Privacy Notice

Last updated: October 2026

1. Introduction

This Privacy Notice explains how we collect, use, store and share personal information when you visit our website, contact us, enquire about our services or instruct us to provide legal services. It also covers personal information about other individuals involved in legal matters, including family members, beneficiaries, witnesses and representatives, and explains your data protection rights.

We process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations 2003 (PECR), in each case as amended.

2. Who We Are

H & S Solicitors Limited is incorporated in England and Wales under company registration number 08011928. We are authorised and regulated by the Solicitors Regulation Authority under SRA number 567729.

H & S Solicitors Limited is the data controller for the processing described in this Privacy Notice. This means that we determine why and how your personal information is used.

For questions about this notice, to exercise your rights or to make a data protection complaint, please contact us using these details.

3. Personal Information We Collect

Depending on your relationship with us and the nature of the matter, we may collect:

• Your name, address, telephone number, email address and other contact details.
• Your date of birth, nationality and identification information.
• Copies of passports, driving licences, proof of address and other identity documents.
• Financial information, including bank account details and source of funds or wealth information.
• Information concerning your legal matter, correspondence, documents and instructions.
• Information about family members, beneficiaries, witnesses, representatives and others relevant to a matter.
• Information needed for anti-money laundering, financial sanctions and other legal or regulatory checks.
• Records of communications with us and information submitted through our website or by email.
• Technical information about your use of our website, where applicable, as explained in section 14.

Some matters involve special category personal information, such as information about health, racial or ethnic origin, religious beliefs or political opinions.

We may separately process information about criminal allegations, proceedings, convictions or offences. Criminal offence information is subject to additional legal safeguards and is distinct from special category information.

We process these categories only where an appropriate lawful basis and any additional legal conditions apply.

4. How We Collect Personal Information

We may obtain personal information:

• Directly from you when you contact or instruct us.
• Through website enquiry forms, telephone calls, emails or correspondence.
• From other individuals involved in a matter.
• From professional advisers, solicitors, barristers, courts, government departments and other organisations.
• From identity-verification, anti-money laundering and sanctions-screening providers.
• From publicly accessible registers and other lawful sources where necessary.

Where we obtain information from someone other than the individual concerned, we provide the required privacy information within the applicable legal timescales, unless a relevant exemption applies, including where disclosure would conflict with protected confidentiality or legal professional privilege.

5. How We Use Personal Information

We use personal information where necessary to:

• Respond to enquiries and assess whether we can accept instructions, including conflict checks.
• Establish and maintain client relationships and provide legal advice and representation.
• Prepare documents, applications and correspondence and communicate about matters.
• Verify identity and undertake anti-money laundering and sanctions checks.
• Comply with legal, professional and regulatory obligations.
• Manage payments, invoices, financial records and business administration.
• Prevent and detect fraud or other unlawful activity.
• Maintain records and establish, exercise or defend legal claims.
• Protect and maintain our website and systems.
• Send marketing communications where permitted by law.

We do not use personal information for incompatible purposes unless permitted or required by law. Where required, we provide further privacy information before processing for a new purpose.

6. Our Lawful Bases for Processing

The lawful basis depends on the particular purpose and circumstances. The main purposes and bases are set out below. We rely only on a basis whose requirements are met; listing more than one basis does not mean that each applies to every use of information.

Where we rely on legitimate interests, we assess whether the processing is necessary and whether your interests, rights and freedoms override those interests.

Where consent is our lawful basis, you may withdraw it at any time by contacting us or using the relevant preference controls. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

For special category information, we also require an applicable condition under Article 9 of the UK GDPR. This may include processing necessary for the establishment, exercise or defence of legal claims. Where another condition is needed, we identify and satisfy that condition and any associated statutory safeguards before processing.

For criminal offence information, we require an Article 6 lawful basis and authorisation under applicable law, including an appropriate condition under the Data Protection Act 2018 where required. We maintain an appropriate policy document where the relevant statutory condition requires one.

7. Anti-Money Laundering and Identity Verification

We are required in certain circumstances to verify identity, undertake anti-money laundering and other regulatory checks, and obtain information about the source of funds or wealth. We may use external providers to assist us.

Where legally required, we may disclose information to relevant authorities, including the National Crime Agency, without notifying the individuals concerned. In some circumstances, the law may prevent us from explaining a disclosure or the action we have taken.

We may be unable to accept or continue instructions if necessary checks cannot be completed.

8. Confidentiality and Sharing Information

We recognise the confidential nature of information entrusted to us. We do not sell personal information.

Where necessary and lawful, we may share information with:

• Courts, tribunals and government departments.
• Barristers, experts and other professional advisers involved in a matter.
• Other parties and their legal representatives where necessary to progress instructions.
• Banks, payment service providers and financial institutions.
• Identity-verification, anti-money laundering and sanctions-screening providers.
• IT support, case-management software, cloud storage and other service providers acting on our behalf.
• Professional indemnity insurers, auditors and external professional advisers.
• The Solicitors Regulation Authority, law enforcement agencies and other competent authorities.

