PHARMACEUTICAL IP

Privacy notice

Evolve IP provides specialised IP strategy services to our clients. As part of this we will need to collect and use your personal data. This privacy notice sets out how we will do this and how we will ensure that your personal data is protected.

We are the controller of your personal data. For more information on what it means for us to be a data controller and our responsibilities please see the official guidance from the Information Commissioner’s Office on data protection principles, definitions, and key terms.

This privacy notice tells you what to expect us to do with your personal information.

Contact details:

Post: 9 Hills Road, Cambridge, CB2 1GE, GB

Telephone: +44 7490 531 064

Email:  contact@evolve-ip.com

What information we collect, use, and why

We collect or use the following information to provide and improve products and services for clients:

  • Names and contact details and other information used to identify you, such as your title, email address and phone number (both landline and mobile)
  • Your work addresses
  • Occupation, including your job title and your company
  • Inventor details required by patent offices, such as your name, home or correspondence address, nationality and country of residence
  • Information relating to compliments or complaints including any information you may submit via an enquiry form on the website or via any feedback, survey responses, and ratings and reviews
  • Records of meetings and decisions
  • Website usage information, such as the pages you view, the website that referred you, your browser and device type, and your country (worked out from your IP address, which our website analytics do not store). Our website’s security service also processes your IP address and connection details to protect the website. We do not collect your device’s location (for example by GPS or Wi-Fi). Our Cookie Notice (www.evolve-ip.com/cookie-notice/) explains the cookies we use and how to switch analytics off.

We collect or use the following personal information for the operation of client or customer accounts:

  • Names and contact details such as your title, email address and phone number (both landline and mobile)
  • Your work addresses
  • Purchase or service history including a record of all matters that we have worked on for you
  • Account information
  • Payment details (including card or bank information for transfers and direct debits)
  • Transaction data (including details about payments to and from you and details of products and services you have purchased)
  • Details of Intellectual Property matters that are linked to you or that affect you.

We collect or use the following personal information for information updates or marketing purposes:

  • Names and contact details such as your title, email address and phone number (both landline and mobile)
  • Job titles and company names
  • Marketing preferences, such as whether you have asked to receive, or to stop receiving, our email updates

We collect or use the following personal information to comply with legal requirements:

  • Name including your title
  • Contact information such as your email address, work address and phone number (both landline and mobile)
  • Work details such as your company and job title
  • Details of the matters we have worked on for you, including payment details and transaction history
  • Any other personal information required to comply with legal obligations (such as legal, financial, tax and accounting obligations)

We collect or use the following personal information for recruitment purposes:

  • Contact details (eg name, address, telephone number or personal email address)
  • Employment history (eg job application, employment references or secondary employment)
  • Education history (eg qualifications)

We collect or use the following personal information for dealing with queries, complaints or claims:

  • Names and contact details including titles, email address, work address and phone number (both landline and mobile)
  • Your work addresses and job title
  • Purchase or service history, including details of your payment history and your bank account or payment card details
  • Details of Intellectual Property matters that are linked to you or that affect you.
  • Correspondence including details of the nature of the query, complaint or dispute

Special category information. In rare instances, for example litigation work, we may receive health information relating to our clients’ inventors or witnesses. We process it only where it is necessary for the establishment, exercise or defence of legal claims, which includes securing and defending intellectual property rights, and we do not use it for any other purpose.  We may receive health information relating to clinical trial participants. This reaches us in pseudonymised form, so that we cannot identify the individuals concerned. We process it only where it is necessary for the establishment, exercise or defence of legal claims, which includes preparing, securing, prosecuting and defending intellectual property rights, and we do not use it for any other purpose.  Other than this, we do not intend to collect special category data (information about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation, or genetic or biometric data).

Providing this information. Some of the information we ask for is needed so that we can enter into and carry out our engagement with you, and so that we can meet our legal and professional obligations — for example the identity and contact details we need in order to act for you, the inventor details that patent offices require us to provide, and the records we are required to keep for tax and accounting purposes. If you do not provide it, we may be unable to act for you, or to progress a particular application or matter. We will tell you at the time if that is the case.

Use of AI tools. We use AI assistants such as Claude (provided by Anthropic) and Gemini (provided by Google), both on paid business accounts – in the course of providing our services and for firm administration, as well as for business development (BD) and marketing purposes. Where the material we submit to these tools contains your personal or confidential information, that information is processed by the AI provider on our behalf as our processor and only for the purpose of providing the tool to us. We use paid business accounts under which the underlying AI models are not trained on our data, and a person always reviews the output.

We do not make any decisions about you based solely on automated processing, and we do not carry out profiling.

Third party links

The website may contain links to third-party websites or services. Those third-party links and websites are not controlled by us and therefore are not covered by this policy. Please review their own privacy notices before you click on any links or share any personal data with them.

