Privacy Notice

This notice explains how Lawyerly Ltd collects, uses, shares and protects personal data, and the rights you have. It applies to everyone whose personal data we handle, including enquirers, clients and the people who represent them, people connected with the matters we handle, website visitors, job applicants and suppliers.

Lawyerly Ltd is the controller of the personal data described in this notice, including the personal data in our client matters.

Please read this notice together with our Cookie Policy, our Processors and third parties page, and any specific privacy information we give you when we collect your personal data.

Lawyerly Ltd is a company registered in England and Wales (company number 15697410), with its registered office at 3rd Floor, 45 Albemarle Street, London W1S 4JL. We are registered with the Information Commissioner’s Office.

We are authorised and regulated by the Solicitors Regulation Authority (SRA number 8010987), and we owe every client a duty of confidentiality that nothing in this notice reduces. We handle personal data in line with the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003.

Enquirers

Your name, role and business contact details, information about your business and its legal need, records of our communications with you, and your marketing preferences.

Clients and the people who represent them

Where your business is our client, or you are its director, officer, employee, shareholder or key representative, we collect your name, role, contact details and signature where relevant; the identity verification and anti-money laundering information the law requires, including identity documents, proof of address and sanctions and politically exposed person screening; information about the business, its ownership and your connection to it; payment and billing information; records of our communications and meetings, including recordings and transcripts where you have consented; documents provided for a matter; and your use of the Client Hub, including login records, activity logs and uploads.

People connected with our clients’ matters

A matter will often involve people who are not our client, such as the client’s employees, directors and shareholders, the other party and its advisers, customers, suppliers and witnesses. Depending on the matter, we may hold their names, roles and contact details, the contents of contracts, correspondence and other documents, and employment, financial or dispute information relevant to the matter.

Website visitors

Technical information such as your IP address, browser, device and operating system, information about how you use the site, and anything you submit through our web forms. Our Cookie Policy explains how we use cookies.

Job applicants

Your CV, covering letter, employment history, references, right to work documents and contact details. Successful applicants receive a separate privacy notice for staff.

Suppliers and other contacts

The business contact details and role of the people we deal with, and the information needed to manage the relationship and any payments.

We collect personal data directly from you, from our client where you are connected with a matter, and from your colleagues or representatives. We also obtain it from public sources such as Companies House, HM Land Registry, court records, sanctions lists and professional registers, from providers we engage such as identity verification services, and automatically through our website, the Client Hub, our email systems and our security tools.

Where we need information to verify your identity under anti-money laundering law, providing it is a legal requirement. If it is not provided, we cannot act for you. Other information we ask for is needed under our contract with you, and without it we may not be able to act.

Our lawful bases

We use personal data only where we have a lawful basis under the UK GDPR. We rely on the performance of a contract, or steps taken at your request before entering into one; compliance with our legal and regulatory obligations, including anti-money laundering, SRA, accounting and tax obligations; our legitimate interests, and those of our clients, where these are not overridden by your rights; and your consent, where we ask for it.

Acting for our clients

We use personal data to set up client accounts, complete identity and conflict checks, take instructions, give legal advice, prepare and negotiate documents, correspond with other parties, run the Client Hub and manage payments. For our clients and their representatives, we rely on our contract with the client, our legal and professional obligations, and our legitimate interest in running our service.

People in our clients’ matters

For other people connected with a matter, we rely on our client’s and our own legitimate interests in obtaining and giving legal advice and in establishing, exercising or defending legal rights, and on our legal and professional obligations. We use only what the matter requires, under our professional duty of confidentiality.

Running our business

We use personal data to administer our accounts, manage suppliers, develop our service, train and supervise our team, protect our systems, keep the records our regulator requires, and exercise or defend legal claims, relying on our legitimate interest in running a well-managed and secure firm and on our legal obligations.

Communicating with you

We use personal data to respond to enquiries and to send service messages and information you have asked for, relying on our contract with you, our legitimate interests or your consent.

Marketing

We send information about our services to business contacts with their consent or, where the Privacy and Electronic Communications Regulations allow, on the basis of our legitimate interests. You can opt out at any time.

We do not routinely collect special category data, such as information about health, ethnic origin or religious beliefs. Where we do, we rely on your explicit consent, the needs of legal claims or legal advice, reasons of substantial public interest such as preventing unlawful acts, or another condition under Article 9 of the UK GDPR and Schedule 1 to the Data Protection Act 2018.

Identity verification may compare a photograph or short video of you with your identity document, which uses biometric data. We ask for your explicit consent before the check is run, and we use the result only to verify your identity.

A matter may involve information about criminal convictions or offences, or our checks may reveal it. We use it only where a condition in Schedule 1 to the Data Protection Act 2018 applies, most often in connection with legal claims and legal advice, or the prevention or detection of unlawful acts.

Where we use special category or criminal offence data, we apply additional safeguards, including stricter access controls and an appropriate policy document where the law requires one.

Strictly necessary cookies make our website work and keep it secure, and are set automatically. With your consent, we also use analytics cookies to understand how the website is used. We do not use advertising cookies or cookies that track you across other websites. Our Cookie Policy explains the cookies we use and how to manage your preferences.

We send marketing only where the law allows, using business contact details. Every marketing email includes an unsubscribe link, and you can also opt out by emailing support@lawyerly.co. Opting out does not affect the service messages we need to send.

Our group

Lawyerly Ltd is wholly owned by Lawyerly Group (Pty) Ltd, a South African company that is our technology provider. It hosts and operates the systems we use, including our case management platform, the Client Hub and our Microsoft 365 environment, acting only on our instructions as our processor under a data processing agreement and an International Data Transfer Agreement. It does not provide legal services, has no independent access to the content of our client matters, and does not use personal data for its own purposes.

