GDPR Privacy Policy

This policy sets out how SOS obtains, maintains, stores, uses and destroys data collected from the client.

SOS has an obligation to ensure all its practices and procedures are safe and compliant and to protect client data.

SOS may hold data for finance and invoicing purposes or for the purpose of providing support services or migration services.

SOS may also need to access the client’s system for the purpose of providing support services.

SOS complies with current Data Protection Legislation when obtaining, maintaining, storing, using, processing and destroying client data.

Definitions

SOS shall mean SOS Legal, First Floor, Trimbridge House, Trim Street, Bath BA1 1HB.

GDPR means the legal framework for the collection and processing of personal information of individuals known as the General Data Protection Regulations.

Data Protection legislation shall mean all applicable Data Protection and Privacy legislation in force from time to time in the UK including but not restricted to the Data Protection Act 2018.

The client shall mean any client with a current contract with SOS.

The system shall mean SOS software being used by the client, either on an on premis server or in the client’s hosted environment.

Support Services shall mean the investigation and resolution of issues with the system.

The contract shall mean the contract entered into by SOS and the client.

Confidential Information shall mean any information relating to the client’s firm or data held by them.

General

SOS hereby undertakes to keep confidential any and all information concerning the client or the client’s business obtained or received as a part of its day-to-day business with the client.

SOS hereby undertakes to notify the client without delay on becoming aware of any breach of data security, examples of which may include:

Access by an unauthorised third party
Deliberate or accidental action or inaction by a data controller or data processor
Sending personal data to an incorrect recipient
Computing devices containing personal data being lost or stolen
Any alteration of personal data without permission
Loss of availability of personal data

SOS records all personal data breaches regardless of whether they are notifiable or not as part of its general accountability requirement under the Data Protection Act 2018.

By providing data the client acknowledges and agrees to that data being processed in accordance with this policy.

We, from time to time, update this policy for operational or regulatory changes. The up-to-date policy is available on our website. We encourage you to review this policy regularly for any changes.

Data held for Finance Purposes

Data held for finance and administrative purposes may include, but not be limited to, Firm Name and Address, Contact Name and Email Address of key contacts. This data is held in a secure accounts system and access is limited to only those trusted employees who need access in the course of their work.

Contacts are held in a secure Dropbox location, access to this is restricted to only those trusted employees who need access in the course of their work.

Data held for Support Purposes

Data held for Ticket logging

Data held for support purposes may include, but not be limited to, Firm Name and Address, Contact Name, Email Address and contact phone number of the person requested the Support services. This is held in a secure ticketing system and access is limited to only those trusted employees who need access in the course of their work.

Data held for Resolution of Support Issues

It may be necessary from time to time to take a partial extract from the database of a specific matter in a redacted format or to take an unredacted copy of a clients database and keep this in house for the purpose of providing support services.

This will be held either on a secure server on our private network or in our secure hosted environment. Access to both is restricted to only those trusted employees who need access to work on the support issue.

SOS will not retain a copy database for longer than is necessary for the resolution of the support issue.

Accessing the client’s system

SOS may need to access the client’s system for the purpose of providing support services.

Confidentiality

When accessing the client’s system SOS will comply with all Data Protection legislation in place in the UK at the time.

SOS will not pass any Confidential Information of the client to any third party.

SOS will restrict access to client’s databases to trusted employees who will abide by the terms of this agreement.

SOS will only access such information as is necessary for the resolution of the support ticket.

When connecting to your system SOS uses a secure system. This software requires the client to initiate the connection and uninstalls on disconnection. No connection software is left on the client’s system and no connection is possible without the client’s express permission.

Exemptions

The above undertakings shall not apply to confidential information which SOS is required to disclose:

By Law
By any Court Procedure
By any rule or regulation of any government authority

Data held for Migration Purposes

It may be necessary to hold a copy of the client’s data to carry out migration services.

SOS will not retain a copy database for longer than is necessary for the migration to take place and be delivered back to and accepted by the client.

Deletion of Data

SOS will at the written direction of the client delete any databases held.

SOS will not store data in an identifiable form for any longer than is permitted by applicable laws and only while we have a legitimate reason to do so.

Website & Community Learning

Use of Cookies

Only minimal basic cookies are used on the website and Community Learning website.

Users are given control over which types of cookies they consent to (e.g., essential vs. non-essential) from the cookie consent banner, so they do not need to opt in to the marketing cookies and analytics.

Users can turn these off if they wish to do so.

Secure Transmission of cookie data

Cookie data is transmitted over secure HTTPS connections to prevent interception.

Encryption of Cookies

Cookies are encrypted during storage to prevent unauthorized access and administrator access control to the site is limited to certain admin users only.

Limited Retention

Cookie data is only stored for as long as necessary, and session data is removed when not required for logins.

Other Data

No other personal data is collected and stored unless the user specifically agrees by completing a registration form.

Version	Date	Author	Changes Made
V1.0	24/03/2025	Steph Brammer
V2.0	28/5/2025	Steph Brammer	Branding & addition of online section
V3.0	17/12/2025	Steph Brammer	Change of Address