Data Protection Policy

This page outlines how the Lord Edmund-Davies Legal Education Trust (the Trust) processes and manages personal data. It:

identifies our data controller/s;
provides our lawful basis for processing personal data;
outlines the scope of personal data we hold and process;
outlines the scope of the special category personal data we hold and process;
describes and justifies our data retention policy;
shows how we intend to respond to Subject Access Requests; and
contains a copy of our privacy notice.

The policies outlined within this document come into full effect on Friday 25th May 2018.

1. Data Controller

The Data Controller/s are the trustees of the Lord Edmund-Davies Legal Education Trust (“the Trustees”).

2. Lawful basis for processing

Personal data of applicants, parents/guardians and teachers, contained in applications to our Summer Schemes, are processed primarily under the lawful bases of legitimate interest and consent. Our legitimate interests are to provide applicants with the opportunity to gain a place on the Schemes and to make selection decisions. Any personal data maintained once a student is accepted on any of the Trust's schemes is processed under the lawful basis of consent and/or legitimate interest. It does not fall within the definition of direct marketing. Our legitimate interests are to ensure that the Schemes run smoothly; that we provide adequate support for participants; that we can offer support and opportunities to Scheme alumni and encourage alumni to help future Scheme participants
Any personal data maintained regarding persons who help with our schemes is processed under the lawful basis of consent and/or legitimate interest. Our legitimate interest is to ensure that the schemes run smoothly and that helpers have any information and support they need.
Personal data maintained regarding persons who donate to the Trust is processed under the lawful basis of consent. It does not fall within the definition of direct marketing
We undertake to always act within the reasonable expectations of our students, alumni, helpers, donors and any other individual about whom we hold personal data.

3. Data we hold

As of 25th May 2018, the Trust holds information on applicants to our schemes, alumni, parents/guardians and teachers of applicants, donors and helpers; and from January 2019, school contacts, where they have opted-in to our information dissemination.

All the information has been supplied by the data subject, or, in the case of applicants to Schemes, by their parents/guardians and teachers. Personal data is stored either electronically and/or in paper form.

This information predominantly consists of, but is not limited to:

Names, addresses and email addresses.
Telephone numbers.
Date of birth (applicants to Summer Schemes only).
Bank details (donors only)
Special category data, outlined in point 4.

Mailing lists

The Trust uses databases of the persons on whom it holds information to send out ad hoc newsletters to keep them informed on matters about the Trust, and to send out information on upcoming events or opportunities related to the Trust. Personal data we hold in this regard includes:

Names, addresses and email addresses.

This information is not products or services for sale and therefore it is not categorised as direct marketing.

4. Special category data we hold

The Trust also holds special category data for a smaller number of data subjects, the applicants to the Summer Scheme* and donors**. This data will be processed under the lawful basis of legitimate interests and/or explicit consent. The relevant condition under Article 9 of the General Data Protection Regulation (EU) 2016/679 is that the Trust is a not-for-profit body. The special category data we hold relates to:

Race and ethnic origin: this optional information is used to monitor the numbers of applications and successful candidates from different ethnic groups. This information is not taken into account in the selection process.
Physical and mental health* (only successful applicants to the Summer Schemes - and only retained until the end of the month in which the Summer Schemes fall); this is collected and held in order to enable us to provide any necessary support for students selected for Summer Schemes.
Bank details** (donors only).

5. Data retention policy

Our office will hold personal data from applications for no longer than 18 months.

Personal data from donors will be held during the period of the donation, if it is annually; and during the relevant accounting period in the case of one-off donations.

Personal data from successful applicants (but not the physical and mental health data) who become alumni on completion of the summer scheme will be held as part of our ‘alumni scheme’ as a continuing on-going interest in the Trust. Thus, from 25th June 2018, we will only hold data on successful alumni as a continuing ongoing interest in the trust.

6. Subject Access Requests

The Trust will comply with Subject Access Requests in line with the guidance given by the Information Commissioner’s Office (ICO).

You have the right to request a copy of the information that we hold about you. You also have a number of other rights in relation to this information. These are listed below, in the Privacy Notice.
The Trust will respond to any request as quickly as possible, within 30 calendar days.
The Trust will request verification of the identity of any individual making a request, and ask for further clarification and details if needed.

