Privacy Notice

Lawyerly Ltd is a private limited company registered in England and Wales with company number 15697410. Our registered office is at 3rd Floor, 45 Albemarle Street, London, W1S 4JL.

We are the controller of the personal data we collect and process as described in this notice. We are registered with the Information Commissioner's Office.

Lawyerly Ltd is authorised and regulated by the Solicitors Regulation Authority (SRA number 8010987). Our solicitors are bound by the SRA Standards and Regulations, including the duty of confidentiality owed to every client. That duty sits alongside, and is not reduced by, anything in this notice.

We handle personal data in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003.

You can contact us about this notice or any data protection matter:

• by email at support@lawyerly.co

• by post to 3rd Floor, 45 Albemarle Street, London, W1S 4JL

• by phone on 0203 442 8479.

If you have a specific concern about how we handle your personal data, please address your message to the Information Governance Lead.

When you enquire about our services, we may collect:

• your name, role and business contact details;

• information about the business you represent;

• information about your legal need or the matter you are enquiring about;

• records of our communications with you, including emails, forms, calls and meetings; and

• marketing preferences and any consents you have given.

When your business becomes a client, or you are connected with a client business (for example as a director, officer, employee, shareholder or key representative), we may collect:

• your name, role, business contact details and signature where relevant;

• identification and verification information collected for anti-money laundering and know-your-client checks, including identity documents, proof of address and the results of screening against sanctions and politically exposed persons lists;

• information about the client business, its ownership and your relationship to it;

• payment and billing information;

• records of our communications and meetings, including recordings and transcripts of meetings where you have consented;

• documents and information provided to us in connection with a matter; and

• information generated through your use of the Client Hub, including login records, activity logs and uploaded content.

When we act for a client, the matter will often involve personal data about people who are not our client. Examples include the client's employees, directors and shareholders; the other party to a contract, negotiation or dispute and their representatives and advisers; the client's customers and suppliers; witnesses; and other professionals involved in the matter.

The personal data we hold depends on the matter. It may include names, roles and contact details; the contents of contracts, correspondence and other documents; employment information; financial information relevant to the matter; and information about disputes, complaints or claims.

We normally receive this information from our client rather than from you. We may also obtain it from public sources such as Companies House, HM Land Registry, court records and professional registers, or from other parties to the matter and their advisers.

When you visit our website, we may collect:

• technical information such as IP address, browser type, device type and operating system;

• usage information such as pages viewed, time on site and referring sources; and

• information you submit through web forms, including any message content.

We explain how we use cookies and similar technologies in our Cookie Policy.

When you apply for a role with us, we may collect your CV, covering letter, employment history, references, right to work documentation, contact details and any other information you provide as part of your application or that we obtain through reference checks. Successful applicants receive a separate Employee Privacy Notice covering the wider scope of staff personal data we hold.

When we engage suppliers, advisers or other contacts, we may collect the business contact details of the relevant individuals, their role, and the information necessary to manage the relationship and any associated payments.

We process personal data only where we have a lawful basis under the UK GDPR. The lawful bases we rely on are:

• performance of a contract with you, or taking steps at your request before entering into a contract;

• compliance with a legal or regulatory obligation, including our anti-money laundering, SRA, accounting and tax obligations;

• our legitimate interests, and those of our clients, as described in each purpose below, where those interests are not overridden by your rights and freedoms; and

• your consent, where we ask for it (for example, for certain marketing activities, for meeting recordings or for particular special category data).

We process personal data to set up client accounts, complete onboarding and compliance checks, take instructions, give legal advice, prepare and negotiate documents, correspond with other parties, manage the Client Hub and complete payments and billing.

For the personal data of our clients and their representatives, the lawful bases are performance of our contract with the client, compliance with our legal and professional obligations, and our legitimate interests in running our service.

For the personal data of other people connected with a matter, the lawful bases are our legitimate interests and those of our client in obtaining and giving legal advice and in establishing, exercising or defending legal rights, and compliance with our legal and professional obligations. We process only what the matter requires and we handle it under our professional duty of confidentiality.

We process personal data to administer our accounts, manage our suppliers, develop and improve our service, train and supervise our team, protect our systems and information, keep the records our regulator requires, and exercise or defend legal claims. The lawful bases are our legitimate interests in operating a well-run and secure firm and, where applicable, compliance with legal obligations.

We process personal data to respond to your enquiries, send you service-related messages and updates, and provide information you have requested. The lawful bases are performance of a contract or our legitimate interests in responding to you, and your consent where required.

We process limited personal data to send you information about our services that we think may interest you. We do this on the basis of your consent or, where permitted by the Privacy and Electronic Communications Regulations, on the basis of our legitimate interests in promoting our services to business contacts. You can opt out of marketing at any time using the unsubscribe link in our messages or by contacting us.

We process personal data to comply with our obligations under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, the SRA Standards and Regulations, tax and accounting law, data protection law, and any other law, regulation, or court or regulatory order that applies to us.

