A. Who We Are And About This Policy
This is the privacy policy of Bequeathed Limited (company number 10960116) whose registered office is at Acre House, 11/15 William Road, London NW1 3ER. In this policy we refer to ourselves as ‘we’ and to users of this website as ‘you’ (and related expressions must be interpreted accordingly).
Our business consists of the operation of a free charity will-writing scheme for the benefit of charities, legal firms and other organisations to which we provide services. We set out below important information about our processing of personal data by reference to the purposes for which we do so in the context of our business.
We have published this policy with the view of engendering your trust in our processes, so that you understand what we do and why, and in order that, if you wish to challenge them, you have information about your rights and how you can contact us.
The purposes are as follows:
Conduct our will-writing scheme and maintaining a database of Wills
Keeping records and accounts
Recording of in-coming and out-going telephone and video calls
Operating our business
Our website and use of cookies and tracking technologies
We have included sections dedicated to describing your rights, our contact information generally, and how you can make a complaint.
Except where stated, this policy does not relate to our storage of personal data relating to your circumstances and wishes that you upload to Bequeathed while using our online will interview, keeping a copy of the draft Will the system creates from your answers, or keeping a record of your questions and answers. We perform those tasks on your behalf as a processor under the Processor Terms.
We have adopted our Processor Terms and made them binding upon us for the benefit of certain of our users in the form of a deed. A reproduction of the terms of the deed can be found here. If you would like to see a copy of the deed itself, please contact us at [email protected]. We make a charge of £50 to provide a copy.
Although you are not a party to the deed, if you are a registered consumer or professional end user who uses the online Will interview via the Website to draft a Will we are liable to you if we breach the terms set out in the deed.
B. The Legal Basis On Which We Process Personal Data
We believe that helping people to make a Will is a good thing to do. The systems required to do so are complex and to make them available to you free of charge we rely on fees from other sources. Therefore, we have a legitimate interest in processing personal data in accordance with our scheme.
We also have a legitimate interest to keep all records relating to our business for our internal purposes and to deal with queries or complaints which may arise.
The legal basis on which we deal with people other than you depends on the circumstances. In all cases we make sure that we have a legitimate reason to do so in connection with our business.
C. When We Collect Information From You
We will obtain personal information about you when you register on our Website to use our will-drafting services and before you register if you request help with us through our Intercom chat and messaging service. See our cookie policy in relation to cookies and tracking technologies.
We communicate and deal with all manner of people in the ordinary course of our business, whether suppliers, competent authorities, and others incidentally in connection with our business. While doing so, having regard to the nature and purpose of those dealings, we will obtain and process personal data.
D. Using And Disclosing The Information You Provide
Unless you have told us otherwise, we will use your information:
to communicate with you during the instruction-taking process;
if you choose to order legal services including drafting your Will from us under a separate Client Care Letter, to advise you and to draft your Will;
if you purchase our Print, Post & Store subscription service, to contact you about maintaining the currency of your Will and estate planning;
if you opt in, to keep you up to date with our products and services related to keeping your Will up to date and estate planning;
to identify when your Will may be affected by a change in the law;
in anonymised form, to inform charities as to our user-base and legacy-giving;
subject to your express permission, we will inform the relevant charity if you have included a legacy-gift in your Will and provide the charity with your contact details for the purpose of it getting in touch with you to say thank you and to request permission to keep in touch with you;
where you have arrived at our Website via a link on the website of one of our customers, to mark you as contact of that customer so that we may tailor our communications to you accordingly;
if you choose to ask us to introduce you to a legal firm so that it may advise you and draft your Will, with your contact details so it may contact you to arrange your appointment;
to administer your user account;
to provide contextual online support to you during your use of the system or tools;
to process any request for advice or information;
to customise the Website;
to ensure that any content you post complies with the terms and conditions of use of the Website;
to ensure that content from our site is presented in the most effective manner for you and for your computer;
to allow you to participate in interactive features of our service, when you choose to do so;
to notify you about changes to our service; and
to analyse how our Website is used and share anonymous information relating to that use with third parties.
We will retain your information for as long as we operate our will-writing scheme, and afterwards for the purposes of our Keeping Records and Accounts (see below).
