Create secure customer journeys with connected document management, communications and eSignatures built for financial services.
This policy explains how Legado collects, uses and protects your personal information, and the rights you have under UK data protection law, the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
When reading this privacy policy, it helps to know that the law distinguishes between a data controller, which is an organisation that decides why and how your personal data is processed, and a data processor, which is an organisation that processes data on behalf of a controller.
Legado is the data controller of some of your personal information if you are:
Legado is the data processor of some of your personal information if you are:
When you use Legado’s application, the company providing the service to you (usually a company you have a product with or receive a service from) is the data controller of your personal information, so you should read their privacy policy first.
If you have any questions about this privacy policy, you are welcome to contact our Data Protection Officer using the details under How to contact us below. For more information about your data rights, the Information Commissioner’s Office provides clear guidance.
In this policy, “Legado”, “we”, “us” and “our” mean Legado Technologies Ltd.
We are an award-winning data and communication company selling software as a service, and you can learn more about our team and our values on our website. Privacy is one of our core business values and we take protecting your data very seriously, so if you have any concerns about how we use your data, please contact us using the details below.
Under UK data protection law, you have certain rights over how any company or organisation holds personally identifying information about you. Personally identifying information is any information that could identify you as an individual, directly or indirectly, for example your name, email address, National Insurance number or bank account details.
We have set out below the rights most relevant to your dealings with us. For more information, we recommend the impartial Information Commissioner’s Office.
You have the right to ask us for copies of your personal information. This right always applies, although some exemptions mean you may not always receive all the information we process. Read more about the right of access.
You have the right to ask us to correct information you think is inaccurate, such as your email address, and to complete information you think is incomplete. This right always applies. Read more about the right of rectification.
You have the right to ask us to erase your personal information in certain circumstances. Read more about the right of erasure.
You have the right to ask us to restrict the processing of your information in certain circumstances. Read more about the right to restriction.
If we process your personal information based on your consent, or to enter into or carry out a contract with you, and the processing is automated, you have the right to ask us to give that information to you, or to another service provider, in a machine-readable format. Read more about the right of data portability.
You have the right to object to us processing your personal data where we rely on legitimate interests as our lawful basis. If you object, we will weigh your request against our reasons for continuing to process your information. You have an absolute right to object to direct marketing, and you can opt out of our marketing at any time using the unsubscribe link in any email or through our contact page.
Exceptions apply to some of these rights and not every right applies in every situation, but we will always respond to a request about your rights within one month. If we cannot, we will tell you why. You do not have to pay to exercise your rights.
If you have questions or want to exercise any of these rights, please contact us using the details below.
If you have any questions about this privacy policy or want to exercise your rights, please contact us by email or by post. We look forward to hearing from you.
Data Protection Team
Wsm Advisors Connect House, 133-137 Alexandra Road, Wimbledon, London, United Kingdom, SW19 7JY
hello@joinlegado.com
Our Data Protection Officer is James Silk, who can be contacted at james.silk@joinlegado.com.
We act as a data controller, deciding why and how some of your personal information is collected, processed and stored, in the circumstances listed below. We use and hold all personal information in line with our privacy and security policies. Each group has its own policy with full details.
We collect usage data such as your IP address, length of visit and referral source. You may not be identifiable from this information alone, and we only use it to help us provide an effective service. Under UK GDPR, our lawful basis for processing this information is legitimate interest.
We collect personal information including, but not limited to, your name, address, date of birth, professional qualifications and pre-employment check results. We also collect sensitive information including, but not limited to, marital status, nationality and gender, to meet our legal obligations when hiring. This information can sometimes come from employment agencies or existing employees. Under UK GDPR, our lawful basis for processing this information is legitimate interest.
We collect information such as your name, company, position and relationship to the applicant, and we will ask for a phone number or email address to contact you as a voluntary referee during the application process. Confirming certain details of an applicant’s employment history, with their consent, is an essential part of our checks before offering a contract of employment. Under UK GDPR, our lawful basis for processing this information is legitimate interest.
We collect personally identifiable information and unique identifiers such as your National Insurance number, as well as sensitive and special category personal information as required by law. We use this information to administer your employment contract and for your career progression and wellbeing. Under UK GDPR, our lawful basis for processing this information is that it is necessary for your contract of employment and to meet our legal obligations as an employer.
One of our employees has given us your name and email address to refer you for a job with us. Under UK GDPR, our lawful basis for processing this information is legitimate interest.
We collect and process the information you choose to give us when you sign up for our newsletter, register for an event or webinar, or download content. Under UK GDPR, our lawful basis for processing this information is your consent, which you can withdraw at any time.
Most of the personal information we process as a data controller comes directly from you, but we also receive some information indirectly, as described above.
We do not sell personal information. We only share personal information we process as a data controller with the carefully selected suppliers who provide the systems we use, under written contracts, or where the law requires it.
For each category of personal data we hold as a data controller, we remove or destroy that data on request, or when we no longer need it for its original purpose.
Our customers are corporate and professional organisations that make our application available to you, their customer. The customer providing the Legado application to you is the data controller of your personal information, so you should read their privacy policy first.
Where you are a registered user of our application provided by one of our customers, we act as a data processor, processing your personal information on that customer’s behalf.
We collect account data such as your name and email address, which comes from you or from our customer providing the Legado service to you. We use it to operate our application, provide our services, maintain back-ups of our databases and communicate with you.
When we act as a processor, we process personal data in line with, and for the purposes of, the agreement we have with our customer. The types of personal data we process include:
We process this personal data in line with this privacy policy, our agreement with the customer and data protection law. We will not use your data for marketing, because the data controller has not instructed us to. All data stored by Legado is held on UK-based servers and backed up on servers located in the UK.
The terms that apply when you use the application are set out in our end user terms, and the terms for nominees given access to a vault are in our data subject terms.
Handling your personal information with respect and transparency is an essential part of protecting your privacy. At Legado, we work to exceed the minimum requirements of Cyber Essentials Plus, the UK government’s cyber security accreditation scheme. We are certified to the ISO/IEC 27001:2022 standard, and we use third-party services that provide ongoing analysis, reporting and monitoring of online activity at national level.
When you give us personally identifying information, we make sure the right cybersecurity and organisational controls are in place to protect it. These include:
We encrypt data using industry-standard algorithms at every verification step, so any data entered into our systems for verification is sent and received securely. Data is also encrypted at rest on our servers using AES-256 encryption.
All of our web traffic is encrypted over TLS and protected by certificate pinning to prevent man-in-the-middle attacks. Our security team runs daily automated vulnerability scans across all of our systems and infrastructure.
We use a number of carefully selected third parties to help provide our services to you, and we expect them to meet the same security requirements we set ourselves.
When we use a third party (a data processor) to process personal data, we put a written contract and data processing agreement in place to make sure they meet their obligations under data protection law.
If law enforcement asks us to share sensitive information, we will do so in line with our obligations under UK law.
Legado has a set of security policies for our team and partners. More information about these policies is available on request.
We want to make sure all personal information we hold is accurate and up to date. If your details change, please let us know using the contact details above.
As our business changes and grows, we may update this privacy policy to reflect our current practices. Please check this page from time to time to see any changes.
Please send any complaint to the Legado Data Protection Team using the contact details above, and we will work to resolve any question or concern about how we use your information within a reasonable time.
If we are unable to resolve your complaint, you can contact the Information Commissioner’s Office or call them on 0303 123 1113.