7. Privacy Notice

The Trust will ensure that all persons sharing their personal data have the opportunity to read our privacy notice. The Trust will:

Publish our privacy notice on our website, https://www.ledlet.org.uk/
Add a link to our privacy notice to our LEDLET application forms, emails and letters.
Direct persons who contact us via letter and telephone to our privacy notice online, or supply them with a paper copy if needed.

Privacy Notice

This privacy notice relates to the personal data processed by the Lord Edmund-Davies Legal Education Trust (the Trust), a charity registered with the Charity Commission: Registered Charity Number: 1168785, in relation to applications to our schemes, students, alumni, donors, helpers, and school contacts.

Who is the Data Controller?

The Data Controller/s is/are the Trustees.

What does the Trust do?

The Trust aims to ensure that all young people in Wales have an opportunity to at least consider the possibility of a career in the law, whether as a solicitor, barrister or legal executive; it proposes to provide educational experiences that will encourage and support those drawn to such careers in their efforts to pursue them; in furtherance of these aims the Trust runs a Summer Schemes, in London and Cardiff, Judicial Mentoring in Wales, bursary competitions, assistance with further work experience, and events, to bring our alumni together, inter alia.

In doing so, the Trust processes personal information, sends out newsletters, updates and invitations, as well as encouraging donations from individuals, for the fulfilment of the aforesaid aims.

How do we process data?

The Trust processes personal data of applicants to the Summer Schemes, and their parents/guardians and teachers, as well as of donors to the Trust and Scheme helpers, under the lawful basis of legitimate interest. In instances where this lawful basis is not sufficient and explicit consent is required, it is requested on the application forms, or, in other instances, you will be contacted to establish your consent.

We are committed to ensuring that the information we collect and use is appropriate for this purpose, and does not constitute an invasion of your privacy.

Will we share your data with anyone else?

We only share the personal data of applicants to the Summer Schemes with official representatives of Legal Wales for the purposes of administering the Schemes. We do not share your data with anyone else without your consent. Legal Wales, and any third parties that we share your data with (with your consent) are obliged to keep your details securely, and to use them only for the basis for which they were originally intended. When they no longer need your data to fulfil this purpose, they will dispose of the details in line with our procedures.

In any case, we will not use your personal data in a way that goes beyond your reasonable expectations in contacting us.

For how long will you keep my personal data?

Scheme applicants, or parents/guardians/teachers of applicants: no longer than 18 months from the end of the relevant Scheme (but applicants can request longer retention of their own data).

Alumni: on a continuing on-going basis

Donors: for the duration of annual donations; and for the relevant accounting period for one-off donations

Helpers: whilst you continue to be a helper of the Trust.

What rights do I have to my personal data?

At any point while the Trust is in possession of or processing your personal data, you, the data subject, have the following rights:

Right to be informed – you have the right to be informed about the collection and use of your personal data, the details of which are outlined in this privacy notice.
Right of access – you have the right to request a copy of the information that we hold about you.
Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
Right to be forgotten – you have a right to have the data we hold about you erased from our records, unless there are legal reasons why we cannot do this.
Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.
Right of portability – you have the right to have the data we hold about you transferred to another organisation.
Right to object – you have the right to object to certain types of processing, such as direct marketing.
Right to judicial remedy: if the Trust refuses your request to exercise any of your personal data rights , we will provide you with a reason why. You have the right to complain to a supervisory body (in this case, the Information Commissioner (ICO) and , if necessary, the Information Tribunal and higher courts.

How can I contact somebody about my privacy or complain about the way my information has been dealt with?

You can get in touch with the Trust by email or using the details at the foot of page one of this document.

Please note that the Trust will ask for identification should you choose to exercise any of the above rights in relation to personal data the Trust holds.

You can complain to the Trust if you feel that any of your rights, in relation to your personal data, have been breached. If you are not satisfied with the response, you can complain further to the Information Commissioner's Office Information Commissioner (ICO).

LEGAL WALES FOUNDATION - CYMRU’R GYFRAITH: STUDENT SCHEMES PRIVACY NOTICE

1. Introduction

LEGAL WALES FOUNDATION/CYMRU GYFRAITH (“Legal Wales”) runs student schemes/programmes in conjunction with the Lord Edmund-Davies Legal Education Trust (the “Schemes”). Further details about the Schemes can be found in paragraph 4 below and here https://www.ledlet.org.uk/summer-scheme-2020 .

