Data Protection Privacy Policy

1. Introduction
1.1. TJL Solicitors LLP (“We”, “Our”, etc) are committed to respecting your privacy and protecting your personal data. This privacy policy tells you how we will do so, including how we will look after your personal data, how we will process and use it, how and when we will transfer and share your personal data and the rights that you have in relation to this under the UK GDPR and Data Protection Act 2018.
1.2. This notice applies to all of your personal data used in connection with our services however it is obtained by us, including any data you may provide through our website, when you meet with us, or when you contact us by phone, by post or using email.
1.3. For the purposes of the UK GDPR and Data Protection Act 2018 we are the data controller.
1.4. In the event that we ask you to provide personal data, then we will only use that information in accordance with this privacy notice.
1.5. Please note that this notice may be updated from time to time. You will be informed of when changes occur to ensure that you continue to be in agreement with any changes that we may have made.
1.6. The effective date for this policy is 06/11/2025.
1.7. Please note that it is important that the personal data we hold about you is accurate and current. For this reason, please ensure that we are kept informed of any changes to your personal data during your relationship with us.

2. Who we are
2.1. TJL Solicitors LLP is a limited liability partnership registered in England and Wales (registered number: OC367616) and is authorised and regulated by the Solicitors Regulation Authority (SRA number: 564906). Registered office: Washbrook House, Talbot Road, Manchester, M32 0FP. You can find us online at www.cosmeticsurgerysolicitors.co.uk and www.tjlsolcitors.co.uk. We specialise in negligent cosmetic surgery claims, negligent dental treatment claims, and personal injury claims.
2.2. Our Data Protection Officer can be contacted at the registered address above or on dp@tjlsolicitors.co.uk and they are responsible for overseeing all matters in connection with this privacy notice. If you have any questions about this privacy notice, including any requests to the right to exercise your legal rights (see below), please contact them using the details set out above.
2.3. Please note that you have the right to make a complaint relating to your personal data at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

3. What is personal data?
3.1. Personal data is defined by the UK GDPR as any information relating to an identifiable individual (a “data subject”) as opposed to information about organisations, corporate bodies or others who are not individuals. An identifiable individual is one who can be identified, directly or indirectly, by reference to a name, identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.
3.2. Personal data does not include data where the identity has been removed (also known as anonymous data).
3.3. Further details about the UK GDPR, Data Protection Act and the nature of personal data can be found at the website for the Information Commissioner (www.ico.gov.uk).

4. The information we collect
4.1. We may collect use, store and transfer a range of information relating to you. The precise nature of that information may depend upon the type of matter in which we are, or will be, instructed. It may include, but may not be limited to:

• Identity – this may include your name, former/birth name, username, other method of identification, passport/driving licence number, gender, date of birth, marital status, employment status, or nationality. It may also include information relating to third parties with whom you have a connection.
• Contact information – this may include your home address, workplace address, telephone and mobile numbers, email address, alternative contacts, and social media details.
• Financial information – this may include bank account details, payment card details, tax or NIS references, salary, savings and investments, sums owing to third parties and details of any previous bankruptcy or financial judgments.
• Transaction details – including information relating to the matter in connection with which we are currently instructed, services provided to you previously both by this firm and others.
• Miscellaneous information – including technical information relating to system used by the data subject, preferences, and interests,
• Marketing information – information used in connection with customer surveys and/or offers, information relating to the other services offered by us in which you might be interested and other marketing related information.
• Aggregated Data – this may include statistical or demographic data and may be derived from your personal data. However, we do not consider this to be personal data as it does not directly or indirectly reveal your identity. Thus, your information may be used to calculate the percentage of users accessing a specific website feature. In the event that Aggregated Data is combined with your personal data in such a way that it can directly or indirectly identify you, then we will regard such combined data as personal data and it will be processed entirely in accordance with this privacy notice.
• Special Category Data – this may include your racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, any personal data that relates to your health, sex life, sexual orientation or criminal offences or records or any genetic or biometric data about you.
• Monitoring – we may record phone calls and retain transcripts of dialogue (e.g. live chat conversations) either for our records or for training purposes. If you visit one of our offices your image may be recorded on CCTV for security purposes.

