Data Protection Policy

Introduction

Pattison & Co is a law firm and provides legal advice and assistance to its clients. It is regulated by the Law Society of Scotland. G12 Property Limited is a limited company, wholly owned by the partners of Pattison & Co, who are the company’s sole directors. G12 Property Limited provides estate agency services to clients of the firm.

The personal data that Pattison & Co and G12 Property Limited process to provide these services relates to its clients and other individuals as necessary, including staff and suppliers’ staff.

This policy sets out Pattison & Co and G12 Property Limited’s commitment to ensuring that any personal data, including special category personal data, is processed in compliance with data protection law. Good data protection practice is embedded in the culture of our staff and our organisation.

Scope

This policy applies to all personal data processed by Pattison & Co and G12 Property Limited. All staff are expected to comply with this policy, and failure to comply may lead to disciplinary action, including dismissal.

Data Protection Principles

Lawfulness, Fairness and Transparency

Personal data is processed lawfully, fairly, and transparently in relation to the data subject.

Purpose Limitation

Data is collected for specified, explicit, and legitimate purposes and not further processed in a way that is incompatible with those purposes.

Data Minimisation

Only data adequate, relevant, and necessary for the intended purpose is collected.

Accuracy

Personal data is accurate, kept up to date, and inaccurate data is rectified or erased without delay.

Storage Limitation

Data is kept no longer than necessary for the purpose for which it is processed.

Integrity and Confidentiality

Data is processed securely, protected against unauthorised or unlawful access, loss, destruction, or damage.

Process, Procedures and Guidance

  • Identify the legal basis for processing in advance and comply with the law
  • Do not use data in ways that are unexpected or outside the scope of privacy notices
  • Provide clear privacy notices advising how and why data is processed
  • Collect only necessary data for identified purposes
  • Maintain accuracy and update data where possible
  • Retain paper files according to Law Society of Scotland guidelines; archived files may be retained indefinitely if necessary
  • Ensure only authorised personnel access data and that transfers are secure
  • Train and supervise staff handling personal data

Destruction of Files

  • Paper files are securely shredded
  • Electronic files are archived but not permanently deleted

Data Subject Rights

Staff are trained to identify and handle requests from data subjects. Requests are considered without undue delay and within one month where possible.

Subject Access

The right to request information about how personal data is processed, including purpose, categories, recipients, retention period, data sources, and automated decision-making.

Rectification

The right to correct inaccurate personal data.

Erasure

The right to have data erased where it is no longer necessary, consent is withdrawn, no legal basis exists, or there is a legal obligation to delete.

Restriction of Processing

The right to limit processing under certain circumstances, such as disputes over accuracy, unlawful processing, or pending verification of an objection.

Data Portability

The right to receive personal data in a machine-readable format to transfer it to another controller, where processing is based on consent or contract.

Objection to Processing

The right to object to processing based on legitimate interests, unless overriding legitimate grounds exist.

Special Category Personal Data

This includes data revealing:

  • Racial or ethnic origin
  • Political opinions
  • Religious or philosophical beliefs
  • Trade union membership
  • Genetic or biometric data for identification
  • Health data
  • Sex life or sexual orientation
  • Criminal convictions or offences

Special category data of employees is processed only as necessary to comply with employment and social security law, with safeguards and retention policies applied.

Responsibility for Personal Data

The partners of Pattison & Co and G12 Property Limited take ultimate responsibility for data protection. For concerns or to exercise GDPR rights, contact:

Name: Bridget McLaren
Address: 19 Glasgow Road, Paisley, PA1 3QX
Email: bridget.mclaren@pattisonandcompany.com
Telephone: 0141 889 3296

Monitoring and Review

This policy was last updated on 24 March 2026 and will be reviewed at least every two years.