Privacy Policy

Punter Southall Group Limited, including Punter Southall Law (we, us or our), knows that you care how your information is used and shared and we appreciate your trust in us to do that carefully and sensibly. Your privacy is important to us and we are committed to protecting and respecting your privacy.

This privacy policy explains how we use and protect any personal information we may collect from you or you provide to us when you use and visit our website or otherwise interact with us, for example by phone or email or other interactions, and your rights in relation to that.

We use some data protection terms in this Privacy Policy. You can see our glossary of terms at to help you understand what we mean.

If you become a client of Punter Southall Law we will send you terms of engagement which also contain terms relating to data protection. There is a separate privacy policy for employment and consultancy applicants, which is linked to below in this policy.

Our website is not intended for children. We do not knowingly collect data from children.

Who we are and how to contact us

We are Punter Southall Law Limited and we are the Data Controller (collectively referred to as PSL, Punter Southall Law, we, us, or our, in this privacy policy), and responsible for your personal data. We are registered with the Information Commissioner’s Office (ICO) in the UK under registration number ZA522958.

PSL is a subsidiary of Punter Southall Group Limited (PSG). PSG is made up of different legal entities, details of which can be found at Our Business Legal Information. Please note that other members of PSG have different privacy policies which you can see on their websites.

Our contact details are:

Registered office: 11 Strand, London WC2N 5HR
Telephone: 020 3327 5000
Email: data.protection@puntersouthallgroup.com
Website: www.puntersouthallgroup.com

The contact detail of our Data Protection Officer is:

Name: Richard Garmon-Jones
Address: 11 Strand, London WC2N 5HR
Telephone: 020 3327 5182
Email: data.protection@puntersouthallgroup.com

If you have any queries, comments or requests regarding this privacy policy, you have a complaint or you would like to exercise any of your rights set out at the end of this privacy policy, you can contact us using the details set out above.

Where personal information is provided by or collected from you when you use our website or contact us, this personal information may be shared with PSG and or one or more of the PSG group companies for the purposes set out in this privacy policy.

Personal data we collect

The specific types of personal information we may collect and use will depend upon how you use the features on our website, your relationship with us and the information you choose to provide.

The types of information we may collect directly from you or receive from third parties are:

Identity information, including first name, last name, any previous names, and prefixes.
Other identifying information including information required for KYC and AML procedures such as passport and driving licence numbers.
Contact details including your postal and billing addresses, email addresses and telephone numbers.
Financial information including payment and bank details.
Job title and company (if applicable).
Interests and preferences.
Information you submit on our website, including marketing and communications data including your preferences in receiving marketing from us and our third parties and your communications preferences.
Publicly available data such as data on your LinkedIn or Facebook profile or data obtained as a result of a background check on you.
Information from our clients – for example where you are a customer or employee of theirs.
Technical Data including Internet Protocol (IP) address, Media Access Control (MAC) address, browser types and versions, operating system and platform type, general location data such as the country from which you accessed our website and time zones, software and hardware attributes (including device IDs and the type of device you are using), referring and exit pages and URLs.
Usage data including the number of clicks, domain names, landing pages, pages viewed and the order of those pages, the amount of time spent on particular pages, the terms you use in searches on our sites, the date and time you used the website, any form submitted, error logs, and other similar information.
If you visit our offices we may use CCTV on our premises, which may capture information about you.
Any other information relating to you which you provide to us.

We will use this information to assess and to improve the performance of our website and our services and the information we provide.

We may use a variety of technologies, including cookies and similar technologies, to assist in collecting this information. Our Cookie Policy sets out information about the cookies we use on our site.

We also collect, use and share aggregated data such as statistical or demographic data which is not personal data as it does not directly (or indirectly) reveal your identity. For example, we may aggregate individuals’ Usage Data to calculate the percentage of users accessing a specific website feature in order to analyse general trends in how users are interacting with our website to help improve the website and our service offering.

Personal data we collect: Special categories of personal data

In some circumstances, our collection of the different categories of data set out above may include the collection of Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). We also may collect Criminal Convictions and Offences Data.