4.2. This information will normally be collected from you by email, telephone, post, live chat, contact forms on our websites.
4.3. We may receive information about you from you or third parties when we are acting for, or considering acting for, a client and we are required to obtain information about you, for example if you are a beneficiary of an estate or a party or a witness in a case. The information we receive may include your contact details, identification information, financial information, employment information, details included in any correspondence and information about you in connection with any matter on which we are engaged or may be engaged to advise our client. Where we receive information about you, we will only use that information for the purposes of the legal transaction, case, or matter (‘matter’).
4.4. You should note that we will not routinely collect any data about you which comes within the definition of special categories of personal data and referred to in Article 9 of the UK GDPR. This includes details revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. If, however, this information is relevant to the matter in connection with which we are instructed then we may need to process that data, but we will obtain your explicit consent to do so. On occasion we may process data about criminal offences. As solicitors we are officers of the court and process any such information in this capacity.
4.5. Please note that if you fail to provide us with any personal data that is required by law, or under the terms of a contract we have with you then we may be unable to carry out the contract we have or are trying to enter into with you. In this is the case then we may have no option but to cancel the provision of services to you. Should this occur, we will notify you if this is the case at the time. Note that our costs in relation to any services provided to you up to the time at which we can no longer act will remain owing notwithstanding the termination.

5. How we collect information
5.1. We obtain personal data in a number of different ways. These include:

• By direct contact – personal data is provided by you either in person, by corresponding with us by post, by email, by completing a form, by completing an online application or form, by telephone, via social media or otherwise.
• From third parties or publicly available sources – we may obtain personal data about you from third parties in connection with the provision of services by us to you. Examples include but are not limited to:
  • Treatment providers (doctors, dentists, clinics, physios etc);
  • People helping you with your enquiry, claim or matter (e.g. a parent or partner);
  • Marketing collectives we are part of with whom you made an enquiry;
  • We may also obtain or receive information from publicly available sources such as Companies House, HM Land Registry, and social media.
• Using automated technologies – your interaction with our website may automatically collect Technical Data about your equipment, browsing actions and patterns which we can collect by using server logs and other similar technologies.
• From identity checking providers – and other similar services.
• From other parties involved in a matter.

6. How we use your data
6.1. We will only use your personal data when we are permitted to do so, and the law allows. Most commonly, we will use your personal data in the performance of the contract we have entered into with you or are about to enter into with you.
6.2. The bases upon which we will rely in processing and handling your personal data will usually be:

• Because the processing is necessary for the performance of a contract to which you are a party or to take preliminary steps with a view to entering into a contract with you.
• Where we need to comply with a legal or regulatory obligation to which we are subject.
• Where the processing is necessary in order to protect your vital interests or those of another natural person.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

6.3. We will not normally rely on consent as a legal basis for processing your personal data other than in relation to sending marketing or other information to a prospective client. If this applies, then you have the right to withdraw that consent at any time and you should contact us should you wish to do so.
6.4. We may need to rely on more than one legal basis in order to process your personal data for the specific purpose for which we are using it. Should you require more details concerning this, or if you would like details about the specific legal bases upon which we will be or are relying, then please contact the Data Privacy Manager referred to above.
6.5. In addition to the general provisions set out above, the following are specific situations in which we may process your personal data:

• registering you as a new client;
• carrying out identity and credit checks;
• generally providing services to you;
• making electronic bank payments to you;
• notifying you of ay relevant policies and processes and any changes thereto;
• addressing correspondence and related documents to other parties and opponents;
• corresponding with other agencies such as the courts or Government agencies where relevant to the work we are doing for you;
• maintaining the financial and other personal information we are required to keep on clients under the professional rules we are subject to and by law including our obligations to HMRC;
• providing information relating you and your matter to the Compensation Recovery Unit of the Department for Work and Pensions;
• compliance with legal and regulatory obligations and good practice, e.g. identifying clients and verifying their identity;
• obtaining feedback from you on our services provided to you in order to improve the service we provide;
• gathering information as part of investigations by regulatory bodies;
• ensuring business policies are adhered to (such as policies covering IT security and Internet use);
• operational reasons, such as recording transactions, training, and quality control;
• file auditing by related companies in order to check the quality of the service we provide you;
• ensuring the confidentiality of commercially sensitive information;
• statistical analysis;
• preventing unauthorised access and modifications to systems; updating and enhancing client records;
• analysis to help us manage our practice;
• statutory returns;
• ensuring safe working practices, monitoring, and managing staff access to systems and facilities and staff absences;
• staff administration and assessments, monitoring staff conduct, disciplinary matters;
• credit reference checks via external credit reference agencies.

