Who We Are And About This Policy
- Our business consists of the operation of a free charity will-writing scheme for the benefit of charities, legal firms and other organisations to which we provide services. We set out below important information about our processing of personal data by reference to the purposes for which we do so in the context of our business.
- We have published this policy with the view of engendering your trust in our processes, so that you understand what we do and why, and in order that, if you wish to challenge them, you have information about your rights and how you can contact us.
- The purposes are as follows:
- Conduct our will-writing scheme and maintaining a database of wills
- Keeping records and accounts
- Recording of in-coming and out-going telephone and video calls
- Operating our business
- We have included sections dedicated to describing your rights, our contact information generally, and how you can make a complaint
- Except where stated, this policy does not relate to our storage of personal data you upload to Bequeathed while using our online will interview, keeping a copy of the will the system creates from your answers, or keeping a record of your questions and answers, so that you can access that information for your own purposes. We perform those tasks on your behalf as a processor under the Processor Terms.
- We have adopted our Processor Terms and made them binding upon us for the benefit of certain of our users in the form of a deed. A reproduction of the terms of the deed can be found here. If you would like to see a copy of the deed itself, please contact us at [email protected]. We make a charge of £50 to provide a copy.
- Although you are not a party to the deed, if you are a registered consumer or professional end user who uses the online will interview via the Website to draft a will we are liable to you if we breach the terms set out in the deed.
The Legal Basis On Which We Process Personal Data
- We believe that helping people to make a will is a good thing to do. The systems required to do so are complex and to make them available to you free of charge we rely on fees from other sources. Therefore, we have a legitimate interest in processing personal data in accordance with our scheme.
- We also have a legitimate interest to keep all records relating to our business for our internal purposes and to deal with queries or complaints which may arise.
- The legal basis on which we deal with people other than you depends on the circumstances. In all cases we make sure that we have a legitimate reason to do so in connection with our business.
When We Collect Information From You
- We will not obtain personal information about you before you register with us to use our will-drafting services. However, see our Cookies Policy in relation to cookies and tracking technologies.
- We communicate and deal with all manner of people in the ordinary course of our business, whether suppliers, competent authorities, and others incidentally in connection with our business. While doing so, having regard to the nature and purpose of those dealings, we will obtain and process personal data.
Using And Disclosing The Information You Provide
- Unless you have told us otherwise, we will use your information:
- we will use your contact details to communicate with you during the will-writing process and after, including to help you maintain your will, and, if you opt in, to contact you about our products and services;
- to identify when your will is affected by a change in the law;
- in anonymised form, to inform charities as to our user-base and legacy-giving;
- subject to your express permission, we will inform the relevant charity if you have included a legacy-gift in your will and provide the charity with your contact details;
- where you have arrived at this website via a link on the website of one of our customers, to mark you as contact of that customer so that we may tailor our communications to you accordingly;
- where you choose to take advice from a panel legal firm, to introduce the firm to you and to provide the firm with a client file containing the information we have collected and the documents we have created so that it may advise you and complete your will;
- to administer your user account;
- to provide contextual online support to you during your use of the system or tools;
- to process any request for advice or information;
- to customise this website;
- to ensure that any content you post complies with the terms and conditions of use of the website;
- to ensure that content from our site is presented in the most effective manner for you and for your computer;
- to allow you to participate in interactive features of our service, when you choose to do so;
- to notify you about changes to our service; and
- to analyse how our website is used and share anonymous information relating to that use with third parties.
- We will retain your information for as long as we operate our will-writing scheme, and afterwards for the purposes of our Keeping Records and Accounts (see below).
- We do not use or disclose data we obtain from anyone else for any purpose in the course of our business other than for which it was given to us.
- If we sell or buy any business or assets we may disclose your information to the buyer or seller of the business or the assets. If we or substantially all of our business or assets are acquired by a third party, your information is likely to be included in the transfer.
- We have implemented the Google Analytics Demographics and Interest Reporting feature which provides us with aggregated information about the age and gender of our users, along with the interests they express through their online activities. Details of how we use Google Analytics cookies are contained in our Cookies Policy.
- You can opt out of the Google Analytics Demographics and Interest Reporting feature by changing your Google Ads settings on the Google website via this link. Alternatively, Google Analytics provides an opt-out add-on for certain internet browsers which you can get by visiting this link.
Collection Of Your Information
- The information about you that we use and disclose is collected through your use of this website and information we learn from your use of the website, or through your use of our other services.
- The information we collect (excluding the information you upload to Bequeathed while using our online will interview which is addressed in the Processor Terms) is:
- how you arrived at our site;
- your name, email address, postcode;
- the pages you have visited on our website;
- any information you choose to provide us with in online chat.
- We will never collect information about you concerning your religion, beliefs, criminal record, health or sexuality without your explicit consent.
Cookies And Tracking Technologies
- Our website sets cookies on your device, and may read cookies already on your device, regarding your use of our website and services. Please see our Cookies Policy for further details regarding the collection and use of this information.
- We also place Facebook Pixels from some of our charity customers on our site, so they may track the actions of users who visit our site having responded to the charity's advertising.
Keeping Records And Accounts
- We keep personal data (including data subject to our Processor Terms) only where and for so long as it is necessary to provide our products and services and afterwards for so long as necessary to meet our legal or regulatory obligations or, if longer, in relation to claims which could be made against us. Our normal practice is to keep information for at least 6 years.
Operating Our Business
- This section is concerned with the systems we use to process personal data and our processing of personal data for internal purposes (including, in respect of Amazon Web Services only, the personal data you upload in your use of our online will interview which is addressed in the Processor Terms).