For example, if you are a client, the nature of your instructions to us, the personal information you submit to us, or some information that we generate in the course of providing services to you might include special categories of information such as race, sexual orientation, or health data in a workplace discrimination case.

Another example is that if we represent an entity/person you are or was associated with, such as a current or former employer, or an estate or trustee under which you are a beneficiary, they might provide us with trade union or race information in an employment tribunal case, or health data in a private wealth matter. We also have an active investigations practice and we are sometimes asked to investigate wrongdoing which might include allegations relating to criminal offences.

How personal data is collected

We collect personal data from you in the course of our relationship with you and also receive information about you from third parties.

We use different methods to collect data from and about you. The following circumstances may apply:

When we communicate with you in person, or by email and other electronic means, such as telephone calls or video conferencing software. Please see the below section titled Other Information-gathering technologies for more details. You may give us your personal data such as identity information, contact information, and sometimes financial information, by corresponding with us by post, phone, email, via our website, or otherwise. This includes personal data you provide when your or an entity you with which you are connected: Make an enquiry about, or request for our services; Contact us via our “Contact us” form on our website or via email; Subscribe to our publications; Request marketing to be sent to you; Complete a survey; or Provide us with feedback;
When you are an opposing party in a transaction or project we are involved in and we receive your personal information as part of that transaction or project process;
When you are employed by or connected to a client or organisation of interest to us in our professional work for example as a board member of a relevant entity;
When we receive personal data from law firms, accountants, trustees and other professional advisors acting for you where our client is a party in a matter where we are instructed – e.g. a transaction, investigation or resolution of a dispute you are involved with including corporate transactions, commercial transactions, investigations, regulatory enquiries, property transactions, litigation, mediation and arbitration matters;
When you or an entity you are connected with supplies us with your services;
When we arrange for the supply of another firm’s services to you or the supply of other specialist advice such as barristers and accountants;
Through our access to CCTV footage;
When you log onto our guest Wi-Fi when attending our offices as a visitor;
Otherwise through providing our legal services and operating our business;
We also collect data from and about you via our website, through automated technologies or interactions. When you interact with our website, we automatically collect Technical Data as outlined above. We collect this personal data by using cookies, server logs, and other similar technologies. Visit Cookies Policy.
Technical Data is also collected from analytics providers such as Google or Silktide;
Through third parties or publicly available sources. More details on receiving personal data from third parties are below.

Personal data received from third parties

The third parties from whom we might receive personal data can include:

Accountancy firms, law firms, trustees and other professional services firms acting for you or an entity associated with you, where our client is a party in a transaction, investigation or dispute resolution that you are involved in. For example, corporate transactions, commercial transactions, property transactions, litigation, mediation, arbitration and other dispute resolution processes.
Banks, building societies, credit reference agencies, and other such financial organisations where you are a customer or debtor and we act for the financial organisation.
Your friends, relatives, and colleagues might provide some personal information about you as part of our work for them or entities they are associated with. For example, as a witness in a dispute or as a beneficiary in an estate or trust.
Payment and delivery services may provide us with data such as contact information and financial information.
Publicly available sources such as Companies House.

Ensuring the lawful use of your data

We will only use your personal data where we have a lawful basis to use it. We rely on one or more of the following legal bases:

Performance of contract with you: using your data where it is necessary for us to perform our contract with you (for example, to provide you with products or services you have requested).
Legitimate interests: where it is necessary for our legitimate interests as a legal and business services provider and your interests and fundamental rights do not override those interests. These interests include things like managing relationships with clients, prospective clients and their staff, hosting clients and others at our offices, hosting virtual and in person events and ensuring appropriate standards and compliance with policies and procedures.
Legal obligation: we may sometimes need to use data to comply with our legal, regulatory and or professional obligations, for example conducting the required compliance, identity, and KYC checks and maintaining those records as required by law and by solicitors regulations.
Consent: we rely on the legal basis of consent only where we have obtained your active agreement to use your personal data for a specified purpose, for example, where you subscribe to receive our email newsletters.
Vital Interests: while unlikely, in rare circumstances we may need to use personal data when necessary to protect the vital interests of a natural person, for example, if someone suffers a medical incident at our offices we might use personal data to contact medical professionals, which may also involve using your special category health data.