Legal Wales’ involvement in running the Schemes means that Legal Wales will obtain and use personal data relating to students who apply for or participate in any of the Schemes, as well as their parents, guardians and teachers. In doing so, Legal Wales will act as a controller under data protection law.

This privacy notice sets out information relating to Legal Wales’ use of personal data relating to students, parents, guardians and teachers in connection with the Schemes. It supplements the information set out in Legal Wales’ general privacy notice which can be found on the Legal Wales Foundation/Cymru Gyfraith website.

2. General

In this privacy notice:

Legal Wales is also referred to as “we”, “us” and “our”;
Students, parents, guardians and teachers are also referred to as ‘you’ or ‘your’;
We refer to the Lord Edmund-Davies Legal Education Trust as “LEDLET”.

Please use the Glossary at the end of this document to help you understand the meaning of some of the other terms used in this Privacy Notice.

We will keep this privacy notice under regular review and if we make any significant changes to it, we will tell you about them. This version of the privacy notice was published in January 2021.

It is important that the personal data we hold about you is accurate and current. Please therefore keep us informed if your personal data changes during the course of your relationship with us.

3. Our data privacy manager and contact details

Legal Wales has appointed a data privacy manager who oversees our data protection compliance. If you have any questions about this privacy notice, wish to make any requests to exercise your legal rights under data protection law or want to know more about Legal Wales’ privacy practices, please contact our data privacy manager using the contact details set out below:

Data Privacy Manager: Fran Edwards, Secretary, Legal Wales

Email address: fran@caswelljones.com

Postal address: Caswell Jones Solicitors, 18 Cardiff Road, Caerphilly, CF83 1JN

Telephone number: 029 2086 4888

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with any concerns you may have before you approach the ICO, so please contact Legal Wales in the first instance.

4. The Schemes

The Schemes are described below:

Access to Law Scheme

One or more programmes of events run by Legal Wales and LEDLET to provide students who have completed Year 11 with information about and experience in relation to a career in the law. Legal Wales and LEDLET jointly select the students who will be offered a place on an Access to Law Scheme. Access to Law Schemes may be run online, as residential events or as a combination of online and residential events. Access to Law Schemes are targeted at students who do not have personal links to the legal profession.

Mentoring Programme

Access to a variety of support, insight and experience relating to the legal profession arranged or provided by Legal Wales and LEDLET. Participation in the Mentoring Programme is offered to students who apply for a place on an Access to Law Scheme but are unsuccessful.

Alumni Scheme

A scheme run by Legal Wales and LEDLET designed to offer continued support and opportunities to students who have participated in an Access to Law Scheme This scheme also encourages students who have previously participated in an Access to Law Scheme to provide support to future participants.

5. Individuals at whom this privacy notice is directed

This privacy notice is directed at the following individuals:

Students who apply for or participate in any of the Schemes;
Parents or guardians of a student who applies for or participates in an Access to Law Scheme;
Teachers of any student who applies for or participates in an Access to Law Scheme.

In paragraphs 6 (Students), 7 (Parents and Guardians) and 8 (Teachers) below we explain in more detail:

What types of personal data Legal Wales will obtain about you;
How Legal Wales will obtain your personal data;
Who Legal Wales will share your personal data with; and
The lawful bases/conditions for processing which Legal Wales will rely upon when using your personal data.

Where Legal Wales needs to share any of your personal data with other individuals or organisations for the purposes of the Schemes, please note that we will always limit the amount and type of data shared to that strictly necessary to achieve the relevant purpose (for example, to enable the efficient running of the Schemes or to ensure the safety and well-being of students).

If you need a recap about the meaning of ‘personal data’ or what is meant by a ‘lawful basis’ for processing, please refer to the Glossary below.

6. Students

This section sets out information relating to Legal Wales’ use of your personal data in relation to the Access to Law Scheme, the Mentoring Programme and the Alumni Scheme respectively. We also explain our policy in relation to the use of photographs and quotes.

