPLICATIONS TO WORK FOR US
If you apply to work for us (directly or indirectly) in any role we may receive data about you from third parties. In addition, we will keep the details of your application and any additional information provided to us by you or others during your application so that we can keep you informed of future opportunities that you may be interested in. If you do not wish for us to keep your details for this reason, please let us know by contacting us using the details provided in this policy.
Please note that we are required to undertake Disclosure Barring Service checks for certain applicants. If this is the case you will be notified. Criminal conviction data will not be stored for unsuccessful applicants.
10. DATA RETENTION
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including meeting legal, regulatory, accounting, professional and reporting requirements and establishing, exercising or defending legal claims. Retention periods vary according to the type of information, the relevant matter or relationship, applicable limitation periods and legal or regulatory duties. You may contact the Privacy Officer for further information about the period applicable to your personal data.
11. YOUR RIGHTS
11.1 Under the Data Protection Laws your rights are:
11.1.1 To be informed – We must make this privacy policy (sometimes referred to as a privacy notice) available with the emphasis on transparency over how we process your data.
11.1.2 Access – You may ask us whether we process your personal data and, where we do, request a copy together with the supplementary information required by law. You may make a request verbally or in writing. We will respond without undue delay and normally within one month after receiving the request and any information reasonably required to confirm your identity or authority. We may extend the period by up to two further months where the request is complex or you have made several requests, and we will tell you within the initial month if an extension is required. Rights and exemptions may apply to protect legal professional privilege, confidential references, the rights of other people and other interests recognised by law.
- confirm that your data is being processed;
- verify the lawfulness and the purpose of the processing;
- confirm the categories of personal data being processed;
- confirm the type of recipient to whom the personal data have been or will be disclosed; and
- let you have a copy of the data in format we deem suitable or as reasonably required by you.
11.1.3 Rectification – We are obliged to correct or update your details. We will correct or update your data without delay provided you make the request in writing to the contact details provided in this policy, clearly specifying which data is incorrect or out of date.
11.1.4 Erasure – This is also known as the request to be forgotten. Under Data Protection Laws you have the right to erasure under specific circumstances. A request for your personal data to be deleted will be decided on a case by case basis and should be submitted in writing to the contact details provided in this policy.
11.1.5 Restrict processing – You have the right to ‘block’ or suppress the processing by us of your personal data.
11.1.6 Portability – You have the right to obtain and reuse your personal data that you have provided to us.
11.1.7 Object – You have the right to object to us processing your data in relation to direct marketing and or profiling.
11.1.8 Rights in relation to automated decision making and profiling – We do not use automatic decision making or profiling.
11.2 Please note that you may need to provide identification in order to prove who you are if you wish to invoke any of your rights as provided by the Data Protection Laws and as summarised above.
11.3 If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone..
12. CHANGES
We keep our privacy policy under regular review and you should check back regularly to ensure you are aware of changes to it. We may display this notice to you from time to time to help ensure you are aware of its contents.
13. COMPLAINTS
You have the right to complain about the processing of your personal data. Please contact us using the details provided above. If you remain dissatisfied, you have the right to complain to the Information Commission (ICO).