We do not use or disclose data we obtain from anyone else for any purpose in the course of our business other than for which it was given to us.
If we sell or buy any business or assets we may disclose your information to the buyer or seller of the business or the assets. If we or substantially all of our business or assets are acquired by a third party, your information is likely to be included in the transfer.
We have implemented the Google Analytics Demographics and Interest Reporting feature which provides us with aggregated information about the age and gender of our users, along with the interests they express through their online activities. Details of how we use Google Analytics cookies are contained in our Cookies Policy.
You can opt out of the Google Analytics Demographics and Interest Reporting feature by changing your Google Ads settings on the Google website via this link. Alternatively, Google Analytics provides an opt-out add-on for certain internet browsers which you can get by visiting this link.
E. Collection Of Your Information
The information about you that we use and disclose is collected through your use of this Website and information we learn from your use of the Website, or through your use of our other services.
The information we collect (excluding the information you upload to Bequeathed while using our online will interview which is addressed in the Processor Terms) is:
how you arrived at our Website;
your name, email address, postcode;
the pages you have visited on our website;
any information you choose to provide us with in online chat.
We will never collect information about you concerning your religion, beliefs, criminal record, health or sexuality without your explicit consent.
F. Cookies And Tracking Technologies
Our Website sets cookies on your device, and may read cookies already on your device, regarding your use of our Website and services. Please see our cookies policy for further details regarding the collection and use of this information.
We also place Facebook Pixels from some of our charity customers on our site so they may track the actions of users who visit our site having responded to the charity's advertising.
G. Keeping Records And Accounts
We keep personal data (including data subject to our Processor Terms) only where and for so long as it is necessary to provide our products and services and afterwards for so long as necessary to meet our legal or regulatory obligations or, if longer, in relation to claims which could be made against us. Our normal practice is to keep information for at least 6 years.
H. Operating Our Business
This section is concerned with the systems we use to process personal data and our processing of personal data for internal purposes (including, in respect of Amazon Web Services only, the personal data you upload in your use of our online Will interview which is addressed in the Processor Terms).
It is not concerned with the nature of the data, the classes of individual on whom we process data, the classes of the data, the sources and disclosures of the data, nor the period of time which we hold data. For information on those topics, please consult the other sections of this policy.
We process personal data using the following principal systems: Amazon Web Services, Intercom, Coview, Slack, GetAccept, Calendly, Zoom, Xero, PayPal and GoCardless, some of which we make work together using Zapier.
AWS
Our web application and data (i.e. data from the will-writing process) are hosted within AWS, in UK datacentres.
So AWS policies and processes are our policies and processes for our physical and network security standards.
Intercom
We use a third-party application called Intercom to communicate with you and provide you with support via email and online chat.
All your information sent from our website to Intercom is encrypted in transit. The API and application endpoints are TLS/SSL only and score an "A+" rating on SSL Labs' tests - meaning that Intercom only uses strong cipher suites and has features such as HSTS and Perfect Forward Secrecy fully enabled.
Our use of Intercom in this way means some of your information will be transferred through Intercom out of the EEA, primarily to Amazon Web Services facilities in the USA. Further details about the measures Amazon take in securing its facilities and services can be found on the Amazon website via this link.
We have a direct agreement with Intercom on the EU Standard Contractual Clause as amended by the UK Addendum regarding the collection, use and retention of personal data.
Coview
We use a third-party application called Coview to be able to provide you with Support. Through Intercom, it enables us to request that you share your screen with us so that we can see what you do.
Coview is based in Germany. You can read more about the measures Coview takes in relation to privacy on the Coview website via this link.
Slack
We use a third-party application called Slack to communicate within our business and with our trusted third-party contractors.
We integrate Slack with Intercom so that we can discuss issues that are raised by users on our Website. Information collected by each of those applications may therefore also be collected by Slack and processed by Slack outside of the EEA.
We have a direct agreement with Slack on the EU Standard Contractual Clause as amended by the UK Addendum regarding the collection, use and retention of personal data.
Calendly
We use Calendly to enable you to book a Support call with us and make an appointment with a panel legal firm (including our inhouse legal team).
