Privacy & Cookie Policy

Blacks Legal | Version 1.16 | 4 October 2026 | Review: October 2027 or on any material change

1. Who we are

Blackslegal Ltd, trading as Blacks Legal, as Solutions4Startups and as LeaseExtensionsDirect, is the controller of the personal data described in this notice. We are a company registered in England and Wales under number 11308835, with our registered office and principal place of business at 88 Cromer Street, London WC1H 8DG. We are authorised and regulated by the Solicitors Regulation Authority under SRA ID 649766.

We are registered with the Information Commissioner’s Office as a fee payer under registration number ZA467559.

We have not appointed a statutory Data Protection Officer. We have assessed the position under Article 37 of the UK GDPR and concluded that appointment is not mandatory for our processing. Responsibility for data protection is held by our data protection lead.

How to contact us

Details

Data protection lead

Kasim Hussain

Email

[email protected]

Post

Data Protection Lead, Blacks Legal, 88 Cromer Street, London WC1H 8DG

Telephone

020 3500 7471

2. Who this notice is for

This notice explains how we handle personal data about everyone outside the firm whose information we hold. It applies to:

  • clients, and the directors, shareholders, beneficial owners, officers, trustees, executors and beneficiaries connected with a client;
  • people who contact us but do not go on to instruct us, including enquirers who telephone, email or complete a form on our website;
  • people we deal with in the course of a matter, including other parties, their solicitors and representatives, witnesses, counterparties, tenants, landlords, buyers, sellers and third parties named in documents we are given;
  • lenders for whom we act on a panel basis, and their officers;
  • barristers, experts, agents, suppliers and other professionals we work with, and their staff;
  • visitors to our website and to our offices; and
  • people who apply to work with us.

Our own partners, employees, consultants and contractors receive separate privacy notices, including a specific notice covering automated time recording.

3. The personal data we hold

What we hold depends on our relationship with you. It may include:

Category

Examples

Identity and contact data

Name, former names, title, date of birth, nationality, photographs in identity documents, address, email address, telephone numbers.

Verification data

Passport, driving licence, biometric residence permit and other identity documents; proof of address; electronic identity verification results; sanctions, politically exposed person and adverse media screening results; company and beneficial ownership information.

Financial data

Bank account details, source of funds and source of wealth information and the evidence supporting it, open banking data where you consent to provide it, mortgage and lender information, details of payments made to and by us, billing and credit control records.

Matter data

The facts, documents and correspondence relating to your matter, including anything you or others tell us, attendance notes, advice given, court and tribunal documents, and records of meetings and calls.

Communications data

Emails, letters, text and messaging app content, telephone call records, and the recording, transcript and summary of any call on our telephone line. See section 6A.

Website and device data

IP address, browser and device information, and pages visited. See our Cookie Policy.

CCTV images

If you visit our office at 88 Cromer Street, images of you recorded by the cameras at the entrance, in reception and in the open-plan working area downstairs. See section 6B.

Recruitment data

CV, application, references, right to work documents and interview notes.

Special category and criminal offence data

Some matters require us to handle more sensitive information. This may include data revealing racial or ethnic origin, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation, genetic or biometric data, and information about criminal offences, allegations, proceedings and convictions. Identity documents commonly reveal nationality, and anti money laundering screening can return results relating to alleged criminal conduct.

We handle this data only where a condition in Article 9 or Article 10 of the UK GDPR and, where required, in Schedule 1 to the Data Protection Act 2018 applies. In practice we rely principally on the condition for the establishment, exercise or defence of legal claims, and on the substantial public interest condition for preventing or detecting unlawful acts in relation to our anti money laundering work.

4. Where we get your data from

Most of the personal data we hold comes from you. We also receive personal data about you from other people, in which case the categories above describe what we receive. The usual sources are:

  • our client, where you are a third party connected with a matter;
  • other parties to a matter and their solicitors or representatives;
  • courts, tribunals and other public bodies;
  • HM Land Registry, Companies House, the electoral roll and other public registers;
  • electronic identity, sanctions and screening providers, and open banking providers where source of funds is verified that way;
  • lenders, brokers, estate agents, accountants, surveyors and other professionals involved in a transaction;
  • referrers and introducers; and
  • publicly available sources, including the internet, where we need to check a fact or carry out due diligence.