Lawful bases

Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information to provide and improve products and services for clients are:

  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
    • Acting for our clients: taking instructions from, and corresponding with, our clients and the people who work for them, inventors, witnesses, and the attorneys and other advisers we work with, so that we can obtain, prosecute, enforce and defend our clients’ intellectual property rights.
    • Running our website securely and understanding, in aggregate, how it is used so that we can improve it. You can switch website analytics off at any time using the setting in our Cookie Notice.
    • Using AI tools in our professional services work, for firm administration, and for business development and marketing, as described in “Use of AI tools” above.

Our lawful bases for collecting or using personal information for the provision of our services and the operation of client or customer accounts are:

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legal obligation – we have to collect or use your information so we can comply with the law, especially in relation to our professional obligations and legal, financial, tax and accounting purposes. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
  • Legitimate interests – where you are not personally our client (for example where you work for our client or for a firm we instruct, or you are an inventor or a witness), we rely on our legitimate interests in acting on our client’s instructions, as described above. All of your data protection rights may apply, except the right to portability.

Our lawful bases for collecting or using personal information for information updates or marketing purposes are:

  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
    • Promoting our business and the expertise of our people by keeping in touch with clients, former clients, prospective clients and professional contacts (for example recipients of our newsletter, people who have contacted us, and people we have met at events) and sending them relevant professional updates, legal bulletins, and marketing communications that we believe will be of interest or benefit to you in a professional capacity. We use information only in ways you would reasonably expect and with minimal impact on your privacy, and you can ask us to stop at any time by replying to any message or contacting us using the details above.

Our lawful bases for collecting or using personal information to comply with legal requirements:

  • Legal obligation – we have to collect or use your information so we can comply with the law, especially in relation to our professional obligations and legal, financial, tax and accounting purposes. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Our lawful bases for collecting or using personal information for recruitment purposes are:

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
    • To effectively manage our recruitment process and assess candidate suitability.

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legal obligation – we have to collect or use your information so we can comply with the law, especially regarding our professional and regulatory obligation to deal with any complaints from our clients. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
    • Responding to queries made through our website or to our published contact details (including from prospective clients).
    • Handling complaints, disputes and legal claims, including recovering fees owed to us and notifying our professional indemnity insurers where a claim is made or anticipated. This use is necessary for those purposes, is what you would reasonably expect, and has a minimal impact on your privacy.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Where we get personal information from

  • Directly from you — for example when you send us an enquiry through our website or using our published contact details, when we correspond or speak with you as a prospective or existing client, when you instruct us or give us information about a matter, when you attend one of our events or seminars, and when you sign up to receive our updates. This includes your name, contact details, job title and the information you give us about your matter.
  • We may receive personal data about you from legal professionals (such as solicitors) as part of prosecuting or defending a claim or an intellectual property right.
  • Publicly available sources, such as social media (e.g. LinkedIn) or your company website.
  • From our clients — where you are an inventor, a witness or a member of our client’s staff and your details are provided to us so that we can act on the client’s instructions.
  • From our suppliers and the other organisations we work with, including foreign attorneys and agents.
  • Automatically when you use our website, through cookies and similar technologies used for website security and analytics (see our Cookie Notice).

How long we keep information

We will only retain your personal information for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you. 

Our standard retention periods are:

  • Anti-Money Laundering (AML) / Client due diligence records: Where the Money Laundering Regulations 2017 apply to our work, retained for 5 years after the end of the business relationship or completion of the transaction. Those Regulations apply to a patent attorney firm only in limited circumstances, principally where we act on the transfer of intellectual property as part of a wider sale of a business.
  • Client matter files (IP prosecution and advice): Retained for 7 years after the file/case is closed.
  • Financial and accounting records (invoices, payments): Retained for 7 years from the end of the relevant financial year.
  • Complaints records: Retained for 7 years from resolution.
  • Marketing contact details: Retained for as long as you remain a relevant professional contact and have not asked us to stop. We remove contacts on request, on objection, and where we become aware the details are no longer current.
  • Website analytics: individual records are deleted automatically after 24 months, after which we keep only aggregated statistics that do not identify anyone. How long each cookie lasts is set out in our Cookie Notice.

To determine the appropriate retention period for personal data where no fixed period applies, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting, or other requirements.

For more information on how long we store your personal information, please contact us using the details provided above. These periods are taken from our Data Retention and Erasure Policy, which sets out our full retention schedule and is available on request.

Who we share information with

Data processors: We use service providers who process personal information on our behalf and on our instructions (data processors). They include providers of IT management and support; document management, email, calendar and file storage; time recording; machine translation; AI assistants (see “Use of AI tools” above); and website hosting, security and maintenance. A current list of the data processors we use is available on request using the contact details at the top of this notice.

