Privacy
The sections below marked as unfinished are the substance of the policy and must be drafted or reviewed by a qualified adviser before publication. They have deliberately not been written for you: a privacy notice that misstates your lawful basis or your retention periods is worse than none.
What this website does
This site is a set of static pages. It sets no cookies, loads no third-party fonts, and embeds no advertising, social media, session-recording or fingerprinting scripts. Nothing on it requires a cookie banner.
The only page that transmits anything you type is the enquiry form on the contact page. It collects your name, email address, jurisdiction, a loss band and your message, and it asks you not to send transaction details or identification documents until a secure channel has been arranged.
Analytics: confirm whether Plausible is deployed, and on which domain. Plausible is cookieless and collects no personal data, but the notice must say whether it is in use and where the instance is hosted. If analytics are not deployed, state that no analytics are collected at all.
Who is responsible for your data
Data controller — registered name, company number, registered address, data protection registration number, and the contact address for privacy enquiries.
What is collected, why, and on what lawful basis
Categories of personal data processed in the course of an investigation, the purpose of each, and the lawful basis relied on. Investigations involve criminal-offence data and special-category data; this section needs specialist review.
How long it is kept
Retention periods for enquiry-form submissions, engaged-matter files, and evidential material, and the trigger for deletion of each.
Who it is shared with
Recipients and processors — instructed solicitors, law enforcement, analytics platform providers, hosting and email providers — and the safeguards applied to transfers outside the jurisdiction of establishment.
Your rights
The data subject rights available under the applicable regime, how to exercise them, the response time, and the supervisory authority a complaint may be made to.
Security
Technical and organisational measures — encryption at rest and in transit, access control, secure file transfer arrangements for client material, and breach notification procedure.
Last updated: date of the published version