DAVID WALLEY & CO SOLICITORS

PRIVACY POLICY

Website & Client Data Protection Notice 

1. Introduction

David Walley & Co Solicitors ("we", "us", "our") processes personal data in the course of providing legal services and operating this website. This Policy is issued in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Data Protection Act 2018.

2. Who We Are — The Data Controller

David Walley & Co Solicitors of 54 Amiens Street, Dublin 1, D01 P5F1 (DX 112021 Talbot Street) is the data controller in respect of the personal data described in this Policy.

•    Email: info@dwalleysol.com

•    Telephone: 01 836 3655

•    Data protection contact: Mark Hennelly, Principal Solicitor

3. Personal Data We Collect

3.1 General Categories

•    Identity data — name, date of birth, gender, PPS number

•    Contact data — postal address, email address, telephone number

•    Financial data — bank account details, income, assets, source of funds/wealth

•    Identification/verification data — passport, driving licence, utility bills

•    Matter/case data — information relevant to your legal matter (varies by practice area)

•    Website and technical data — IP address, browser/device type, pages visited (see Cookie Policy)

•    Marketing preferences

3.2 Special Category and Criminal Offence Data

Depending on the nature of the matter, we may process:

•    Health data — for example, in personal injury, medical negligence, employment, capacity/wardship, or probate/will matters

•    Criminal conviction or offence data — for example, in criminal defence, licensing, or employment vetting matters

4. How We Collect Personal Data

•    Directly from you — through instructions, meetings, correspondence, and forms (including enquiry forms on this website);

•    From third parties — for example, other solicitors, barristers, courts and tribunals, expert witnesses, financial institutions, and public registers such as Tailte Éireann, the Companies Registration Office, the Probate Office, and the Revenue Commissioners;

•    From publicly available sources; and

•    Automatically, through your use of this website (see our Cookie Policy).

5. Purposes and Legal Basis for Processing

We rely on the following legal bases under Article 6 GDPR, depending on the purpose of processing:

Purpose

Legal Basis

Providing legal advice and services under a retainer

Performance of a contract (Art. 6(1)(b))

Client due diligence and ongoing monitoring under anti-money laundering law

Legal obligation (Art. 6(1)(c)) — Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 (as amended)

Compliance with Solicitors Accounts Regulations and Law Society/LSRA regulatory requirements

Legal obligation (Art. 6(1)(c))

Conflict-of-interest checking

Legitimate interests (Art. 6(1)(f)) — our interest in identifying conflicts and complying with professional conduct obligations

Establishing, exercising, or defending legal claims (including against the firm)

Legitimate interests (Art. 6(1)(f)) — our interest in protecting the firm's legal position — or legal obligation, as applicable

Billing, accounts, and debt recovery

Performance of a contract — recovering payment for services provided — or legitimate interests

Responding to general enquiries prior to any retainer

Legitimate interests (Art. 6(1)(f)) — our interest in responding to prospective clients — or pre-contractual steps (Art. 6(1)(b))

Marketing communications (newsletters, seminar invitations)

Consent (Art. 6(1)(a)), or legitimate interests (Art. 6(1)(f)) — our interest in maintaining professional relationships with existing clients, where permitted

Website analytics and non-essential cookies

Consent — see Cookie Policy

5.1 Is Providing Your Personal Data Mandatory?

In most circumstances, you are not legally obliged to provide us with personal data. However:

•    where we are required by law to verify your identity — for example, under anti-money laundering legislation, or in connection with a property, probate, or company transaction — we will not be able to provide the relevant legal service without this information; and

•    where personal data is necessary for the performance of your retainer with us, we may be unable to act, or to continue acting, for you if that information is not provided.

6. Sharing Your Personal Data

We may share personal data with the following categories of recipient, where necessary for the purposes described above:

•    Counsel (barristers) and expert witnesses instructed in connection with your matter;

•    Courts, tribunals, and the Office of the Legal Costs Adjudicators;

•    The other party's solicitors or representatives;

•    Public registries and State bodies, including Tailte Éireann, the Companies Registration Office, the Revenue Commissioners, and the Probate Office;

•    Financial institutions, including banks holding client account funds;

•    Costs accountants;

•    Our professional indemnity insurers and auditors, and our regulator (the Law Society of Ireland and/or the Legal Services Regulatory Authority), where required for regulatory or insurance purposes;

•    IT, cloud hosting, and practice management software providers acting as our data processors under written contracts compliant with Article 28 GDPR, including Squarespace Ireland Limited (website hosting, forms, and website analytics) and other IT service providers engaged to support the practice; and

•    Any other party where required or permitted by law, or with your consent.

7. International Transfers

Our website hosting provider is Squarespace Ireland Limited, an Irish company. Squarespace Ireland Limited engages its US parent company, Squarespace, Inc., as a sub-processor. Personal data may therefore be transferred to the United States as part of this sub-processing arrangement. Such transfers are carried out under the EU-U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, which Squarespace has adopted as the safeguard for this transfer. Further information is available on request from us, or directly from Squarespace's own published privacy documentation.

8. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, having regard to:

•    the nature of the matter and applicable limitation periods under the Statute of Limitations 1957 (as amended);

•    Law Society of Ireland guidance on the retention and destruction of paper and electronic files;

•    record-keeping requirements under the Solicitors Accounts Regulations;

•    record-keeping obligations under anti-money laundering legislation; and

•    the risk of future claims against the firm (for example, professional negligence claims, which may arise some years after a matter concludes).

Indicative retention periods are set out below, based on standard practice for Irish solicitors' firms:

Record Type

Indicative Retention Period

General client files

7 years from conclusion of the matter

Conveyancing files / title documents

Retained indefinitely

Probate files

12 years from the date of the grant

Files involving a minor

Until the client reaches the age of 18, plus a further 6 years (i.e. until age 24)

Anti-money laundering / client due diligence records

Minimum 5 years from the end of the business relationship (Criminal Justice (Money Laundering and Terrorist Financing) Act 2010, as amended)

Accounting records

6 years (Solicitors Accounts Regulations)

9. Your Rights

Subject to certain exemptions (see below), you have the right to:

•    Access — request a copy of the personal data we hold about you;

•    Rectification — request correction of inaccurate or incomplete data;

•    Erasure — request deletion of your data in certain circumstances;

•    Restriction — request that we limit how we use your data in certain circumstances;

•    Data portability — receive, in a structured format, data you provided to us, where technically feasible;

•    Object — object to processing based on legitimate interests, or to direct marketing at any time; and

•    Withdraw consent — where processing is based on consent, at any time, without affecting the lawfulness of processing before withdrawal; and

•    Not be subject to automated decision-making — not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

We do not currently carry out solely automated decision-making, including profiling, that produces legal or similarly significant effects. If this changes, we will provide further information about the logic involved and the significance and envisaged consequences for you.

To exercise any of these rights, please contact us at info@dwalleysol.com.

9.1 Exemptions and Limitations

Certain rights are limited where:

•    personal data is subject to legal professional privilege; or

•    processing is necessary for the establishment, exercise, or defence of legal claims or prospective legal claims or proceedings (Data Protection Act 2018, s.60).

Where we rely on such an exemption in responding to a request, we will explain this to you.

10. Complaints to the Regulator

You have the right to lodge a complaint with the Data Protection Commission if you believe your personal data has been processed unlawfully:

•    Address: 21 Fitzwilliam Square South, Dublin 2, D02 RD28

•    Website: www.dataprotection.ie