Others we share personal information with

  • Overseas attorneys and legal advisers. Evolve’s IP services include coordinating with locally qualified attorneys and other legal advisers to advise on intellectual property (IP) matters and manage global IP portfolios in their respective jurisdictions. Where they are based outside the UK, there may be a limited transfer of your personal data outside the UK (see “Sharing information outside the UK” below). This may include inventor names and contact information, Evolve’s client names and contact information, and attorney colleague names and contact information.
  • Regulators and other authorities — such as the World Intellectual Property Organization, the UK Intellectual Property Office, the European Patent Office, and other national and regional patent offices and IP registers throughout the world — and other bodies we are legally obliged to share personal information with. These authorities act as independent controllers, processing personal data for their own statutory purposes (for example, maintaining public IP registers).
  • Organisations we’re legally obliged to share personal information with such as HM Revenue & Customs, our regulator (the Intellectual Property Regulation Board), the Legal Ombudsman, courts and tribunals, and law enforcement or other public authorities where the law requires it.
  • Publicly, only where you have agreed to it, for example if you agree to provide a testimonial, to be named in a news item or case study on our website or social media, or to provide comments to a legal directory such as IP STARS or IAM. We will ask you first and you can withdraw your agreement at any time.
  • Professional advisers and consultants. Our accountants, our external legal advisers, our business, marketing and website consultants and, where we use them on a matter, independent freelance patent attorneys or consultants who work under our supervision and are bound by confidentiality obligations and our data protection policies.
  • Our insurers. We share personal information with our professional indemnity insurers where we need to notify them of a claim, or of circumstances that may give rise to a claim, and to enable them to deal with it.

A list of the organisations we share personal information with is available on request using the contact details at the top of this notice.

Sharing information outside the UK

We transfer personal information outside the UK in two main situations:

  • Our IP work. To obtain, prosecute, enforce and defend our clients’ intellectual property rights, we send personal information (such as inventor, client and attorney names and contact details) to the overseas attorneys and agents we instruct, and to patent offices and other IP authorities, including international organisations such as the World Intellectual Property Organization and the European Patent Office. The attorneys we instruct are based in the European Economic Area and in countries around the world, including the United States, China, India, Japan and Australia.
  • Our service providers. Some of our data processors, or their sub-processors, process personal information in the European Economic Area, New Zealand, the United States and other countries.

How these transfers comply with UK data protection law. Where UK regulations approve transfers to the destination (adequacy regulations, for example for the European Economic Area), we rely on those regulations. Where they do not:

  • for our service providers, we rely on safeguards in our contracts with them, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses; and
  • for our IP work, we transfer personal information only where UK data protection law permits it, for example where the transfer is necessary for the establishment, exercise or defence of legal claims (which includes obtaining and defending intellectual property rights), or where appropriate safeguards are in place.

For a list of the countries we transfer personal information to, or a copy of any safeguard we rely on, please contact us using the details at the top of this notice.

Security Measures

We take reasonable and appropriate technical and organisational measures designed to protect personal information from accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures are set out in our Information Security Policy and include:

  • Named user accounts, with access to systems and information granted on the principles of least privilege and need-to-know, using role-based access controls, and removed promptly when someone leaves;
    • Strong, unique passwords for all firm systems;
    • Encryption of all firm laptops and desktops (Microsoft BitLocker), managed centrally through Microsoft Intune;
    • Anti-malware protection (Bitdefender), with alerts monitored by our IT provider;
    • Centrally managed security updates, with critical updates prioritised and applications set to update automatically where supported;
    • Storage of client, matter and staff information only in approved systems: our Equinox document management system (hosted in the United Kingdom and encrypted at rest and in transit) and Microsoft 365 (with customer data at rest stored in the United Kingdom);
    • Daily backups of our Microsoft 365 email and files, stored separately from the live environment and monitored by our IT provider;
    • Managed IT support from an external IT provider;
    • Staff policies on information security and data protection, and a procedure for reporting and handling security incidents and personal data breaches.

However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

Your Rights

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

How to complain

If you have any concerns about our use of your personal information, you can make a data protection complaint to us: We will acknowledge your complaint within 30 days, look into it, keep you informed of our progress and tell you the outcome without undue delay.

We will investigate the complaint fairly and will take appropriate steps (including making appropriate enquiries) to respond to your complaint.

Please note that we may need to ask you for proof of identity so that we can ensure that we are disclosing personal data to the right person.

Email: contact@evolve-ip.com

Telephone: +44 7490 531 064

Post: Evolve Intellectual Property 9 Hills Road Cambridge CB2 1GE

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

The ICO’s address:           

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint