Privacy Policy

1. Who we are

Heirloom Fair Legal is a trading style of FD Law Limited.

FD Law Limited is a company registered in England and Wales under company number 10290745.

FD Law Limited is authorised and regulated by the Solicitors Regulation Authority under SRA number 632067.

FD Law Limited is registered with the Information Commissioner's Office under ICO registration number ZA441929.

For the purpose of data protection law, FD Law Limited is the data controller for personal data processed in connection with its legal services, claims services, website, client matters, marketing activities and business operations.

In this Privacy Policy, references to “Heirloom Fair Legal”, “FD Law Limited”, “we”, “us” or “our” mean FD Law Limited trading as Heirloom Fair Legal.

2. Contact details

If you have any questions about this Privacy Policy, how we use your personal data, or if you wish to exercise your data protection rights, you can contact us using the details below:

FD Law Limited trading as Heirloom Fair Legal

Email: justice@heirloomfairlegal.com

Website: www.fairlegal.com

You may also contact our Data Protection Officer Philip Bigelow or data protection contact using the details published on our ICO registration, or by contacting us at the email address above.

3. What personal data means

Personal data means any information relating to an identified or identifiable living individual. This can include your name, address, telephone number, email address, identification documents, financial information, claim details, medical information, litigation records, communications and other information that can identify you directly or indirectly.

Some information is classed as special category data under UK data protection law. This includes information about health, disability, racial or ethnic origin, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, sex life or sexual orientation.

Information about criminal convictions and offences is subject to additional protections.

4. The types of personal data we collect

Depending on how you interact with us and the services we provide, we may collect and use the following categories of personal data:

Contact data

This may include your name, postal address, email address, telephone number, previous addresses, IP address and contact preferences.

Identity data

This may include your full name, title, date of birth, gender, signature, identification documents, proof of address, national insurance number, passport details, driving licence details, and other identity verification information.

Client and matter data

This may include information contained in your enquiry, client care documents, retainer, instructions, claim documents, witness statements, evidence, case notes, advice records, file notes, correspondence, settlement discussions, funding documents, after-the-event insurance documents, complaints, and matter history.

Legal services data

This may include information needed to assess your legal position, provide legal advice, investigate a claim, prepare documents, correspond with other parties, deal with insurers or funders, comply with court rules, meet professional obligations, and manage your legal matter.

Claim and litigation data

This may include details of the claim or potential claim, the facts of the dispute, opponent details, court documents, tribunal documents, pleadings, evidence, disclosure, witness evidence, expert evidence, damages information, costs information, settlement offers, litigation strategy, hearing details, court orders, judgments, enforcement steps and case outcome.

Financial and product data

This may include information about financial products, lenders, brokers, commission arrangements, credit agreements, vehicle finance agreements, loans, bank accounts, payment history, affordability, insurance, funding, invoices, costs, disbursements, deductions, damages and compensation.

Vehicle data

Where relevant to a claim or enquiry, this may include vehicle registration, make, model, finance agreement details, purchase details, dealership details, lender details, mileage, valuation and related documents.

Tenancy, housing or property data

Where relevant to a claim or enquiry, this may include property addresses, tenancy agreements, deposit details, landlord details, letting agent details, prescribed information, scheme search results, rent records, disrepair evidence, photographs, reports, complaints and correspondence.

Special category data

Where necessary for legal services or claims, we may process special category data. This may include information about health, disability, vulnerability, medical treatment, injuries, symptoms, mental health, care needs, accessibility requirements, financial hardship, or other sensitive personal circumstances.

Criminal offence data

In limited circumstances, we may process criminal offence data where it is relevant to legal advice, litigation, fraud prevention, regulatory compliance, safeguarding, risk assessment, legal claims, or where required by law.

Marketing and communications data

This may include your marketing preferences, communication preferences, consent records, unsubscribe records, enquiry history, service interest, website interactions and records of communications sent to you.

Website, technical and analytics data

This may include IP address, browser type, device information, operating system, location data, usage data, cookie identifiers, pages viewed, forms started or completed, online journey data and analytics information.

Recruitment and employment-related data

If you apply to work with us, we may collect CVs, application forms, references, employment history, qualifications, right-to-work information, interview notes and recruitment communications.

5. How we collect personal data

We may collect personal data in the following ways:

Directly from you

We collect information when you contact us, complete an online form, call us, email us, use our website, sign a retainer, provide instructions, send documents, participate in a claim, respond to requests for information, or otherwise communicate with us.

From our website and online platforms

We may collect technical, cookie, analytics and form data when you visit or use our website, landing pages, online forms, client portals, chat tools or digital signing platforms.

