HR Privacy Notice
Introduction
Richard Nelson LLP (the Firm) is the data controller of the personal information described in this Privacy Notice. The Firm is committed to protecting your privacy. This Notice explains how we collect, use and share your personal information in the course of our employment and consultancy practices. Personal Data or personal information means any information from which a living individual can be identified.
We keep the information you provide to us confidential and apply high standards of security to protect it. We are accredited under the UK Government-backed Cyber Essentials Plus scheme.
If you have any questions about this Notice, please contact our Data Protection Officer by email at dataprotection@richardnelsonllp.co.uk.
Who This Notice Applies To
This Privacy Notice applies to our current and former employees, partners, consultants and consultant assistants, including agency staff, casual staff and locums. It also applies to work experience students and placement students.
Information We Collect About You
As part of our employment and consultancy practices, we collect and use different types of personal information for a range of purposes. This may include:
- contact and identity details, including your name, date of birth, address, email address, telephone number, National Insurance number, emergency contacts and information used to verify your identity;
- financial information, including bank account details, remuneration and tax status;
- Companies House information, including information about other businesses in which you are involved and other consultancy arrangements;
- employment and professional information, including professional memberships or registrations, regulatory checks, references, right-to-work evidence, security checks, practising certificates and photographs;
- recruitment information, including CVs, application forms, interview notes and assessment materials;
- information relating to your employment or consultancy relationship, including contracts, start dates, working arrangements, working hours, previous roles, remuneration, absence records and sickness records;
- information about your legal needs and personal or professional circumstances;
- performance and development information, including performance outcomes and management, training records and information relating to your professional development;
- i. disciplinary or grievance records;
- medical or health information, including information about physical or mental health conditions and occupational health assessments or reports;
- information gathered during HR investigations;
- holiday and other leave records;
- information about criminal convictions or offences where necessary for our legal or regulatory obligations, including the results of background, regulatory or SRA checks;
- special category Personal Data where needed, including health information, information concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and genetic or biometric data; and
- marketing and communications information, including your preferences, interests and feedback, for example through surveys or events.
How We Collect Your Information
We use a range of methods to collect personal information about you, including:
- information you provide directly, for example when completing a new starter form, communicating by email, post, telephone or in person, visiting our offices, providing feedback or supplying a practising certificate;
- information collected when you use our website, including device, browsing and technical data collected through cookies. Further information is available in our Cookie Notice;
- information that is publicly available online, including information from professional networking platforms such as LinkedIn and from Companies House; and
- information received from third parties, including recruitment agents, the SRA, fraud prevention and credit reference agencies, subscription databases, insurance databases and government bodies.
How We Use Your Information
We will use your personal information only where the law allows us to do so. The lawful bases on which we most commonly rely are:
Performance of a contract or steps before entering into a contract.
This includes entering into and administering an employment or consultancy arrangement and taking steps at your request before entering into such an arrangement.
Compliance with legal obligations.
This includes meeting legal, tax, employment, regulatory and reporting obligations, including obligations owed to HMRC and relevant professional regulators.
Consent.
Where we rely on consent, we will make this clear when we collect the information. You may withdraw consent at any time. We do not generally rely on consent for most employment or consultancy processing.
Legitimate interests.
We may process information where necessary for our legitimate interests, or those of our clients or others, provided those interests are not outweighed by your rights and interests. These interests may include:
- providing legal, advisory or consultancy services;
- meeting regulatory requirements and maintaining accreditations;
- delivering a high standard of service to clients;
- promoting our services;
- collecting feedback; and
- improving our services and developing our business.
Recognised legitimate interests and public functions.
We may share or otherwise process information where another organisation requires it for a public task or official function, or where necessary for national security, public security, defence, responding to an emergency, preventing, detecting or investigating crime, or safeguarding an individual from harm or neglect.
Special category Personal Data.
We process special category Personal Data only where both a lawful basis under data protection law and an additional condition for processing apply. Depending on the circumstances, this may include processing that is necessary for employment, social security or social protection law obligations; the assessment of working capacity; the establishment, exercise or defence of legal claims; reasons of substantial public interest; protecting vital interests; information you have manifestly made public; or where you have given explicit consent.
We process special category Personal Data and criminal offence data in accordance with Data Protection Legislation, our Data Protection Policy, our Record of Processing Activities and our retention and security procedures.
Criminal convictions and offences data.
We process criminal convictions and offences data only where authorised by law and where necessary for legal or regulatory compliance, employment-related purposes, safeguarding, preventing or detecting unlawful acts, or establishing, exercising or defending legal claims. This may include background, regulatory and SRA checks undertaken as part of our onboarding.
