Privacy Policy

This privacy notice sets out information about our use of personal information relating to individuals we have dealings with, including our clients, individuals who use our website and individuals who subscribe to our newsletters and updates. It also sets out details of the rights individuals have in relation to our use of their personal information and various other information which we are required to provide under data protection law.

In particular, this privacy notice provides information to individuals about how they can object to our use of their personal information, how they can withdraw any consent they have given to us to enable us to process their personal information and how they can make a complaint.

We may provide additional privacy information to individuals on specific occasions when we are collecting personal information. This is to ensure that we are being transparent about why and how we are using personal information. This privacy notice supplements any other such notices and is not intended to override them.

This privacy notice applies to:

• Our clients;
• Other individuals who contact us (for example, to make an enquiry about legal services);
• Individuals (other than clients) whose personal information we obtain in connection with a legal matter;
• Individuals who use our website
• Individuals who subscribe to our updates and newsletters;
• Individuals who engage with us on social media; and
• Individuals who access our premises or the surrounding areas and who may be captured on our CCTV system.

We refer to such individuals in this privacy notice using the terms “you” or “your”.

We take your privacy extremely seriously and want you to feel confident that your personal information is safe in our hands. We will only use your personal information in accordance with data protection law applicable to England and Wales from time to time and the SRA rules of professional conduct we are subject to as a law firm.

Under data protection law, when we use your personal information, we will be acting as a data controller. Essentially, this means that we are responsible for your personal information and will be making decisions about how it is used and why.

Below, we summarise the main rules that apply to us as a data controller under data protection law:

1. We must be upfront about how we intend to use your personal information and must use it fairly. Providing privacy information to individuals (such as in this privacy notice) is one aspect of using personal information fairly.

2. We must only use your personal information if we have a legal basis to do so under data protection law. The legal bases available are set out in data protection law and include that:- We need to use your personal information to perform a contract between you and us (or to take steps at your request before entering into such a contract);- We (or someone else) have a legitimate reason (such as a business or commercial reason) for needing to use your personal information, so long as this is not overridden by your rights and interests; and- We need to use your personal information to comply with laws or regulations that we are subject to.

3. We must only use certain types of sensitive personal information (such as information relating to your health, racial or ethnic origin or religion) if we can satisfy one of the conditions set out in data protection law or if an exemption applies to us. This type of personal data is known as “special category personal data”.The conditions that apply to the use of special category personal data include that:- We need to use the information for the purposes of establishing, exercising or defending legal claims; and- That you have given us your explicit consent to use it.

4. Generally, we must not share your personal information with others unless we have a legal basis for doing so and have provided you with information about our intention. However, there are certain circumstances in which we can share your personal information with a third party without first informing you (e.g. for the prevention of a criminal offence or fraud).

5. Generally, we must only use your personal information for the specific purposes we told you about when we collected or obtained it. If we want to use your personal information for other purposes, we need to contact you to tell you about this and will generally need to obtain your consent.

6. We must not hold more personal information about you than we need for the purposes we have told you about and must not retain your personal information for longer than is necessary for those purposes (known as the “retention period”). We must also dispose of any information that we no longer need securely.

7. We must ensure that we have appropriate security measures in place to protect your personal information.

8. We must act in accordance with your rights under data protection law.

9. We must not transfer your personal information outside the United Kingdom unless we can satisfy certain conditions. One such condition is that the personal data will only be transferred to a country that has been approved by the United Kingdom as having adequate data protection laws.

How we will use your personal information and the legal bases we will rely upon, will depend upon the nature of our relationship with you and our reasons for obtaining or collecting your personal information in the first place.

If you are a client or prospective client of the firm, we will only send you Updates if you provide us with your consent to do so. Our legal basis for doing so will usually be that we have a legitimate interest in using your personal information for the purposes of direct marketing in order to expand our client base (for example, by telling you about the range of legal services that we provide and/or our areas of expertise).

This means that we do not usually need your consent to send this sort of information to you. However, your consent will be required in certain circumstances. Where this is the case, we will ask you for your consent separately and clearly and will not send you Updates without your consent.

You have the right to withdraw your consent to receiving updates from us at any time. You can do this by:

• contacting us using the details set out on our Contact page;
• using the opt-out link in marketing emails we send to you; or
• using the unsubscribe option on our website on our Insights in your inbox page.