From introducers, referrers and lead providers

We may receive personal data from third-party introducers, marketing partners, claims management companies, lead suppliers, comparison websites, advertising providers, call centres or other referral sources where you have made an enquiry or consented to your information being passed to us.

Where we receive data from a third party, we expect that third party to have collected and shared the data lawfully and to have provided appropriate privacy information to you.

From opponents and third parties involved in a claim

We may receive data from defendants, opponents, solicitors, barristers, experts, courts, tribunals, insurers, brokers, lenders, landlords, letting agents, claims administrators, redress schemes, ombudsman schemes, regulators, public bodies and other parties involved in your matter.

From public sources

We may collect information from publicly available sources such as Companies House, HM Land Registry, the electoral register, court records, insolvency registers, social media, professional directories, search engines and other public databases where relevant and lawful.

From verification, compliance and due diligence providers

We may receive information from identity verification providers, anti-money laundering providers, sanctions screening providers, credit reference agencies, fraud prevention agencies and other compliance service providers.

From group companies and associated businesses

Where lawful and necessary, we may receive personal data from other companies within the wider Heirloom Fair Legal group or associated businesses for administration, compliance, legal services, funding, insurance, operational support, conflict checking, client service management, reporting or other legitimate business purposes.

6. Why we use personal data

We may use personal data for the following purposes:

• to respond to enquiries;
• to assess whether we can assist you;
• to carry out conflict checks;
• to verify identity and complete anti-money laundering checks;
• to onboard you as a client;
• to provide legal advice and legal services;
• to investigate, assess and pursue claims;
• to assess prospects of success, limitation, evidence, liability, causation, quantum and costs;
• to prepare letters of claim, pleadings, witness statements, court forms, settlement documents and other legal documents;
• to manage pre-action correspondence, litigation, settlement, costs and enforcement;
• to communicate with you and others involved in your matter;
• to manage funding, conditional fee agreements, damages-based agreements, after-the-event insurance, disbursements, costs and deductions;
• to comply with court rules, tribunal rules, professional obligations and regulatory requirements;
• to deal with complaints, disputes, audits, supervision, quality assurance and file reviews;
• to comply with legal, regulatory, tax, accounting and reporting obligations;
• to prevent fraud, money laundering, financial crime and misuse of our services;
• to protect our legal rights and defend legal claims;
• to manage our website, systems, records, security and business operations;
• to improve our services, systems, client experience and risk controls;
• to send service communications and updates about your matter;
• to send marketing communications where permitted by law;
• to manage recruitment, employment applications and HR processes;
• to maintain professional indemnity insurance, business records and regulatory audit trails.

7. Lawful bases for processing personal data

We only use personal data where we have a lawful basis to do so under UK data protection law. Depending on the circumstances, we may rely on one or more of the following lawful bases:

Contract

We process personal data where it is necessary to take steps before entering into a contract with you, or to perform our contract with you. This includes dealing with enquiries, onboarding you as a client, providing legal services, managing your matter and communicating with you about our services.

Legal obligation

We process personal data where necessary to comply with legal and regulatory obligations. This includes obligations relating to anti-money laundering, sanctions, fraud prevention, tax, accounting, court rules, regulatory reporting, professional conduct, complaints, file retention and cooperation with regulators.

Legitimate interests

We process personal data where necessary for our legitimate interests or the legitimate interests of others, provided your rights and freedoms do not override those interests. This may include running and managing our business, assessing claims, communicating with clients, maintaining records, improving services, supervising legal work, managing risk, preventing fraud, defending claims, recovering costs, obtaining professional advice, using secure IT systems and sending relevant service information.

Consent

We rely on consent where required by law, including for certain types of marketing, cookies, optional communications, or where we ask for your specific permission to use your data for a particular purpose. You can withdraw consent at any time.

Vital interests

In rare cases, we may process personal data where necessary to protect someone's vital interests, for example in an emergency.

Public task

In limited circumstances, we may process personal data where necessary in connection with the administration of justice or where required by a court, tribunal, regulator or public authority.

8. Special category data and sensitive information

We may process special category data where it is necessary for legal services, legal claims, litigation, professional obligations, equality and accessibility support, safeguarding, or where you have provided explicit consent.

Where we process special category data, we will rely on an Article 9 condition under UK GDPR. This may include:

• processing necessary for the establishment, exercise or defence of legal claims;
• processing necessary for reasons of substantial public interest;
• processing necessary for the provision of legal services and professional obligations;
• processing necessary to protect vital interests where relevant;
• explicit consent where appropriate.

Examples of special category data we may process include information about health, disability, vulnerability, medical evidence, accessibility requirements, financial hardship, personal circumstances, or other sensitive information relevant to your claim or legal matter.

We will only collect and use special category data where it is necessary and proportionate for the relevant purpose.

