Privacy Policy

Who we are

Hunter Legal Ltd, trading as Hunter Lawyers, is a firm of solicitors authorised and regulated by the Solicitors Regulation Authority, SRA ID 617971. We are registered in England and Wales, company number 09248654, with our registered office at 2 Upper Northgate Street, Chester, CH1 4EE. We are the controller of the personal data described in this notice. This means we decide how and why it is used, and we are responsible for protecting it. We are registered with the Information Commissioner’s Office under number ZA108166. Our Data Protection Officer is Lucas Hunter, Director. You can contact him by email at LH@hunterlawyers.co.uk, by telephone on 0333 358 4015, or by post at 2 Upper Northgate Street, Chester, CH1 4EE. This notice explains how we collect, use, share and protect personal data, and the rights you have. It applies to our clients, prospective clients, people who contact us or use our website, and other people whose data we hold in the course of our work, such as opposing parties, witnesses and other advisers. We comply with the UK General Data Protection Regulation, the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications Regulations.

What personal data we collect

We collect your name, address, email address, telephone number, date of birth and identity documents such as your passport or driving licence. We also collect your bank details and financial information relevant to your instructions, and information about your legal matter and our dealings with you. Depending on the matter, we may also hold information about your employment, pay, pension, family, tax affairs and immigration status. Some matters require us to hold more sensitive data, known as special category data. This includes information about your health, racial or ethnic origin, religious or philosophical beliefs, trade union membership, sex life or sexual orientation. We may also hold information about criminal convictions or offences where it is relevant to your matter or to our anti-money laundering checks. When you visit our website, we collect technical information such as your IP address and browsing data through cookies. Our cookie policy, on our website, explains this and lets you control which cookies are set.

Where we get it from

Most of the data we hold comes directly from you, by email, telephone, in meetings, through our website or through our client portal. We also obtain data from others. These include identity verification and credit reference agencies, public registers such as Companies House and HM Land Registry, and your employer, former employer or their representatives. They also include your other advisers, medical professionals, courts and tribunals, and other parties to your matter and their lawyers. Where you give us information about another person, please make sure they know you have done so.

Why we use it and our lawful basis

The law allows us to use personal data only where we have a lawful basis for doing so. We use your data to provide legal services to you and to manage our relationship with you. This is necessary to perform our contract with you, or to take steps at your request before entering into one. We use your data to verify your identity, carry out anti-money laundering and sanctions checks, keep accounting and file records, and meet our obligations to the Solicitors Regulation Authority, HMRC and other authorities. This is necessary to comply with our legal obligations. We use your data to run our business efficiently, maintain our professional indemnity insurance, carry out audits and quality checks, train our staff, protect our systems, deal with complaints and claims, and tell existing and former clients about our services. We do these things because they are in our legitimate interests. Those interests are running a well-managed, secure and compliant legal practice and keeping our clients informed. We have considered your interests and rights and are satisfied they are not overridden.

We use special category data and criminal offence data where it is necessary to establish, exercise or defend legal claims or to obtain legal advice. We also do so where it is necessary for reasons of substantial public interest permitted by the Data Protection Act 2018, such as preventing fraud and money laundering. In any other case we do so only with your explicit consent. Where we rely on your consent, you may withdraw it at any time. Withdrawal does not affect anything we did before you withdrew it. We do not make decisions about you based solely on automated processing.

If you do not give us information

We need certain information to act for you. The law requires us to verify your identity. If you do not provide the information we need, we may be unable to act for you or to continue acting.

Marketing

We may send you updates on legal developments and our services by email, post or telephone. We will send electronic marketing only to existing and former clients about similar services, or where you have agreed to receive it. We never sell your data or share it with others for their marketing. You may opt out at any time by writing to us, using the unsubscribe link in any email, or replying STOP to any text.

Who we share it with

We share personal data only where necessary and only as much as is needed. Depending on your matter, we may share it with barristers, experts, mediators and other professional advisers. We may also share it with courts and tribunals, ACAS, and other parties to your matter and their representatives. Our bank, National Westminster Bank plc, may receive it, as may our professional indemnity insurer, AXIS, and our broker, Miller Insurance. So may our auditors, accountants and quality assessors. The Solicitors Regulation Authority, the Legal Ombudsman, HMRC, the National Crime Agency and other public bodies may receive it where the law requires. We also use service providers who process data on our behalf and only on our instructions, under written contracts that require them to keep it secure and confidential. These include our practice management system, Clio, our electronic signature provider, Dropbox Sign, and our electronic identity verification provider. They also include our email, IT support and cloud storage providers, and any outsourced typing or administrative services. If our business is sold, merged or acquires another, your data may be reviewed in confidence by the other party and its advisers as part of that process.

Transfers outside the United Kingdom

Some of our service providers store or access data outside the United Kingdom. Where data is transferred to the European Economic Area, it is protected by UK adequacy regulations. Where it is transferred elsewhere, we ensure it is protected. This may be by UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework. Otherwise it may be by the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. You may ask us for details of the safeguards that apply.

How long we keep it

We keep personal data only for as long as necessary. We generally keep client files for at least six years after our final bill, which reflects the time within which claims may be brought. We may keep them longer where the law requires, where the matter involves a minor or a person lacking capacity, or where documents are held in safe custody at your request. We keep identity verification records for at least five years after our relationship ends, as the Money Laundering Regulations require. Accounting records are kept for at least six years. Enquiries that do not lead to instructions are kept for twelve months. Marketing data is kept until you opt out. When data is no longer needed, we securely delete or anonymise it.

Your rights

You have the right to ask for a copy of the personal data we hold about you. You may have inaccurate data corrected and incomplete data completed. You may ask us to erase your data or restrict our use of it in certain circumstances. You may object to our use of your data where we rely on legitimate interests, and at any time to its use for marketing. You may receive data you gave us in a portable format, or ask us to transfer it to another organisation. And you may withdraw any consent you have given. Some rights are limited. For example, we may be unable to disclose or erase data that is subject to legal professional privilege, that concerns other people, or that we must keep by law. If a right does not apply, we will explain why. To exercise any right, please contact our Data Protection Officer. We may need to verify your identity. We will respond within one month. We may extend this by up to two further months for complex or numerous requests, in which case we will tell you why. We do not usually charge a fee.

Security

We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. These include encryption, access controls, secure systems and staff training. Only those who need access to your data have it. We have procedures to deal with any suspected data breach, and we will notify you and the Information Commissioner where the law requires. Please be aware that email is not completely secure. We will never tell you of a change to our bank details by email.

Complaints

If you are unhappy with how we have handled your personal data, please complain to our Data Protection Officer first. We will acknowledge your complaint within 30 days, investigate it without undue delay, and tell you the outcome. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. The ICO will usually expect you to have complained to us first.

Changes to this notice

We review this notice regularly. We will publish any changes on our website and, where they materially affect you, tell you directly.