Last updated 7 September 2026.
Western Legal Corporation Limited, company number 10453250, registered in England and Wales at 19 The Circle, Queen Elizabeth Street, London SE1 2JE, is the data controller for the personal data described in this notice.
The solicitor responsible for data protection is Santosh Pandey, Solicitor of England and Wales, SRA No. 641612. Contact us at sp@westernlegal.co.uk or +44 204 577 1755.
From our enquiry forms. Your name, email address, telephone number where you give one, the matter type you select, and whatever you tell us about your situation, including any documents you attach.
From email, WhatsApp and telephone. Whatever personal data you choose to share in those communications.
When you pay. Your name, email address, billing address, telephone number where you give one, the amount paid and, for a trade mark filing bought online, the mark and applicant name you enter at checkout. Card and bank details are entered on pages hosted by Stripe, our payment provider, and are never received, seen or stored by us. We receive a payment confirmation, the last four digits of the card and, where you agree to save a payment method for staged payments, a reference token that lets Stripe take the agreed payment; we never hold the card or account number itself.
Automatically, with your consent. Advertising click identifiers and campaign parameters, described in section 5.
If you instruct us. The information needed to carry out the work, which depending on the matter may include business details, addresses, company and shareholding information, employment details, contractual documents, correspondence with third parties, and identification documents where anti money laundering checks apply.
We do not ask for special category data and you should not send it unless the matter requires it. Where a matter does require it, for example health information in an employment dispute, we process it under Article 9(2)(f) of the UK GDPR, the establishment, exercise or defence of legal claims.
Responding to your enquiry. To assess your matter and give you a written quote. Our legitimate interest in responding to prospective clients, Article 6(1)(f), or steps taken at your request before entering a contract, Article 6(1)(b).
Carrying out your matter. Performance of our contract with you, Article 6(1)(b), together with our legal obligations as a regulated solicitor, Article 6(1)(c).
Regulatory and record keeping obligations. Compliance with legal obligations, Article 6(1)(c), including the SRA Standards and Regulations and anti money laundering law where it applies.
Analytics and advertising measurement. Your consent, Article 6(1)(a), which you may withdraw at any time using the Cookie settings link in the footer of every page.
Taking payment. Performance of a contract with you, Article 6(1)(b) UK GDPR, and our legal obligations to keep accounting and tax records, Article 6(1)(c).
Under the Privacy and Electronic Communications Regulations 2003, non essential cookies and similar storage require your consent before they are set. Nothing beyond the strictly necessary category is loaded until you choose Accept.
| wl_consent | Stores your cookie choice so we do not ask again. Browser local storage, set by us, retained until you clear it or change your choice. |
| Google Ads tag AW-17980143249 | Measures which advertisements lead to enquiries, calls and WhatsApp messages. Set by Google. Typical duration up to 90 days. |
| Microsoft Advertising UET tag 343268376 | The same measurement for advertisements shown on Bing and the Microsoft network. Set by Microsoft. Typical duration up to 90 days. |
| Attribution storage set by us | Click identifiers and campaign parameters, described in section 5, held in browser local storage for 90 days so that an enquiry can be matched to the advertisement that led to it. |
We operate Google Consent Mode v2 and Microsoft UET consent mode. Both tags load with advertising and analytics storage set to denied, and are only granted if you choose Accept. Choosing Essential only leaves them denied, and the site works normally.
You can change or withdraw your choice at any time using Cookie settings in the footer of every page. We do not use a cookie wall, and refusing is as easy as accepting.
If you reach this site from an advertisement and you have accepted cookies, we store the click identifier in your browser for 90 days and attach it to any enquiry you send, so that we can tell which advertising produces genuine instructions. The parameters are gclid, gbraid and wbraid from Google, msclkid from Microsoft, and the standard utm campaign parameters. This information is not used to build a profile of you and is not combined with your matter for any purpose other than measuring advertising.
Resend. Enquiry form submissions are delivered to us by email through Resend, our transactional email provider. They process the content of your enquiry solely to deliver it.
FormSubmit. Used only as a fallback if our own delivery fails, so that an enquiry is never lost. In that event the same enquiry content passes through FormSubmit to reach our inbox.
Stripe. Stripe Payments UK Ltd processes card, Apple Pay, Google Pay and Bacs Direct Debit payments on our behalf. When you pay, you enter your payment details on a page hosted by Stripe; Stripe processes them to take the payment, to prevent fraud and to meet its own legal obligations, and shares the payment confirmation, your billing details and the last four digits of your card with us. Stripe is a PCI DSS validated provider and acts as our processor for the payment itself; for fraud prevention and regulatory purposes it also acts as an independent controller under its own privacy policy at stripe.com/gb/privacy.
Vercel. Hosts this website and processes server logs, including IP addresses, for security and availability.
Google and Microsoft. If you consent to advertising cookies, conversion signals are transmitted to them for measurement.
Intellectual property offices. Where you instruct us on a trade mark, your applicant details are submitted to the UKIPO, EUIPO or WIPO as the procedure requires. Applications and their contents become part of a public register.
Correspondent agents and counsel. Where a matter needs a filing agent, correspondent counsel in another jurisdiction, or instructed counsel or litigation solicitors, we share only what that step requires, and we tell you before any cost arises.
Professional advisers, insurers and regulators. Where we are required or entitled to, including our professional indemnity insurers and the Solicitors Regulation Authority.
We do not sell personal data, and we do not use your data for unsolicited marketing.
Some processing involves transfers outside the United Kingdom. Google, Microsoft, Resend, Vercel, Stripe and Meta, where you contact us by WhatsApp, may process data outside the UK. Where they do, we rely on adequacy regulations or on the International Data Transfer Addendum to the standard contractual clauses, under Chapter V of the UK GDPR. Where a matter requires correspondent counsel in another country, that transfer is necessary for the performance of your contract or for legal claims.
Enquiries that do not proceed. Twelve months, then deleted.
Client files. Six years after the matter concludes, in line with the Limitation Act 1980 and SRA expectations, and fifteen years where the matter concerns land or trusts. Registration certificates and related correspondence may be kept longer where they retain ongoing relevance to the right.
Anti money laundering records. Five years from the end of the business relationship, as the Money Laundering Regulations require.
Cookie and attribution storage. As stated in section 4, and always within your control.
Payment records. Kept for six years from the end of the financial year to which they relate, as HMRC requires for company records.
You have the right to access your personal data, to have inaccurate data corrected, to erasure, to restrict processing, to data portability, to object to processing based on legitimate interests, and to withdraw consent where processing is based on consent.
Some of these rights are qualified. Where we hold data under a legal or regulatory retention obligation, or where it is needed for the establishment, exercise or defence of legal claims, we may not be able to delete it on request, and we will explain why if that applies.
To exercise any right, write to sp@westernlegal.co.uk. We respond within one month. There is no charge unless a request is manifestly unfounded or excessive.
Communications with us about a legal matter are confidential, and instructions to a solicitor carry legal professional privilege. Data protection rights held by third parties do not override privilege, and we will not disclose privileged material in response to a request from anyone other than the client.
If you are unhappy with how we handle your personal data, tell us first and we will look into it. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
We update this notice when our processing changes. The date at the top shows when it was last revised.
UK · EU · US · International