This table outlines the expected and common ways we plan to use your personal data, and which lawful bases apply:

Purpose / Use	Type of data	Lawful basis
To conduct checks to determine whether or not we can act for you and onboard you as a client, such a conflict checks and KYC checks. To conduct onboarding and conflict checks where you are not the intended client, but you are involved in another way, e.g.: as another party in a dispute.	Identity, contact. financial information. Sometimes we may deal with special category data for this purpose, e.g.: if we are onboarding a matter concerning health or race discrimination.	Performance of contract, legal obligation, and legitimate interest.
To contact you when send us an enquiry.	Identity and contact information. Sometimes we may deal with special category data for this purpose, e.g.: if your enquiry asks if we can represent you in a trade union related employment matter.	Legitimate interest (to provide information to people asking about our business and services and potentially growing our business).
To deliver our services to you, including managing invoices, collection payments, and engaging other service providers such as barristers, accountants, and external law firms.	Identity, contact, and financial information.	Performance of contract and legitimate interests.
To administer and protect our business and our website, such as troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data.	Identity, contact, and technical and usage information.	Legitimate interests (for running our business, provision of administration and IT services, and network security)
To use data analytics to improve and enhance our website, newsletters, customer relationships, and customer experiences.	Identity, technical and usage information, marketing and communication information.	Legitimate interests (to keep our website updated and relevant and to develop our business).
To make suggestions and recommendations to you about services or website content that may be of interest to you.	Identity, contact, technical and usage information, marketing and communications information.	Legitimate interests (to grow and develop our business).
To review and analyse social media engagement, for example reviewing or responding to the reactions and comments on our posts on LinkedIn.	Identity and contact information (and other information you may choose to include in comments or communications).	Legitimate interests (to grow and enhance our social media presence, which can help develop our business).

There may be other times when we use personal data as a Data Processor. For example in an internal investigation our client may ask us to process personal data on their behalf. In that situation we may look at a wide range of data including technical data like metatags to work out what happened, whether documents are accurate, whether a fraud has been committed etc. In these situations we will usually be acting under the direction of our client who will determine the use of data.

If you are an opposing party to or a person involved with a transaction we are involved with we may use your personal information in order to perform our services for our clients. Elements of your information contained in matter files may be shared with or disclosed to third parties as part of our work in relation to that matter.

Direct Marketing

We may use your identity, contact, technical and usage data to form a view on what we think might be of interest to you. This is how we decide which products, services, and offers might be relevant for you, we call this marketing. Emails we send for marketing purposes may include tracking devices like pixel tags which enable us to work out who opened those emails, whether they were forwarded etc. You may receive marketing communications if you have requested information from us or purchased our services. If you agree to us providing you with marketing information, you can always opt out at a later date. You can ask us to stop sending you marketing messages at any time by emailing info@puntersouthall.law.

Emails

We use secure email services and document delivery technology which may give us reports on when emails where opened and other information. We may also use standard email features to enable us to get a delivery receipt or a notification when an email is opened. You can usually disable that functionality with standard emails. There is more information about that at Microsoft: Read Receipts.

AI

We currently use Microsoft 365 Copilot to assist us in our work. The Copilot instance we use may share data across PSG. You can find out more about this at Copilot: Data, Privacy, and Security for Microsoft 365 Copilot.

When conducting investigations or litigation we may also use AI functionality in tools designed to assist us. For example we may use AI functionality embedded in tools such as Relativity and Everlaw. You can see the Relativity privacy policy at Relativity Full Privacy Policy and the Everlaw privacy policy at Everlaw Privacy Notice. We may use third parties to access those tools and they may have their own plug-ins which may also use AI.

