Our Privacy Policy
This Notice is primarily for the benefit of our clients or potential clients or for related third parties whose data we may process as part of the provision of legal services. We maintain and will provide separate privacy notices in relation to the collection and use of personal information about our staff and employees, including potential employees, during and after their working relationship with us.
This firm processes your data in accordance with the terms of the Data (Use and Access) Act 2025, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019) and the relevant provisions relating to the General Data Protection Regulation contained within the European Union (Withdrawal) Act 2018 (UK GDPR).
The terms ‘personal data’, ‘data controller’, ‘data processor’ and ‘data subject’ are as defined in the Data Protection Act 2018 and UK GDPR.
This Data & Privacy Notice explains, in detail, the types of personal data we may collect about you when you interact with us. It also explains how we will store and handle that data and keep it safe. Unless otherwise indicated, references in this Data and Privacy Notice to the GDPR refer to the UK GDPR.
Conditions for Processing Data
We are only entitled to hold and process your data where the law allows us to. The current law on data protection (Article 6 GDPR) sets out a number of different reasons for which a law firm may collect and process your personal data. These include:
Contractual obligations: The main purpose for our holding your data is to provide you with legal services under the agreement we have with you. This agreement is a contract between us and the law allows us to process your data for the purposes of performing a contract (or for the steps necessary to enter into a contract). We may also need to process your data to meet our contractual obligations to the Legal Aid Agency where you receive legal aid to fund your case or advice.
Legitimate Interests: In specific situations, we require your data to pursue our legitimate interests in a way which might reasonably be expected as part of running our businessand which does not materially impact your rights, freedom or interests. Should we identify a need to use this processing basis, we will have ensured the use of personal data is necessary for the purposes of the legitimate interests we have identified and that this processing has been balanced against the interests of the data subject whose information we need to use.
Recognised Legitimate Interests: In some circumstances, we may need to process your data for the purposes that do not relate to our core functions but because there is a recognised legitimate interest and the data processing is in the public interest. This may include processing necessary for national security, detection or prevention of crimeor safeguarding vulnerable individuals.
Legal compliance: If the law requires us to, we may need to collect and process your data. For example, we can pass on details of people involved in fraud or other criminal activity.
Consent: In some situations, we can collect and process your data with your consent. For example, when you tick a box to receive email newsletters. When collecting your personal data, we'll always make clear to you which data is necessary in connection with a particular service.
When do we collect your data?
We normally collect your data when you provide it to us or when it is provided to us by others (your opponent's solicitors for example) during your case. You may give us your data by email; through an online web form; over the telephone; face to face; or by post.
We also collect data automatically with regard to each of your visits to our website including technical information.
What sort of data do we collect?
Information you provide to us: You voluntarily give us your personal information for instance when you contact us via our website, sign up to any newsletters, interact with us on social media platformsand/or use our services.
Client services: We may collect personal data as follows:
- name and contact details (including address, email and phone numbers). This may include asking for and keeping a copy of your passport/driving licence and proof of address
- date of birth
- personal information that may be included in communications with us
- payment information and financial information that relates to a contractual relationship including bank details.
We may gather details of your age; ethnicity; gender etc. if required to do so by the Legal Aid Agency where you are in receipt of Legal Aid. Where you have Legal Aid, we may also gather financial information from you. We also collect and hold information about your case or legal problem.
Depending on the circumstances of their legal matters, for some clients, we may have access to or process personal data relating to criminal convictions and offences or related security measures. The special condition for processing this data (pursuant to Schedule 1 and Article 10 of the GDPR) is because it is necessary for, connected to and/or or relates to legal claims including for the purposes of assisting with legal proceedings, obtaining legal advice and/or establishing, exercising or defending legal rights. We have considered the risks and impact associated with the processing of criminal offence data not least with regard to data minimisation, security and transparency.
Website or third party sources: We collect certain related technical information including, but not limited to, traffic data, location data, logs (including, where available, the IP address and location of the device connecting to the online services) and other communication data. Information may be collected through the use of cookies or pixels to maintain and improve our website.
How do we use your data?
Provision of services: We only use your data for the purposes of providing you with legal advice, assistance and where appropriate, representation and for reasons directly associated with those services.
Regulatory: We use data to communicate with our regulators or legislators and to obey laws, regulations and codes of conduct that apply to us. For example, we will process your data to conduct fraud, credit and anti-money laundering checks.
Website enhancement and business development: We use data to develop our business and services, respond to individual experiences, conduct researchand understand your website journey.
Cookies
A cookie is a small file which asks permission to be placed on your computer’s hard drive. We use cookies (like Google Analytics) to monitor how our website is being used so we can make improvements. For full details on the exact cookies we use, how we use themand how you can opt out or manage your preferences, please read our full Cookie Policy.
Artificial Intelligence
In order to provide an optimum service to our clients, we may utilise technology which uses artificial intelligence (AI) to improve our business processes, expedite legal researchand help facilitate anti-money laundering procedures. We take steps to ensure our use of AI technology is safe, secure and compliant with data protection legislation. Personal data will only be processed through an AI tool where we have conducted a data protection impact assessment.
Automated decision making
Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. We do not envisage that any decisions will be taken about you using automated means, however we will notify you in writing if this position changes.
Where all parties consent, we may use WhatsApp as a convenient way to communicate with clients and provide updates on their case. While we strive to keep our communications secure, it is important to understand that WhatsApp messages are stored on client files for record-keeping and may potentially be used in the legal process.
How do we protect your data?
We take protecting your data very seriously. We protect our IT system from Cyber Attack. Access to your personal data is password-protectedand sensitive data is secured by encryption.
How long will we keep your data?
We use the following retention periods:
- Information in a matter file will usually be kept for a period of six years after the case or matter ends.
- Data obtained for compliance with crime or fraud prevention has to be retained by us for five years.
- Enquiries where we do not take on your case are kept for only 18 months.
- Any complaints files for six years after the complaint is concluded.
- Financial information will be kept for a period of 7 years to comply with HMRC requirements.
- Enquiries about job opportunities are kept for 12 months.
Who do we share your personal data with?
We sometimes share your personal data with trusted third parties such as barristers, experts, translatorsand secure file storage companies. We apply a strict policy to those recipients to keep your data safe and protect your privacy.
Where is your data processed?
Your data is stored and processed within the United Kingdom (UK). If we ever have to share your personal data with third parties and suppliers outside the UK we will seek your specific consent to do so.
What are your rights?
You have the following rights under the UK GDPR: the right to be informed, the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, the right to objectand rights in relation to automated decision making and profiling.
Complaints about your personal data
In accordance with the Data (Use and Access) Act 2025, should you wish to raise a complaint about a potential breach of your personal data or if you have any other concern about our handling of your personal data, please contact our Director Mr Ishtiaq Sarwar. Enquires and requests can be sent to them via email at crime@blackandcosolicitors.co.uk, by phone at 01455 844005or by writing to Black & Co, 3-5 Welford Road, Leicester LE2 7AD. They will acknowledge your complaint within 30 days and, without undue delay, take appropriate steps to respond to the complaint and inform you of the outcome.
You also have the right to lodge a complaint with the ICO. For further information please visit: https://ico.org.uk/make-a-complaint/data-protection-complaints or call 0303 123 1113.
Changes to this Notice
We reserve the right to revise this Notice at any time. If this Notice changes in any way, we will place an updated version on this webpage.
Version: July 2026