Privacy notice
Who we are
Hawthorne Partners is a trading name of Flowbridge Partners Limited, a company registered in England and Wales (company number 17205026), registered office 9 Regent Road, Crosby, Liverpool L23 5RL. We are the controller of the personal data described in this notice and are registered with the Information Commissioner's Office (registration number ZC144323).
Contact us about this notice or your data at the email address shown on our website, by phone on 01908 103 072, or by post to 9 Regent Road, Crosby, Liverpool L23 5RL.
Hawthorne Partners is not a firm of solicitors. Reserved legal activities on our matters are carried out by SRA-authorised firms and by counsel regulated by the Bar Standards Board. Those firms and counsel are separate controllers of the data they hold and have their own privacy notices.
Whose data we process
- Clients and referrers: companies, lenders, investors, creditors, insolvency practitioners and regulated firms who refer or instruct us, and their staff.
- People involved in a matter: suspects, witnesses, employees, directors, account holders and other people named in the documents and evidence we are given or collect.
- Professional contacts: solicitors, counsel, experts, investigators and agency staff we work with.
- Website visitors: limited technical data, described below.
What data we process
- Identity and contact details.
- Financial and transaction data, such as bank records, ledgers, payment and cryptoasset transaction records.
- Employment, directorship and company records.
- Correspondence, witness statements, interview records and documents supplied to us.
- Digital evidence, including data recovered from devices and accounts where lawfully obtained.
- Information about alleged criminal offences, including allegations, suspicions and evidence of fraud or other offences.
- Occasionally, special category data (for example health information) where it appears in evidence or is relevant to a matter.
Where it comes from
From our clients and referrers, from the people concerned, from witnesses, and from public sources such as Companies House, the Insolvency Service, court records, land registries and open-source research. Some also comes from forensic analysis of material lawfully provided to us, and from other professionals working on the matter.
Why we use it and our lawful basis
| Purpose | Lawful basis (UK GDPR Art 6) |
|---|---|
| Assessing referrals and taking on instructions | Taking steps at your request before a contract (6(1)(b)); legitimate interests (6(1)(f)) |
| Investigating suspected fraud and preparing evidence and case files for private prosecutions, civil recovery and referrals to agencies | Legitimate interests of our clients and of us in investigating fraud, establishing and enforcing legal rights and bringing offenders to justice (6(1)(f)) |
| Complying with disclosure and other duties in criminal and civil proceedings, and with our own legal obligations | Legal obligation (6(1)(c)) |
| Running our business, record keeping and dealing with professional contacts | Legitimate interests (6(1)(f)) |
Criminal offence data (UK GDPR Art 10) is processed under the Data Protection Act 2018, Schedule 1: paragraph 33 (legal claims: processing necessary in connection with legal proceedings, including prospective proceedings, obtaining legal advice, or establishing, exercising or defending legal rights) and paragraph 10 (preventing or detecting unlawful acts). We keep an appropriate policy document where the law requires one.
Special category data is processed only where necessary to establish, exercise or defend legal claims (UK GDPR Art 9(2)(f)).
Where we rely on legitimate interests, we have balanced those interests against the rights of the individuals concerned. The public interest in fraud being investigated and prosecuted weighs heavily in that balance.
Who we share it with
- SRA-authorised solicitor firms who conduct proceedings on our matters, and the counsel they instruct.
- Forensic accountants, digital forensic specialists, experts and investigators working with us.
- Courts and tribunals, and defendants and their representatives where disclosure obligations require it.
- Law enforcement and regulators, including the police, the Serious Fraud Office, the Financial Conduct Authority, HM Revenue & Customs, the National Crime Agency and the Insolvency Service, where we make or support a referral or are legally required to.
- Our clients, and where relevant their insurers, auditors and insolvency practitioners.
- IT, hosting, email and document storage providers acting on our instructions.
We do not sell personal data or use it for marketing to the people named in our matters.
International transfers
We generally hold data in the UK. Where a matter involves tracing assets abroad or overseas service providers, data may be transferred outside the UK. Where that happens we use a lawful transfer mechanism, such as UK adequacy regulations or the International Data Transfer Agreement, or rely on the exception for legal claims.
How long we keep it
We keep matter files for six years after a matter closes. Where proceedings, confiscation orders, appeals or enforcement continue, we keep them until those end plus six years. Referral enquiries that do not become instructions are deleted within 12 months. Records we must keep by law are kept for as long as the law requires.
Your rights
You have rights to access your personal data, and to ask us to correct it, erase it, restrict its use, or transfer it. You can also object to our use of it. You can make a request using the contact details above, and we will respond within one month.
These rights are not absolute. The Data Protection Act 2018 (Schedule 2) contains exemptions, including where giving information or complying with a request would be likely to prejudice the prevention or detection of crime or the apprehension or prosecution of offenders, or where information is needed for legal proceedings or is legally privileged. We apply these exemptions case by case. For the same reasons, we may not notify people who are the subject of an investigation that we hold their data.
Website
Our website does not use cookies, analytics or tracking. When you visit it, our hosting provider and the content-delivery network that serves the site's code receive your IP address and basic browser information, which they need to deliver the page. We use this only to operate and secure the site.
Complaints
If you are unhappy with how we have handled your data, please contact us first. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes
We may update this notice from time to time.