6.6. In most cases we will only use your personal data for those purposes for which it was acquired, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. In the event that this is the case we are happy to explain to you how the processing for the new purpose is compatible with the original purpose.
6.7. In the event that we need to use your personal data for an unrelated purpose, we will contact you and explain the legal basis which allows us to do so.
6.8. Where it is required or permitted by law, we may process your personal data without your knowledge or consent, in compliance with the above rules.

7. Sharing your personal data
7.1. From time to time, it will be necessary for us to share your personal data with parties involved with the handling of your matter, and with others with whom we are under a legal or regulatory obligation to share such data. Those with whom that information will be shared may include, depending upon the circumstances:

• service providers,
• professional advisers including other lawyers, bankers, auditors, and insurers who provide consultancy, banking, legal, insurance, accounting, and other professional services,
• professional experts and those involved in the writing or provision of reports,
• other contractors working for the firm,
• HM Revenue & Customs, regulators and other authorities based in the United Kingdom who require reporting of processing activities in certain circumstances,
• HM Land Registry, Information Commissioner’s Office, Intellectual Property Office, Companies House, HM Courts and Tribunal Services {add any further public organisations with whom you deal regularly} and any other public office based in the United Kingdom,
• fraud prevention, credit reference and identity verification agencies,
• regulators such as the SRA or ICO,
• The Legal Ombudsman,
• The Law Society,
• mediation and arbitration service providers, and employees of the firm.

7.2. In the event that there is a change to our business, then any new owners may use your personal data in the same way as set out in this privacy notice.
7.3. Please be assured that we require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
7.4. We will not transfer your personal information outside the European Economic Area (EEA), however, we have no control over where your devices are located and how data is routed to and from your device.

8. Security
8.1. TJL Solicitors LLP are committed to ensuring that your information is secure.
8.2. All electronic devices used by us are password protected, and only authorised persons have access to those devices and passwords. Only strong passwords meeting predefined complexity requirements shall be used. Where there is more than one authorised person with access to one electronic device, each person will have their own password.
8.3. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic, and managerial procedures to safeguard and secure the information we collect online. These include:

• 128-bit encryption;
• Next-Gen antivirus, hardware, and software firewalls;
• Patch management and vulnerability scanners;
• Secure and limited employee access;
• Ongoing training for employees on information and data security;
• Secure and regular backups, with a tested disaster recovery plan;
• Secure password protection.

8.4. Please note however that where you are transmitting information to us over the internet this can never be guaranteed to be 100% secure.

9. Retention of data
9.1. In the event that you do not instruct us in relation to a legal matter, then we will retain your personal data for a period of 7 years.
9.2. In the event that you instruct us to act for you in relation to a legal matter, then we will retain your personal data during the currency of your matter and thereafter in accordance with our usual retention periods, which are 7 years from the date your file is closed and archived.

10. Your Legal Rights
10.1. In the event that you are not happy with any aspect of our use of your personal data you have the right to complain to the Information Commissioner at ico.org.uk – Tel: 0303 123 1113.
10.2. You also have the right to obtain confirmation that your personal data is being processed by us and obtain a copy of your personal data from us. This will be provided without charge. Please send such requests to dp@tjlsolicitors.co.uk or by post to the Data Protection Officer at our registered address. This is known as a Subject Data Access Request which will in normal circumstances be dealt with within one month of receipt, unless the matter is complex in which case we may notify you that we wish to extend by up to two months the time in which we will respond to that request.
10.3. Please note that until such time as we are satisfied that the person making the request is entitled to the information requested, we will not release any information or acknowledge whether or not such information is held by us.
10.4. Please note that we have the right to charge reasonable fees for additional copies of information that has already been supplied to you, and for requests that are manifestly unfounded or excessive, particularly where such requests are repetitive.
10.5. You also have various other rights in relation to your personal data which you may be able to exercise (depending upon the circumstances). These include:

