Privacy Policy

This policy explains how the Firm handles personal information in connection with this website and with inquiries made through it. It reflects widely recognised data protection principles.

Effective date: Owner to insert effective date • Document version: Owner to insert version reference • Prepared by: Owner to insert responsible person

Draft for the Firm’s review. This policy is drafted to reflect the principles of the EU/UK General Data Protection Regulation (GDPR) and comparable frameworks. It is not a statement that the Firm has verified its compliance with the GDPR or any other law. The Firm must confirm the identity of the controller, the applicable law and regulator, the actual processing activities, recipients, transfer safeguards, and retention periods, and must have this document reviewed by a qualified data protection adviser before publication. Every operational fact is left as a placeholder and must not be invented.

1. Introduction

1.1 The Firm respects the privacy of everyone who visits this website and everyone who contacts it. This policy describes what personal information the Firm processes in that context, why, and on what basis, and it explains the rights available to individuals.

1.2 This policy uses the vocabulary of the GDPR because that vocabulary is widely understood. Using it does not mean the Firm has confirmed that the GDPR applies to it, or that it has completed a compliance assessment. The law that actually applies depends on where the Firm is established and whom it serves, and is identified at Owner to insert applicable data protection law(s) and supervisory authority.

1.3 Separate information about how the Firm handles client information during a matter is provided to clients as part of the engagement process and is governed by the Engagement Agreement and the Firm’s professional obligations.

2. Who is responsible for your information

2.1 The controller of personal information processed through this website is Owner to insert legal entity name, legal form, and registration number, of Owner to insert registered or principal office address.

2.2 The Firm has appointed / not appointed — owner to confirm a data protection officer or dedicated privacy contact. Contact details for privacy matters are in section 22. The Firm must not state that it has a data protection officer unless one has actually been appointed.

2.3 If the Firm is required to have a representative in another jurisdiction, that representative’s details will be added here: Owner to insert representative details if applicable, otherwise remove.

3. Scope of this policy

3.1 This policy covers personal information the Firm processes when you: (a) visit or interact with this website; (b) send an inquiry to the Firm by email or through a link on this website; or (c) correspond with the Firm before any Engagement Agreement is in place.

3.2 This policy does not cover: (a) processing carried out by third-party websites the Firm links to; or (b) processing of client information during a matter, which is addressed separately as noted in section 1.3.

4. Definitions

Personal information (or personal data) means information relating to an identified or identifiable individual.
Processing means any operation performed on personal information, such as collection, storage, use, disclosure, or deletion.
Controller means the person that determines the purposes and means of processing.
Processor means a person that processes personal information on behalf of the controller.
Special category information means information about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health, or a person’s sex life or sexual orientation, and, treated with similar care, information about criminal offences and proceedings.
Supervisory authority means the public body responsible for supervising data protection law in the relevant jurisdiction.

5. Categories of personal information

5.1 Depending on how you interact with the Firm, the categories of personal information processed through this website may include:

Identity and contact information — such as your name, the organisation you represent, your email address, your telephone number, and your postal address, if you provide them.
Inquiry information — the content of your message, the nature of the matter you describe, and any documents or details you choose to include.
Correspondence — records of communications between you and the Firm before any engagement.
Conflict-check information — the names of parties, entities, and other persons connected with a potential matter, used to check for conflicts of interest.
Technical information — limited information generated automatically when a device connects to the website, such as an IP address, request time, and the page requested, recorded in server logs by the hosting provider. Owner to confirm exactly what the host logs and for how long.

5.2 The website is built to avoid collecting information that is not necessary. It does not use analytics, advertising, or tracking technologies by default.

6. Where we obtain personal information

6.1 The Firm obtains personal information:

directly from you, when you contact the Firm or correspond with it;
automatically, through server logs generated when you access the website;
from people acting on your behalf, such as a colleague or adviser who contacts the Firm about your matter; and
occasionally from public sources or third parties, where necessary to run conflict checks or to verify information, to the extent permitted by Applicable Law. Owner to confirm whether any such sources are used.