We may also use AI functionality to help take meeting minutes. We may use Microsoft Facilitator and similar products to do this. You can find out more this at Facilitator in Microsoft Teams meetings.

As an innovative law firm we are also exploring the ways in which we can improve the service we offer to clients and that may involve additional AI applications. We may use some of the data we hold to help train and improve AI models. If you would prefer us not to use your data to train AI please let us know.

Who we share your personal data with

We share your personal data with trusted third parties who assist us in operating our website and providing our facilities, services and products to you. When we do share your data with these third parties, we have written contracts in place with them to ensure they only use your data for the purpose we specify to them and that your privacy is secure and respected. These third parties can include entities such as but not limited to:

our professional advisors and auditors;
our insurers including our professional indemnity insurers;
suppliers who provide business and legal support services to us, such as e-signature software, time recording software, legal management software (currently we use LEAP whose privacy policy is here Privacy Statement | LEAP Legal Software), document production software such as NitroPro (see Privacy Policy | Nitro) and Adobe (see here Adobe Privacy Policy), data rooms, and identity checking software such as SmartSearch (see here Privacy Notice | SmartSearch);
general business support software providers such as Microsoft Teams and cloud storage providers such as Microsoft OneDrive;
IT service and tech support service providers including Littlefish who support our IT systems. You can find out more about Littlefish here Managed IT Services | Cyber Security | 24/7 IT Support UK | Littlefish;
we use speech processing services from Philips to help us in our professional work. This may involve Philips processing your personal data on our behalf. You can find out more about what they do here Voice recorder online – Record & save anywhere – Philips SpeechLive and access their privacy policy here Privacy policy – Philips SpeechLive;
third parties we engage for recruitment activities such as ICIMS (more details below); and
third parties we engage for expert or professional services on behalf of our clients such as barristers or other specialist law firms.

We will also disclose your personal data to third parties if we are under a duty to disclose or share your personal data in order to comply with any legal obligation.

If you would like confirmation of the third parties we have shared your data with, and how those companies process your data, please let us know.

We may share your personal data with other PSG companies.

PSG companies may also share your personal data for analytics and marketing purposes. We will only share your personal data with third parties (including our group companies) for them to use for their own direct marketing purposes when you have given your consent for us to do so.

We may also share or transfer your personal data in connection with a business transition or business re-organisation (such as a merger, acquisition by another company, or a sale of all of or portion of our assets). In these circumstances, we might also need to transfer personal data to a relevant third party as part of a due diligence or conflict check process in a business transition. For example, we may need to share your personal data with a prospective buyer and external professional advisors such as accountants, insurers, lawyers or financial institutions.

If we sell our business, or part of it, we may share your information with a buyer. They may not be in the same line of business as we are. We will ask any buyer to respect this privacy policy. Likewise, your personal information may be passed on to a successor in interests in the unlikely event of a liquidation, bankruptcy or administration.

We may be required to share your personal data with the police authorities (such as HMRC or the National Crime Agency) or other enforcement, regulatory or Government bodies, where we are legally obliged to do so. We may also need to share your data with professional bodies like the Solicitors Regulation Authority (SRA). We will also disclose your personal data to third parties if we are under a duty to disclose or share your personal data in order to comply with any legal obligation.

If you are an opposing party, a person involved with a transaction we are involved with, or someone involved in a matter we are handling we may use your personal information in order to perform our services for our clients. Elements of your information contained in matter files may contain your personal data, and might be shared with or disclosed to third parties as part of our work in relation to that matter.

Where you are a client of ours, or an opposing party to a transaction we are involved with such as a dispute, we may also disclose your personal information to:

Our client;
Courts and tribunals;
Regulatory authorities;
The other side of a transaction or dispute;
Third party experts such as counsel or experts (such as medical experts);
Other investigators;
Audit professionals.

We may do this for the purposes of carrying out that work and only to the extent we consider necessary.

Cookie Policy

Like many companies, we use technology on our website to collect information that helps us enhance your online experience, discover how you use our website and measure the effectiveness of our marketing communications.

