Privacy and Data Processing Policy

1.1Northbound Legal Ltd ("we" or "us" or "our") conducts its business as an outsourced legal service provider with offices situated at Unit 82a James Carter Road, Bury St Edmunds, England.

1.2We are committed to protecting and respecting your privacy. We strive to ensure that our use of your personal information is lawful, reasonable, and relevant to our business activities, with the ultimate goal of improving our services and your experience.

1.3This Privacy Policy describes how we will treat your personal information, whether provided by you to us, or collected by us through other means when you engage with us, in your ordinary use of our services, in providing us with your products and services, or in accessing our website.

1.4We are registered with the Information Commissioner's Office (ICO) as a data controller under registration number pending. The person responsible for overseeing questions in relation to this Privacy Policy is Martin Shillo. You may contact them at hello@northboundlegal.co.uk to discuss this Privacy Policy or your rights under data protection legislation that is applicable to you.

2.1We collect your personal information in the following ways:

1. 2.1.1through direct or active communications with you;

2. 2.1.2through automated or passive interactions with you;

3. 2.1.3you wish to attend, or have attended, an event or meeting;

4. 2.1.4you subscribe to our e-newsletter;

5. 2.1.5you have applied for a job with us;

6. 2.1.6from third parties and public sources.

2.2We may require you to submit certain personal information to:

1. 2.2.1enable you to access portions of the website;

2. 2.2.2subscribe to our publications;

3. 2.2.3request marketing or information about our events to be sent to you;

4. 2.2.4apply for job opportunities;

5. 2.2.5make contact with our partners and employees;

6. 2.2.6enable you to facilitate the conclusion of an agreement with us; and

7. 2.2.7comply with our statutory or regulatory obligations.

2.3We also collect personal information directly from you when you communicate directly with us, for example when you complete certain application forms (including client onboarding and vendor forms), via e-mail, telephone calls, feedback forms, registering for and attending events, giving us your business card, site comments or forums.

2.4Our website does not use cookies, tracking pixels or analytics tools, and does not passively collect information that identifies you or your device for marketing, profiling or personalisation purposes. Our hosting provider automatically logs limited technical information for security and operational purposes, such as IP address, browser type and the date and time of each request; this is not used to identify individual visitors or to track behaviour across visits.

3.1We use your Personal Information for the following purposes:

1. 3.1.1to provide outsourced legal services to our clients;

2. 3.1.2in connection with the use of artificial intelligence tools and other software and platforms (including, without limitation, Microsoft 365 Copilot, e-signature platforms, virtual data rooms, contract management software, e-discovery software, data analytics tools, due diligence and document review tools, drafting and research tools, data analysis tools, large language models and similar tools or technologies) in the provision of legal services to our clients and/or the procurement of products and services from our suppliers;

3. 3.1.3in relation to matter-related documents and information, for legal research, referencing and drafting (i.e. documents are re-used for know-how purposes);

4. 3.1.4to comply with our regulatory reporting obligations;

5. 3.1.5to comply with our statutory obligations, including client identification and verification, and any screening we may need to conduct when you access our premises to comply with any relevant regulations or protocols;

6. 3.1.6to conduct the recruitment and hiring processes, which includes conducting criminal record and credit checks (where appropriate), the capturing of a job applicant's details and providing status updates to job applicants;

7. 3.1.7in relation to supplier information, to create supplier profiles on our systems, pay suppliers, and for general supplier administration;

8. 3.1.8to maintain and improve the Website and to improve the experience of our website users, including by requesting feedback from our website users on our products and services and to facilitate the procurement of our products and services;

9. 3.1.9to retain and make information available to you on the Website;

10. 3.1.10to maintain and update our client, or potential client databases;

11. 3.1.11to maintain and update our supplier database;

12. 3.1.12to establish and verify your identity on the Website;

13. 3.1.13to operate, administer, secure and develop the Website and the performance and functionality of the Website;

14. 3.1.14to detect, prevent or manage actual or alleged fraud, security breaches or the abuse, misuse or unauthorised use of our systems and files, the Website and/or contraventions of this Privacy Policy and/or the Terms and/or the Agreements;

15. 3.1.15to inform you about any changes to the Website, this Privacy Policy or other changes that are relevant to you;