9. Criminal offence data

We may process criminal offence data where relevant to legal advice, litigation, fraud prevention, regulatory compliance, safeguarding, risk assessment, professional obligations, legal claims, or where required by law.

We will only process criminal offence data where we have a lawful basis and an appropriate condition under data protection law.

10. Legal professional privilege and confidentiality

As a law firm, we owe duties of confidentiality to our clients. Some information we process may also be protected by legal professional privilege.

We will handle client information in accordance with our professional obligations, applicable law, the SRA Standards and Regulations, and our confidentiality duties.

We may be required to disclose information where required by law, court order, regulator, professional obligation, anti-money laundering rules, sanctions requirements, or where disclosure is necessary to establish, exercise or defend legal rights.

11. Client data and matter files

When you become a client, we create and maintain a matter file. This may contain your instructions, identification records, retainer documents, funding documents, evidence, legal advice, correspondence, internal notes, supervision records, risk assessments, court documents, settlement records, costs records, complaints and closure documents.

We use this information to provide legal services, comply with professional obligations, maintain an audit trail, supervise work, evidence decisions, manage risk, and protect your interests and our legal position.

12. Claim data and litigation data

Where we are instructed in relation to a claim, we may process data about the facts of the claim, the parties involved, the evidence, legal merits, limitation, damages, settlement, court proceedings, costs and enforcement.

This may include information about:

• the background to the claim;
• contracts, agreements, transactions or financial products;
• losses, damages and compensation;
• opponents, defendants, lenders, brokers, landlords, agents, insurers or other parties;
• documents and evidence;
• pre-action correspondence;
• court or tribunal proceedings;
• witness statements and expert evidence;
• settlement offers and negotiations;
• costs, funding, deductions and disbursements;
• enforcement and recovery action.

We may share relevant claim and litigation data with courts, tribunals, opponents, solicitors, barristers, experts, costs draftsmen, insurers, funders, litigation support providers, process servers, tracing agents, enforcement agents and other parties where necessary for your matter.

13. Marketing and communications

We may contact you with information about our legal services, updates about existing claims, or other claim types that may be relevant to you.

We may send marketing communications by email, SMS, telephone or post where permitted by law. We may rely on consent or, where applicable, legitimate interests and the soft opt-in under the Privacy and Electronic Communications Regulations.

The soft opt-in may apply where you have previously engaged with us or entered into negotiations with us about similar legal services, and you have been given a clear opportunity to opt out.

You can opt out of marketing at any time by using the unsubscribe method provided in our communications or by contacting us at justice@heirloomfairlegal.com.

We will not sell your personal data.

Where we work with marketing partners, introducers or referrers, we will only share personal data where lawful, necessary and subject to appropriate safeguards.

14. Cookies, analytics and website tracking

Our website may use cookies and similar technologies to operate the website, improve functionality, analyse usage, support security, measure advertising performance and improve user experience.

Some cookies are necessary for the website to function. Non-essential cookies, analytics or tracking technologies will only be used where permitted by law and, where required, with your consent.

Further information may be provided in our Cookie Policy or cookie banner.

15. Who we share personal data with

We may share personal data with the following categories of recipients where necessary and lawful:

• our employees, consultants, contractors and authorised personnel;
• other companies within the wider Heirloom Fair Legal group or associated businesses;
• IT providers, cloud providers, hosting providers, software providers and case management system providers;
• client onboarding, identity verification, anti-money laundering and sanctions screening providers;
• barristers, counsel, experts, costs draftsmen and other professional advisers;
• courts, tribunals, ombudsman schemes, regulators and public authorities;
• opponents, defendants, insurers, lenders, brokers, landlords, agents, solicitors and other parties involved in a matter;
• litigation funders, after-the-event insurers, disbursement funders and insurance brokers;
• process servers, tracing agents, enquiry agents and enforcement agents;
• payment providers, banks, accountants, auditors and tax advisers;
• professional indemnity insurers and insurance brokers;
• complaints handlers, quality assurance reviewers and compliance advisers;
• document storage, archiving, scanning and destruction providers;
• marketing, advertising, analytics and communications providers;
• introducers, referrers and lead providers where lawful;
• any organisation involved in a business sale, restructuring, merger, acquisition, funding arrangement or transfer of assets;
• law enforcement agencies, regulators or other bodies where required by law or necessary to protect legal rights.

Where we use third-party service providers, we require them to protect personal data and only process it in accordance with our instructions and applicable law.

16. Group sharing

FD Law Limited may share personal data with other companies within the wider Heirloom Fair Legal group or associated businesses where there is a lawful basis to do so.