5. What we use your data for, and our lawful basis

We only use your personal data where the law allows. The table sets out our purposes and the lawful basis for each. Where we rely on legitimate interests, we have assessed that our interest is not overridden by your interests, rights and freedoms, and you may ask us for that assessment.

Purpose

Lawful basis

Taking instructions, opening a matter and providing legal services

Performance of a contract with you, or our legitimate interests in providing legal services where the contract is with someone else.

Client due diligence, identity verification, source of funds and source of wealth checks, sanctions and politically exposed person screening, ongoing monitoring and reporting suspicions

Compliance with a legal obligation under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, the Proceeds of Crime Act 2002 and related law.

Conflict checking and file opening

Compliance with a legal obligation, and our legitimate interests in meeting our professional obligations.

Conducting litigation, correspondence with other parties, and instructing counsel, experts and agents

Performance of a contract, and our legitimate interests in conducting the matter properly. For special category and criminal offence data, the legal claims condition.

Recording time, preparing bills, costs schedules and statements of costs, and credit control

Performance of a contract, our legitimate interests in being paid for our work, and compliance with a legal obligation where a court requires a costs schedule.

Using artificial intelligence tools to assist with document review, research, summarising and drafting, always subject to review by a qualified member of our team

Our legitimate interests in delivering matters efficiently and keeping our costs competitive.

Keeping notes of enquiries and initial calls, including where the enquiry does not become a matter

Our legitimate interests in keeping an accurate contemporaneous record of what we were told and what we said.

Regulatory compliance, professional indemnity insurance, file audits by the SRA, quality assessors and our insurers, and responding to the Legal Ombudsman

Compliance with a legal obligation, and our legitimate interests in maintaining our practice.

Handling complaints, including data protection complaints

Compliance with a legal obligation, and our legitimate interests in resolving complaints properly.

Accounting, tax and statutory record keeping

Compliance with a legal obligation.

Sending you information about other legal services we offer

Your consent, which you may withdraw at any time, or our legitimate interests where we are permitted to market to an existing client about similar services.

Running, securing and improving our website and our IT systems, and preventing fraud and cyber crime

Our legitimate interests in keeping our systems and our clients’ money and information secure.

Operating CCTV at our office

Our legitimate interests in the security of our premises, of the people in them, and of the client files and client money held there; in being able to investigate a suspected loss of confidential information, which we are also required to be able to do under data protection law and our professional rules; and in being able to establish what happened after an incident at our office, including to defend a claim. See section 6B.

Recruitment

Steps taken at your request before entering a contract, compliance with a legal obligation for right to work checks, and our legitimate interests in assessing candidates.

We do not use your personal data for any purpose that is incompatible with the purpose for which we collected it, and we do not sell your personal data to anyone.

6. Artificial intelligence and automated processing

We use artificial intelligence tools, both our own internal systems and third party services, to help us deliver matters efficiently. They may be used for document review, legal research, summarising information, preparing draft correspondence and reconstructing records of the time spent on a matter.

Three points matter, and we hold ourselves to all three. A qualified member of our team reviews the output before it is sent to you or relied upon, and we remain fully responsible for the advice and services we provide. We do not make decisions about you by automated means alone where the decision produces legal effects or similarly significant effects, so the rights in Article 22 of the UK GDPR are not engaged. Where an AI provider processes personal data for us it does so as our processor, under a written contract containing the protections required by Article 28 of the UK GDPR, and subject to the international transfer safeguards described in section 9.

6A. Call recording and transcription

Calls to and from our office telephone line are recorded and transcribed. This applies to every external call in both directions, whether you telephone us or we telephone you, and whether or not you are a client. It applies from the first time you call us, including a call about a problem you decide not to instruct us on. Our system also produces a written summary of the call.

You will hear this said in our hold message when you call us. If we call you, we will tell you at the start of the call. If you would rather not be recorded, say so and we will arrange another way to have the conversation.