16. 3.1.16to create user profiles, compile and use statistical information (including non-personal information) about you and other users and their access to the Website and to analyse and compare how you and other users make use of the Website, including (without limitation) their browsing habits, click-patterns, preferences, frequency and times of use, trends and demographic information including recommendations to users and tailoring information and content for users;

17. 3.1.17to conduct market research surveys;

18. 3.1.18to offer you information and content which is more appropriately tailored for you as far as reasonably possible;

19. 3.1.19to provide you with the latest information about our products and services or events provided that you have agreed to receive such information;

20. 3.1.20for security, administrative and legal purposes;

21. 3.1.21pitching, opportunity tracking and reporting;

22. 3.1.22campaign tracking and reporting;

23. 3.1.23to communicate with you and retain a record of our communications with you and your communications with us;

24. 3.1.24to fulfil any contractual obligations that we may have to you or any third party;

25. 3.1.25to invite you to webinars, functions or events that we may host alone or in conjunction with our alliance partners, affiliated firms or other Companies with whom NBL has collaboration arrangements;

26. 3.1.26to analyse and compare the types of Access Devices that you and other users make use of and your physical location; and

27. 3.1.27for other activities and/or purposes which are lawful, reasonable and adequate, relevant and not excessive in relation to the provision of our services and/or the use of the Website, our business activities or such other purpose for which it was collected.

3.2The legal bases we rely on for the purposes above are, depending on the purpose: performance of a contract with you or your employer; compliance with a legal or regulatory obligation; our legitimate interests (including running and securing our business, recruitment, and maintaining client and supplier relationships) and, for direct marketing and any other purpose requiring your consent. Where we process criminal offence data, such as through recruitment checks, we do so under the applicable condition in Schedule 1 to the Data Protection Act 2018. Where we rely on legitimate interests, you can ask us for more detail about the specific interest relied on for a given purpose.

3.3We will obtain your permission before collecting or using your Personal Information for any other purpose.

4.1Data protection legislation may confer certain rights on you in respect of your personal information. We aim to be clear about what Personal Information we collect so that you can make meaningful choices about what Personal Information you make available to us.

4.2You may, for example:

1. 4.2.1Request copies of your Personal Information, which indicates what Personal Information we have about you.

2. 4.2.2Request the correction of your Personal Information, in order to ensure that any incomplete or inaccurate Personal Information is corrected.

3. 4.2.3Request the erasure of your Personal Information, where there is no lawful basis for the retention or continued processing of it.

4. 4.2.4Object to the processing of your Personal Information for a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms.

5. 4.2.5Request the restriction of the processing of your Personal Information. This enables you to ask us to suspend the processing of your Personal Information in limited circumstances, which may differ by jurisdiction.

6. 4.2.6Withdraw your consent to processing based on consent, at any time. This will not affect the lawfulness of any processing based on consent before its withdrawal, and will not affect any processing we carry out on another lawful basis, such as to perform a contract or comply with a legal obligation.

7. 4.2.7Request us to transfer your information from one organisation to another or give it to you. This right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated.

8. 4.2.8Institute civil proceedings regarding an alleged interference with the protection of your Personal Information processed in accordance with this Privacy Policy.

9. 4.2.9Lodge a complaint - You may complain directly to us about how we have handled your Personal Information by emailing hello@northboundlegal.co.uk marked "Data protection complaint" — we will acknowledge your complaint and aim to provide a full response within three months. You may also lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection, at ico.org.uk or by calling 0303 123 1113, without prejudice to any other administrative or judicial remedy. We would, however, welcome the opportunity to address your concerns directly first.

4.3You are not required to pay any charge for exercising your rights. We have one month to respond to you. Please contact us at hello@northboundlegal.co.uk if you wish to make a request.

5.1We may share your personal information but will only do so when this is fair and lawful. We will not intentionally disclose your personal information, whether for commercial gain or otherwise, other than with your permission, as permitted by applicable law or in the manner as set out in this Privacy Policy.

