Privacy Policy | Berry & Lamberts LLP

This Privacy Policy explains how Berry & Lamberts LLP ("we", "us", "our") collects, uses and protects personal data in accordance with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and guidance published by the Information Commissioner's Office (ICO).

1. Data Controller

The data controller is Berry & Lamberts LLP, a limited liability partnership registered in England & Wales. Registered office: 11 Church Road, TN1 1JA, Tunbridge Wells, United Kingdom. VAT registration number: GB 209 6047 68. Contact: [email protected] · +44 1892 526344.

2. Personal data we collect

Identity data — full name, title, date of birth, National Insurance number where required.
Contact data — address, email, telephone.
Financial data — bank details, assets and liabilities where relevant to your matter.
Special-category data — health information where relevant to capacity, care funding or advance decisions.
Technical data — IP address, browser type, cookies (see our Cookie Policy).

3. Lawful basis for processing

We process personal data on the following lawful bases under Article 6 of the UK GDPR:

Contract — to perform legal services you have instructed us to provide.
Legal obligation — to meet SRA regulatory duties, anti-money-laundering (Money Laundering Regulations 2017) and HMRC obligations.
Legitimate interests — to administer our business and respond to enquiries.
Consent — for marketing communications, which you may withdraw at any time.

Where we process special-category data we rely on Article 9(2)(f) — establishment, exercise or defence of legal claims — or your explicit consent.

4. How we use your data

To provide and manage the legal services you instruct.
To comply with client due-diligence and anti-money-laundering checks.
To communicate with you, courts, HMRC, the Office of the Public Guardian, and other parties as required.
To administer accounts and billing.
Where you consent, to send you occasional legal-update newsletters (no more than four per year).

5. Recipients of your data

We may share data with barristers, counsel, medical experts, HM Courts & Tribunals Service, HMRC, the Office of the Public Guardian, banks, and other regulated professionals — only where necessary to progress your matter. We use vetted, UK-based IT and secure-storage providers under written data-processing agreements.

6. International transfers

We do not routinely transfer personal data outside the United Kingdom. Where a matter requires transfer outside the UK, we rely on adequacy regulations or the ICO's International Data Transfer Agreement.

7. Retention

We retain client files for a minimum of six years from the conclusion of your matter, in line with SRA guidance. Wills and deeds are retained in secure storage for as long as the client requires. Anti-money-laundering records are retained for five years. Marketing data is retained until you unsubscribe.

8. Your rights

Under the UK GDPR you have the right to (a) be informed, (b) access your data, (c) rectify inaccurate data, (d) request erasure ("right to be forgotten") subject to our regulatory obligations, (e) restrict processing, (f) data portability, (g) object to processing, and (h) rights in relation to automated decision-making. We do not carry out automated decision-making.

To exercise any right, contact [email protected]. We will respond within one calendar month.

9. Complaints to the ICO

If you are dissatisfied with our handling of your personal data, you may complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow SK9 5AF · ico.org.uk · 0303 123 1113.

10. Security

We employ technical and organisational measures — including encrypted email on request, access controls, staff training and regular penetration testing — to protect your data.

11. Changes

We review this Policy annually. The version and date at the top of this page indicate the current edition.