• Identity data, such as your name, title, and date of birth.
• Contact data, such as your email address, telephone number, and postal address.
• Financial data, such as billing details and payment information.
• Technical data, such as IP address, browser type, operating system, device information, login data, cookies, and analytics data.
• Usage data, such as information about how you use our website, Client Hub, and services.
• Profile data, such as usernames, passwords, preferences, communication history, and matter history.
• Marketing data, such as your communication preferences and whether you want to receive updates from us.
• Content you choose to share, such as documents, images, audio, or video provided as part of a matter or enquiry.

In limited cases, we may also process special category data, such as information about health, racial or ethnic origin, or trade union membership, and criminal offence data, such as information relating to criminal convictions or allegations, where this is necessary and permitted by law.

• respond to enquiries and assess whether we can assist;
• onboard clients and administer accounts;
• provide legal and related services;
• verify identity and carry out compliance, AML, or KYC checks;
• process payments and manage billing;
• communicate about services, matters, updates, and support;
• maintain records and comply with legal, regulatory, tax, and accounting obligations;
• protect our systems, prevent fraud, and manage business risk;
• improve our website, services, and user experience; and
• send marketing communications where we are permitted to do so.

The lawful bases we rely on may include:

• our employees, consultants, and contractors who need access to it for legitimate business purposes and who are subject to confidentiality obligations;
• service providers and processors who support our systems and operations, such as technology, cloud, hosting, payment, communications, and support providers;
• professional advisers, such as accountants, auditors, insurers, and external legal advisers;
• regulators, law enforcement bodies, courts, tribunals, or public authorities where disclosure is required or appropriate; and
• carefully selected service partners who support the delivery, administration, promotion, or security of our services, acting on our behalf under appropriate contractual controls.

We require third parties who process personal data for us to handle it securely, confidentially, and only for authorised purposes.

Most personal data is stored and processed in the UK or in jurisdictions with appropriate protections. Where personal data is transferred outside the UK, we will ensure that appropriate safeguards are in place. These may include an adequacy decision, the UK International Data Transfer Agreement, or other approved transfer mechanisms.

You may contact us if you would like more information about the safeguards we use for international data transfers.

• client matter files may be kept for up to 7 years after the end of the client relationship;
• AML and KYC records may be kept for 5 years where required by law;
• marketing data may be kept until you opt out or withdraw consent;
• website analytics may be kept for up to 2 years; and
• supplier and contractual records may be kept for up to 7 years after the relevant relationship ends.

Where data is no longer needed, we will securely delete it or anonymise it.

• request access to the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of personal data where there is no lawful reason for us to keep it;
• request restriction of processing;
• object to our processing, including direct marketing;
• request portability of certain personal data; and
• withdraw consent where we rely on consent.

We do not use personal data for automated decision-making or profiling that produces legal effects or similarly significant effects.

These rights are not absolute, and there may be situations where we are entitled or required to refuse a request, or where an exemption applies. If that happens, we will explain our position.

We may ask for proof of identity before responding to a request. We will usually respond within one month, although that period may be extended where permitted by law.

If you have any concerns about how we collect, use, or protect personal data, please contact us first so that we can try to resolve the issue. You also have the right to complain to the Information Commissioner’s Office.