This notice explains how Mills & Reeve LLP, a limited liability partnership registered in England and Wales with registered number OC326165, will collect, use or otherwise process your personal data for electronic signature of documents through the use of e-signature platforms, such as DocuSign and Nitro Sign. You will have been, or will be, notified of which e-signature platform is being used for execution by you of the relevant document
This privacy notice supplements other notices and privacy policies, such as our client privacy notice, and is not intended to override them.
What information may we hold about you when executing documents electronically?
The types of personal data that we will process for facilitating electronic signature of documents include:
- Contact details (name, email address, address, phone numbers)
- Job information (title, place of work)
- Signatures
- IP addresses, other unique device identifiers and geolocation information
We act as a controller of your personal data when processing this information.
The purpose and legal basis for processing your personal data
We process this data in order to arrange for the valid electronic execution of legal or other documents, such as contractual agreements, as required during the course of provision of legal services to our clients. We have introduced electronic signatures to facilitate a smoother and faster completion process. Processing personal data is necessary for the purposes of these legitimate interests.
We may also process this data in order to comply with our legal and regulatory requirements as well as for the prevention, detection and investigation of fraud.
The consequences if you decide not to provide data
The provision of personal data is necessary to complete electronic signature of documents. If you decide not to supply personal data that we have requested, then you will be unable to execute the relevant document(s) with an electronic signature through use of an e-signature platform.
Who will see or use your data and who might we share it with?
Your personal data may be seen or used by our partners and staff (whether lawyers or support staff) in the course of their duties or others lawfully working with us in the ordinary course of our business (for example, former staff or partners working with us on a consultancy basis).
The e-signature platform provider will have access to your data. They will be data processors in relation to your information and we have a data processing agreement in place with the relevant e-signature platform provider to ensure that personal data is processed lawfully. Where an e-signature platform provider proposes to process your personal data as a controller in their own right, rather than on our instructions, the e-signature platform provider will notify you of this, and provide you with a privacy notice to explain how they will process your personal data. They may do this, for example, to manage any account that you create for use of their platform.
Exceptionally we might need to share your personal information in order to obtain necessary confidential legal advice or to comply with our insurance, legal or regulatory obligations. For example, we may have to provide some information to our insurers, legal advisors, public authorities such as HMRC, or to a court/tribunal.
Transfer of your data to other countries
The e-signature platform provider may transfer your data to the United States. The e-signature platform providers that we work with have put in place appropriate safeguards for such transfers, in order to comply with the EU General Data Protection Regulation and the UK GDPR. For DocuSign, binding corporate rules have been approved in accordance with EU GDPR Article 47.
How long will we keep your data?
We expect to retain your personal data in accordance with our retention policy. This policy is reviewed periodically and the periods for storage specified in it may alter depending on the requirements of law and regulation, client requirements, best practice and insurance.
We may be obliged to suspend any planned destruction or deletion under our retention policy where legal or regulatory proceedings require it or where proceedings are underway such as require the data to be retained until those proceedings have finished.
Your rights over your data
You have the right to request copies of the personal data we hold about you. If you wish to obtain a copy of your personal data, you may contact us by emailing [email protected]. You also have the right to ask for inaccuracies in your data to be corrected, and in certain circumstances for us to stop processing your data or for your data to be erased. Some of these rights are not automatic, and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.
If you have any questions about this privacy notice please use the following contact point: [email protected]. If you believe that we have not complied with any of our obligations under data protection laws in the UK, please let us know. You have the right to lodge a complaint with the Information Commissioner’s Office.
Version 1: August 2020