1. Scope of this policy
This policy covers personal data handled in connection with this website and with enquiries sent through it or to the published email address. It also covers data received in the course of an engagement, where it is handled on the same principles.
It does not cover websites operated by other people, even where this site links to them. Those are governed by their own privacy information.
2. Who is responsible for your data
Personal data described here is handled by Casey Johns, working as an independent legal adviser and consultant, who decides why and how it is processed. Questions, requests and complaints about it go to info@caseyjohnslaw.com and are answered from there.
3. What data is collected
Only what an enquiry needs in order to be understood and answered:
- the name you give, so that a reply can address you;
- your email address, which is the channel a reply goes back on;
- the country or jurisdiction, where you choose to say, because it usually determines which requirements apply;
- the description of your question, in your own words;
- the correspondence that follows, including anything you choose to send later.
The country field is optional and the form says so. Nothing else is requested. No account is created, no profile is built, and no data is bought from or enriched by anyone else.
This site does not ask for, and does not need, special categories of data such as health, biometric or belief data, nor identity documents. The form carries a note asking you not to include them in a first enquiry. If such material is genuinely relevant to a matter, it is exchanged later, by a route agreed for the purpose, and only to the extent the matter requires.
4. Why it is processed
For three purposes, and no others:
- To answer your enquiry. Reading what you sent, coming back with questions, and telling you whether this is something that can be helped with.
- To carry out an engagement, where one is agreed: doing the work, keeping the record of it, and corresponding with you and with anyone you ask to be involved.
- To meet obligations that apply to the practice, such as keeping records of work performed for the period the applicable rules require.
Your data is not used to send marketing, is not used to profile you, and is not used to make any decision about you by automated means alone.
5. The basis for processing it
Answering an enquiry you have chosen to send is processing carried out at your request, in order to take steps towards a possible engagement. Where an engagement follows, processing is necessary to perform it. Where records must be kept, processing rests on the obligation that requires them. Where none of those apply, the basis is the legitimate interest in running an advisory practice, and only where that interest does not override your own rights and freedoms.
Where consent is the basis for something, you are asked for it separately and you can withdraw it at any time, without affecting anything done before you did.
6. How long it is kept
An enquiry that does not lead to an engagement is kept only while it is still live, and then for a short further period so that a returning correspondent is not met with a blank record. After that it is deleted.
Where an engagement follows, the file is kept for as long as the matter runs and then for the period the applicable professional and record-keeping rules require, after which it is deleted or anonymised.
Retention periods are set by those rules rather than chosen freely, which is why this policy describes them by reference rather than by a fixed number of years.
7. Who it may be shared with
Personal data is not sold, is not rented and is not shared for anyone else's marketing.
It may be disclosed in only three situations: to a professional qualified in a particular country, where a matter needs one and you have asked for or agreed to that involvement; to the service providers that make email and website hosting work, which handle data on instructions and only to deliver those services; and where disclosure is required by a court, a regulator or the law that applies.
Everyone in the first two categories is bound by confidentiality, either professionally or by contract.
8. Data leaving the country it was collected in
Because services are provided across borders, correspondence and documents may be handled in a country other than the one you sent them from, and email and hosting providers may store data outside it.
Where that happens, transfers are made only to recipients who are subject to confidentiality obligations, and safeguards appropriate to the transfer are used, such as contractual protections with the provider concerned. The scope of the protection available to you can differ depending on where you are and where the data goes, and this policy does not claim otherwise.
9. Your rights
Subject to the law that applies to you, you can ask:
- to be told what data is held about you and to receive a copy of it;
- to have inaccurate data corrected and incomplete data completed;
- to have data deleted, where there is no continuing reason or obligation to keep it;
- to have processing restricted while a question about it is resolved;
- to object to processing that rests on legitimate interest;
- to receive the data you provided in a portable form;
- to withdraw a consent you previously gave.
The exact scope of these rights depends on where you are resident and which law governs the processing, so a request is assessed against the rules that actually apply to it rather than against this list alone.
10. How to exercise them
Write to info@caseyjohnslaw.com and say what you want. No particular form is required. You may be asked for enough information to be sure the request comes from you, which is a protection for you rather than an obstacle: data should not be handed to somebody claiming to be you.
Requests are answered without undue delay and within the period the applicable law allows. If a request cannot be met in full, you are told why.
11. Complaints
If you are not satisfied with how a request has been handled, please say so directly first, because most problems can be resolved that way. You also have the right to complain to the data protection authority competent for your country of residence, and doing so does not prevent you from raising the matter here as well.
12. Security
Data is protected by measures appropriate to the risk: access limited to those who need it, up-to-date devices and software, encrypted transport for the website, and backups held under the same restrictions as the originals.
No system is beyond compromise, and ordinary email in particular is not a secure channel, which is why the form asks you not to attach documents to a first enquiry. Where a matter calls for a more protected route, one is arranged before material is exchanged.
13. Cookies
This site sets only what is technically necessary for it to work. It runs no analytics platform, no advertising network and no cross-site tracking pixel. The detail is in the Cookie Policy.
14. Children
The service is addressed to adults and to businesses. It is not directed at children, and personal data is not knowingly collected from them. If you believe a child has sent data through this site, write to the address above and it will be deleted.
15. Changes to this policy
This policy is updated when what the site or the practice does changes. The version and the date of the last change are shown beside the title. A change that materially affects how your data is handled will be communicated to you directly where there is a live matter or correspondence between us.
Questions about this document
Write to info@caseyjohnslaw.com.