What happens to the recording depends on whether the call relates to a matter. If it does, the person who took the call files it to that matter, and the recording, the transcript and the summary become part of the file. Our practice management system then produces a short further summary using an AI service, which is described at section 6. If the call does not relate to a matter, and most first enquiries that go no further do not, nothing is filed: the recording stays within the telephone system, is deleted within six months, and no AI service ever sees it.

Video meetings on Microsoft Teams are not the same as telephone calls. They are not recorded or transcribed unless someone in the meeting switches it on. If a Teams meeting is transcribed, the transcript is kept within our own Microsoft environment.

6B. CCTV at our office

We operate closed circuit television at our office at 88 Cromer Street. The cameras cover the entrance, the reception area, the hallway down to our offices and the open-plan working area downstairs. If you visit us, you will be recorded.

We do this for four reasons. To keep the premises secure, and with them the people who work there. To protect the client files, original documents and client money held there. To be able to investigate if we ever have reason to think that confidential information or property has been interfered with, which is something data protection law and our professional rules both require us to be able to do. And to be able to establish what happened if there is an incident at our office, including where a claim is made about it.

We rely on our legitimate interests. We have considered whether the same result could be achieved without cameras and concluded that it could not, in a building where confidential files and original documents are held and where papers are sometimes left in trays overnight.

The cameras record images only. They do not record sound, and we do not use them to listen to anything.

There are two different things we do with what the cameras see, and we describe them separately because they are not the same. The live view from all of the cameras, including the open office area, is shown on a monitor in the office and is seen by the people working there, who use it as part of keeping the premises secure. The recording is different: a saved recording is accessed only by a partner, and only where there is a reason to look at it, such as an incident, a theft or a security concern.

We keep recordings for up to about eight weeks, and they are then overwritten. We have set that period against the third and fourth of the reasons above, because those are the ones that need it. If confidential information is taken, nothing appears to be missing and we would usually learn of it only when it came to light somewhere else, which is weeks rather than days. The same is true of an incident at the office, which is often reported to us some time after it happened. A shorter period would be enough for a break-in and of no use at all for either of those. We keep the period under review, and the question we ask at each review is whether footage older than a few weeks has in fact been needed.

We would keep a particular clip for longer than the ordinary period if it were needed for an investigation, an insurance claim or legal proceedings, and then only for as long as that purpose lasts. We would disclose footage to the police or to an insurer if we were properly asked for it.

You can ask us for a copy of footage of yourself under section 11. Because the cameras record other people as well, we may need to obscure them before we can give you a copy, and occasionally that makes a request one we cannot fully meet.

The cameras also record the people who work for and with us while they work. They are told separately how that affects them. We do not use the cameras to monitor how our people work, their productivity or their attendance. A recording is opened only where there is a specific reason, which is written down first, and only on the written authority of a partner.

7. Who we share your data with

We share personal data only where we need to, and we do not disclose more than is necessary. Our duty of confidentiality as solicitors applies in addition to data protection law, and limits disclosure further. The people we may share your data with are:

Recipient

Why

Other parties to your matter, their solicitors and representatives

To conduct the matter on your instructions.

Courts, tribunals and other adjudicative bodies

To bring, defend or progress proceedings.

Barristers, experts, costs draftsmen, process servers, agents, translators, interpreters and enquiry agents

To obtain specialist input or to carry out steps in your matter.

Lenders, brokers, estate agents, accountants, surveyors and other professionals in a transaction

To progress the transaction, where you have asked us to deal with them or the transaction requires it.

HM Land Registry, HM Revenue and Customs, Companies House and other public bodies

Registration, tax returns and statutory filings.

The National Crime Agency and other law enforcement bodies

Where the law requires us to report a suspicion. We may be prohibited by law from telling you that we have done so.

The Solicitors Regulation Authority, the Legal Ombudsman, quality assessors and our auditors

Regulatory supervision and audit. You may ask in writing that your file is not audited.

Our professional indemnity insurers and brokers, and our own legal advisers

Insurance, and defending or advising on a claim against the firm.

Our IT and business service providers acting as our processors

To run the systems on which the firm operates. These are set out below, by name or by what they do.

Our bank

To hold and transfer client and office money. Our bank is Barclays Bank plc, which acts as a controller in its own right rather than as our processor.

