2.1 Who is responsible for your data
Invicta Legal (company number: 13476252, SRA number 827230) is the data controller. Our registered office is Manchester Business Park 3000, Aviator Way, Manchester, M22 5TG, and our office is at 3000 Aviator Way, Manchester M22 5TG. We are registered with the Information Commissioner's Office under registration number The ICO (Information Commissioner's Office) data protection registration number for Invicta Legal (operating under its privacy policy and trading details) is ZB263988.
For any question about this policy or your data, contact us on 0161 523201, or by post at the address above.
2.2 Personal data we collect
| Who you are | What we may collect |
|---|---|
| Website visitors | IP address, browser and device details, pages visited, referral source, and cookie data (see our Cookie Policy). |
| People who contact us | Name, email, telephone number, and the content of your message or enquiry. |
| Clients and prospective clients | Identity and contact details, date of birth, address history, proof of identity and address, financial information, and details of your matter, which can include sensitive information. |
| Other parties to a matter | Names, contact details and information relevant to the case, such as opponents, witnesses, beneficiaries, and their representatives. |
| Job applicants | CV, work history, qualifications, references and right-to-work information. |
| Suppliers and business contacts | Names, business contact details and payment details. |
Some of the data we handle is special category data (for example health information) or criminal offence data. We process it only where the law permits, usually because it is necessary to establish, exercise or defend legal claims, or because you have given explicit consent.
2.3 How we collect it
We collect personal data directly from you, for example through our website forms, by telephone, email and post, and in meetings. We also collect it from third parties where relevant to your matter, such as identity verification and credit reference providers, banks and lenders, estate agents, other solicitors, courts, HM Land Registry, Companies House, your employer, medical professionals and public sources.
2.4 Why we use your data and our legal basis
| Purpose | Legal basis |
|---|---|
| To provide legal services and manage your matter | Performance of our contract with you, or steps taken before entering one. |
| To verify your identity and carry out anti-money laundering, sanctions and fraud checks | Legal obligation (Money Laundering Regulations 2017 and related law). |
| To comply with SRA rules, the law, court orders and requests from authorities | Legal obligation. |
| To send invoices, take payment and recover debts | Contract, and our legitimate interests in running and getting paid for our business. |
| To respond to website enquiries | Legitimate interests in answering your questions, or pre-contract steps. |
| To keep records, manage risk, handle complaints, and defend legal claims | Legitimate interests, and legal obligation where applicable. |
| To send you updates about our services and legal developments | Your consent, or our legitimate interests where the law allows email to existing clients. |
| To improve our website and measure how it is used | Consent for non-essential cookies; otherwise legitimate interests. |
| To recruit staff | Legitimate interests, and steps taken before entering a contract. |
Where we rely on legitimate interests, we have balanced them against your rights and freedoms. You can ask us for details of that assessment.
2.5 Marketing
We will send you marketing emails only if you have agreed to receive them, or if you are an existing client and the message is about similar services, and you have not opted out. You can unsubscribe at any time using the link in any email or by contacting us. We never sell your data to third parties for their own marketing.
2.6 Who we share your data with
We share personal data only where it is necessary and appropriate. Recipients may include:
Barristers, experts, agents, process servers, translators and other professionals we instruct for your matter
Courts, tribunals, HM Land Registry, HM Revenue and Customs, Companies House, and other public bodies
Banks, lenders, insurers, estate agents, and other parties to your transaction
Identity verification, credit reference and anti-fraud providers
Our IT, case management, cloud storage, accounting, telephony and communications providers, who act on our behalf under written contracts
Our auditors, insurers, professional advisers, and the SRA, the Legal Ombudsman and other regulators
Any buyer or successor to our business, if it is ever sold or reorganised
We may also disclose data where we are required to do so by law, or where we need to protect our rights or those of others.
2.7 International transfers
We aim to keep your data in the UK. If we or our service providers transfer it outside the UK, we make sure it is protected, for example by sending it only to countries covered by UK adequacy regulations, or by using the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Contact us for a copy of the safeguards.
2.8 How long we keep your data
We keep data only for as long as we need it for the purpose it was collected for, including to meet legal, accounting and regulatory duties.
| Type of data | Typical retention |
|---|---|
| Client files | Six years after the matter closes (longer for certain matters such as wills, trusts, long-term property and matters involving minors or lack of capacity) |
| Identity and anti-money laundering records | Five years after the end of the business relationship, as the law requires |
| Accounting records | Six years from the end of the financial year |
| Website enquiries not leading to instructions | 12 months |
| Marketing preferences | Until you unsubscribe, then a suppression record |
| Unsuccessful job applications | Six months |
2.9 Keeping your data secure
We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, including access controls, encryption, staff training and confidentiality obligations. No system is completely secure, so please take care when you send us information. If there is a breach that is likely to risk your rights and freedoms, we will tell you and the ICO as the law requires.
2.10 Your rights
You have the right to:
Be informed about how we use your data, which is what this policy does
Access a copy of the personal data we hold about you
Rectify data that is inaccurate or incomplete
Erase your data in certain circumstances, although we may have to keep some of it for legal or regulatory reasons
Restrict how we use your data in certain circumstances
Object to processing based on legitimate interests, and to direct marketing at any time
Data portability, in certain cases where we process your data by consent or contract using automated means
Withdraw consent at any time, where we rely on it, without affecting earlier processing
Not be subject to solely automated decisions with legal or similarly significant effects. We do not make such decisions
To use these rights, contact us using the details above. We may need to verify your identity and, if your request is unclear, to ask you for more detail. We carry out reasonable and proportionate searches for the data you ask for. We normally respond within one month and do not charge a fee, unless a request is clearly unfounded or excessive. Legal professional privilege and confidentiality can limit what we are able to disclose.
2.11 Complaints to the ICO
If you are unhappy with how we use your data, please contact us first so we can try to put it right. You can complain to us using the details above. We aim to acknowledge your complaint within 30 days and to respond without undue delay. You also have the right to complain to the Information Commissioner's Office at www.ico.org.uk, or on 0303 123 1113, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
2.12 Links to other sites
Our website may link to other websites. We do not control them and are not responsible for their privacy practices. Please read their policies before giving them your data.
2.13 Children
Our website is not aimed at children, and we do not knowingly collect their data through it. We may act for children in legal matters, and when we do, we handle their data in line with this policy.
2.14 Changes to this policy
We may update this policy from time to time. The latest version will always be on this page with the date at the top. If we make a significant change, we will tell you in an appropriate way.