5.2We may share your personal information under the following circumstances:

1. 5.2.1with our agents, advisers and suppliers that have agreed to be bound by applicable data protection legislation and this Privacy Policy or similar terms, which offer the same level of protection as this Privacy Policy;

2. 5.2.2with our employees, suppliers, consultants, contractors and agents for the provision of our services or to the extent necessary for them to process such personal information on our behalf, to provide services to or for us. We have contracts in place with such third parties. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct;

3. 5.2.3to protect our rights, property or safety or that of our employees, contractors, suppliers, agents and any other third party;

4. 5.2.4with governmental agencies and other regulatory or self-regulatory bodies, if required to do so by law or when we reasonably believe that such action is necessary to:

   1. 5.2.4.1comply with the law or with any legal process;

   2. 5.2.4.2protect and defend the rights, property or our safety, or our clients, employees, contractors, suppliers, agents or any third party;

   3. 5.2.4.3detect, prevent or manage actual or alleged fraud, security breaches, technical issues, or the abuse, misuse or unauthorised use of the Website and/or contraventions of this Privacy Policy; and/or

   4. 5.2.4.4protect the rights, property or safety of members of the public (if you provide false or deceptive information or misrepresent yourself, we may proactively disclose such information to the appropriate regulatory bodies and/or commercial entities).

5.3We will get your permission before disclosing your personal information to any third party for any other purpose, if we are required by law to do so.

5.4When it is necessary for us to transfer your personal information outside of the UK this will only be done in accordance with the UK GDPR.

6.1Where we provide links to websites of other organisations, this Privacy Policy does not apply to such websites or the websites of any other parties, or the applications, products or services such websites advertise, or websites that link to or advertise on our website.

6.2We are not responsible for the privacy practices of such third-party websites, or for any claims, loss or damage arising from these.

6.3We advise you to read the privacy policy of each third-party website and decide whether you agree to their privacy practices and policies, as these third-party websites may also be collecting or sharing your personal information.

7.1We store your Personal Information on:

1. 7.1.1our premises, in the form of hard copies (if applicable);

2. 7.1.2the premises of third-party service providers such as document storage service providers;

3. 7.1.3our servers; or

4. 7.1.4on the servers of our third-party service providers, such as IT systems or hosting service providers.

7.2In the event of the scenarios contemplated in clauses 7.1.2 and 7.1.4, we will ensure that we have entered into written agreements with those third-party service providers governing our relationship with them that require them to secure the integrity and confidentiality of Personal Information in their possession by taking appropriate, reasonable technical and organisational measures.

7.3From time to time, our service providers may need to transfer to and/or store your Personal Information on servers in a jurisdiction other than where it was collected (i.e. outside of England and Wales) and we hereby notify you that such jurisdiction may not have comparable data protection legislation.

7.4If the location to which Personal Information is transferred and/or is stored does not have substantially similar laws to those of England and Wales, which provide for the protection of Personal Information, we will take reasonably practicable steps, including the imposition of appropriate contractual terms to ensure that your Personal Information is adequately protected in that jurisdiction.

7.5In particular, where we transfer Personal Information outside the UK – including to our delivery team in South Africa – we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (or another UK GDPR Article 46 transfer mechanism), supported by a transfer risk assessment carried out using the ICO's transfer risk assessment tool. Our South African operations additionally comply with the Protection of Personal Information Act 2013 (POPIA).

7.6Please contact us if you require further information as to the specific mechanisms used by us when transferring your Personal Information outside of England and Wales or to a jurisdiction that is different to the one in which we collected your Personal Information.

8.1We may keep your Personal Information for as long as you continue to engage with us, provide services or products to us, access the Website and content and/or use our products and/or services or for as long as reasonably necessary or until you contact us and ask us to destroy it.

8.2Aside from clause 8.1 above and any other clause in this Privacy Policy, we may retain and process some or all of your Personal Information if and for as long as:

1. 8.2.1we are required or permitted by law, a code of conduct or a contract with you to do so;

2. 8.2.2we reasonably need it for lawful purposes related to the performance of our functions and activities;

3. 8.2.3we reasonably require it for evidentiary purposes; or

4. 8.2.4you agree to us retaining it for a specified further period.

8.3To determine the appropriate retention period for Personal Information, we will consider, among other things, the nature and sensitivity of the Personal Information, the potential risks or harm that may result from its unauthorised use or disclosure, the purposes for which we process it and whether those purposes may be achieved through other means. We will always comply with applicable legal, regulatory, tax, accounting or other requirements as they pertain to the retention of Personal Information, as well as our Record Retention Policy.

