Privacy notice

1Who we are and how to contact us

NJS Law Limited (company number 15170704; registered office St George Chambers, St George's Place
Macclesfield, Cheshire
SK11 8BT) is the controller of your personal information. We are authorised and regulated by the Solicitors Regulation Authority, SRA number 8006550. ICO registration number ZB879361.

Data protection contact: email info@njslaw.co.uk, for the attention of our data protection lead, or post to the address above. Data protection lead: Amanda Nicholson.

We handle your information under the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations.

2What we collect when you enquire

• your name, mobile number and email address;
• the type of claim and what happened, which may include information about your health;
• what you type into our web form or the chat on our website, and how you found us if you tell us;
• for clients: the information we need to run your claim.

When you use this website we also collect technical information needed to run it securely. We only use strictly necessary cookies unless you agree to others: see our cookie notice and section 4.

Our web form and website chat (Zapier and Pipedrive)

• What they are. The enquiry form on this website is our own. When you send it, your details go to Zapier, a service that passes them on to Pipedrive, the customer relationship system we use to record and follow up enquiries, and tells our team a new enquiry has arrived. The chat window is provided by Pipedrive: it is Pipedrive's LeadBooster chat. The chat may start with a few set questions, asked automatically by Pipedrive's chatbot, before a member of our team picks it up. The chatbot makes no decision about your claim.
• What goes into it. Your name, phone number and email address, the type of claim, what happened (which may include information about your health), how you would like us to contact you, and the page you were on. From the web form also where you found us; the first page you opened on this visit and the name of the website that sent you to us (not the page you were reading there); the time you sent it; and, if you came to the website from one of our adverts or campaigns, which one (the campaign tags and advert click id in the link you followed). On our pages about specific injuries, conditions or treatments, and our client case stories, the page addresses are replaced by a neutral code and the campaign names are left out. Tell us only what you are comfortable sharing; a solicitor can ask you for more later.
• What happens next. Your enquiry is saved as a lead in Pipedrive. Straight after you send the web form, we send you a text message and an email confirming we have your enquiry, and our team will be in touch. We send text messages through CloudTalk; the email is sent through Pipedrive (its Campaigns feature). A text may include a link to book a call-back appointment through Calendly, or to message us on WhatsApp (see WhatsApp below and section 4).
• Who handles it. Zapier, Inc. (United States) is our processor for passing on what you send through the web form, under its data processing addendum, which forms part of its terms of service. Zapier processes data in the United States and relies on the UK Extension to the EU–US Data Privacy Framework (the "UK–US data bridge"). Pipedrive is our processor, under its data processing addendum, which also forms part of its terms of service. Pipedrive hosts each account with Amazon Web Services in the region set for that account (its regions include the UK, the EU and the United States); where data is transferred outside the UK, Pipedrive relies on the EU standard contractual clauses with the UK Addendum. CloudTalk is our processor for the text message confirming your enquiry (section 4).
• How long. If your enquiry does not go ahead, we keep it in Pipedrive for 6 years, then delete or anonymise it. We keep it to deal with any later questions or claims about it, and to send you follow-up messages and occasional news under the soft opt-in (see Marketing). You can ask us to delete it sooner, and you can opt out of messages at any time. If you become a client, it goes on your case file (section 6).
• Our legal basis. Taking the steps you asked us to take before you instruct us. For information about your health, that it is needed to establish, exercise or defend legal claims (UK GDPR Article 9(2)(f)). If you instruct us, we ask for your explicit consent before we obtain your medical records.

If you use our new client form

Some of our pages may show our own new client form instead of the web form above. When you press Submit, your details go to NJS Law's own enquiry system, which runs on Railway in the EU. We text a code to your mobile through CloudTalk and email one to you through Microsoft, and Cloudflare checks that you are not a robot. Once both codes are confirmed, we pass your enquiry on to Pipedrive through Zapier and call you. We use your details to deal with your enquiry, as for the web form (above).

If you enquire through a form on Facebook, Instagram or TikTok, or on Typeform

Some of our adverts on Facebook, Instagram and TikTok have their own enquiry form, and some of our Facebook and Instagram adverts open a form provided by Typeform. If you use one, your answers are passed to us and saved as an enquiry in Pipedrive, and we use them as we do for our web form (above). Typeform (Typeform SL, Spain) is our processor for those forms, under its data processing terms. The UK recognises Spain as giving adequate protection; for any onward transfer outside the UK and EEA, Typeform relies on the UK Addendum to the EU standard contractual clauses. The platform's own privacy policy covers what you do on Facebook, Instagram or TikTok.

WhatsApp

If you message us on WhatsApp, for example from the link in our text message, WhatsApp (part of Meta) carries the messages. They are answered first by an automated chatbot that we run through Zapier, and Twilio delivers its replies. We keep the messages with your enquiry in Pipedrive.

