Privacy Notice
This Privacy Notice explains how Bone & Payne LLP collects, uses, stores and shares personal data relating to clients, prospective clients and other individuals who contact us or use our services.
It provides an overview of the personal data we may hold, why we use it, who we may share it with, how long we may keep it and the rights available to you.
1. Who we are
Bone & Payne LLP is the controller of personal data covered by this Privacy Notice. We are a firm of solicitors regulated by the Solicitors Regulation Authority. We are committed to handling personal data lawfully, fairly, securely and transparently in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and our professional duties of confidentiality. Oversight of data protection compliance rests with the firm’s Data Protection Supervisor, Jamie Herbert.
2. The personal data we may collect
Depending on the nature of your enquiry, instructions or dealings with us, we may collect and hold personal data including your name, address and contact details; date of birth and identification information; financial and payment information; information relevant to your legal matter or transaction; correspondence, documents and records you provide to us; and other personal data reasonably required for client onboarding, file administration, legal advice, regulatory compliance, risk management and the legitimate operation of the firm.
3. How we use your personal data
We use personal data for client onboarding, conflict checks, identity and anti-money laundering checks where required, opening and administering files, advising and acting for clients, corresponding with clients and others involved in a matter, managing accounts and payments, complying with legal and regulatory obligations, maintaining business records, and protecting the security and integrity of our systems, files and premises. We will process personal data only where we have a lawful basis for doing so. Depending on the circumstances, this may include taking steps at your request before entering into a contract, performing our contract with you, complying with legal and regulatory obligations, pursuing our legitimate interests in operating and safeguarding the practice, or relying on consent where consent is the appropriate basis.
Where appropriate to a matter, we may also process special category data or other confidential personal data requiring additional protection, for example information concerning health or other sensitive matters relevant to the legal services requested. We will do so only where there is a lawful basis and, where required, an additional lawful condition applies.
4. Who we may share your personal data with
We will share personal data only where this is necessary, proportionate and lawful. This may include sharing with banks, identity verification providers, barristers, experts, courts, tribunals, regulators, insurers, auditors, translation or other professional support providers, and IT or other service providers engaged to support our operations. We may also disclose personal data where this is necessary for your matter, to comply with legal or regulatory obligations, or to protect the legitimate interests of the firm or our clients.
5. How long we keep your personal data
We will retain personal data only for as long as is reasonably necessary for legal, regulatory, professional, client and business purposes. Retention periods may vary depending on the nature of the matter, applicable limitation periods, regulatory requirements and our internal retention practices. When information is no longer required, it will be securely deleted, destroyed or anonymised as appropriate.
6. Your rights
You may have rights in relation to your personal data, including rights of access, rectification, erasure, restriction of processing, objection to processing and, in some circumstances, data portability. These rights are not absolute and may be affected by legal professional privilege, duties of confidentiality and other lawful restrictions. If you have any query about how we handle personal data, or if you wish to exercise any of your rights, please contact the firm. If you are dissatisfied with how your personal data has been handled, you may raise the matter with the Information Commissioner’s Office.
7. Contact us
This Privacy Notice is provided for information purposes and does not require signature or separate acknowledgement. Where consent is required for any specific processing activity, this will be requested separately. If you would like further information about this Privacy Notice or our handling of personal data, please contact Bone & Payne LLP.
Version dated 26.05.26