Legal basis for processing data and information sharing

We process personal information as the law requires us to, or as it’s needed to deliver the contract you have with us.


For all other processing, we will collect personal information where:

  • you, or your legal representative, have given consent
  • you have entered into a contract with us
  • it’s required by law (such as where this is mandated by statute or under a court order)
  • it’s necessary for employment related purposes
  • it’s necessary to protect you or others from harm (e.g. in an emergency)
  • it’s necessary for exercising or defending legal rights
  • you have made your information publicly available
  • it’s necessary for archiving, research, or statistical purposes
  • it’s necessary in the event of substantial public interest authorised by law
  • it’s necessary for fraud prevention
  • it’s in our legitimate interests (or those of a third party) provided your interests and fundamental rights do not override those interests
  • We can share your personal information with other organisations in certain circumstances. For example with organisations who help us to provide services and who perform technical operations such as data storage and hosting on our behalf.


These practical arrangements and the laws that govern the sharing and disclosure of personal information often differ from one service to another.


We provide extra information about how we collect and use your information in service specific privacy notices. They explain:

  • why we need your information
  • what information we need
  • who else we obtain or receive it from
  • the legal basis for collection and the choices you have
  • who we share it with
  • whether decisions which legally affect you are made solely using machine based technologies
  • how long we keep your information
  • how to exercise your rights