Privacy Policy

This notice explains how Woodruff Billing collects, uses, and protects personal information, as well as the terms under which our website, services, and any associated systems or tools may be used. It outlines the conditions under which personal data may be disclosed and the measures we take to keep it secure. This notice does not apply to any third-party websites that may link to ours. We are committed to protecting your personal data and maintaining appropriate standards of confidentiality, security, and compliance.

Website and Service Terms

Any tools, systems, or services made available by Woodruff Billing are provided for professional use within legal billing and costs drafting workflows. Where internal systems or technology tools are used to support service delivery, they are operated in accordance with our confidentiality, data protection, and security obligations.

Access to any systems, tools, or processes is provided on an “as is” basis and may be amended, updated, or withdrawn at any time. Nothing on this website or within any associated systems constitutes legal advice or creates a contractual obligation beyond the scope of agreed professional instructions.

Use of this website or any associated systems indicates acceptance of this Privacy Policy and these terms.

Who We Are

Data is collected, processed, and stored by Woodruff Billing, and we are what is known as the ‘data processor’ of the information you, the ‘data controller,’ provide to us.

We have a data protection regime in place to oversee the effective and secure processing of your personal data.

We are the Data Processors instructed by a Data Controller to carry out work on their legal aid matters.

We process this data solely for the purpose of billing the case. These personal details will not be used for any other reason, other than for the purpose for which Woodruff Billing is instructed.

Woodruff Billing will not sell or rent the data to third parties, nor will we share the data with third parties for marketing purposes.

Our Data Protection Principles

• We will only act on the instructions of the data controller (unless required by law to act without such instructions).
• We will ensure that any person processing the data is subject to a duty of confidence.
• We will take appropriate measures to ensure the security of processing (Article 32 GDPR).
• We will only engage a sub-processor with the prior consent of the data controller and a written contract.
• We will assist the data controller in providing the subject access and allowing data subjects to exercise their rights under the GDPR (Articles 15-22 GDPR).
• We will assist the data controller in meeting its GDPR obligations in relation to the security of processing (Article 32 GDPR), the notification of personal data breaches (Article 33 GDPR), and data protection impact assessments (Article 35 GDPR).
• We will delete or return all personal data to the controller as requested at the end of the contract.
• We will submit to audits and inspections, provide the controller with whatever information it needs to ensure that they are both meeting their Article 28 obligations, and inform the controller immediately if asked to do something infringing the GDPR or other data protection law of the EU or a member state.

Data Security

Protecting your data is important to us, and we have put in place security measures to prevent your data from being accidentally lost, used or accessed in an unauthorised way, altered, or disclosed. We also limit access to your personal data to employees who are subject to a duty of confidentiality.

We maintain exceptional standards of technology and operational security to protect personally identifiable data from loss, misuse, alteration, or destruction. Similarly, we adopt a high threshold when it comes to confidentiality obligations to ensure all personal data is handled and processed in line with our stringent confidentiality and data protection policies.

We use computer safeguards such as anti-virus software and ransomware protection, and all digital files are kept in a secure manner. We enforce physical access controls to our buildings and files to keep data safe.

We have put in place procedures to deal with any suspected personal data breaches and will notify you and any applicable regulator of a breach where we are legally required to do so.

Data Retention

Your personal information will be retained, usually in computer or manual files, only for as long as necessary to fulfil the purposes for which the information was collected; as required by law; or as set out in any relevant contract you may hold with us.

You are able to exercise certain rights in relation to your personal data that we process. These are set out in more detail at the Information Commissioner’s Office (ICO) – GDPR.

Marketing Data

We will never send marketing communications via SMS or call you regarding marketing without your specific consent; nor do we ever pass on or sell your details to a third party.

How We Collect Personal Data

The following are examples, although not exhaustive, of how we collect your personal information:

• Submitting an online enquiry
• Providing personal details when first instructing us
• Following/liking/subscribing to our social media channels
• Asking us a question or submitting any queries or concerns via email or on social media channels
• Posting information to our website or social media channels, for example when we offer the option for you to comment on or join discussions
• Leaving a review about us on platforms like Google Reviews

How We May Use Your Details

The following are examples, although not exhaustive, of how we may use your personal information for our legitimate business interests:

• Fraud prevention
• Network and information systems security

We may use your personal information for legitimate interests, such as providing you with information you would expect to receive or that would benefit and enhance our relationship. This information will help us review and improve our products and services.