The Access to Law Scheme

Type of personal data

If you apply for a place on an Access to Law Scheme, Legal Wales will obtain and use the personal data you include in your application form, being:

Your first and last name, date of birth and gender (“Identity Data”);
Your postal address, email address, mobile and landline telephone numbers and any contact information you provide to us (“Contact Data”);
Details of the school you attend, a summary of your academic achievements to date, whether you speak Welsh, English or both languages, details of any schemes or programmes (such as the Seren Network) you are part of and any other information you include in your application form in support of your application (“Background Data”);
Any information you choose to include in the application form about your national and ethnic origin. In law, this information counts as ‘Special Category Personal Data’. This term is explained in the Glossary, towards the end of this document, but essentially it means that we must protect the information even more carefully than the rest of the personal data that we have about you. Please note that information about your national and ethnic origin is not included in the expression ‘Special Category Data’, which comes up in the next section and elsewhere in this document. That data is also ‘Special Category Personal Data’ in law and needs special protection from us, but it concerns your health and well-being needs.

If you are offered a place on an Access to Law Scheme, Legal Wales will obtain and use the following personal data about you:

Details of any additional funding that may have been allocated to you by Legal Wales, LEDLET or other sources and the reasons for such allocation (“Finance Data”);
Details of any medical conditions, disabilities, allergies, dietary requirements or special needs you may decide to tell us about so that we can ensure your safety or wellbeing and/or that you are able to fully participate in the relevant Access to Law Scheme (‘Special Category Data’). Please note that we will only ever ask you for such information where we feel it is necessary to ensure your safety or wellbeing and/or to ensure that you can access the Scheme fully.

Legal Wales may also receive additional personal data falling within the above categories directly from you when you participate in Access to Law Scheme programmes or events.

Purpose of processing

Legal Wales will use your personal data for the following purposes in relation to the Access to Law Scheme:

To review your application and make our selection.

If you are offered a place on an Access to Law Scheme:

To correspond with you about arrangements for the relevant Access to Law Scheme (Identity Data and Contact Data);
To make necessary administrative and practical arrangements (Identity Data, Contact Data, Background Data, Special Category Data);
To arrange suitable placements, work experience and/or support for you (Identity Data, Contact Data, Background Data, Special Category Data);
Where appropriate, to ensure that any medical, dietary or other additional needs you may have are met (Identity Data, Special Category Data); and
To provide you with any funding allocated to you by Legal Wales, LEDLET or other sources (Identity Data, Contact Data and Finance Data).
If your application is unsuccessful, to make contact with you about this and to tell you about the Mentoring Programme (Contact Data).

Data Sharing

If you are offered a place on an Access to Law Scheme, we will need to share your personal data with the following types of persons and organisations:

Where applicable, accommodation providers (Identity Data);
Where applicable, providers of venues for events that form part of the relevant Access to Law Scheme (Identity Data);
Individuals, businesses and organisations which support events that form part of the relevant Access to Law Scheme (for example, providers of online or in-person debate training or workshops on applying to study law at University) (Identity Data, Background Data, Special Category Data);
Solicitors, barristers and other members of the legal profession who have agreed to provide you with work experience or remote support (Identity Data, Contact Data, Background Data, Special Category Data); and
Members of the Legal Wales Board, LEDLET trustees and other volunteers who are involved in the running of the relevant Access to Law Scheme (Identity Data, Contact Data, Special Category Data).

Lawful basis

To lawfully process your personal data in connection with the Access to Law Scheme, we will generally rely on the ground that our use is necessary for the purposes of our legitimate interests (i.e. to deliver the relevant Access to Law Scheme).

However, we need to satisfy an additional condition in order to process Special Category Data relating to you. The condition we will rely upon is your explicit consent. Consequently, if you are offered a place on an Access to Law Scheme, you will be asked, as part of the acceptance process, to agree in writing to Legal Wales and LEDLET using any Special Category Data you provide to us for the purposes described above.

If you do not provide your explicit consent, Legal Wales will not use your Special Category Data in connection with your participation in the relevant Access to Law Scheme.

The Mentoring Programme

Type of personal data

If you are unsuccessful in your application for a place on an Access to Law Scheme, you will be asked if you wish to be included in the Mentoring Programme. If you say yes to this, we will retain and use the following information about you to enable us to deliver the Mentoring Programme:

Identity Data;
Contact Data; and
Background Data relating to any particular branch of the legal profession or field of law you have expressed an interest in when applying for a place on the relevant Access to Law Scheme.

Purpose of processing

Legal Wales will use your personal data for the following purposes:

To correspond with you about arrangements and support opportunities relating to the Mentoring Programme (Identity Data and Contact Data); and
To run the Mentoring Programme (Identity Data, Contact Data and Background Data). This includes corresponding with third parties to arrange mentoring (see ‘Data Sharing’ below).