When we use your personal information, we follow this Notice. When providing legal services, we are also bound by strict professional duties of confidentiality. For information about how we balance legitimate interests against your rights, contact the Data Protection Team at dataprotection@richardnelsonllp.co.uk.
Other Purposes for Which We May Use Personal Information
Conducting legal services and marketing
- managing legal matters, including court proceedings, claims, criminal cases, tribunals, arbitrations, mediations, investigations and regulatory actions;
- providing legal advice and consultancy support;
- advertising our services on our website or social media platforms, including LinkedIn;
- collecting and processing online reviews, feedback forms and surveys; and
- carrying out checks and sharing information where appropriate to help prevent, detect or investigate crime, fraud and financial crime.
Meeting legal and regulatory requirements
- making disclosures required by law or court order;
- sharing information, where appropriate, with the police, tax authorities, the National Crime Agency or other public bodies; and
- providing information to regulators, ombudsmen or other official bodies where required or permitted.
Audit and quality checks
We may provide access to files for audit, review or quality assurance purposes. This may involve sharing personal information relating to employees, consultants or partners.
Running our business
We may use personal information for day-to-day business purposes, including compliance, complaints handling, financial management, billing, business development and record keeping.
Business changes
We may process personal information in connection with a merger, sale, restructuring, joint venture or transfer of part or all of our business or assets.
International Transfers of Data
In the course of providing legal services and conducting our employment and consultancy practices, some third parties with whom we work, including IT providers, document management systems and other service providers, may process your Personal Data outside the United Kingdom. Where this occurs, we take appropriate steps to ensure that your data remains protected and handled securely. Depending on the destination and circumstances, these safeguards may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another safeguard recognised under Data Protection Legislation.
Use of Artificial Intelligence (AI)
We are committed to safeguarding Personal Data when using AI. Personal Data will be processed through AI systems only where those systems have been formally assessed and approved in accordance with our policies and procedures. Approved systems are required to comply with our confidentiality obligations and data protection policies.
We may use AI tools to support the delivery of legal and business services and to enhance internal operations. These tools may include large language models, machine learning technologies and generative AI systems. Approved third-party tools may also be used where appropriate.
AI is used as a support tool and does not replace professional judgement. We do not make decisions producing legal or similarly significant effects about you based solely on automated processing unless permitted by law and appropriate safeguards are in place. Where applicable, you may request human intervention, express your point of view and challenge such a decision.
How Long We Retain Your Personal Data
We retain Personal Data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, regulatory, tax, accounting and professional obligations, and to establish, exercise or defend legal claims. The applicable period depends on the nature of the information and the purpose for which it is held.
You can view our Retention and Destruction Policy here and our Retention Schedule here.
How We Protect Your Personal Data
We are committed to keeping personal information secure and have measures in place to protect it from unauthorised access, loss, misuse, alteration or damage. These include physical, technical and organisational safeguards designed to protect the Personal Data we hold. Further information is available in our Data Protection Policy in the Office Manual.
Your Personal Data Rights
Depending on the circumstances, you may have rights under data protection law to request access to your Personal Data; request correction or erasure; request restriction of processing; object to processing; receive certain information in a portable format; and withdraw consent where consent is relied upon. These rights are not absolute and may be subject to legal exemptions. To exercise a right, contact dataprotection@richardnelsonllp.co.uk.
Complaints Procedure
You may raise a complaint with us if you believe we have infringed Data Protection Legislation in the way we have handled your personal information. For example, a complaint may concern:
- how we responded to a subject access request or other rights request;
- the security measures used to store your information or a Personal Data Breach; or
- how we collected, used, retained or maintained the accuracy of your personal information.
A data protection complaint may be sent to our Data Protection Team at dataprotection@richardnelsonllp.co.uk or by post to our Head Office: Richard Nelson LLP, Priory Court, 1 Derby Road, Nottingham, NG9 2TA.
We will acknowledge receipt promptly. We will take appropriate steps to investigate and respond to your complaint, keep you informed where appropriate and provide a substantive response within 8 weeks.
If we are unable to resolve your complaint and you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO). The ICO’s contact details are available at www.ico.org.uk.
Our Contact Details
If you have any questions about this Privacy Notice, contact dataprotection@richardnelsonllp.co.uk or write to the Data Protection Officer, Lucie Malins, at our Head Office: Richard Nelson LLP, Priory Court, 1 Derby Road, Nottingham, NG9 2TA.
Changes to This Notice
We review this Privacy Notice regularly and may update it from time to time. We recommend that you check it periodically to stay informed of any changes.
This Notice was last updated in October 2026.