Lawyerly Ltd is wholly owned by Lawyerly Group (Pty) Ltd, a South African company. Lawyerly Group is our technology provider: it hosts and operates the systems on which we run our practice, including our case management platform, the Client Hub and our Microsoft 365 environment. It does this only on our instructions and as our processor, under a written data processing agreement and an International Data Transfer Agreement. Lawyerly Group does not provide legal services, has no independent access to the content of our client matters, and does not use personal data from our practice for its own purposes.

Lawyerly Group engages Shft (Pty) Ltd, a South African technology company, to build and maintain the platform, operate the production infrastructure and provide IT and security administration. Shft acts under written processing terms that flow down our requirements, and it has given us direct transfer safeguards.

We use carefully selected service providers to support our operations and the delivery of our services. They act as our processors, on our documented instructions and under written contracts meeting the requirements of Article 28 of the UK GDPR, and they may not use personal data for their own purposes. The main categories are:

• cloud hosting, productivity and collaboration platforms (for example, Microsoft and Microsoft Azure);

• customer relationship management and marketing platforms (for example, HubSpot), together with our marketing operations provider Seek the Just (Pty) Ltd;

• identity and access management and in-app messaging for the Client Hub (for example, Auth0 and Sendbird);

• meeting transcription tools used with your consent (for example, Fireflies);

• AI tools that support service delivery (for example, Anthropic), as described in the Automated decision-making and AI section below;

• compliance, operational and finance tooling (for example, monday.com and Xero); and

• our external regulatory compliance consultants, who support our compliance function under confidentiality terms.

The current list of our processors, where they are located and the transfer safeguards that apply is published on our processors and third parties page. We update that page when we add or change a provider.

A small number of providers decide for themselves how they handle certain personal data and are therefore controllers of it, alongside us. Our payment provider, Stripe, is a controller of the payment data it processes, and our identity verification provider, ComplyCube, is a controller of certain verification records. Their own privacy notices apply to that processing, and they are identified as independent controllers on our processors and third parties page.

To carry out a client's instructions we may need to share personal data with the other parties to a matter and their advisers, with courts, tribunals, registries and regulators, and with barristers, accountants, tax advisers, notaries or other specialists engaged in connection with a specific matter. We share only what the matter requires.

Where we make a referral or introduction at your request, we share only the information you have asked us to share or that is needed for the referral.

We may share personal data with regulators, courts and law enforcement bodies where we are required to do so by law, by a court order or by a regulatory authority such as the Solicitors Regulation Authority, the Information Commissioner's Office or HM Revenue and Customs. We may also share personal data with our professional indemnity insurers and brokers, our accountants and auditors, and our regulatory compliance consultants, in each case under duties of confidentiality.

If we sell, restructure or reorganise our business or assets, we may share personal data with the relevant counterparties and their advisers, subject to appropriate confidentiality and data protection safeguards and to our regulatory obligations.

You have the right to be informed about how we collect and use your personal data. This notice is our main way of providing that information.

You have the right to ask us for a copy of the personal data we hold about you and information about how we process it.

You have the right to ask us to correct personal data we hold about you that is inaccurate or incomplete.

You have the right to ask us to erase personal data we hold about you in certain circumstances, for example where the data is no longer needed for the purposes for which we collected it. We may not be able to comply where we are required to keep the data by law or by our regulator, or where it is needed for the establishment, exercise or defence of legal claims.

You have the right to ask us to restrict our processing of your personal data in certain circumstances, for example while we investigate a complaint or a rectification request.

Where we process personal data on the basis of consent or performance of a contract and by automated means, you have the right to ask us to provide that data to you, or to another controller, in a structured, commonly used and machine-readable format.

You have the right to object to our processing of personal data where we rely on legitimate interests. You also have the right to object to processing for direct marketing purposes at any time, and we will stop that processing when you do so.

You have the right not to be subject to a decision based solely on automated processing which produces a legal effect on you or similarly significantly affects you, except in limited circumstances permitted by law. We do not make such decisions about you.

Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Because we are a law firm, some of the personal data we hold is subject to legal professional privilege or to the duty of confidentiality we owe to our clients. Data protection law recognises this. We are not required to disclose information that is covered by legal professional privilege, and we may withhold information that would reveal another person's personal data without their agreement. Where we rely on an exemption we will tell you, unless doing so would itself defeat the purpose of the exemption.

If you are not our client and your personal data appears in a matter we are handling, we may not be able to tell you about that processing directly at the time, for example where doing so would prejudice our client's legal position or would involve disproportionate effort. This notice is how we provide that information in those cases.

To exercise any of your rights, please contact us at support@lawyerly.co. We will respond within one month, although we may extend this period by up to two further months for complex or numerous requests, in which case we will let you know. We do not usually charge a fee, but we may charge a reasonable fee or refuse to act on a request that is manifestly unfounded or excessive.

We may need to verify your identity before responding to a rights request, particularly where it relates to special category data or where there is a risk that the request has come from someone other than the data subject.