Our platform developer

Lawyerly Group engages Shft (Pty) Ltd, a South African technology company, to build and maintain the platform, operate the infrastructure and provide IT and security administration. Shft acts under written processing terms that reflect our requirements, and has given us direct transfer safeguards.

Our service providers

We use service providers for cloud hosting and productivity, customer relationship management and marketing, identity, access and messaging for the Client Hub, meeting transcription with your consent, AI tools, compliance, operations and finance, and regulatory compliance advice. They act as our processors under written contracts and may not use personal data for their own purposes. Our Processors and third parties page names each provider, with its location and safeguards.

Independent controllers

Our payment provider, Stripe, is a controller of the payment data it processes, and our identity verification provider, ComplyCube, is a controller of certain verification records. Their own privacy notices apply to that processing.

Others in a matter

To carry out a client’s instructions, we may share personal data with the other parties to a matter and their advisers, with courts, tribunals, registries and regulators, and with barristers, accountants or other specialists engaged on the matter. Where we make a referral at your request, we share only what the referral needs.

Regulators, insurers and auditors

We share personal data with regulators, courts and law enforcement bodies where the law, a court or a regulator such as the Solicitors Regulation Authority, the Information Commissioner’s Office or HM Revenue and Customs requires it. We may also share it with our professional indemnity insurers and brokers, our accountants and auditors, and our compliance consultants, each under a duty of confidentiality.

Changes to our business

If we sell, restructure or reorganise our business, we may share personal data with the parties involved and their advisers, subject to confidentiality, data protection safeguards and our regulatory obligations.

Where personal data leaves the United Kingdom, we put an appropriate transfer mechanism in place and assess the risks before the transfer takes place.

Transfers to South Africa, where Lawyerly Group, Shft and our marketing operations provider are based, are made under the International Data Transfer Agreement issued by the Information Commissioner’s Office, supported by our transfer risk assessment.

Transfers to the United States, where several of our software providers or their parent companies are based, are made under the UK Extension to the EU-US Data Privacy Framework where the provider is certified, and otherwise under the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment.

Transfers to the European Economic Area are covered by the United Kingdom’s adequacy regulations. Our Processors and third parties page shows the location and safeguard for each provider, and our Information Governance Lead can provide a copy of the relevant safeguards on request.

Client matter files, including personal data about other people in a matter, are kept for seven years after the end of the client relationship, or longer where a matter carries extended limitation exposure.

Identity verification and client due diligence records are kept for five years after the end of the business relationship, as anti-money laundering law requires.

Financial, accounting and tax records are kept for six years from the end of the relevant accounting period, and supplier and contract records for seven years after the contract ends.

Marketing data is kept until you opt out or for two years from your last meaningful contact with us, whichever is sooner. Unsuccessful job applications are kept for six months after the recruitment decision, unless you agree to a longer period, and website analytics data for two years before it is aggregated or deleted.

Deleted data may remain in backups for a short period before it is overwritten in the ordinary course. Where a legal hold applies, we keep the data for as long as the hold requires.

We protect personal data with appropriate technical and organisational measures, including encryption, access controls and multi-factor authentication, and we require the same of our providers.

No system is completely secure. If a breach occurs, we will notify the Information Commissioner’s Office and anyone affected where the law requires it. If you become aware of a possible incident affecting your personal data, please contact us promptly.

You have the right to be informed about how we use your personal data, to access it, to have it corrected, to have it erased, to restrict how we use it, to receive it in a portable format, to object to how we use it, and not to be subject to decisions based solely on automated processing that have legal or similarly significant effects. You may object to direct marketing at any time, and where we rely on your consent, you may withdraw it at any time without affecting what we did before.

Most of these rights are not absolute. For example, we may not be able to erase personal data that the law or our regulator requires us to keep, or that we need for legal claims.

Some of the personal data we hold is protected by legal professional privilege or by our duty of confidentiality to our clients. The law recognises this, and we may withhold information on that basis or where disclosure would reveal another person’s personal data. Where we rely on an exemption, we will inform you, unless doing so would defeat its purpose.

If you are not our client and your personal data appears in a matter we are handling, we may not be able to inform you directly at the time, for example where doing so would prejudice our client’s position. This notice provides that information instead.

To exercise your rights, please email support@lawyerly.co. We will respond within one month, which we may extend by up to two further months for complex or numerous requests, in which case we will inform you. We do not usually charge a fee, but we may charge a reasonable fee for, or refuse, a request that is manifestly unfounded or excessive. We may need to verify your identity before responding. We will make reasonable and proportionate searches, and the time to respond is paused while we wait for information we need to verify your identity or understand your request.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

We use AI tools for research, drafting, summarising, document review and operational support. We review, and remain responsible for, all legal advice and work. We assess each AI provider before use, use business-grade services under written contracts, and require that personal data and client information are not used to train their models. Our AI providers are listed on our Processors and third parties page.

If you are unhappy with how we have handled your personal data, please raise it with our Information Governance Lead at support@lawyerly.co first, so that we can try to put things right. We will acknowledge your complaint within 30 days, look into it without undue delay and inform you of the outcome.

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection, at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, on 0303 123 1113, or at ico.org.uk.

We may update this notice to reflect changes to our services, how we use personal data, or the law. The version number and effective date are shown at the top of this page. Where a change is material, we will take reasonable steps to notify you, such as by a notice on our website, a message in the Client Hub or an email.

Earlier versions of this notice are available on request.