• the right to ask us to correct personal data that is inaccurate or incomplete. Where relevant, we will rectify the personal data in question, and inform you of that rectification, within one month of you informing us of the issue. The period can be extended by up to two months in the case of complex requests. If such additional time is required, you shall be informed.
• the right to ask us to delete your personal data or stop processing it, unless it is necessary for us to retain it to comply with our legal obligations and/or the exercise or defence of legal claims. Unless we have reasonable grounds to refuse to erase personal data, all requests for erasure shall be complied with, and you will be informed of the erasure, within one month of receipt of your request. The period can be extended by up to two months in the case of complex requests. If such additional time is required, you shall be informed.
• the right to restrict our use of your personal data. You may request that we cease processing the personal data we hold about you. If you make such a request, our firm shall retain only the amount of personal data concerning you (if any) that is necessary to ensure that the personal data in question is not processed further. Please note that if the data is used in relation to your instructions to us then we may no longer be able to perform those instructions and may need to cease acting for you.
• the right to object to us using your personal data. Where you object to us processing your personal data based on the basis of legitimate interests, we will cease such processing immediately, unless it can be demonstrated that our legitimate grounds for such processing override your interests, rights, and freedoms, or that the processing is necessary for the conduct of legal claims.

WEBSITE PRIVACY POLICY

11. Introduction
11.1. TJL Solicitors LLP (“We”, “our”, etc) are committed to protecting and respecting your privacy when you visit our website. This privacy policy sets out how we will process and use any personal data that you provide to us, or that we may collect from or about you as a result of visiting our website. For the purposes of the UK GDPR and Data Protection Act 2018, we are the data controller.
11.2. In the event that we ask you to provide any information by which you can be identified when using this website, then we will only use that information in accordance with this privacy policy.
11.3. Please note that this policy may be updated from time to time. Please therefore check this page to ensure that you continue to be in agreement with any changes that we may have made.
11.4. The effective date for this policy is 06/11/2025.

12. The information we collect
12.1. We may collect the following information:

• Your name,
• You contact information (including email address and telephone number),
• Information such as postcode, preferences, and interests,
• Other information used in connection with customer surveys and/or offers,
• Details of your enquiry, which may include sensitive health data that you tell us about.

12.2. This information will normally be collected from you by means of webforms, live chat, comments, posts etc.

13. How we use the information we collect
13.1. The information that we collect is used:

• To better understand your needs and to enhance the quality of the service that we provide to you;
• To create, update and maintain our internal records;
• To inform you of services or products that we have that may be of use to you, including where you have consented to receive marketing information, in respect of our services;

13.2. Please note that where information is sent to you following your consent to receive that information you may at any time unsubscribe or withdraw your consent by emailing us.

14. Links to other websites
14.1. In the event that you follow links to other websites from our website, we cannot provide any assurances in relation to the content, accuracy or privacy of those websites, and cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites. You should exercise caution and look at the privacy statement applicable to the website in question.

15. Your rights
15.1. In the event that you are not happy with any aspect of our website or our use of your personal data you have the right to complain to the Information Commissioner at ico.org.uk – Tel: 0303 123 1113.
15.2. You have the right to obtain confirmation that your personal data is being processed by us and obtain a copy of your personal data from us. This will be provided without charge. Please send such requests to dp@tjlsolicitors.co.uk or by post to the Data Protection Officer at our registered address.
15.3. You also have various other rights in relation to your personal data which you may be able to exercise (depending upon the circumstances). These include:

• the right to ask us to correct personal data,
• the right to ask us to delete your personal data or stop processing it, unless it is necessary for us to retain it to comply with our legal obligations and/or the exercise or defence of legal claims,
• the right to restrict our use of your personal data,
• the right to object to us using your personal data.

16. Google AdWords
16.1. This website uses the Google AdWords remarketing service to advertise on third party websites (including Google) to previous visitors to our site. It could mean that we advertise to previous visitors who have not completed a task on our site, for example using the contact form to make an enquiry. This could be in the form of an advertisement on the Google search results page, or a site in the Google Display Network. Third-party vendors, including Google, use cookies to serve ads based on someone’s past visits to the website. Of course, any data collected will be used in accordance with our own privacy policy and Google’s privacy policy.
16.2. You can set preferences for how Google advertises to you using the Google Ad Preferences page, and if you want to you can opt out of interest-based advertising entirely by cookie settings or permanently using a browser plugin.