We limit disclosures to what is appropriate for the purpose and take appropriate steps to protect personal and confidential information. Where a provider processes information on our behalf, we put appropriate contractual protections in place. Some recipients act as independent data controllers and are responsible for their own processing.

Nothing in this notice overrides applicable duties of client confidentiality or legal professional privilege. A data protection lawful basis does not, by itself, authorise disclosure of confidential or privileged client information.

9. How Long We Keep Personal Information

We retain personal information only for as long as necessary for the purpose for which it is held, taking account of applicable legal, regulatory and professional obligations.

Client matter files are generally retained for six years following the date of our final bill. A longer period may be appropriate because of the nature of the matter, relevant limitation periods, a complaint or legal claim, or another legal or professional obligation. We assess and document the reason for longer retention rather than retaining files indefinitely.

Documents held in safekeeping may be subject to separate arrangements. Anti-money laundering records are subject to their applicable statutory retention and deletion requirements.

For enquiries that do not result in instructions, retention depends on whether follow-up remains necessary, whether there is a complaint or potential claim, and whether limited information needs to be retained for conflict checking. Financial and other business records are retained by reference to applicable statutory requirements, the continuing business purpose and relevant limitation periods.

When information is no longer required, we securely delete, destroy or anonymise it, as appropriate.

10. How We Protect Your Information

We use appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. These include measures appropriate to the information and risks involved, such as access restrictions and secure storage.

No electronic transmission or storage method can be guaranteed to be entirely secure. This does not limit our responsibility to apply appropriate safeguards or comply with our legal obligations.

11. International Transfers of Personal Information

Where personal information is transferred outside the United Kingdom, we ensure that the transfer complies with applicable UK data protection law. Depending on the circumstances, this may involve reliance on UK adequacy regulations, appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, or a specific legally permitted exception.

Where required, we assess the protection provided by the transfer arrangements and apply additional safeguards. You can contact us using the details in section 2 for information about relevant transfers and to request a copy of applicable safeguards. We may redact confidential information where necessary.

12. Your Data Protection Rights

Subject to applicable conditions and exemptions, you may have the right to:

• Access your personal information.
• Correct inaccurate or incomplete information.
• Have personal information erased.
• Restrict processing.
• Object to processing based on legitimate interests, on grounds relating to your particular situation.
• Receive personal information in a portable format and, where applicable, have it transmitted to another controller.
• Withdraw consent where processing is based on consent, without affecting earlier lawful processing.

You have the right to object at any time to processing for direct marketing, including related profiling. If you object, we will stop processing your information for that purpose.

Rights are not absolute. Relevant limitations may include legal retention requirements and exemptions protecting legal professional privilege or the rights of others. We consider the applicable legal position when responding to a request.

Please use the contact details in section 2 to exercise your rights. We may request information reasonably necessary to verify your identity. We respond within the applicable statutory timescales. Requests are normally free of charge; any fee or refusal will be limited to circumstances permitted by law and explained to you.

13. Marketing Communications

We may occasionally provide information about our services or legal developments where permitted by law. Where consent is required for electronic marketing, we obtain it before sending the communications.

You may opt out at any time by contacting us or using the unsubscribe facility in the relevant communication. We may retain limited information on a suppression list to ensure that we respect your preference.

14. Cookies and Website Technologies

Our website may use cookies and similar technologies for functions such as security, site operation, preferences and usage measurement. Information about the technologies actually used, their providers, purposes and durations, and the choices available to you, is provided through the cookie information and controls made available on our website. Where consent is required, we obtain it before using the technology and provide a means to withdraw that consent.

Where a statutory exception to consent applies, we comply with its conditions, including providing information and an opportunity to object where required. Browser settings may also allow you to block or delete cookies, although doing so may affect website functionality.

15. Third-Party Websites

Our website may link to websites operated by third parties. Those operators are responsible for their own privacy practices. Please review their privacy notices before providing personal information.

16. Information We Require From You

Some information is required by law, including information needed for applicable identity-verification and anti-money laundering checks. Other information is necessary to enter into or perform our agreement with you or to conduct your matter.

We explain what information is required in the circumstances. If you do not provide necessary information, we may be unable to accept or continue instructions. Where information is optional, we will make this clear.

17. Automated Decision-Making

We may use electronic systems to assist with identity verification, anti-money laundering checks, sanctions screening and other risk assessments. The use of an electronic system does not necessarily mean that a decision is taken solely by automated means.

Where any decision concerning you is made solely by automated processing and has legal or similarly significant effects, we will provide the information and safeguards required by applicable data protection legislation, including information about the decision and relevant rights where applicable.

18. Complaints About Personal Information

You have the right to complain to us about how we use your personal information. Please contact us using the details in section 2, describing your concern and providing any information that will help us investigate. We will acknowledge and investigate your complaint, keep you appropriately informed and explain the outcome without undue delay, in accordance with applicable legal requirements.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator. We welcome the opportunity to address your concerns first, but this does not remove your right to contact the ICO.

19. Changes to This Privacy Notice

We may update this notice to reflect changes in law, guidance, our services or the way we process personal information. The current version and its update date will appear on our website. Where required, we will bring material changes to your attention and provide further information before processing for a new purpose.