Privacy Notice

1.Introduction

Carman Partners Limited (“we”, “us”, “our”) is a law firm authorised and regulated by the Solicitors Regulation Authority (SRA Number: 805158). We are committed to protecting and respecting your privacy and handling your personal data in accordance with:

• The UK General Data Protection Regulation (UK GDPR);
• The Data Protection Act 2018;
• The Privacy and Electronic Communications Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025;
• The SRA Standards and Regulations.

This Privacy Notice explains how we collect, use, store and protect your personal data.

2.Data Controller

For the purposes of data protection law, Carman Partners Limited is the Data Controller.

If you have any questions about this policy or how we handle your data, please contact us using the details above.

3.The Information We Collect

We may collect and process the following categories of personal data:

3.1 Client Data

• Full name and date of birth;
• Contact details (address, telephone, email);
• Identification documents (passport, driving licence);
• Financial information (bank details, payment information);
• Case/matter information;
• Criminal record data (where relevant);
• Special category data (e.g. health information, ethnicity) where necessary for your case.

3.2 Third Party Data

• Information relating to opponents, witnesses, beneficiaries, employees or other parties connected with a matter.

3.3 Website & Communication Data

• IP address;
• Browser type;
• Usage data;
• Enquiry form submissions;
• Email correspondence.

4.How We Collect Your Data

We collect personal data:

• Directly from you;
• From third parties (e.g. HM Courts & Tribunals Service, Companies House, Land Registry, medical professionals, barristers);
• From publicly available sources;
• From your employer (if you are a corporate client or employee contact);
• Through our website (cookies — see our Cookie Policy).

5.Legal Bases for Processing

We process your personal data under the following lawful bases:

• Performance of a contract — to provide legal services;
• Legal obligation — e.g. anti-money laundering checks;
• Legitimate interests — running our business efficiently;
• Consent — where required (e.g. marketing);
• Establishment, exercise or defence of legal claims (Article 9(2)(f) UK GDPR for special category data).

Where criminal offence data is processed, we rely on Schedule 1 of the Data Protection Act 2018.

6.How We Use Your Information

We use personal data to:

• Provide legal advice and representation;
• Carry out identity verification and AML checks;
• Communicate with you;
• Manage billing and payments;
• Comply with court orders and regulatory requirements;
• Manage complaints or claims;
• Improve our services;
• Send marketing communications (where permitted).

7.Who We Share Your Data With

We may share your personal data with:

• Courts, tribunals and regulators;
• Barristers and expert witnesses;
• Opposing solicitors;
• HMRC;
• Banks and financial institutions;
• Legal and IT service providers;
• Professional indemnity insurers;
• The SRA, Legal Ombudsman or other regulators if required.

We require all third parties to respect the security of your personal data.

8.International Transfers

We do not routinely transfer data outside the UK.

If we do transfer data outside the UK, we ensure appropriate safeguards are in place, such as:

• UK adequacy regulations;
• International Data Transfer Agreements (IDTAs); and
• Standard Contractual Clauses.

9.Data Security

We implement appropriate technical and organisational measures, including:

• Encrypted email where appropriate;
• Secure document management systems;
• Access controls and password protection;
• Confidentiality agreements;
• Staff data protection training;
• Regular cybersecurity monitoring.

We also comply with SRA confidentiality and information security requirements.

10.Data Retention

We retain client files in accordance with our Retention Policy. Typical retention periods:

File type	Retention period
Lease / Conveyancing files	6–15 years
Corporate files	6 years after conclusion
AML records	5 years from end of business relationship or completion of transaction — Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (SI 2017/692), regulation 40

We may retain data longer where required by law or for the defence of legal claims.

11.Your Data Protection Rights

Under UK GDPR, you have the right to:

• Access your personal data;
• Rectify inaccurate data;
• Erase data (in limited circumstances);
• Restrict processing;
• Object to processing;
• Data portability;
• Withdraw consent (where processing is based on consent).

Some rights may be restricted due to legal professional privilege or our regulatory obligations.

To exercise your rights, please contact us at info@carmanpartners.com.

12.Legal Professional Privilege

As a law firm, much of the information we hold is protected by legal professional privilege. This may limit the information we can disclose, even in response to a data subject access request.

13.Complaints

If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to:

14.Marketing Communications

We may send marketing communications where you have consented, or where it is permitted under PECR (soft opt-in). You may opt out at any time by emailing us at info@carmanpartners.com.

15.Cookies

Our website uses cookies. Please see our separate Cookie Policy for full details.

16.Changes to This Policy

We may update this Privacy Notice from time to time. The latest version will always be available on our website.

← Back to Home