The Contract Studio UK Ltd – Privacy Policy

Last updated: 9 February 2026

1. Important information and who we are

The Contract Studio UK Ltd respects your privacy and is committed to protecting your personal data. This privacy policy explains what personal data we collect, how and why we use it, and your rights in relation to that data.

This policy applies to:

• Clients and prospective clients
• People who sign up for our newsletters, webinars or events
• Suppliers and other professional contacts
• Job applicants and consultants

Our website and services are not intended for children. If you provide information about children (for example in connection with legal advice), we will handle it with appropriate safeguards and in line with data protection law.

You should read this policy together with any specific privacy notices we give you on particular matters. Those additional notices complement, rather than replace, this policy.

Controller

The Contract Studio UK Ltd is the controller and is responsible for your personal data (referred to as "we", "us" or "our" in this policy).

We have not appointed a formal Data Protection Officer, but you can contact us about any data protection issue using the details below.

Contact details

Please tell us if your personal details change while we are working with you so we can keep our records accurate and up to date.

Changes to this policy

We review this policy regularly and may update it from time to time. Where appropriate we will notify you of significant changes, for example by email or a notice on our website.

Third-party links

Our website may contain links to third-party websites, plug-ins or applications. Clicking those links may allow third parties to collect or share data about you. We are not responsible for those third-party sites and encourage you to read their privacy notices.

2. The data we collect about you

"Personal data" means information from which an individual can be identified. It does not include anonymous data.

Depending on our relationship with you, we may collect, use, store and transfer the following categories of data:

• Identity data – name, title, job title, date of birth, marital status, identifiers on documents (such as passport or driving licence numbers), and any other identifiers we need to verify you or carry out conflict checks.
• Contact data – postal address, email address, telephone numbers and social-media handles.
• Matter / advice data – information relating to instructions you give us, including background facts, documents, correspondence, evidence, agreements and other data needed to provide our services.
• Financial data – bank account details, payment card details, billing and payment history and other information required for invoicing, payment processing and fraud prevention.
• Transaction data – details of services you have purchased from us and payments to and from you.
• Technical data – IP address, login data, browser type and version, time-zone setting, operating system and other technology on the devices you use to access our website.
• Usage data – information about how you use our website, products and services.
• Marketing and communications data – your preferences in receiving marketing from us and your communication preferences.
• Physical access data – records of visits to our premises (for example reception logs or CCTV images).

We do not routinely collect "special category" data (such as health, ethnicity or trade-union membership) or data about criminal convictions unless it is necessary for the legal services we provide and permitted by law.

If we ask for personal data and you do not provide it, we may be unable to carry out our contract with you or to comply with our legal obligations.

3. How we collect your personal data

We collect data in a number of ways, including:

• Directly from you – for example when you: instruct us; fill in forms; correspond by phone, email, post or via our website; attend meetings, webinars or events; sign up for newsletters; or give us feedback.
• From your organisation or other parties involved in a matter – for example other professional advisers, counterparties, witnesses, experts, courts and tribunals.
• From service providers – such as payment processors, credit-reference agencies, search providers and analytics providers.
• From publicly available sources – including Companies House, the electoral register, professional networking sites and other public registers.

As you interact with our website we may automatically collect Technical and Usage data using cookies and similar technologies. For more details, please see our Cookie Policy.

4. How and why we use your personal data

We will only use your personal data when the law allows us to. Most commonly we use it where:

• We need to perform a contract with you or take steps at your request before entering into one.
• It is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• We must comply with a legal or regulatory obligation.

Examples of how we use your data include:

• To open a file, carry out conflict checks, verify your identity and register you as a new client.
• To provide legal and related services to you or your organisation.
• To manage our relationship with you, including handling queries, complaints and updating you about changes to our terms or policies.
• To process payments, recover debts and maintain accounting records.
• To operate and secure our website, IT systems and office premises.
• To send you legal updates, insights and information about events or services we think may interest you (where permitted by law).
• To comply with our professional, regulatory and legal duties, including record-keeping, anti-money-laundering checks and reporting to regulators or authorities.

We do not rely on consent as a legal basis for processing your data except for certain marketing activities. You can withdraw consent at any time by contacting us or using the unsubscribe link in our emails.

Marketing

We may use your Identity, Contact, Technical, Usage and Marketing data to decide which services, events or updates may be relevant for you and to send you marketing communications. We will only send electronic marketing where the law allows this (for example where you are an existing client or you have opted in). You can opt out at any time.

Change of purpose

We will only use your personal data for the purposes set out in this policy unless we reasonably consider that we need to use it for another compatible purpose. If we need to use it for an unrelated purpose we will explain the legal basis and update this policy where appropriate.

5. Disclosures of your personal data

We may share your personal data with:

• Members, employees and consultants of The Contract Studio UK Ltd who need the information to perform their roles.
• Professional advisers and service providers who support our business, such as counsel, experts, accountants, insurers, IT and cloud-service providers, marketing or event partners, and payment processors.
• Opposing parties, courts, tribunals, regulators, government bodies and law-enforcement agencies where required in connection with your matter or by law.
• Third parties to whom we may sell, transfer or merge parts of our business or assets.

We require third parties to respect the security of your personal data and to process it only according to our instructions and the law. We do not permit them to use your data for their own purposes.

6. International transfers

Our core systems are located in the UK or EEA. If we ever transfer your personal data outside the UK/EEA, we will ensure that appropriate safeguards are in place (for example using standard contractual clauses or other mechanisms approved by the UK Information Commissioner's Office).

7. Data security

We use appropriate technical and organisational measures to prevent personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Access is limited to those who have a business need to know and are subject to confidentiality obligations.

We have procedures to deal with any suspected personal data breach and will notify you and the relevant regulator where we are legally required to do so.

8. Data retention

We keep your personal data only for as long as necessary for the purposes we collected it for, including to satisfy legal, accounting and regulatory requirements.

Generally we retain:

• Client file information for 6 years after the matter closes, and 12 years where work involved a deed or other document requiring longer retention.
• Basic contact, identity and transaction information for at least 6 years for tax and regulatory purposes.

We may anonymise your data (so it can no longer be linked to you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

9. Your legal rights

You have a number of rights under data-protection law, including the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure of your data in certain circumstances.
• Object to processing based on legitimate interests, and to direct-marketing.
• Request restriction of processing in certain circumstances.
• Request the transfer of your personal data to you or to another controller (data portability).
• Withdraw consent where we rely on consent to process your data.

If you wish to exercise any of these rights, please contact us using the details above and tell us who you are and which right you wish to exercise. We may need to verify your identity before responding.

We aim to respond within one month of receiving a valid request. We usually do not charge a fee, but may do so or refuse to act if a request is manifestly unfounded, repetitive or excessive.

10. Complaints

If you have concerns about how we handle your personal data, please contact us at hello@thecontractstudiouk.com in the first instance so we can try to resolve the issue.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):