Privacy notice for consultant solicitors

At a glance Applies to: consultant solicitors, and solicitors applying to work with SAS as consultants.

SAS holds the personal data it needs to engage you, pay your invoices, meet its insurers’ and the SRA’s requirements, and keep client data secure.
SAS monitors activity in its own systems and apps, as set out in section 8 of the BYOD Policy. It does not monitor your personal apps, files or browsing.
No activity monitoring software (ActivTrak) is installed on consultants’ own computers.
You can ask for a copy of your data, or for it to be corrected or deleted, by emailing Patrick.
You can complain to the Information Commissioner’s Office (ICO).

Who to ask: Patrick Knight, Data Protection Officer (pk@settlementagreement.com).

Who we are

Settlement Agreement Solicitors Ltd (company number 12589585, registered office Thomas House, 84 Eccleston Square, London SW1V 1PX) is the controller of your personal data. Our Data Protection Officer is Patrick Knight, pk@settlementagreement.com.

What we hold and why

What	Examples	Why	Legal basis
Identity and contact details	Name, address, phone, personal email, emergency contact; your company’s details if you contract through one	To engage you and contact you	Contract; legitimate interests
Professional details	Practising certificate, SRA number, qualification date, CV, references, CPD, your SRA record and any regulatory history	To check you are entitled and competent to practise, as the SRA requires	Legal obligation; legitimate interests
Insurance information	Your answers to SAS’s professional indemnity insurer’s questionnaire, including any past claims or regulatory matters	To arrange and keep SAS’s professional indemnity insurance	Legal obligation; legitimate interests
Fitness to practise	Anything you tell us under the BYOD Policy section 9, such as SRA investigations, convictions or bankruptcy	To meet SAS’s duties as a regulated firm	Legal obligation; substantial public interest (regulatory requirements)
Invoices and payments	Bank details, invoices, fees, referral payments	To pay you and keep accounts	Contract; legal obligation
Work records	Cases, file reviews, complaints, client feedback, absence cover arrangements	To supervise the service and deal with complaints and claims	Contract; legitimate interests
Calls and meetings	RingCentral call recordings, transcripts, summaries and quality scores (RingSense); Google Meet recordings	To check service quality, deal with complaints and claims, and meet regulatory duties	Legitimate interests
System and device records	Sign-ins, activity in the SAS Chrome profile and SAS systems, device security status (Addigy, Endpoint Verification), Harmony SASE connections	To keep client data and SAS systems secure	Legitimate interests; legal obligation
Wellbeing check-ins	Answers you choose to share in a Spill check-in	To help the team support each other	Your choice to share; legitimate interests

We do not make decisions about you based solely on automated processing.

Where your data comes from

Mostly from you. We also get information from the SRA’s register of solicitors, referees, SAS’s insurers and broker, and from SAS systems as you work.

Service providers who process data on our instructions: Google, Zoho, RingCentral, our IT support provider (NVOY) and its security tools (Addigy, Check Point, Dropsuite), Adobe (signing), Anthropic (Claude), Xero and our outsourced bookkeeping provider.
SAS’s professional indemnity insurers and broker, for underwriting and claims.
Spill, our wellbeing provider. What you tell Spill stays with Spill under its own privacy notice; SAS only receives anonymised usage figures.
Regulators and public bodies where the law requires: the SRA, HMRC, the ICO, the courts.
A buyer or investor, if SAS is sold or restructured, as far as possible in anonymised form until the deal completes.

Some providers process data outside the UK. Where they do, SAS relies on UK-approved safeguards, such as the UK-US data bridge or the ICO’s international data transfer agreement.

How long we keep it

Information	Kept for
Engagement, invoice and payment records	6 years after your engagement ends
Professional, insurance and fitness to practise records	6 years after your engagement ends, or longer while a claim or regulatory matter is open
Unsuccessful applications	6 months after the decision, or 12 months if you agree
Call recordings	6 years
System and device records	As set out in SAS’s security records schedule, and no longer than 6 years

Your rights

You can ask SAS to give you a copy of your personal data; correct it; delete it where SAS no longer has a good reason to keep it; restrict how it is used while a concern is checked; stop using it where SAS relies on legitimate interests, unless SAS has strong grounds to continue; and give it to you in a portable form. Email Patrick to make a request. There is normally no fee, and SAS responds within one month. If you are unhappy, please tell Patrick first. You can also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint or 0303 123 1113.

Changes to this notice

SAS will tell you when this notice changes. The current version is always on this page.

BYOD Policy, Data protection, AI use
Working with SAS as a consultant
Your consultancy agreement, clauses 9 and 10

Version 2.0 · Effective on publication · Owner: Patrick Knight, DPO · Approved by Patrick Knight · Acknowledgement: confirmation of receipt by every consultant

​Who we are

​What we hold and why

​Where your data comes from

​Who we share it with

​How long we keep it

​Your rights

​Changes to this notice

​Related