Data & Privacy Notice

3) The data we collect
Depending on your interactions with us, we may process:

• Identity & contact data (name, address, email, phone, job title, organisation);
• Matter data (information relevant to your legal matter, including special category data where necessary for advice or litigation);
• Website/technical data (IP address, device/browser data, pages viewed, cookies—see Section 9);
• Recruitment data (CV, application details, references);
• CCTV imagery of visitors to our premises (see Section 7).

Where we rely on consent, you may withdraw it at any time. Where we rely on legitimate interests, we have carried out a balancing test.

5) Who we share your data with
We only share data where necessary and lawful—for example with courts, counsel, experts, insurers, regulators, law enforcement, IT/service providers acting on our instructions, and professional advisers. We have contracts in place with our processors.

6) International transfers
If we transfer personal data outside the UK, we use approved safeguards (e.g., the UK International Data Transfer Agreement or UK Addendum to EU Standard Contractual Clauses) and assess the risks of the transfer. Details are available on request.

7) CCTV at our offices
HSS operates CCTV in certain areas of our offices. Key information:

• Purpose: To protect our people and property, control access, and investigate incidents. We do not use CCTV for staff performance monitoring.
• Locations covered: Reception; main openplan office; corridor. We do not place cameras in toilets, changing areas, prayer/quiet rooms, or private client consultation
  rooms.
• Audio: OFF by default.
• Lawful basis: Legitimate interests (security of premises, people, and assets). We have completed a Legitimate Interests Assessment (LIA) and a Data Protection
  Impact Assessment (DPIA).
• Retention: Routine deletion after [30] days unless footage is required longer for a specific investigation or legal claim.
• Access & security: Restricted to authorised personnel only; protected by strong authentication and technical controls.
• Sharing: Footage may be shared with law enforcement or our legal advisers where lawful and necessary.
• Storage & transfers: [Local storage only or Cloud storage with vendor [Name]. If cloud, some data may be processed outside the UK—appropriate safeguards are in place].
• Your rights: You can request access to footage that identifies you. We may ask for details (date/time/location) to help us locate the relevant clips and we may redact third parties where appropriate.
• Contact: For CCTV queries or rights requests, email mita@hstirling.com

8) How long we keep your data
We keep data only as long as necessary for the purposes described above, in line with our retention schedule and legal/regulatory requirements. Typical retention periods are available on request. CCTV retention is set out in Section 7.

9) Cookies and analytics
We use essential cookies to make our site work. With your consent, we may use additional cookies for analytics and improvement. You can change your cookie preferences at any time via our cookie banner/settings tool. See our Cookie Notice for details.

10) Your rights
Under UK data protection law you have rights to:

• access your data; correct it; erase it; restrict or object to our processing; and data portability in some cases.
  Where we rely on consent, you may withdraw it at any time. You can also object to processing based on our legitimate interests (including CCTV) where your circumstances justify it.

To exercise your rights, contact henry@hstirling.com. We will respond within one month and may ask for proof of identity.

11) How to complain
If you have concerns, please contact us first at henry@hstirling.com. You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk / 0303 123 1113.

12) Changes to this notice
We may update this notice from time to time. Any significant changes will be highlighted on this page.

Last updated: 9 Sep 2025