Privacy Policy

1. Introduction

Witness Connect® respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share personal data when you use our website and platform. We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other relevant laws. By using Witness Connect, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller

Witness Connect is the Data Controller for personal data processed via the platform. For certain activities (such as expert reports), Witness Connect may act as a Data Processor on behalf of solicitors who remain the Data Controller.

3. Data We Collect

We may collect and process the following categories of data:

• Experts: name, contact details, CV, qualifications, professional registrations, insurance, payment details, uploaded documents, communications.
• Solicitors: name, contact details, firm details, SRA number (if applicable), payment details, uploaded case documents, communications.
• Website enquiries: name, contact details, company, and the details you give us when you contact us, request a demo or apply to join.
• Usage data: how you use our website and platform, such as pages visited and searches made, collected through cookies (see our Cookie Policy) and our own pseudonymised platform records.
• Special Category Data: case materials may include medical, psychological, or other sensitive personal data. This is processed strictly for the purpose of expert instruction and reporting.

4. How We Use Personal Data

We process data for the following purposes:

• Facilitating connections between solicitors and experts.
• Verifying expert credentials and compliance.
• Managing secure communications and case document exchange.
• Managing payments via our third-party payment provider.
• Compliance with legal and regulatory obligations.
• Improving the website, platform and user experience.
• Measuring how well our advertising works, where you have consented to advertising cookies.

5. Lawful Bases for Processing

We rely on the following lawful bases under UK GDPR:

• Contract: processing necessary to perform our contract with you.
• Legal Obligation: compliance with laws and regulations.
• Legitimate Interests: operating and improving the website and platform in a balanced and proportionate way.
• Consent: required for processing special category data where instructed by solicitors, and for non-essential cookies and marketing communications.

6. Sharing of Data

We may share personal data with:

• Solicitors and experts engaged in cases via the platform.
• Third-party payment providers (escrow services).
• IT, security, and hosting providers.
• Analytics and advertising providers (Google and LinkedIn), where you have consented to analytics or advertising cookies.
• Regulators or law enforcement where legally required.

We do not sell personal data to third parties.

7. International Transfers

If personal data is transferred outside the UK, we ensure safeguards such as Standard Contractual Clauses or adequacy decisions are in place.

8. Data Retention

• Expert and solicitor account data: retained for as long as the account is active.
• Case documents: retained in line with legal and contractual obligations, then securely deleted.
• Financial and transaction records: retained for a minimum of six years in line with HMRC requirements.
• Website enquiries and demo requests: deleted 24 months after our last contact with you, unless you become a customer, in which case they form part of your account data.
• Applications to join as an expert that are not accepted: deleted after 12 months.
• Platform usage records: pseudonymised and deleted after 90 days.
• Google Analytics data (where you have consented to analytics cookies): detailed activity is deleted after 2 months; data linked to your analytics identifier is deleted 14 months after your last visit.

9. Data Security

• End-to-end encryption for documents and communications.
• Role-based access controls.
• Regular penetration testing and monitoring.
• Secure cloud storage with offsite backups.

10. Your Rights

Under UK GDPR you have the following rights:

• Right of access to your data.
• Right to rectification of inaccurate data.
• Right to erasure (subject to legal obligations).
• Right to restrict processing.
• Right to data portability.
• Right to object to processing.
• Right to withdraw consent at any time, where we rely on consent.
• Right to lodge a complaint with the ICO.

Requests to exercise your rights can be made by contacting Witness Connect at support@witnessconnect.co.uk.

If you have a concern or wish to complain about our use of your personal data, please contact us at support@witnessconnect.co.uk. We aim to acknowledge all complaints within 30 days and respond without undue delay.

11. Cookies

We use cookies and similar technologies on our website and platform. Please see our Cookie Policy at www.witnessconnect.co.uk/articles/cookies for details.

12. Updates to this Policy

We may update this Privacy Policy from time to time. Significant changes will be notified to users via email or platform notifications.