Ziora People Advisory Ltd values your privacy and takes care over the way your personal information is handled.Ziora People Advisory Ltd is the data controller for the personal information it processes, which means we are responsible for deciding how your personal information is held and used.
We are registered with the Information Commissioner's Office (the "ICO") under registration number [ICO REGISTRATION NUMBER — insert on registration].
This policy describes: (1) the personal information we collect; (2) how we obtain it; (3) how and why we use it; (4) the lawful bases on which we use it; (5) how long we keep it; (6) who we share it with; (7) how we protect it; (8) international transfers; (9) your rights; and (10) how to contact us. It does not apply to our own personnel, whose information is handled under separate arrangements.
1. The personal information we collect
We may collect personal information in the course of our business, including through your use of this website, when you contact or instruct us, and in the course of providing our services.
This may include:Basic information — your name, title, the organisation you work for, and your role;
Contact information — postal address, email address and telephone number;
Identification and background information — provided by you or collected as part of our client acceptance, conflicts and anti-money laundering checks;
Financial information — such as billing and payment-related information;
Technical information — about your visits to and use of this website;
Information relating to our services — personal information provided to us by or on behalf of our clients, or generated by us in the course of a matter. Given the nature of our work — in particular workplace investigations, grievances, disciplinary matters and settlement agreements — this may include special category personal data (such as information about health, disability, racial or ethnic origin, religion, sexual orientation, or trade union membership) and information relating to criminal allegations or proceedings; andany other information you choose to provide to us.
2. How we obtain your personal information
We collect information directly from you when you contact or instruct us; as part of our client acceptance, conflicts and due diligence processes; in the course of providing our services; and through your use of this website.
We may also receive information about you from our clients (where you are connected to a matter we are handling), from other parties involved in a matter, and from publicly available sources used to keep our records accurate.
3. How and why we use your personal information
We use personal information to: provide, administer and improve our services; carry out client acceptance, conflicts, anti-money laundering and other regulatory checks; manage our relationship with you and our clients; issue and collect invoices; comply with our legal, regulatory and professional obligations, including establishing, exercising or defending legal claims; operate, secure and improve this website; and, where you have not opted out, send you legal updates and information about our services.
4. The lawful bases on which we use your personal information
We rely on one or more of the following lawful bases: performance of a contract (for example, to provide services under our engagement); compliance with a legal or regulatory obligation (for example, our anti-money laundering, conflicts and record-keeping obligations); our legitimate interests (for example, administering and promoting our practice, and managing risk), balanced against your rights; and, where required, your consent, which you may withdraw at any time.
Where we process special category personal data, or data about criminal allegations or proceedings, we do so only where an additional condition under data protection law applies — for example, where processing is necessary for the establishment, exercise or defence of legal claims, or for reasons of substantial public interest, or with your explicit consent. 
5. How long we keep your personal information
We retain personal information in accordance with our data retention policy.
Closed matter files are ordinarily retained for a minimum of six years from closure, and in some cases longer where a legal, regulatory or professional requirement or the nature of the matter justifies it.
When information is no longer required, it is securely deleted or destroyed.
6. Who we share your personal information with
We may share your personal information, where necessary and subject to appropriate safeguards, with: barristers and other external counsel; local counsel on cross-border matters (instructed and paid by the client); our IT, practice management, secure cloud storage and other service providers; our accountants, bookkeepers, auditors, insurers, brokers and professional advisers; and regulators, courts, tribunals, government agencies and law enforcement where we are required or permitted to do so. We may also share information with solicitor consultants and specialist consultants engaged by the Firm under supervision and appropriate confidentiality and data-protection obligations.We do not sell or rent your personal information.
7. How we protect your personal information
We use appropriate technical and organisational measures to protect personal information against unauthorised access, use, disclosure, alteration or destruction. These include multi-factor authentication, encrypted storage and secure communications, proportionate to the nature of our work.8. International transfersMost of our processing takes place within the UK. Where a matter has an overseas element — in particular our cross-border employment coordination work — we may need to transfer personal information outside the UK, for example to local counsel or overseas advisers instructed on the matter. Where we do so, we assess the applicable international-transfer requirements and put in place appropriate safeguards, and we limit what is shared to what is necessary for the instruction. We obtain your client's authority before disclosing information to overseas advisers.
9. Your rights
Under data protection law you have rights in relation to your personal information, including the right to be informed about how it is used; to request access to it; to have inaccurate information corrected; and, in certain circumstances, to have it erased, to restrict or object to its processing, and to data portability. Some of these rights are qualified and may not apply where we are required or permitted by law to continue processing — for example, to meet our regulatory obligations or to establish, exercise or defend legal claims.If you have any concern about how we handle your personal information, please contact us (see below). You also have the right to complain to the ICO at www.ico.org.uk, although we would welcome the opportunity to address your concerns first.
10. Cookies and how to contact us
This website uses cookies. If cookies or analytics are used, insert a cookie description and, where required, a compliant cookie consent banner, and confirm the analytics tool(s) in use (e.g. [INSERT]). — Confirm actual cookie and analytics stack before go-live; do not state a tool that is not in use.]
For any question about this policy, or to exercise your rights, please contact us at hello@zioraadvisory.com. This policy will be reviewed at least annually.