Visit our Cookie Policy to learn more.

Other information-gathering technologies

WordPress: We use a third party service, WordPress.com, to help with some of the content on our website. WordPress is run by Automattic Inc. WordPress may collect information about users’ activity on the site, for example the number of users viewing pages on the site, to monitor and report on the effectiveness of the site and help improve it. WordPress may require you to enter a name and email address (for example to make a comment where a page has that functionality). For more information about how WordPress processes data, please see Automattic’s privacy notice at https://automattic.com/.
GoDaddy: we also use GoDaddy for their website and hosting services for our own website. The main GoDaddy relationship is with PSG but some GoDaddy functionality is used on the PSL website. Their privacy policy is here: https://www.godaddy.com/en-uk/legal/agreements/privacy-policy.
iControlWP: we also use iControlWP to help us with WordPress administration, which is part of Fernleaf Systems Limited. Their privacy policy is here: https://www.fernleafsystems.com/common/privacy-policy-common/.
Google and YouTube: Our website uses analytical data provided by Google Analytics and collected by them from the website. We may also use other Google services such as Google Translate. Google is based in Mountain View, California, United States. Google may aggregate data it collects from its various services including Google Analytics, Google Translate, Google Maps and YouTube. It may do this to enrich the data it sells to advertisers including through its DoubleClick subsidiary. You can find out more about the types of analytical data and how that data is processed by visiting https://www.google.com/policies/privacy/partners. Using Google Analytics to gather statistics on site usage may involve the use of cookies—there are more details on this in Google’s own privacy policy. You acknowledge and accept that we have no control over Google’s data processing—please refer to Google’s privacy policy for details of their data processing practices.
Microsoft: We also use various Microsoft services including Teams, 365 and Microsoft cloud storage services. We also use Microsoft Copilot which includes some AI functionality. Microsoft is based in Redmond, Washington, United States. Some of our sites may also have LinkedIn cookies. You can find out more about the way LinkedIn uses data in their privacy policy. LinkedIn is owned by Microsoft and there may be additional Microsoft functionality. Microsoft may aggregate data with data it collects from other sources including Bing. It may do this to enrich the data it sells to advertisers. Microsoft’s Privacy Statement is here https://www.microsoft.com/en-gb/privacy/privacystatement. You acknowledge and accept that we have no control over Microsoft’s data processing.
Everlaw: We use Everlaw to process data in investigations, litigation and for subject access requests. Everlaw is based in Oakland, California, USA. You can find out more about Everlaw’s data protection practices here Privacy Notice | Everlaw.
Relativity: We also use Relativity to process data in investigations, litigation and for subject access requests. Relativity is based in Chicago, Illinois, USA. You can find out more about Relativity’s data protection practices here Privacy and Cookie Policy
Third party servers: We may also store personal information with a third party on its servers. This includes storing data on services owned by Microsoft (as outlined above) which may be located outside of your own country. You can find out more about the locations of Microsoft data centres here: https://azure.microsoft.com/en-us/explore/global-infrastructure/geographies.
Bitly and similar services: We sometimes shorten the internet URLs we use using a URL shortening service like bit.ly. URL shortening services may give us access to information on people who click through the link including the data and time that they access the link and their location. You can find out more about bit.ly and the way in which these services work here https://en.wikipedia.org/wiki/Bitly.
LinkedIn and X (formerly Twitter): We have a social media presence on LinkedIn and on X. You can visit the LinkedIn website for details of their privacy policy: https://www.linkedin.com/legal/privacy-policy. The X privacy policy is available here: https://x.com/en/privacy. The Insights section of our website has buttons which allow you to share our content on social media. Please do read their privacy policies to see what that sharing includes. Be aware of that fact that social media companies may aggregate data you share with them with other data they hold including data from cookies, from searches and website activity and from people you associate with online. They may also use this data to send you targeted adverts.
VOIP: In common with many other businesses we use VOIP technology when you call us or when we call you. VOIP stands for Voice Over Internet Protocol. You can find out more about VOIP here: https://en.wikipedia.org/wiki/Voice_over_IP. Since your call will be relayed via the internet, we can’t control where your data is processed. Some of our telephony also routes through Microsoft Teams. If you would prefer not to use VOIP or Teams you can call any of our team on their mobile phones.
Other websites: Our website may sometimes contain links to other websites, for example through our website’s Insight articles. This Privacy Policy applies only to this website so when you access links to other websites you should read their own privacy policies.
Zoom, Teams, WhatsApp and others: we may also agree to hold calls with you by some other medium. This can include WhatsApp (https://www.whatsapp.com/legal/privacy-policy-uk), Microsoft Teams (as outlined above), or Zoom (https://www.zoom.com/en/trust/privacy/privacy-statement/). You acknowledge and accept that we have no control over their data processing practices —please refer to their privacy policy for details of their data processing practices.
The Solicitors Regulation Authority and Yoshki: Our website also maintains a badge which is a mandatory requirement of the SRA, our regulator. The SRA requires us to display this logo but we have not been able to establish how the SRA and its providers use data from our website. We understand that the SRA uses Yoshki to help them with the digital badge (https://www.sra.org.uk/solicitors/resources/fees/clickable-logo/). For more information on the badge you may contact the SRA at www.sra.org.uk or Yoshki at www.yoshki.com.

