Privacy Policy


Burtonwoods (“the Firm”) is a firm of solicitors operating as a partnership. We are located at Wax Chandler’s Hall, 6 Gresham Street, London EC2V 7AD. We are regulated by the Solicitors Regulation Authority (registration number 00324143).

We are the data controller for the purpose of the General Data Protection Regulation (EU 2016/679), the Data Protection Act 2018, and supporting legislation.

This Privacy Notice is intended to provide information about how we will use your personal data in the course of our business including when you contact or request information from us (including via our website), when you engage our legal services or as a result of your relationship with one or more of our staff and clients. A Privacy Notice for Staff provides further information for anyone who works for, or acts on behalf of us.

We have appointed the Office Manager  as the Data and Systems Lead  who will deal with all your requests and enquiries concerning our use of your personal data (see section on Your Rights below) and endeavour to ensure that all personal data is processed in compliance with this policy and data protection law. The Office Manager, Leon Lau, can be contacted by emailing .

Categories of data collected by us

In order to carry out our business, we need to process a wide range of personal data about individuals. The personal information that we process includes:

  • Basic information, such as your name, the company you work for, your title or position and your relationship to a person
  • Contact information, such as your postal address, email address and phone number(s)
  • Financial information, such as payment-related information
  • Identification and background information provided by you or collected as part of our business acceptance processes
  • Personal information provided to us by or on behalf of our clients or generated by us in the course of providing services to them, which may include special categories of data
  • Any other information relating to you which you may provide to us

How we collect data

We collect information from you as part of our business acceptance processes and about you and others as necessary in the course of providing legal services.

We gather information about you when you provide it to us. We may also collect or receive information about you from third parties, such as other firms of solicitors.

Legal basis for processing data

We use your personal information on the following basis:

  • To perform a contract, such as engaging with an individual to provide legal services
  • For the establishment, exercise or defence of legal claims or proceedings
  • To comply with legal and regulatory obligations
  • Because we have a legitimate interest in it

Our “legitimate interests” include our interest in running our Firm in a professional, sustainable manner, in accordance with all relevant ethical, legal and regulatory duties and requirements (whether or not connected directly to data protection law). We expect that the following uses will fall within the category of “legitimate interests”:

  • To provide our services to you and to our clients, including handling the personal information of others on behalf of our clients
  • To provide information requested by you
  • To promote our services
  • To manage and administer our relationship with you and our clients

Sharing your information with others

We may share your personal information with certain trusted third parties in accordance with contracts in place with them, including:

  • Our professional advisers and auditors
  • IT service providers including webhosting
  • Third parties engaged in the course of the services we provide such as barristers and conveyancing search agents

Where necessary or required, personal information may also be shared with regulatory authorities, courts, tribunals, government agencies and law enforcement agencies.

In the unlikely event that a third party is acquiring or considering acquiring all or part of our Firm, we may need to transfer your information to third parties and their advisers.

Transfer of data abroad

In order to provide our services we may need to transfer your personal information to a country outside the European Economic Area (EEA), for example for the purpose of communicating with clients based outside the EEA and for the purpose of certain processing activities carried out by third parties. The level of information protection in countries outside the EEA may be less than that offered within the EEA. Where this is the case, we will implement appropriate measures to ensure that personal data remains protected and secure in accordance with applicable data protection laws.

How long your information is kept by us

The length of time your data is retained depends on the purpose for which the data was collected and used, taking into account legal and regulatory requirements to retain the information for a minimum period, limitation periods for taking legal action, good practice and our business purposes.

How we protect data

We have internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our staff in the performance of their duties.

Where we engage third parties to process personal data on our behalf, they do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of data.

Automated decision-making

We do not use automated decision-making.

Your rights

The European Union’s General Data Protection Regulation and other applicable data protection laws provide certain rights for data subjects.

You are entitled to request details of the information we hold about you and how we process it.  You may also have a right to have it rectified or deleted, to restrict our processing of that information, to stop unauthorised transfers of your personal information to a third party and, in some circumstances, to have personal information relating to you transferred to another organisation. You may also have the right to lodge a complaint in relation to our processing of your personal information with the Information Commissioner (ICO), see below.

If you object to the processing of your personal information, or if you have provided your consent to processing and you later choose to withdraw it, we will respect that choice in accordance with our legal obligations.

Your objection (or withdrawal of any previously given consent) could mean that we are unable to perform the actions necessary to achieve the purposes set out above or that you may not be able to make use of our services. Please note that even after you have chosen to withdraw your consent we may be able to continue to process your personal information to the extent required or otherwise permitted by law, in particular in connection with exercising and defending our legal rights or meeting our legal and regulatory obligations.

We must ensure that your personal information is accurate and up to date. Therefore, please advise us of any changes to your information by emailing Leon Lau at

If you would like to exercise any of the rights described above, please contact Leon Lau at . If you believe that we have not complied with your data protection rights, you can complain to the ICO. The ICO can be contacted at