Data sharing

Our use of your personal data for the purposes of the Mentoring Programme will include us sharing your personal data with the following persons and organisations:

Solicitors, barristers and other members of the legal profession who have agreed to mentor you or provide you with support (Identity Data, Contact Data and relevant Background Data);
Members of the Legal Wales Board, LEDLET and other volunteers who are involved in the running of the Mentoring Programme (Identity Data and Contact Data); AND
Organisations which provide venues for any events (limited Identity Data and details of the school you attend).

Lawful basis

To lawfully process your personal data in connection with the Mentoring Programme we will rely on two legal bases:

Your consent; and
That the processing is necessary for the purposes of Legal Wales’ legitimate interests (that is, to enable us to deliver the Mentoring Programme).

Alumni Scheme

Type of personal data

If you participate in an Access to Law Scheme, you will be asked if you wish to participate in the Alumni Scheme. If you say yes to this, Legal Wales will use the following personal data about you in connection with the running of the Alumni Scheme:

Your Identity Data;
Your Contact Data; and
Background Data relating to the schools you attended and whether you speak Welsh, English or both languages.

Such personal data will either already be our possession or will be shared with us by LEDLET.

Purpose of processing

Legal Wales will use the personal data described above for the following purposes:

To administer and run the Alumni Scheme (Identity Data, Contact Data and Background Data);
To correspond with you about the Alumni Scheme (Identity Data and Contact Data);
To notify you about events, opportunities and support within the legal profession available to alumni and to make arrangements relating to such events, opportunities and support (Identity Data and Contact Data); and
To make arrangements for you to provide support to future participants in the Access to Law Scheme (Identity Data and Contact Data).

Data Sharing

Our use of your personal data for the purposes of the Alumni Scheme will include us sharing your personal data with the following persons and organisations:

Members of the Legal Wales Board, LEDLET and other volunteers who are involved in the administration of the Alumni Scheme (Identity Data); and
Any future participants in the Access to Law Scheme to whom you agree to provide support (Identity Data).

Lawful basis

To lawfully process your personal data in connection with the Alumni Scheme, we will rely on two legal bases:

Your consent; and
That the processing is necessary for the purposes of our legitimate interests (i.e. to enable us to run the Alumni Scheme).

Use of photographs and quotes

If you participate in an Access to Law Scheme (whether as a successful applicant or in a support role through the Alumni Scheme), we will ask for your written permission to:

Take and use photographs of you; and
Collect and use quotes from you.

If you agree to the above, such photographs and quotes will be used on the Legal Wales website and in Legal Wales’ promotional materials. Provided you have agreed to us doing so, we will also share the photographs with LEDLET for use on its website and in its promotional materials.

When using any photographs or quotes we will only use your first name and your town or area of residence.

7. Parents and Guardians

If your child or a young person under your care applies for a place on an Access to Law Scheme, we will have access to the information about you included in your child’s/the young person’s application form. That information will consist of:

Your title and first and last name (‘Identity Data’); and
Your postal address, email address, mobile number and landline number (‘Contact Data’).

Your Identity Data and Contact Data will be used by Legal Wales for the purpose of ensuring that we have an emergency point of contact for your child/the young person under your care. Such use will include sharing your Identity Data and Contact Data with persons and organisations involved in:

organising events which form part of the relevant Access to Law Scheme; and/or
providing your child/the young person under your care with work experience and support.

The lawful basis we will rely upon to use your Identity and Contact Data is that such use is necessary for the purposes of our and the relevant student’s legitimate interests.

8. Teachers

If one of your students applies for a place on an Access to Law Scheme, you will be asked if you would like to hear about future schemes and other opportunities provided by Legal Wales.

If you say yes, Legal Wales will use the following information to keep you informed about student or school initiatives that Legal Wales is promoting or involved in:

Your title, first and last name and the subject you teach (‘Identity Data’); and
The address of the school you work at (‘Contact Data’).

Such use will include sharing your Identity Data and Contact Data with other persons and organisations involved in such student or school initiatives.

We will rely on two lawful bases to use your Identity and Contact Data in the ways described above:

Your consent; and
That our use of your personal data is necessary for the purposes of Legal Wales’ and your school’s legitimate interests

9. Consent

Please note that where our processing of your personal data relies on your consent or your explicit consent, you have the right to withdraw that consent at any time. If you wish to do so, please notify our data privacy manager.