Please be aware that since some of our services are provided by other members of PSG the contractual relationship with third parties may be with PSG and not with Punter Southall Law.

Cookie Policy

Like many companies, Punter Southall Law (we, us and our) use technology on our website to collect information that helps us enhance your online experience, discover how you use our website and measure the effectiveness of our marketing communications.

Visit our Cookie Policy to learn more.

International transfer of your personal data

As some of our service providers are located in countries outside of the UK or the EEA, it may be necessary for the personal data that we collect from you to be transferred to or accessed from outside the UK or the EEA in order for you to use the features on our website. Some of our clients are also located outside of the UK or EEA (for example in the USA) and so this may also mean a transfer of your data there.

If we do this, we have procedures in place to ensure your data receives what we consider to be appropriate protections.

Where we transfer your personal information to countries deemed to provide an acceptable level of data protection by the UK Information Commissioner’s Office, we rely on that decision to transfer your personal information.

For transfers to service providers outside the UK or the EEA where no adequacy decision applies, we use International Data Transfer Agreements, Standard Contractual Clauses or other transfer tools provided for in the applicable data protection legislation to protect your personal information.

If you would like further information about a data transfer mechanism we use for a data transfer of your personal data, please get in touch with us using the contact details provided at the beginning of this privacy policy.

How we protect your information

We have put in place security procedures and technical and organisational measures designed to help safeguard your personal information. We will use what we consider to be reasonable efforts to safeguard your personal information. However, you should be aware that the use of the Internet (and VOIP, Teams and telephone calls) is not entirely secure and for this reason we cannot guarantee the security or integrity of any personal information which is transferred from you or to you.

Despite the measures taken by us and any third parties we engage the internet is not secure and as a result others may nevertheless intercept or access private transmissions or data. If you ask us to share data with third party sites their servers may also not be secure.

How long we will keep your personal data

We will only keep your personal data for as long as we need to in order to fulfil the purposes for which it was collected, as set out in this privacy policy, and for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation .

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

In some circumstances, you can ask us to delete your personal data. Please see below for further information.

In some circumstances we may anonymise personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

Growing our team

Our website contains a Careers page that links to a website where you can apply for employment at PSG and its group companies. This recruitment website is administered by ICIMS, a PSG service provider. The ICIMS website collects personal information such as your personal details, contact information and work history and qualifications. You can find out more about ICIMS and their privacy policy here Privacy Notice Website | iCIMS.

As a law firm that’s looking to expand we also have our own in-house recruitment team which is primarily focused on legal talent. They use their existing contacts and publicly available information (such as LinkedIn) to work out who might be a good fit for us and in some cases to approach them to talk with them about opportunities to work with us. We also speak with specialist legal recruiters and sometimes they send us information on potential candidates – this could be solicited or unsolicited – which we then review for suitability. We sometimes have conversations with other people too about potential candidates – for example people we know who have worked with them in the past.