If you ask for one of our guides

• What we collect. Your email address and mobile number, which guide you asked for, whether you ticked "Please call me about a possible claim" and, if you did, your first name.
• What we do with it. We email and text you a private link to the guide. The link works for 24 hours. We use your mobile number for that one text and nothing else unless you tick the box. We don't send you marketing because you asked for a guide.
• If you tick "Please call me". We treat it as an enquiry (above) and use your name and phone number to call you about a possible claim.
• Who handles it. We send the email through Microsoft and the text through CloudTalk. The guides themselves are stored privately with Cloudflare (EU).
• What we don't do. We don't use which guide you asked for to decide what marketing you get, and we don't share it with advertising companies.
• How long. If you don't tick the box, we delete your email address and mobile number 30 days after your request, keeping only a count of how many guides were requested. If you tick it, your enquiry is kept as section 6 says for enquiries.
• Our legal basis. Legitimate interests (answering your request). If you tick the box, the same basis as an enquiry (above).

3How we use it, and our legal basis

Marketing by email and text

• If you send us an enquiry. If you enquire through our web form, our chat, by phone or through a form in one of our adverts, we may send you occasional news about our services by email or text, and follow-up messages if we could not reach you or you have not finished signing up, because you asked us about our services. This is called the "soft opt-in" (regulation 22(3) of the Privacy and Electronic Communications Regulations).
• Saying no. You can say no when you enquire (tick the box on our web form, or tell us), and in every message we send.
• If you become our client. We ask you separately, with a box left unticked, when your claim starts. Saying no does not affect your claim.
• How to stop. Every message tells you how to stop: reply STOP to a text, or use the unsubscribe link in an email. You can also email info@njslaw.co.uk at any time.
• What we don't use. We do not use information about your health or your claim to decide what marketing you get.
• Not marketing. Messages that only deal with your own enquiry or claim, for example confirming we have it, arranging a call you asked for or asking for a document we need, are not marketing.
• Our legal basis. For enquirers, legitimate interests; for clients, your consent.

4Who we share it with

We use these service providers (processors), under their data processing terms, which protect your information. Where each one processes data, and the safeguard it relies on outside the UK, is set out below and in section 5:

• Pipedrive: our customer relationship system, the welcome email we send after a web enquiry, and the chat on this website, including the chatbot that may ask a few set questions first (section 2); hosted with Amazon Web Services in the region set for our account;
• Zapier: passes what you send through our web form on to Pipedrive and alerts our team (section 2); United States, under the UK–US data bridge;
• Typeform: some of the enquiry forms in our adverts (section 2); Typeform SL, Spain;
• Twilio: carries the automated replies to WhatsApp messages (section 2); Twilio Ireland Limited, whose messages may be handled in the United States, where Twilio relies on the UK–US data bridge, with the UK Addendum to the EU standard contractual clauses as a fallback. Twilio is a separate controller for the routing data it needs as a telecoms provider and for limited purposes such as security and fraud prevention;
• Calendly: the online booking page we may send you a link to, so you can book a call-back appointment; Calendly, LLC, United States, under its data processing addendum, which forms part of its terms, relying on the UK–US data bridge, with the UK Addendum to the EU standard contractual clauses as a fallback;
• CloudTalk: our phone system, for calls to and from us, for the text messages we send you, including the one confirming your enquiry (section 2), and for call tracking (which advert or web page led to a call). Where a call is recorded, CloudTalk stores the recording in Germany (EU); some of its other processing takes place outside the UK and EU, including in the United States. Where data leaves the UK, CloudTalk relies on the EU standard contractual clauses with the UK Addendum;
• Microsoft: email and Teams (UK/EU);
• DocuSign: electronic signature;
• Cloudflare: delivers this website over its worldwide network and checks that our new client form is not being used by a robot (the guide files are stored in the EU);
• Railway: our own systems that receive your guide requests and what you send through our new client form (EU);
• Trustpilot: review invitations, only if you become a client.

To run your claim we also share information with the other side and their insurer, medical experts, barristers and the court, as your claim needs.

Analytics and advertising (only if you accept them)

If you accept analytics or advertising cookies in our cookie banner, these tools run on this website. If you do not, none of them loads, and you can change your choice at any time in cookie settings. On every page, the address and title sent to Google Analytics are replaced by a code; our Google Ads tag receives each page's real address and title, including on our pages about specific injuries, conditions or treatments, and our client case stories. On those pages our Meta and TikTok tags do not run; instead, Meta and TikTok may receive, from our own server, a coded reference that does not identify the page or what it is about, and not the page address. Google Analytics receives only the code and is told not to use the visit for advertising. We set these tools up so that none of them receives what you type into the enquiry form or the chat; the hashed email address and phone number described below are sent by our own systems, not by these tools.

• Google Analytics (Google): how visitors use the site, with each page reported under a code instead of its address;
• Google Ads (Google): which adverts led to an enquiry;
• Meta Pixel (Meta Platforms): which Facebook and Instagram adverts led to a visit or an enquiry;
• TikTok Pixel (TikTok): which TikTok adverts led to a visit or an enquiry.