9.1This Privacy Policy may be updated from time to time. Where we make a change, we will post the revised policy on the Website and take reasonably practicable steps to inform you of any material change.

9.2Accordingly, please check this Privacy Policy for changes periodically. If you continue to engage with us, provide products or services to us or access or use the Website and/or products and services after amendments are made to the Privacy Policy and displayed on this Website, you will be deemed to have accepted the updated Privacy Policy.

10.1We process Personal Information for the purpose of direct marketing by way of electronic communication. We will only send you direct marketing materials if you have specifically opted-in to receive these materials, or if you are a client of ours, at all times in accordance with applicable laws.

10.2You may refuse to accept, require us to discontinue, or pre-emptively block any approach or communication from us if that approach or communication is primarily for the purpose of direct marketing ("direct marketing communications").

10.3You may opt out of receiving direct marketing communication from us at any time by requesting us (in any manner, whether telephonically, electronically, in writing or in person) to stop providing any direct marketing communication to you. You may send your opt-out requests to hello@northboundlegal.co.uk

11.1The preceding sections of this privacy policy describe our role as a controller. When we deliver outsourced legal and paralegal support services to instructing law firms, we process matter data (including any Personal Information and Special Personal Information contained in that matter data) as a processor acting on your documented instructions, who remains the controller (or a processor for its own clients). We process only the matter data assigned to us, only for the purpose of delivering the contracted services, and only through personnel assigned to that matter.

11.2Every such engagement is governed by a written Data Processing Agreement, which addresses the subject matter, duration, nature and purpose of processing, confidentiality obligations on all personnel, assistance with data subject rights requests and security incidents, breach notification without undue delay, audit and information rights, and return or deletion of data at the end of the engagement, at the client firm's election. A copy is available on request before instruction.

11.3We maintain a list of sub-processors engaged in delivery of its services (including its delivery team engagement partner and hosting, email and payment providers), which is made available to instructing firms on request. We will give client firms at least 30 days' notice of any intended change to sub-processors, with the right to object on reasonable grounds. Sub-processors supporting our website, enquiry handling and billing do not receive client matter data.

11.4Delivery of these services is performed by our team in South Africa. As South Africa is not covered by UK adequacy regulations, restricted transfers of matter data are made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment available to client firms on request, and our delivery operations comply with the Protection of Personal Information Act 2013 (POPIA). Where a firm prefers, work can instead be performed entirely within the firm's own systems under scoped access, so that matter data is not transferred to our systems at all.

11.5Access to matter data is restricted to personnel assigned to the relevant firm on a need-to-know basis and revoked on reassignment; data is encrypted in transit and at rest; personnel give written confidentiality undertakings and use multi-factor authentication; and matter data is never used for training, marketing or benchmarking, or with AI tools, except as and where the client firm instructs in writing. We will notify the client firm without undue delay of any security incident affecting matter data.

11.6Questions relating to a specific client engagement, including requests for the Data Processing Agreement, transfer risk assessment or sub-processor list, should be sent to hello@northboundlegal.co.uk marked "Data protection", and we will respond within 5 business days.

12.1If we sell, merge or transfer all or part of our business, your personal information may be transferred as part of that transaction, and we will notify you in accordance with this Privacy Policy. We may engage sub-contractors and service providers to help us operate our business (for example, IT and hosting providers); where they process personal information on our behalf, we remain responsible for it and require them to protect it to a standard consistent with this Privacy Policy.

12.2Subject to clause 12.1, this Privacy Policy shall apply for the benefit of and be binding on each party's successors and assigns.

12.3Our failure to exercise or enforce any right or provision of this Privacy Policy shall not constitute a waiver of such right or provision.

12.4Each provision of this Privacy Policy, and each part of any provision, is removable and detachable from the others. As far as the law allows, if any provision (or part of a provision) of this Privacy Policy is found by a court or authority of competent jurisdiction to be illegal, invalid or unenforceable (including without limitation, because it is not consistent with the law of another jurisdiction), it must be treated as if it was not included in this Privacy Policy and the rest of this Privacy Policy will still be valid and enforceable.

12.5This Privacy Policy, and any dispute or claim arising out of or in connection with it, is governed by and construed in accordance with the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.