PRIVACY POLICY

1. Who We Are (Data Controller)

Lamzai Solicitors is the data controller in respect of the personal data we process. We are a sole practice authorised and regulated by the Solicitors Regulation Authority (SRA No. 8014486), practising at:

2. Personal Data We Collect

Depending on how you interact with us, we may collect and process the following categories of personal data:

Contact and Identity Data

• Full name, title, date of birth
• Postal address, email address, telephone number
• Information provided via our contact form or by email, post, or telephone

Client and Case Data

• Details of your legal matter, instructions, and correspondence
• Identity verification documents (e.g. passport, driving licence, proof of address) as required by our anti-money laundering obligations
• Financial information relevant to your matter (e.g. details of assets, debts, or transactions)
• Special category data where relevant to your case (e.g. health information, immigration status, criminal records)

Website Usage Data

• IP address, browser type and version, operating system
• Pages visited, time spent on the site, referring website
• Cookie data (see our Cookie Policy for details)

We do not knowingly collect personal data from children under 13 without parental consent.

3. How We Use Your Personal Data

We use personal data only for specified, lawful purposes. These include:

• Responding to your enquiries and providing initial advice
• Opening a client file and providing legal services under our retainer
• Complying with our legal and regulatory obligations (including anti-money laundering checks, SRA requirements, and court obligations)
• Sending you updates about your matter and invoicing for our services
• Maintaining our business records and improving our services
• Analysing website usage to improve the performance and content of our website

We will never sell your personal data to third parties, nor use it for unsolicited marketing without your consent.

4. Lawful Basis for Processing

Under UK GDPR, we rely on the following lawful bases:

• Contract: Processing is necessary to provide legal services under the terms of our client engagement.
• Legal obligation: Processing is required to comply with our obligations under law (e.g. anti-money laundering regulations, court orders, SRA rules).
• Legitimate interests: Processing is necessary for our legitimate business interests, such as running our firm, protecting against fraud, and maintaining client records, where these interests are not overridden by your rights.
• Consent: Where we process special category data (such as health or immigration information) or send optional communications, we will seek your explicit consent.
• Vital interests: In rare circumstances, we may process data to protect someone’s life.

5. Sharing Your Personal Data

We may share your data with the following categories of recipients, where necessary and proportionate:

• Courts, tribunals, and other legal authorities in connection with your matter
• Counsel (barristers), expert witnesses, and other legal professionals instructed on your behalf
• The Solicitors Regulation Authority (SRA) or other regulatory bodies if required
• HM Revenue & Customs or the National Crime Agency in connection with our anti-money laundering obligations
• IT service providers and professional advisers who support our business, all of whom are bound by confidentiality obligations
• Opposing parties or their solicitors, to the extent required by your matter

We will not share your data with any other third party without your consent, except where required by law.

6. International Data Transfers

We primarily process and store personal data within the United Kingdom. Where any transfer outside the UK is necessary (for example, if instructing overseas counsel or dealing with an international matter), we will ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or equivalent protections.

7. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, and in accordance with our legal and regulatory obligations. Our standard retention periods are:

• Client files (general): 7 years from the conclusion of the matter, in line with the Limitation Act 1980
• Wills, probate, and property matters: up to 15 years, or as required by applicable law
• Anti-money laundering records: 5 years from the end of the business relationship
• Enquiries that did not proceed to a matter: up to 2 years
• Website usage data: as set out in our Cookie Policy

After the relevant retention period, personal data is securely deleted or anonymised.

8. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

• Right of access: You can request a copy of the personal data we hold about you (a “Subject Access Request”).
• Right to rectification: You can ask us to correct any inaccurate or incomplete data.
• Right to erasure: You can ask us to delete your personal data in certain circumstances (“right to be forgotten”).
• Right to restriction: You can ask us to restrict how we use your data in certain circumstances.
• Right to data portability: Where processing is based on consent or contract, you can request your data in a structured, machine-readable format.
• Right to object: You can object to processing based on legitimate interests or for direct marketing.
• Rights related to automated decision-making: You have the right not to be subject to solely automated decisions that produce significant effects.

Please note that some of these rights are subject to exemptions — for example, we may need to retain data to comply with legal obligations or defend legal claims.

To exercise any of these rights, please contact us using the details in Section 1 above. We will respond within one calendar month. There is no charge for making a request, unless it is manifestly unfounded or excessive.

9. How to Complain

If you are unhappy with how we have handled your personal data, please contact us first so we have the opportunity to resolve your concern. If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s data protection supervisory authority.

10. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include secure storage of physical files, password-protected and encrypted digital systems, and restricted access on a need-to-know basis.

Where we engage third-party service providers, we require them to maintain appropriate security standards and enter into data processing agreements where required.

In the unlikely event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO as required by law.

11. Third-Party Links

Our website may contain links to third-party websites. We have no responsibility or control over the privacy practices of those sites and encourage you to read their privacy policies before providing any personal data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be published on this page with an updated “last updated” date. Where changes are material, we will take reasonable steps to bring them to your attention.