10.Legitimate Interests

If the legal basis we rely upon for processing is our or a third party’s legitimate interests, we are first required to undertake a legitimate interest assessment (‘LIA’).

If you would like more information about the LIAs we have undertaken, please contact our data privacy manager.

In relation to the Schemes, the legitimate interests we generally seek to rely upon are that the particular processing is necessary for the running of the Schemes in a safe and efficient manner, which, in turn, is of benefit to students.

11. Aggregated Data

Legal Wales will also use the information included in applications for the Access to Law Scheme to compile aggregated data and/or create statistics. This might include, for example, data that shows the number of students from a particular ethnic group who apply for a place on an Access to Law Scheme in a given year.

Aggregated data will be derived from your personal data but is not considered personal data in law (as this data will not directly or indirectly reveal your identity). However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.

12. Data Minimisation

Whenever we use your personal data (including when we share it with others), we will ensure that the minimum amount of personal data necessary to achieve the relevant purpose is processed.

13.Change of purpose

We will only use your personal data for the particular purposes referred to above, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

If you wish to receive an explanation as to how processing for any new purpose is compatible with the original purpose, please contact our data privacy manager.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the lawful basis which allows us to do so.

Notwithstanding the above, we may need to process your personal data without your knowledge or consent where this is required or permitted by law.

14. International transfers

We will not transfer your personal data outside the United Kingdom.

15. Data retention

Details about Legal Wales’ retention policy can be found in Legal Wales’ general privacy notice.

The following additional information relating to data retention applies to the Schemes:

Students

If you accept a place on an Access to Law Scheme, we will retain your personal data for a period of 1 year after the end of the relevant Access to Law Scheme. However, please note the information below regarding the position if you decide to participate in the Alumni Scheme.
If you join the Alumni Scheme, we will retain your Identity Data, relevant Background Data and Contact Data while you remain part of the Alumni network. You will be asked periodically if you wish to remain part of the network.
If you join the Mentoring Programme, we will retain your personal data until you cease to be mentored under the programme or you tell us that you no longer wish to participate in the programme.

Parents/Guardians

We will retain your personal data for the duration of the relevant Access to Law Scheme in which your child or the young person under your care is participating.

Teachers

We will retain your personal data until you tell us that you no longer wish to be kept informed of additional opportunities or schemes. We will contact you periodically to ask you if you wish to continue to receive such information from us.

Please note that in some circumstances you can ask us to delete your personal data (see paragraph 16 below for further information).

16. Your legal rights

Under certain circumstances, you have rights under data protection law in relation to your personal data. Details of the rights that may be available to you are set out in the Glossary.

Additional information relevant to your rights under data protection law can also be found in Legal Wales’ general privacy notice.

17. Glossary

Meaning of ‘personal data’

The term ‘personal data’ refers to any information about an identified or identifiable living individual.

A person is considered ‘identifiable’ in a number of different ways, including from names and addresses, identification numbers, physical characteristics and online identifiers (such as IP addresses).

Some types of personal data (known as ‘special category personal data) has stronger protection under the law than others. Personal data which falls under the definition of special category personal data includes information about a person’s health, religion and ethnic origin.

The lawful bases for processing

Under UK data protection law, it is only lawful to use an individual’s personal data if the processing satisfies one of the lawful bases for processing set out in legislation.

The lawful bases available are that:

The individual has given his or her consent to the processing of the relevant personal data for specific purposes;
The processing is necessary for the performance of a contract that the individual has entered into or in order to take steps at the individual’s request prior to entering into a contract;
The processing is necessary for compliance with a legal (e.g. statutory) obligation that the controller is subject to;
The processing is necessary to protect the vital interests of an individual or another person;
The processing is necessary to enable the controller to carry out a task in the public interest or to exercise official authority;
The processing is necessary for the purposes of legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or rights or the individual. In the context of Legal Wales, our legitimate interests being able to run the Schemes safely and efficiently. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

Your legal rights

Under UK data protection law, you have a number of different legal rights. You have the right to:

Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:

If you want us to establish the data's accuracy.
Where our use of the data is unlawful but you do not want us to erase it.
Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain services to you, for example, we will be unable to notify you of events we are running. We will advise you if this is the case at the time you withdraw your consent.