We integrate Calendly with Zoom and it is available through Intercom also.
Calendly stores data with Amazon Web Services and Google in the U.S.
A Data Processing Addendum is included in the standard Calendly terms and conditions.
Zoom
We use Zoom to conduct Support calls with you and to enable our panel legal firms (including our inhouse legal team) to conduct the legal appointment with you.
See also our Call Recording Policy at this link.
We have opted to store our recordings in the Cloud with Zoom in Germany.
Payment processors - Xero, GoCardless and PayPal
We use these applications to invoice you where you order paid-for services and to enable you to make payments. You can read about the GDPR polices and processes of each at:
GetAccept
We use GetAccept to send you the Client Care Letter under which legal services are to be provided, gather your ID and enable you to sign the Letter so that you and we are bound by its terms.
Data you enter into our system that is shared with GetAccept to enable this e-contracting process is stored in a datacentre in the EU, in Ireland.
We have timetabled auto-delete rules in place to delete your data once you have completed the Client Care Letter or if you choose not to sign the Client Care Letter after a certain amount of time.
Zapier
We use Zapier to help make the other third-party systems work together.
We have a direct agreement with Zapier on EU Standard Contractual Clause as amended by the UK Addendum regarding the collection, use and retention of personal data.
I. Computers and mobile devices
Our staff and representatives use computer and communications equipment to access these systems to perform their duties, and in particular workstations, laptop computers, other mobile computing devices and mobile phones. Personal data is stored on these devices appropriate to the use for the time being.
We use personal data for the following internal purposes:
Training
Corporate governance and management
External service providers
In addition to the third-party applications listed above, we have engaged external service providers to provide the following services:
Tier 2 Consulting Limited, for developing and maintaining our technology platform
J. Storage
All information you provide to us is stored on secure servers or encrypted devices.
Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.
The transmission of information via the Internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk.
Once we have received your information, we will use procedures and security features to try to prevent unauthorised access.
K. Recording Of In-Coming And Out-Going Telephone and Video Calls
Please see our Call Recording Policy at this link.
L. Where Information Is Processed
Information processed via the third party services listed in this policy may be processed outside of the EEA. Data held directly on behalf of Bequeathed is at AWS in the UK.
M. Your Rights
Individuals have several rights under data protection law in relation to how we process personal data. These are identified below. To read more please visit the Information Commissioner’s website via this link.
We cannot charge for providing information where individuals exercise their rights, except that we may charge a reasonable fee based on our administrative costs to provide additional copies where requested in connection with a request to access data, or where we can demonstrate that requests are manifestly unfounded or excessive. In the latter case we may alternatively refuse to act on a request.
If someone wishes to exercise any of their rights, please contact us at [email protected]
Right to be given clear and easy to understand information on what personal information we have, why and who we share it with.
Right to access information that we hold as personal data, subject to protecting the interests of others as appropriate.
Where any information we hold is inaccurate or incomplete, we can be required to rectify it.
Right for information to be deleted or removed if there is not a compelling reason for us to retain it.
Right to restrict processing of personal data for certain reasons.
Right for a copy of personal data to be provided for personal purposes to use across different services, including to transfer the personal information we hold to another company.
Where we are subject to a breach of security which is likely to result in a high risk to individuals about whom we hold data we must communicate the breach to the individuals concerned without undue delay. In some cases, this may be done by public communications. This right is subject to certain exceptions where measures have been taken to protect the information.
Right to object to processing of personal data.
You can object to us processing your personal data where it is based on our legitimate interests, in which case we can no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
You can object at any time to our use of personal data relating to you in connection with our direct marketing. Where you do so, the personal data shall not afterwards be processed for such purposes.
Where personal data is processed for direct marketing purposes, you have the right to object at any time to processing.
Where we are processing personal data about you with your consent you can withdraw it at any time.
N. Contact
If you have any questions about this Privacy Policy or the personal data we will obtain and process about you, please contact us at [email protected].
If someone has a complaint about our handling of personal data, we ask that they contact us at [email protected].
If we are unable to resolve a complaint, the matter can be referred to the Information Commissioner's Office. You can make that complaint from the ICO website at this link. A claim may also lie in the courts.