Our processors are set out below. Each is engaged to provide a service to the firm and acts on our instructions. We require written data protection terms with every processor we use, meeting the requirements of Article 28 of the UK GDPR, and we check those terms and keep them under review. We name a provider where knowing who it is tells you something you would want to know; otherwise we describe what the provider does, which is what matters to you and does not change when we change supplier.

Providers we name

Processor

What they do for us

Anthropic Ireland Limited

AI assisted drafting, summarising and narrative generation. Named because the processing takes place in the United States and the safeguards for that transfer are set out at section 9.

VXT

Our office telephone system, including the recording, transcription and summary of every external call, as described at section 6A. Named because it holds the recording of your call.

The Cashroom Limited

Outsourced legal cashiering: client and office account postings, payments and reconciliations. Named because it handles money held for you.

Providers we describe by what they do

We keep an internal register of these providers and the data protection terms that govern them. You may ask us at any time who is in any of these categories, and we will tell you.

Category

What they do for us

Our cloud productivity providers

Email, documents, calendars, file storage and video meetings.

Our practice management and document management providers

The systems that hold the matter record, the matter file and our billing.

Our telephony and electronic fax providers

Carrying telephone calls and sending and receiving faxes. The recording of calls is dealt with separately above and at section 6A.

Our identity verification, search and electronic signature providers

Electronic identity checks, sanctions and politically exposed person screening, property and company searches, and electronic signature.

Our document production, court bundling and delivery providers

Printing, binding, producing court bundles and delivering documents.

Our IT support, hosting and security providers

Keeping our systems running and secure.

8. Confidentiality and legal professional privilege

As solicitors we owe you a professional duty of confidentiality that is wider than data protection law and continues after your matter ends. Much of what we hold for a client is also covered by legal professional privilege. Where a third party makes a request for information we hold, privilege and confidentiality are respected: they are not overridden by a data protection request, and we will refuse disclosure where doing so would breach them.

9. Sending data outside the United Kingdom

Our practice is UK based and most of the personal data we hold stays in the United Kingdom. Where it does not, the position is as follows.

Provider or situation

Location and safeguard

Microsoft 365

UK data residency. Some access or transfer to the United States is possible under Microsoft’s standard data processing terms, which include the UK Addendum to the EU Standard Contractual Clauses.

iManage

UK data residency.

Clio

Hosted in the European Union at eu.app.clio.com.

Anthropic Ireland Limited

Processing takes place in the United States. Anthropic is not certified under the UK Extension to the EU-US Data Privacy Framework, so the transfer relies on appropriate safeguards under Article 46: the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment and acceptance of Anthropic’s Article 28 data processing addendum, signed on 14 July 2026. Content is minimised before transfer.

VXT

VXT Limited is a New Zealand company. New Zealand is covered by UK adequacy regulations, so a transfer to VXT requires no additional safeguard. VXT hosts its service on third party cloud infrastructure and, where personal data is held outside the United Kingdom, its published data processing terms apply.

Google

We contract with Google Cloud EMEA Limited, of Dublin, Ireland, for Google Workspace. Where personal data is stored outside the United Kingdom, Google’s data processing terms apply, which include the UK Addendum to the EU Standard Contractual Clauses.

Your matter

Where a matter itself involves a party, court, lender or professional outside the UK, we transfer only what the matter requires, relying where necessary on the exception for the establishment, exercise or defence of legal claims or on the performance of a contract with you.

 

You may ask us for a copy of the safeguards we rely on for any transfer.

10. How long we keep your data

We keep personal data no longer than we need it. Our periods are:

Record

Retention period

Client matter file, electronic or paper

At least 6 years after the matter is completed, after which we may securely destroy it without further notice.

Original documents held in safe custody, such as wills and deeds

Until you ask us to release them. We do not destroy them.

Client due diligence and anti money laundering records

5 years from the end of the business relationship or the completion of the transaction, as required by the Money Laundering Regulations 2017, unless a longer period is justified.

Accounting and billing records

6 years from the end of the accounting period, as required by tax and company law.

Notes of an enquiry that does not become a matter

6 months from the date of the enquiry, after which the record is deleted.