White Label services

We also offer White Label services to other law firms. For example a law firm might want to focus on working with its clients and it outsources some services like billing, compliance and administration to us. In these situations we can be a Data Controller and/or a Data Processor. We might access personal data of the clients, employees and other contacts of that firm. We may also share data with that firm – for example for conflict checking purposes.

How to access and control your personal data – Your data rights

You may have some rights with respect to your information which are summarised below. Not all of these rights apply to everyone and they do have limits. Some of the rights are complex therefore, not all details are included in the summary:

Right of access, commonly known as a subject access right: you may have the right to request to see the personal data that we hold about you. Please note that there are some exceptions to this right, so in some circumstances access may be denied, for example when if disclosing the information would reveal personal data about other people. As lawyers some of the information we have may also be protected by legal privilege which may mean that we do not have to disclose that data to you. If the subject access right does apply we will conduct a reasonable and proportionate search to respond to your request – you might be able to access some but not all of the personal data requested.
Right to rectification: you may be able to ask us to have inaccurate information held about you corrected, though in some circumstances we may need to verify the accuracy of the new data you provide to us.
Right to erasure: in some circumstances you may ask for the information held about you to be erased (subject to certain criteria). This right enables you to ask us to delete or remove personal data where there is no good reason for us to continue to process it.
Right to restriction of processing: in some circumstances, you may ask us to restrict or suspend the processing of your information, for example when we no longer need your data but you want us to keep it in order to exercise or defend legal claims.
Right to object to processing: Where we are processing your personal data on the basis of our legitimate interests, you may be able to ask us to stop processing it and we will do so unless we can demonstrate we have an overriding legitimate reason to continue processing your personal data or we need to process it for the purposes of legal claims. As outlined below, regarding direct marketing communications, you may have the right to opt-out of receiving communications from us at any time even if you have chosen to opt-in on an earlier occasion.
Right to data portability: This only applies to information you have given us. You may, under certain circumstances, request that we transmit your personal information to another provider of services, or give it to you.

You can find out more about these rights by reading UK GDPR which you can view at: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance

If you would like to exercise or inquire about any of your rights mentioned above, you can do so by writing or emailing our Data Protection Officer at the address detailed above.

Your right to withdraw consent

Where you have provided consent for us to process your information (for example, where you have subscribed to our email newsletter or to any other marketing emails), you can withdraw your consent at any time.

You can withdraw your consent by writing or emailing our Data Protection Officer at the address detailed above. If you would like to unsubscribe from our marketing emails, you can also use the unsubscribe link contained in any of the marketing emails you have received from us.

Your right to make a complaint

If you have a complaint about the way we process your personal data or think that we have not complied with your rights, you can get in touch with us.

We hope that you won’t ever need to, but if you do need to complain about our use of your personal information we will ensure at all times that your complaint:

will be treated seriously;
will be dealt with promptly; and
will be dealt with in a professional manner.

There is more information about how you can make a complaint about the way in which we process personal data here Data Protection Complaints.

If we can’t resolve your complaint you can also make a complaint to:

The Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113 or 01625 545745
Fax: 01625 524510
Website: www.ico.org.uk

Changes to your personal information

It is important that the personal data we hold about you is accurate and current. Please keep us informed if you become aware that we have any inaccurate personal data we or if your personal data changes during your relationship with us, for example a new address or email address. We will not be responsible for any losses arising from any inaccurate, inauthentic, deficient or incomplete personal data that you provide to us.

Changes to Privacy Policy

We keep our Privacy Policy under regular review. If we change our Privacy Policy we will post the changes on this page, so that you may be aware of the information we collect and how we use it at all times. If you’d like a permanent copy of this Privacy Policy kindly print a copy for your records. Do check back in for the latest version of our Privacy Policy when submitting personal data to us.

This policy was last updated on the 15 September 2026.