7. Purposes for which we use personal information

7.1 The Firm uses personal information collected through the website to:

receive and respond to your inquiry and correspond with you about it;
carry out conflict-of-interest checks and decide whether the Firm is able to act;
carry out client identification and due-diligence checks where the Firm proposes to act, and to meet related legal obligations;
prepare and issue an Engagement Agreement if the Firm and you decide to proceed;
keep records of inquiries and decisions, including where the Firm declines a matter, for the period described in section 13;
operate, maintain, and secure the website, and investigate and prevent misuse;
establish, exercise, or defend legal claims, and comply with legal, regulatory, and professional obligations; and
handle complaints and other communications about the website.

7.2 The Firm does not use personal information collected through the website to send marketing communications, and does not sell or rent personal information.

8. Potential lawful bases for processing

8.1 Where a data protection law based on the GDPR model applies, the Firm expects to rely on one or more of the following lawful bases. The precise mapping of basis to activity must be confirmed by the Firm: Owner and data protection adviser to finalise the lawful-basis analysis.

Steps at your request before entering a contract — to respond to your inquiry and assess a possible engagement.
Legitimate interests — to run the website securely, to carry out conflict checks, to keep appropriate records, and to protect the Firm’s legal position, where those interests are not overridden by your interests and rights.
Legal obligation — to comply with obligations that apply to the Firm, including record-keeping, anti-money-laundering, and reporting obligations.
Consent — where the Firm asks for it for a specific purpose; you may withdraw consent at any time without affecting processing already carried out.
Establishment, exercise, or defence of legal claims — where processing is necessary for that purpose.

9. Special category and sensitive information

9.1 The Firm asks you not to include special category information in an initial inquiry. If a matter necessarily involves such information, the Firm will explain how it should be provided and on what basis it will be processed.

9.2 Where the Firm processes special category information, it expects to rely on a condition such as the establishment, exercise, or defence of legal claims, the provision of legal advice, a substantial public interest recognised by law, or your explicit consent. Owner and data protection adviser to confirm the applicable conditions.

10. Cookies and similar technologies

10.1 By default, this website does not set analytics cookies, advertising cookies, or other tracking technologies, and does not load third-party scripts, fonts, or embeds. Assets are served from the website itself.

10.2 The website may use a small number of strictly necessary cookies or local storage entries only if required for security or for basic functionality. Owner to confirm whether any such cookies are used and to list them, or to state that none are used.

10.3 If the Firm later introduces any non-essential cookie or similar technology, it will update this section, describe the purpose and duration of each item, and obtain consent where Applicable Law requires it before that technology is used.

10.4 Your browser lets you block or delete cookies and clear local storage. Doing so should not prevent you from reading the website or contacting the Firm.

11. Recipients and disclosures

11.1 The Firm limits access to personal information to those who need it. Personal information collected through the website may be shared with:

personnel of the Firm involved in responding to inquiries and assessing potential matters;
service providers acting as processors under written terms, such as the website hosting provider, email provider, and IT support. Owner to identify each processor and confirm that a written data processing agreement is in place;
professional advisers to the Firm, such as its own lawyers, auditors, and insurers, where relevant;
courts, regulators, law enforcement, and other authorities, where the Firm is legally required or permitted to disclose, in accordance with the Compliance and Law Enforcement Requests Policy; and
a successor to the Firm’s practice, in connection with a reorganisation or transfer, subject to Applicable Law and professional rules.

11.2 The Firm does not disclose personal information for any purpose incompatible with those described in this policy.

12. International transfers

12.1 Personal information may be processed in, or accessible from, countries other than the one in which you are located, depending on where the Firm and its service providers operate. Owner to identify the countries involved.

12.2 Where personal information is transferred to a country that does not provide an equivalent level of protection under Applicable Law, the Firm intends to rely on an appropriate safeguard, such as an adequacy decision, standard contractual clauses, or another recognised mechanism. Owner to confirm which safeguard applies to each transfer; do not state a safeguard that is not actually in place.

12.3 You may ask the Firm for more information about transfers and safeguards using the contact details in section 22.

13. How long we keep information

13.1 The Firm keeps personal information only for as long as necessary for the purposes described in this policy, and then deletes it or anonymises it.