A call recording, transcript and summary filed to a matter

6 years, with the matter file, and destroyed with it.

A call recording and transcript not filed to any matter, including a first enquiry that goes no further

6 months from the call, after which it is deleted from the telephone system.

Recruitment records for unsuccessful candidates

6 months from the decision. This allows time for a discrimination claim, which must be brought within 3 months less a day, and a margin beyond it.

CCTV footage

Up to about 8 weeks, and then overwritten. The period is set by reference to the time it typically takes for a loss of confidential information, or an incident at our office, to come to light. A clip kept for an investigation, an insurance claim or legal proceedings is kept only for as long as that purpose requires. See section 6B.

Website analytics and cookie data

The site sets no cookies. Page view statistics are held within the service that hosts our website for as long as the site is hosted there, and we keep no separate copy. See our Cookie Policy.

Complaint records

6 years from the conclusion of the complaint. This is set by the 6 year limitation period for a negligence claim arising from the same facts, and by our insurers’ notification requirements, not by the Legal Ombudsman, whose own time limit is 1 year from the act or omission and 6 months from our final response.

11. Your rights

You have the following rights in relation to your personal data. There is no charge for exercising them, and we will respond within one month, which we may extend by up to two further months for complex or numerous requests, telling you if we do.

  • Access: To be told whether we hold personal data about you and, if we do, to receive a copy of it and information about how we use it.
  • Rectification: To have inaccurate personal data corrected and incomplete data completed.
  • Erasure: To ask us to delete personal data, where we no longer need it and no other ground for keeping it applies.
  • Restriction: To ask us to limit what we do with your data while a question about it is resolved.
  • Portability: To receive data you gave us in a machine readable form, where we process it by automated means on the basis of consent or a contract.
  • Objection: To object to processing we carry out on the basis of legitimate interests. We will stop unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is for legal claims. You may object to direct marketing at any time and we will always stop.
  • Withdrawing consent: Where we rely on consent, to withdraw it at any time, without affecting anything done before you withdrew it.

To exercise any of these rights, contact our data protection lead using the details in section 1.

Limits on these rights

Data protection law contains exemptions, and in a law firm several of them apply regularly. We may not be able to give you information that is subject to legal professional privilege, that would breach our duty of confidentiality to someone else, that would prejudice the prevention or detection of crime, or that we are required to keep by law or by our regulator. Where we withhold something, we will tell you that we have done so and why, unless telling you would itself defeat the purpose of the exemption.

12. Complaints

If you are unhappy with how we have handled your personal data, please tell us first. You can make a data protection complaint by email to [email protected], by post to the Data Protection Lead at 88 Cromer Street, London WC1H 8DG, or by telephone on 020 3500 7471, in each case addressed to our data protection lead. You do not have to use any particular route or use the words “data protection”, and we will treat a complaint as a complaint however it reaches us.

What we will do: We will acknowledge your complaint within 30 days of receiving it. We will make appropriate enquiries, keep you informed of progress, and tell you the outcome and our reasons. This reflects section 164A of the Data Protection Act 2018, inserted by section 103 of the Data (Use and Access) Act 2025, which came into force on 19 June 2026.

 

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection. The Commissioner will normally expect you to have raised the matter with us first. The ICO can be contacted at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, on 0303 123 1113, or at ico.org.uk.

A complaint about the service we have provided, or about our bill, is different and is dealt with under our complaints procedure in our Standard Terms of Business, which may lead to the Legal Ombudsman. A complaint about our professional conduct may be made to the Solicitors Regulation Authority.

13. If you give us data about other people

If you give us personal data about someone else, for example a beneficiary, a family member, a witness, a director or a shareholder, please tell them and show them this notice, so that they know what we will do with their information. Where we obtain personal data about someone from a source other than that person, we will provide this notice to them within a reasonable period, unless doing so is impossible, would involve disproportionate effort, or is subject to an exemption such as legal professional privilege or the prejudice to legal claims.

14. Changes to this notice

We review this notice at least once a year and whenever our processing changes materially. The current version is always available at blackslegal.co.uk. Where a change materially affects you, we will bring it to your attention rather than relying on the updated page alone.