Privacy notice

The personal data we hold and where it comes from

We hold the personal data we need to provide legal services and run our practice: contact and identity details; information needed for client due diligence under anti-money laundering law; the content of instructions, advice, correspondence and documents on a matter, which may include personal data about counterparties, witnesses, employees and other people connected with it; records of meetings and calls, including notes, transcripts and summaries; billing and payment information; and the details of anyone who writes to us. Most of this comes from our clients and the people we correspond with. Some comes from public sources, identity-verification and screening providers, courts, regulators, counterparties and other advisers.

Why we use it and our lawful bases

We use personal data to provide legal services under our contract with the client (Article 6(1)(b) UK GDPR, where the client is an individual); to comply with our legal and regulatory obligations, including anti-money laundering checks, sanctions screening and our obligations to the Solicitors Regulation Authority (Article 6(1)(c)); and for our legitimate interests in running an efficient, accurate and secure legal practice, keeping proper records, managing our relationships, and promoting our services (Article 6(1)(f)), which includes the processing of personal data about people who are not our clients but are connected with a matter. Where a matter involves special category data (for example, health information) or information about criminal offences, we rely on the condition for the establishment, exercise or defence of legal claims, which includes obtaining legal advice (Article 9(2)(f) and Schedule 1 to the Data Protection Act 2018), or on explicit consent where we ask for it. We do not make any decision about you solely by automated means.

Technology and AI-assisted processing

We use secure cloud-based systems to store and process information, and artificial intelligence tools, under our supervision, to help us deliver legal services and run our practice: to research, analyse and draft; to review documents; to prepare, with the notice described below, notes, transcripts and summaries of meetings and calls we take part in; and to organise our own work. The providers of these tools (AI assistant providers and meeting transcription providers) act as our processors under written data processing terms. They are required to keep information confidential and secure and are not permitted to use it to train their AI models. We will tell you which providers we currently use on request. A solicitor remains responsible for all of our work and verifies AI-assisted output before we rely on it, and clients may ask us not to use AI tools on their matter.

Where we use an AI tool to transcribe a meeting or call, we tell all participants before transcription begins and we respect objections. We do not keep audio or video recordings; transcripts and summaries are held confidentially, and verbatim transcripts are deleted once a summary has been prepared unless they are needed for the matter.

Who we share it with

We share personal data only where necessary: with barristers, experts, foreign lawyers and other professionals instructed on a matter; with counterparties, their advisers, courts, tribunals, registries and public bodies to progress a matter; with our technology, cloud and AI providers, identity-verification and screening providers, and other suppliers who process data for us under written terms; with our insurers, bank, accountants and professional advisers; and with regulators and authorities, including the Solicitors Regulation Authority, the Legal Ombudsman and law-enforcement agencies, where the law requires or permits.

International transfers

Some of our providers are based in, or process data in, countries outside the UK, including the United States. Transfers are protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, for certified US organisations) or by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Where a matter requires us to send personal data to lawyers or authorities in another country, we do so under the safeguards the law allows for that purpose.

How long we keep it

We keep matter files, including correspondence and work product, for at least six years after a matter ends, and longer where the type of matter or the law requires. We keep client due diligence records for five years after the end of our relationship with the client, as anti-money laundering law requires. Content held within AI tools is deleted when a matter closes or sooner. Records of people who contact us but do not become clients are kept only as long as needed to deal with the enquiry and our conflict-checking obligations.

Your rights

You have the rights given by UK data protection law, including the rights to access your personal data, to have it corrected or erased, to restrict or object to its processing, and to data portability, in each case subject to the exemptions that apply to legal work, including legal professional privilege. Where we rely on consent, you may withdraw it at any time. To exercise any right, email oliver@ojllaw.com or write to us at 38 Bow Lane, London EC4M 9AY.

Complaints

If you are unhappy with how we have handled your personal data, you can complain to us by email to oliver@ojllaw.com, by post to 38 Bow Lane, London EC4M 9AY, or by using the complaint form on our website. We will acknowledge your complaint within 30 days and respond without undue delay, in accordance with section 164A of the Data Protection Act 2018. You may also complain at any time to the Information Commissioner’s Office: ico.org.uk • 0303 123 1113 • Wycliffe House, Water Lane, Wilmslow SK9 5AF. Complaints about our legal services or our invoices are dealt with under our Complaints Procedure, published at ojllaw.com.

Our website

Our website does not use cookies or analytics. The SRA digital badge in the footer is provided by the SRA's badge provider, Yoshki; when a page loads, Yoshki's server receives the technical details that any web request carries, such as your IP address. If you email us, we use your details to respond to you and, where you ask us to act, to open a file and carry out the checks described above.

Changes to this notice

We may update this notice from time to time. The current version is published at ojllaw.com and is available on request.