- It is not concerned with the nature of the data, the classes of individual on whom we process data, the classes of the data, the sources and disclosures of the data, nor the period of time which we hold data. For information on those topics, please consult the other sections of this policy.
- We process personal data using six principal systems: Amazon Web Services, Intercom, Coview, Slack, Calendly and Zoom, some of which we make work together using Zapier.
- Our web application and data (i.e. data from the will-writing process) are hosted within AWS, in UK datacentres. So AWS policies and processes are our policies and processes for our physical and network security standards.
- We use a third-party application called Intercom to communicate with you and provide you with support via email and online chat.
- All your information sent from our website to Intercom is encrypted in transit. The API and application endpoints are TLS/SSL only and score an "A+" rating on SSL Labs' tests - meaning that Intercom only uses strong cipher suites and has features such as HSTS and Perfect Forward Secrecy fully enabled.
- Our use of Intercom in this way means some of your information will be transferred through Intercom out of the EEA, primarily to Amazon Web Services facilities in the USA. Further details about the measures Amazon take in securing its facilities and services can be found on the Amazon website via this link.
- We have a direct agreement with Intercom on the European Model Contract Terms regarding the collection, use and retention of personal data.
- We use a third-party application called Coview to be able to provide you with Support. Through Intercom, it enables us to request that you share your screen with us so that we can see what you do. Coview is based in Germany. You can read more about the measures Coview takes in relation to privacy on the Coview website via this link.
- We use a third-party application called Slack to communicate within our business and with our trusted third-party contractors.
- We integrate Slack with Intercom so that we can discuss issues that are raised by users on our website. Information collected by each of those applications may therefore also be collected by Slack and processed by Slack outside of the EEA.
- We have a direct agreement with Slack on the European Model Contract Terms regarding the collection, use and retention of personal data.
- To read more about the measures that Slack takes in relation to privacy, visit the Slack website at this link.
- We use Calendly to enable you to book a Support call with us and make an appointment with a panel legal firm.
- We integrate Calendly with Zoom and it is available through Intercom also.
- Calendly stores data with Amazon Web Services and Google in the U.S.
- A Data Processing Addendum is included in the standard Calendly terms and conditions.
- To read more about the measures Calendly takes in relation to privacy, visit the Calendly site at this link.
- We use Zoom to conduct Support calls with you and to enable panel legal firms to conduct the legal appointment with you.
- See also our Call Recording Policy at this link.
- We have opted to store our recordings in the Cloud with Zoom in Germany.
- To read more about the measures Zoom takes in relation to privacy, visit the Zoom site via this link.
- We use Zapier to help make the other third-party systems work together. We have a direct agreement with Zapier on the European Model Contract Terms regarding the collection, use and retention of personal data.
Computers and Mobile Devices
- Our staff and representatives use computer and communications equipment to access these systems to perform their duties, and in particular workstations, laptop computers, other mobile computing devices and mobile phones. Personal data is stored on these devices appropriate to the use for the time being.
- We use personal data for the following internal purposes:
- Corporate governance and management
External Service Providers
- In addition to the third-party applications listed above, we have engaged external service providers to provide the following services:
- Tier 2 Consulting Limited, for developing and maintaining our technology platform
- All information you provide to us is stored on secure servers or encrypted devices. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.
- The transmission of information via the Internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use procedures and security features to try to prevent unauthorised access.
Recording Of In-Coming And Out-Going Telephone and Video Calls
Where Information is Processed
- Information processed via Intercom, Slack, Calendly and Zapier is processed outside of the EEA. Data held at AWS is in the UK.
- Individuals have several rights under data protection law in relation to how we process personal data. These are identified below. To read more please visit the Information Commissioner’s website via this link.
- We cannot charge for providing information where individuals exercise their rights, except that we may charge a reasonable fee based on our administrative costs to provide additional copies where requested in connection with a request to access data, or where we can demonstrate that requests are manifestly unfounded or excessive. In the latter case we may alternatively refuse to act on a request.
- If someone wishes to exercise any of their rights, please contact us at [email protected]
- Right to be given clear and easy to understand information on what personal information we have, why and who we share it with.
- Right to access information that we hold as personal data, subject to protecting the interests of others as appropriate.
- Where any information we hold is inaccurate or incomplete, we can be required to rectify it.
- Right for information to be deleted or removed if there is not a compelling reason for us to retain it.
- Right to restrict processing of personal data for certain reasons.
- Right for a copy of personal data to be provided for personal purposes to use across different services, including to transfer the personal information we hold to another company.
- Where we are subject to a breach of security which is likely to result in a high risk to individuals about whom we hold data we must communicate the breach to the individuals concerned without undue delay. In some cases, this may be done by public communications. This right is subject to certain exceptions where measures have been taken to protect the information.
- Right to object to processing of personal data.
- You can object to us processing your personal data where it is based on our legitimate interests, in which case we can no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
- You can object at any time to our use of personal data relating to you in connection with our direct marketing. Where you do so, the personal data shall not afterwards be processed for such purposes.
- Where personal data is processed for direct marketing purposes, you have the right to object at any time to processing.
- Where we are processing personal data about you with your consent you can withdraw it at any time.
- If someone has a complaint about our handling of personal data, we ask that they contact us at [email protected].
- If we are unable to resolve a complaint, the matter can be referred to the Information Commissioner's Office. You can make that complaint from the ICO website at this link. A claim may also lie in the courts.