How long we will need to hold on to your personal information and the reasons for this will vary depending upon the nature of the personal information and the purpose of the processing.

Below, we have set out brief details of the retention periods (and related reasons) that apply to some of the personal information we hold.

Unless you have asked us (and we have agreed) to store your personal information for a longer period, we won’t hold on to your personal information for longer than is necessary for the relevant purpose and once we no longer require it, we will ensure that it is disposed of securely.

Both in the course of providing legal services to our clients and as a necessary part of running our business, we will often need to share your personal information with third parties. The general position under data protection law is that we should only share your personal information with third parties if we have told you that we intend to do so and have a valid reason for doing so. We must also put safeguards in place to ensure that we share your personal information securely.

This section provides you with information about the third parties we will share your personal information with and our reasons for doing so.

In some cases, we only describe the category of third party with whom we will share your personal information. This is because:

• when handling matters on behalf of clients, the identity of such third parties will vary from matter to matter; and
• the identity of third parties we use to provide business-related services to us (and who may have access to your personal information) will change from time to time.

If you would like more information about any of the third parties with whom we share your personal information or the steps we take to ensure that your personal information is secure, please contact us using the details set out in our Contact page.

To deliver services to our clients and conduct our business, we sometimes need to transfer personal information outside the United Kingdom. The main situations in which we will need to do so are:

• if you are located outside the United Kingdom;
• if any third parties we are using to provide legal services to you are located outside the United Kingdom (for example, experts or professional advisers in other jurisdictions); and/or
• where there is an international dimension to the matter on which we are advising you.

As  countries outside the United Kingdom may not offer the same protection to personal information as the United Kingdom, transfers of personal information outside the EEA are subject to special rules. Generally speaking, we must only transfer your personal information outside the United Kingdom if:

• the United Kingdom has approved or made a finding of adequacy in relation to the relevant country;; or
• an appropriate safeguard has been put in place and enforceable data subject rights and effective legal remedies for data subjects are available. The appropriate safeguard we rely upon most often is the use of standard contractual clauses (as approved by the ICO).

If you would like more information about situations in which your personal information may be transferred outside the United Kingdom and/or how we will seek to ensure that your personal information  continues to be protected, please contact us using the contact information provided in this privacy notice.

Your personal information will either be held at our offices or by the third party agencies, service providers, representatives and agents used by us.

Some of these third parties may be based outside the United Kingdom.

We take the protection of your personal information extremely seriously and we have a number of measures in place to prevent personal information from being accidentally lost or used or accessed in an unauthorised way. For example:

• electronic document security which operates on a number of different levels, including:
  • access to our IT network is username and password protected;
  • once logged on to our network, documents may only be accessed through our document management system;
  • every action applied to a document is logged by date, user, device and type of activity;
  • encryption of moveable media (e.g. laptops and mobile phones);
  • next generation anti-virus software is implemented across all devices;
• emails are sent using TLS encryption where possible;
• staff receive data protection and information security awareness training and are required to adhere to our internal data protection policies and procedures;
• multi-factor authentication is used for externally accessible systems; and
• implementation of physical security measures at all of our offices (including restricted access and CCTV).

We also limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

In addition, we have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Under data protection law, you have a number of different rights relating to the use of your personal information. The table below contains a summary of those rights and our obligations. More information about your rights and our obligations can be found on the ICO website.

For further information relating to any of the above rights or to exercise any of your rights, please contact us using the details set out on our Contact page.

You can also find more information about your rights on the ICO’s website.

If you request the exercise of any of your rights, we are entitled to ask you to provide us with any information that may be necessary to verify your identity.

Generally, we must deal with your request within 28 days of receiving it. However, it may take us longer than this to respond to you if your request is particularly complex or if you have made a number of requests. In this situation, we will let you know when we envisage being able to meet or fully deal with your request.

If you have given us your consent to use any of your personal information, you can withdraw your consent at any time. To do so, please contact us using the details set out on our Contact page.

You can get in touch with us in the following ways:

If we are unable to deal with a complaint to your satisfaction or if you are unhappy with the way we are using your personal information, you have the right at any time to make a complaint to the ICO. You can contact the ICO here at or by telephoning 0303 123 1113.

We may update this privacy notice from time to time.

This privacy notice was last updated on 29/05/2024