Last updated: 5 March 2024

1. Your Privacy

Your privacy is important to Smokeball, and we are committed to protecting your personal data. This Privacy Notice provides you with information about how we collect, use, disclose, and otherwise process personal data collected in connection with your use of our websites, mobile applications, software solutions and other Smokeball (including FamilyProperty) services (collectively, the “Services”).

In this Privacy Notice, unless otherwise specified:

• 'Smokeball', 'we', 'our', 'us', and any similar terms refers to:
  • if you are accessing or using Smokeball Services in the UK, or accessing Smokeball UK's websites, Smokeball UK Limited; and
  • if you are accessing or using Smokeball Services in Australia, or accessing Smokeball Australia or Family Property websites, Smokeball Australia Pty Limited.
• the 'Smokeball Group' refers to Smokeball UK Limited, Smokeball Australia Pty Ltd, and Smokeball Inc, as well as any of their parent or subsidiary companies (or companies controlled by the same parent) from time to time.

2. What data does Smokeball collect?

2.1 General categories of personal data

'Personal data' means any information about an identified or identifiable person.  In general, we collect and process the following types of personal data (although the specific types of data that we collect and process about you will depend on how you interact with us and our Services, as explained in section 3 below):

• Contact Data such as your first name, last name, email address, phone number(s), billing address, and business address.
• Employment Data such as your job title, employment status, employer organisation, and professional qualifications held.
• Public and Third Party Data such as information you make public on your social media profiles (e.g. LinkedIn), which is publicly available from third-party websites (e.g. your firm's or chamber's websites), or which is provided to us by third party (e.g. referrers).
• Transaction History Data such as information about any payments you have made to us, refunds we have paid to you, credits, adjustments, or discounts that you are entitled to or that we have applied, details of any Services you have purchased from us, and your Service renewals and cancellations.
• Financing Data such as the identity and details of your financier, and details of any financing or credit arrangements you have entered into in relation to the payment of our fees.
• Technical Data such as your device type used to access our Service (e.g. mobile or desktop), your device’s operating system (e.g. iOS, Windows, or Android), application software, browser type and settings (e.g. language, time zone, location), Internet Protocol (IP) address, MAC address, and access times.
• Communications Data such information you provide to us when you communicate with us by e-mail, telephone, at in-person events, conferences, and seminars, by mail, through our social media channels, when you respond to surveys, when you provide us with feedback or ideas for our Services, and when you leave reviews or testimonials about us or our Services.
• Support Data such as information you provide to us when you make a request for support in relation to our Services, and information we can see from your screen or account if we need to provide remote support using a 'share-screen' feature, or if we need to access your account remotely. We will only use this information for providing support in relation to our Services.
• Marketing Data such as your preferences for receiving marketing from us and the Smokeball Group, marketing lists you are part of, topics you are interested in receiving marketing communications about, and your communication preferences.
• User Data as described in section 2 below.
• Client Data as described in section 3 below.

2.2 User Data

If you are an individual end user of our Services (for example, a sole practitioner, a barrister, or an employee or partner of a law firm that uses our Services), then we collect, store, and otherwise process information about you that you provide, upload to, input, or generate from your use of our Services.  Depending on the Services you use, this may include information about your work emails, calendar, meetings and appointments, time recordings, invoices, memos, work-related documents, interactions with other colleagues and counterparties through our Services, and account passwords. We may also collect or infer certain information from your use of our Services, such as the particular Services you access, features you use, time of access, login attempts, duration of each usage session, where you access our Services from, and your Service settings, preferences, and usage habits.

2.3 Client Data

If you are a client of one of our customers (for example, a client receiving legal services from a law firm that is using our Services), then we may collect, store, and otherwise process information about you and your legal matter, which our customers upload or import to, or generate from, our Services.  This may include documents and e-mails exchanged between you and our customer, documents uploaded, imported, or generated by our customers in relation to your legal matter, invoices generated by our customer in relation to your legal matter and work they have performed for you, and your contact information.  This data may include 'special category data' as described in section 2.4 below.

Our Services may also give customers the ability to grant limited access to certain parts of the Services (including data stored on those Services, such as Client Data) to third parties.  This will allow those third parties to access certain Client Data that our customers choose to share through the Services.  Some examples of how our customers may use this feature to share Client Data with third parties include:

• a customer may set up a virtual data room through our Service as part of a corporate acquisition, to share certain Client Data with the purchasing party and their professional advisors for the purposes of conducting due diligence;
• a customer may create a shared space to share Client Data relating to legal proceedings with an external barrister; or
• a customer may create a shared space to enable sharing of Client Data with relevant third parties in the context of a conveyancing transaction.

We collect, share, and otherwise process Client Data as a data processor on behalf of our customers (i.e. law firms, barristers, and other legal professionals that use our Services).  This means that in the vast majority of cases, the customer is the controller of this data and will determine how your Client Data is processed and who it is shared with.  If you have any questions about our processing of Client Data, you should first speak with the law firm or legal professional that you are a client of, and that has provided us the Client Data for processing.

We only collect and process Client Data as required to provide our Services to our customers, or where required to comply with applicable law. We do not access or share Client Data stored on our servers except in the following circumstances:

• where Client Data may be made temporarily visible to us when providing technical support or training to our customers, or when we are responding to a customer's questions;
• where we are required or compelled by law (including by court order of subpoena) or a direction of a government or law enforcement authority to share Client Data with another party (and in such cases, we may act as the controller of the data); or
• where our customer has authorised the Client Data to be shared with a third party.

2.4 Special Category Data

'Special category data' means:

• data about your racial or ethnic origin, political opinions, sexual practices or orientation, religious or philosophical beliefs, trade union membership, criminal history, or physical or mental health;
• your genetic or biometric data; and
• any other specific categories of data that are subject to more onerous requirements under applicable data protection laws from time to time.

We do not proactively seek to collect or process special category data.  However, we may store, share, and otherwise process sensitive category data to the extent that this data is Client Data, as described in section 2.2 above.  We describe the purposes for which we process Client Data (including where this contains special category data) in sections 2.2 above and 4 below.

2.5 Aggregated Data

We also collect and process high-level statistical and/or demographical data about how our customers interact with our Services (for example, how customers of a certain size or type like to use our Services).  This data relates only to our customers, and cannot be used to directly or indirectly identify a specific individual user of our Services.  As such, this data is not considered personal data and may not be subject to the same safeguards as described in this Privacy Notice.

We use this aggregated data to better understand our customers, what features they use the most, to identify opportunities to improve our Services, and to determine what marketing content, guides, and publications will be of most value to our customers.

3. How we collect your personal data

The ways in which we collect personal data, and the types of personal data that we collect each way, is set out in the table below.

3.1 Information you provide to us

We collect personal data you provide when you use our Services from one or more devices associated with you, or that you provide in any other way, including over the phone, by email, or on paper.  The table below sets out some of the ways you may provide personal data to us, and the types of personal data we collect in these ways.

3.2 Information we receive from other sources

We may collect personal data about you from third party sources, such as information that is publicly available on your social media profiles or third-party websites (such as your firm website), or where we receive personal data about you from a third party referrer participating in our referral program. The table below summarises some of the different third party sources we may use to collect your personal data, and the types of personal data we collect from these sources.

3.3 Information that we automatically collect

When you visit our websites or blogs, open or click on any links in our marketing communications, or use our Services, we may automatically collect information about your visit, including pages you access, links you click and actions you take through the use of essential and non-essential cookies, web beacons, pixel tags and other tracking technologies (collectively, “cookies”). We may also collect Technical Data from your device and web browser.  If you are in the UK and would like more information about our use of cookies, please see our UK cookie policy at https://www.smokeball.co.uk/cookies.

4. How do we use and disclose your personal data?

We use and disclose the personal data that we collect only for the purposes described in this Privacy Notice or for purposes that we explain to you at the time of collection. Depending on our purpose for collecting your personal data, we rely on one or more of the following legal bases:

• Performance of a contract: we require certain personal data in order to provide the Services you purchase or request from us, and which we have agreed to provide, under a contract.
• Consent: in certain circumstances, we may ask for your consent (separately from any contract between us) before we collect, use, or disclose your personal data, in which case you can voluntarily choose to give or deny your consent without any negative consequences to you.
• Compliance with our legal obligations: there may be instances where we must collect, store, process, or disclose your personal data to comply with our legal obligations.
• Legitimate interests: we may use or disclose your personal data for our legitimate business interests. Where we need to process your data to pursue our legitimate interests, it will be in a way which is reasonable for you to expect as part of the running of our business and which does not materially affect your rights and freedoms.           

The table below provides more detail on the purposes for which we may process your personal data, the types of personal data we process for that purpose, and the legal basis (or bases) upon which we rely to so process your personal data.

5. Who do we share your personal data with?

We may share your personal data with the following categories of recipients:

• Other members of the Smokeball Group, who provide data processing services necessary to provide you with our Services (for example, to support the delivery of, provide functionality on, or help to enhance the security of our website and online services), or who otherwise process personal data for purposes described in this Privacy Notice.
• Third party payment processors, who we use to process payments when you purchase a subscription to our Services. The third party processor will need to collect and process your payment data (such as your payment card or bank account details) to process your payments.  We do not collect or process this data ourselves.
• Other third party service providers and partners who provide data processing services to us as necessary to provide you with our Services (for example, to support the delivery of, provide functionality on, or help to enhance the security of our website and online Services), or who otherwise process personal data for purposes described in this Privacy Notice. We may also share personal data with providers of third party services that interface with or are integrated with our Services, if you request to use those third party services.  Some of the third party services we use include:  ChurnZero, Salesforce, Zendesk, Pardot, Jira/Confluence, and Outreach.
• Third party services and business partners when you use third party and partner services linked through our website or online Services (for example, third party payment services) your personal data will be collected by the provider of such services. Please note that when you use third party services, their own terms and privacy notices will govern your use of their services.
• Third party financiers when you contact us about financing arrangements for our Services. We may share some of your personal data with third party financiers to enable them to enter into a financing arrangement with you.  We do not collect, store, or share any financial data about you ourselves. 
• Third parties who our customers share Client Data with through the Services. As described in section 3 above, our Services allow Customers to create shared spaces where they can share certain Client Data with third parties. These third parties may include, for example, barristers, counterparties in a corporate transaction, or real estate agencies in a conveyancing transaction.  We share Client Data with these third parties as processor on behalf of our customers, who as controller determine what Client Data is shared and who it is shared with.  If you are a client of one of our customers and would like to know more about who your Client Data is shared with, you should speak with the customer in the first instance.
• Any competent law enforcement body, regulatory, government agency, court or other third party (such as our professional advisers) where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person.
• A buyer (and its agents and advisers) in connection with any actual or proposed purchase, merger or acquisition of any part of our business, provided that we inform the buyer it must use your personal data only for the purposes disclosed in this Privacy Notice.
• Any other person with your consent to the disclosure (obtained separately from any contract between us).

6. How do we keep your personal data secure?

Our information security risk management framework is aligned with ISO27001 employing multiple layers of reasonable security controls to protect our platforms.

A risk-based approach is utilised and industry-accepted controls from ISO and NIST are referred to ensure appropriate defence measures are implemented including:

• Access management,
• Continuous malware monitoring,
• Encryption utilising a minimum of TLS1.2 for data in transit and at rest,
• Patch and vulnerability management and
• System resiliency/recovery.

Where you have an account with us that uses a unique password to enable you to access our Services, it is your responsibility to keep this password secure and confidential.

7. International data transfers

Where we transfer your personal data to other Smokeball Group members, or to other third parties as outlined in section 5 above, your data may be processed in countries other than the country in which you are resident.  These countries may have data protection laws that are different to the laws of your country (and, in some cases, may not be as protective).

Our servers and the Smokeball Group companies are located in the United Kingdom, the United States, and Australia. Our third party service providers and business partners operate in the United Kingdom, the United States, and Australia.  This means that when we collect your personal data, it may be processed in any of these countries.

If we transfer your personal data to countries and territories outside of the UK, which have been formally recognised as providing an adequate level of protection for personal data, we rely on the relevant “adequacy decisions” from the European Commission (and equivalent decisions of the Secretary of State in the UK).

Where the country or territory is not subject to an adequacy decision or regulations (such as Australia), we have taken appropriate safeguards to ensure that your personal data will remain protected in accordance with this Privacy Notice and applicable laws. For transfers of personal data from the UK to non-adequate countries, we will ensure the overseas recipient is bound by the International Data Transfer Agreement ("IDTA") issued by the UK Secretary of State under Section 119A of the Data Protection Act 2018, as approved and effective from 21 March 2022.

8. Data retention

We retain the personal data we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements).

In certain circumstances, we will need to keep your personal data for legal reasons after your subscription to our Services has ended.  The specific retention periods depend on the nature of the personal data and why it is collected and processed and the nature of the legal requirement.

When we have no ongoing legitimate business need or legal reason to process your personal data, we will either delete or anonymise it. If this is not possible (for example, because your personal data has been stored in backup archives), then we will securely store your personal data and isolate it from any further processing until deletion is possible.

9. Data subject rights

You have the following data protection rights.  To exercise any of these rights, you should contact us using the contact details provided in section 13 below.

• You may access, correct, update or request deletion of your personal data as set out in section 10
• If you are an individual in the UK only, you can object to processing of your personal data, ask us to restrict processing of your personal data, or request portability of your personal data (i.e. your data to be transferred in a readable and standardised format).
• You have the right to opt-out of marketing communications we send you at any time. You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing e-mails we send you.  To opt-out of other forms of marketing (such as postal marketing or telemarketing), please contact us using the contact details provided in section 13 If you choose to opt out of marketing communications, we may still send you non-promotional administrative emails, such as emails about your current subscription and Service alerts.
• If we have collected and processed your personal data with your consent, then you can withdraw your consent at any time by using the contact details provided in section 13 Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal data conducted in reliance on lawful processing grounds other than consent. 
• You have the right to complain to a supervisory authority about our collection and use of your personal data (see section 11 below).

We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.

10. How to access and correct your personal data?

You may ask to access any personal data that we hold about you at any time by contacting us using the details set out in section 13.

If you believe that any personal data that we hold about you is incorrect, incomplete or inaccurate, then you may ask that we correct that data. We will consider your request for correction, and if we do decide not to make the correction, then you can ask that we add a note to the personal data that we hold stating that you disagree with it.

We will try to provide you with suitable means of accessing the personal data (for example, by posting or emailing it to you), and may charge you a reasonable fee to cover our administrative and other reasonable costs in providing the data to you. We will not charge you for simply making the request and will not charge for us making any corrections to your personal data.

There may be instances where we cannot grant you access to the personal data we hold. For example, we may need to refuse access if granting access would interfere with the privacy of others or if it would result in a breach of confidentiality or legal professional privilege. If that happens, we will provide you with written reasons for our decision.

11. How to make a complaint?

If you believe that your privacy has been breached, please contact us using the details set out in section 13 and provide us with details of your concerns so that we can investigate the matter further. We will treat your complaint confidentially, and will try to investigate and resolve your complaint within a reasonable period of time.

You may also lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office; in Australia with the Office of Australian Information Commissioner, by calling 1300 363 992 or sending an email to enquiries@oaic.gov.au).

More information about your rights and our obligations in relation to privacy, and information on making a privacy complaint are your local supervisory authority (in the UK, the Information Commissioner's Office; in Australia the Office of the Australian Information Commissioner, which can be contacted at www.oaic.gov.au, or by post to GPO Box 5218 Sydney NSW 2001, or by email to enquiries@oaic.gov.au).

12. Updates to this Privacy Notice

We may update this Privacy Notice from time to time in response to changing legal, regulatory, technical, or business developments.  When we update our Privacy Notice, we will act appropriately to inform you, consistent with the significance of the changes we make.  We will obtain your consent to any material Privacy Notice changes if, and where, required by applicable data protection laws.

You can see when this Privacy Notice was last updated by checking the “last updated” date displayed at the top of this Privacy Notice.

13. How to contact us

If you have any questions or concerns about how we use of your personal data, how long we retain your personal data, or the steps we take to protect your personal data, please send us an email at infosec@smokeball.com.