We also use Google Ads, Meta and TikTok to show our adverts to people who have visited our website, including our pages about specific injuries, conditions or treatments and our client case stories. We do not split these audiences by type of injury.

If you allow marketing cookies and send us an enquiry through our website form, our website turns your email address and phone number into a hashed (coded) form in your browser and keeps only that. Our own server may then tell Meta and TikTok about the enquiry, with that hashed (coded) copy of your email address and phone number, which they use to match the enquiry to their own users, the page's code, any Meta or TikTok advert click reference, and your IP address and browser details. We do not send them the type of claim or what happened.

Each of these companies may process information outside the UK, including in the United States, as follows (from each company's own data protection terms):

• Google Analytics. Google Ireland Limited acts as our processor, handling the information on our instructions under Google's data processing terms. Google may process it in any country where Google or its subprocessors have facilities, including the United States, and protects transfers out of the UK through the UK Extension to the EU–US Data Privacy Framework or standard contractual clauses.
• Google Ads. Google LLC, in the United States, is a separate controller of the information it receives about advert clicks and enquiries, under Google's controller-to-controller data protection terms. Transfers to it are covered by Google LLC's certification under the UK Extension to the EU–US Data Privacy Framework or by the UK Addendum to the standard contractual clauses.
• Meta (Facebook and Instagram). Meta Platforms, Inc., in the United States, is our joint controller for collecting information through the Meta Pixel on our website and sending it to Meta. It acts as our processor for measuring our adverts, and is a separate controller of how it uses the information after that. Meta is responsible for handling your rights over the information it holds (see Meta's privacy policy). Transfers to Meta are covered by the UK Addendum to the standard contractual clauses.
• TikTok. TikTok Information Technologies UK Limited and TikTok Technology Limited (Ireland) are our joint controllers for collecting information through the TikTok Pixel, sending it to TikTok and reporting on our adverts; TikTok is a separate controller when it uses the information to target and improve adverts and for safety. TikTok is responsible for handling your rights over the information it holds (see TikTok's privacy policy). TikTok says it stores data in the United States, Malaysia and Singapore, with limited remote access from other countries; onward transfers are covered by standard contractual clauses.

Telling advertising companies which adverts led to a case

If you came to our website by clicking one of our adverts, we keep the advert's click reference with your enquiry. If you allow marketing cookies, we hold it in your browser while you look around our website (see our cookie notice); if you send your enquiry from the page the advert opened, it is in that page's address. For a Google advert, the reference is also added to the address of our thank-you page, so that Google Ads can count the enquiry against that advert; the advertising tags on that page, which run only if you allow marketing cookies, can see that address. With your consent to marketing cookies, we may later tell the company that showed the advert (Google, Meta or TikTok) whether your enquiry became a case, whatever the type of claim, using that reference and sometimes a hashed copy of your email address and phone number, so we can see which adverts work. In that report we do not tell them which of our pages you read, or what injury or condition your enquiry is about.

Not showing our adverts to our clients

If you become our client, we may give Google, Meta and TikTok a hashed (coded) copy of your email address and phone number so that they stop showing you our adverts. We use these lists only to exclude people from our adverts.

5Transfers outside the UK

Where a provider processes information outside the UK, it relies on the UK–US data bridge (the UK Extension to the EU–US Data Privacy Framework) for certified US providers, such as Zapier, Twilio and Calendly, or on the EU standard contractual clauses with the UK Addendum, such as Pipedrive and CloudTalk, as set out in section 4. You can ask us for more detail.

6How long we keep it

• Enquiries that do not go ahead: kept for 6 years, then deleted or anonymised, including the enquiry and chat in Pipedrive. We keep them to deal with any later questions or claims, and for follow-up messages and marketing under the soft opt-in. You can ask us to delete yours sooner, and opt out of messages at any time.
• Guide requests where you did not ask for a call: your email address and mobile number deleted 30 days after the request (section 2).
• Analytics and advertising cookies: as set out in our cookie notice.
• Clients: your file is kept for 6 years from the date of our final bill, then destroyed, apart from any documents you ask us to keep in safe custody.

7Automated decisions

We make no decisions about you by automated means that have legal or similarly significant effects. A solicitor decides whether we can help and what happens next.

8Children

We do not take instructions from anyone under 18 through this website. A parent or guardian can contact us about a child's claim.

9Your rights

You can ask for a copy of your information, ask us to correct or delete it, object to or restrict how we use it, and ask for it to be moved. You can withdraw consent to calls or messages at any time: reply STOP or tell us.

To use any of these rights, email info@njslaw.co.uk. We reply within one month; if your request is complex we may need up to two more months, and we will tell you. There is normally no fee. We may ask you to prove who you are first. You can object at any time to our using your information for direct marketing, and we will stop. Withdrawing your consent does not affect what we did before you withdrew it.

10Complaints about your data

Email info@njslaw.co.uk, for the attention of our data protection lead, or write to us at the address in section 1. We acknowledge your complaint within 30 days and reply as soon as we can. You can also complain to the Information Commissioner's Office: 0303 123 1113, ico.org.uk.