13.2 In deciding how long to keep information, the Firm considers:

whether it is still responding to or acting on your inquiry;
the need to keep a record of conflict checks and of decisions to act or decline;
limitation periods for potential legal claims connected with the inquiry;
professional-conduct and regulatory record-keeping requirements; and
any legal hold or ongoing dispute, investigation, or request.

13.3 Specific retention periods will be set out in the Firm’s retention schedule: Owner to insert actual retention periods once determined; do not invent periods. Server logs held by the hosting provider are retained for Owner to confirm the host’s log-retention period.

14. Information security

14.1 The Firm takes appropriate technical and organisational measures to protect personal information against unauthorised or unlawful processing and against accidental loss, destruction, or damage. Owner to describe the actual measures in place, for example transport encryption, access controls, staff training, and supplier vetting.

14.2 No method of transmission or storage is completely secure. You should not send sensitive information by email until the Firm has told you how to do so safely, as explained in the Website Terms of Use.

14.3 If the Firm becomes aware of a personal data breach that is likely to result in a risk to individuals, it will act in accordance with its legal obligations, which may include notifying the supervisory authority and affected individuals within the time limits that apply.

15. Your rights

15.1 Subject to the conditions and exceptions in Applicable Law, you may have the right to:

be informed about how your personal information is processed;
request access to the personal information the Firm holds about you;
request correction of inaccurate or incomplete information;
request erasure of your information in certain circumstances;
request restriction of processing in certain circumstances;
object to processing based on legitimate interests, and to object to direct marketing at any time;
request the transfer of certain information to you or another controller in a structured, commonly used format;
withdraw consent, where processing is based on consent; and
lodge a complaint with a supervisory authority.

15.2 These rights are not absolute. In particular, they may be limited where the information is subject to legal professional privilege or a duty of confidentiality owed to a client, where disclosure would adversely affect the rights of others, or where the Firm must retain information to comply with a legal obligation or to establish, exercise, or defend legal claims.

16. How to exercise your rights

16.1 To exercise any right, contact the Firm using the details in section 22. Please describe clearly what you are asking for.

16.2 The Firm may need to verify your identity before acting on a request, and may ask for more information to locate the relevant records.

16.3 The Firm will respond within the time limit set by Applicable Law (for GDPR-modelled laws, generally one month, extendable for complex requests). There is normally no charge, although the Firm may charge a reasonable fee or decline to act where a request is manifestly unfounded or excessive, to the extent Applicable Law permits.

17. Automated decision-making and profiling

17.1 The Firm does not make decisions about you that produce legal or similarly significant effects based solely on automated processing, and does not carry out profiling through this website.

17.2 If this changes, the Firm will update this policy and explain the logic involved, the significance, and the consequences, and will provide the safeguards Applicable Law requires.

18. Children

18.1 The website is intended for adults and for a professional audience. The Firm does not knowingly collect personal information from children through the website.

18.2 If you believe a child has provided personal information through the website, please contact the Firm so that it can take appropriate steps.

19. Third-party links

19.1 The website may link to third-party websites. The Firm is not responsible for the privacy practices of those websites. You should read their privacy notices before providing personal information to them.

20. Professional confidentiality and privilege

20.1 Lawyers owe strict duties of confidentiality to their clients, and certain communications are protected by legal professional privilege. These duties and protections operate alongside data protection law and, in some respects, take priority over it.

20.2 Where responding to a data protection request or a third-party request would require the Firm to disclose information that is privileged or confidential to a client, the Firm will not disclose that information except as permitted or required by law and by the applicable rules of professional conduct. This is explained further in the Compliance and Law Enforcement Requests Policy.

21. Changes to this policy

21.1 The Firm may update this policy from time to time. The current version is the one published on the website, with the effective date shown at the top.

21.2 Where changes are significant, the Firm will take reasonable steps to draw attention to them.

22. Contact and complaints

22.1 For any privacy question or to exercise a right, contact the Firm at inquiries@ioannadigital.example (Owner to confirm the monitored privacy contact address), or by post at Owner to insert postal address.

22.2 If you are not satisfied with the Firm’s response, you may complain to the relevant supervisory authority: Owner to insert the name and contact details of the competent supervisory authority; do not assume a jurisdiction. You may also have other remedies under Applicable Law.