This may include sharing for:

• client administration;
• legal services support;
• operational support;
• IT and systems support;
• finance, billing and accounting;
• funding, insurance or disbursement support;
• compliance, risk and audit purposes;
• conflict checks;
• complaints handling;
• management information and reporting;
• business planning;
• service improvement;
• regulatory compliance;
• legal claims and protection of legal rights.

Where group sharing takes place, we will ensure that personal data is only shared where necessary, proportionate and subject to appropriate confidentiality, security and access controls.

Where another group company acts as a separate controller, it will be responsible for explaining how it uses your personal data.

17. International transfers

Some of our service providers, systems or group support arrangements may involve the transfer of personal data outside the United Kingdom.

Where personal data is transferred outside the UK, we will ensure that appropriate safeguards are in place. This may include adequacy regulations, standard contractual clauses, international data transfer agreements, transfer risk assessments or other legally recognised safeguards.

18. How long we keep personal data

We will only keep personal data for as long as reasonably necessary for the purposes for which it was collected, including legal services, claims handling, regulatory compliance, complaints, limitation periods, tax, accounting, audit, insurance and reporting requirements.

Retention periods may vary depending on the type of data and matter.

As a general approach:

• enquiry data may be retained for a reasonable period to deal with the enquiry, evidence consent, manage risk and comply with legal obligations;
• client matter files are usually retained for a period after file closure in accordance with our file retention policy, regulatory obligations, insurance requirements and limitation considerations;
• litigation and claim files may be retained for longer where necessary to protect legal rights, deal with complaints, respond to regulatory issues, evidence advice or manage potential disputes;
• AML and identity verification records will be retained in accordance with applicable anti-money laundering requirements;
• complaints records will be retained for regulatory, audit and risk management purposes;
• marketing records, consent records and suppression records may be retained to evidence preferences and ensure we do not contact you where you have opted out;
• recruitment records will be retained for a reasonable period after the recruitment process unless a longer period is required or agreed.

We may retain personal data for longer where there is a complaint, dispute, investigation, regulatory issue, legal claim, potential claim, professional indemnity issue, audit requirement or where we are required to do so by law.

When personal data is no longer required, we will delete, anonymise or securely destroy it.

19. Security of your personal data

We take appropriate technical and organisational measures to protect personal data from unauthorised access, loss, misuse, alteration, disclosure or destruction.

These measures may include access controls, password protection, encryption, secure storage, staff training, confidentiality obligations, system monitoring, supplier due diligence, data minimisation, secure disposal and incident response procedures.

We have procedures in place to deal with suspected personal data breaches. Where legally required, we will notify the ICO and affected individuals.

20. Your data protection rights

Depending on the circumstances, you may have the following rights:

• the right to be informed about how your personal data is used;
• the right of access to your personal data;
• the right to rectification of inaccurate or incomplete data;
• the right to erasure in certain circumstances;
• the right to restrict processing in certain circumstances;
• the right to object to processing in certain circumstances;
• the right to data portability in certain circumstances;
• the right to withdraw consent where processing is based on consent;
• the right not to be subject to solely automated decisions that have legal or similarly significant effects, where applicable;
• the right to complain to the ICO.

Some rights may be limited where we need to keep or use information for legal services, legal claims, litigation, regulatory compliance, professional obligations, legal privilege, fraud prevention, complaints, insurance, tax, accounting or other lawful reasons.

To exercise your rights, please contact us at justice@heirloomfairlegal.com.

21. Complaints about how we use personal data

If you have concerns about how we process your personal data, you have the right to raise a data protection complaint with us.

Please contact us at:

justice@heirloomfairlegal.com

We will consider your complaint and respond in accordance with applicable data protection law and our complaints procedure.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection.

The ICO can be contacted at:

Website: www.ico.org.uk

Telephone: 0303 123 1113

22. Providing personal data

You do not have to provide personal data to us. However, if you do not provide information we reasonably require, we may not be able to respond to your enquiry, assess your claim, verify your identity, comply with legal obligations, provide legal services, act for you, continue acting for you, or progress your matter.

23. Automated decision-making and profiling

We may use systems, tools or structured criteria to help assess enquiries, allocate work, identify claim types, prioritise cases, assess eligibility, support marketing relevance, or manage operational efficiency.

We do not make solely automated decisions that produce legal or similarly significant effects without appropriate safeguards.

Where automated tools support decision-making, human review will be available where required and appropriate.

24. Links to other websites

Our website may contain links to other websites. We are not responsible for the privacy practices, security or content of third-party websites. You should read the privacy policies of any third-party websites you visit.

25. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Any updated version will be published on our website and will take effect from the date it is published.

We recommend that you review this Privacy Policy periodically.

26. Questions

If you have any questions about this Privacy Policy or how we use your personal data, please contact:

Email: justice@heirloomfairlegal.com