17. IP Addresses and Cookies
17.1. TJL Solicitors care about your privacy and will not collect any personal information about you by using cookies on our websites. Please visit www.aboutcookies.org to learn more.
17.2. Cookies are small text files that ask for permission to be saved on your device when you visit most websites. Once you agree, the files are added, and the cookies enable us to provide you with an optimum experience while helping us improve our website by making sure we can provide you with the content that is relevant to you.
17.3. Cookies allow websites to respond to you as an individual, but we cannot and do not use these to identify you personally. Our website uses cookies to tailor to your needs, likes and dislikes by gathering and remembering information about your preferences.
17.4. We also use cookies to place adverts on other websites, and on search engines for people who have visited our website before or are interested in our specialist fields. These cookies help us analyse how well our marketing is working and give you the ability to interact with social media via our website.
17.5. Some third parties, such as Vimeo and YouTube, may also ask your permission to use cookies while browsing our website, but we have no control over these, so please see their websites for more information.
17.6. When visiting our website, you will see a pop-up that will provide you with information about cookies, and how to manage them, and that if you continue to use our website you will be agreeing to our use of cookies.
17.7. You can choose to accept or decline cookies. You can also modify your internet browser settings to decline cookies permanently, but this may prevent you from taking full advantage of our website and its features. Please see the help section in your browser for more information.

18. Cookies we collect
18.1.
Essential cookies
These cookies are necessary for the website to function correctly. They allow features such as navigation, secure access to forms, and other core functionality. These cookies do not store any personally identifiable information and are always active.

Analytics cookies (Google Analytics)
We use Google Analytics to collect anonymous information about how visitors use our site. This includes which pages are visited, how long visitors stay, and how they arrived at the site. The cookies used for this purpose may include: _ga, _gid, and _gat. This information helps us improve the performance and content of the site. No personally identifiable information is collected.

Behavioural analytics (Smartlook)
We may also use Smartlook to record user interactions on the site. This helps us understand how users navigate our pages and identify any usability issues. The Smartlook tool may set cookies such as smartlookCookie, SL_C_*_KEY, SL_C_*_SID, and SL_C_*_VID. These do not track personally identifiable information and are used for analysis purposes only.

Marketing and remarketing cookies
From time to time, we may run marketing or remarketing campaigns, which could involve setting cookies that track whether a user has visited our website. This enables us to serve relevant adverts on platforms like Google or social media to previous site visitors. These cookies are not used unless you consent via the cookie banner.

Third-party content cookies
If we embed content from other websites (for example, videos hosted on YouTube or Vimeo), those services may set their own cookies to track usage and support media playback. These third-party cookies are outside of our control, and we recommend checking the relevant provider’s cookie and privacy policies.

Cookie consent preferences
When you visit our site, you may be presented with a cookie banner asking for your consent to use non-essential cookies. Your selection will be stored using a cookie to remember your preferences..

TELEPHONE CALL RECORDING AND TRANSCRIPTION

19. Introduction
19.1. TJL Solicitors LLP record and automatically transcribe certain telephone calls made to or from our offices.
19.2. We do this to ensure the accuracy of client instructions, maintain the quality of our services, support staff training and supervision, manage complaints, and comply with our legal and regulatory obligations as a law firm.

20. What information we collect
20.1. The recordings and their associated transcripts may include:

• Your voice and any information you disclose during the call;
• The date, time, duration, and telephone numbers involved in the call; and
• Where applicable, information relating to your client matter or enquiry.

21. How we use call recordings and transcripts
21.1. We may use call recordings and transcripts to:

• Verify and document instructions or information provided by you;
• Monitor and improve our service delivery and staff training;
• Manage complaints or resolve disputes;
• Meet professional, legal, and regulatory requirements; and
• Detect or prevent fraud, misconduct, or other unlawful activity.

21.2. We do not use call recordings or transcripts for marketing purposes.

22. Lawful basis for processing
22.1. We rely on our legitimate interests as a regulated legal services provider (Article 6(1)(f) UK GDPR) to record and transcribe calls.
22.2. Where a recording relates directly to a client matter, processing may also be necessary for the performance of a contract (Article 6(1)(b)).
22.3. Before or at the start of any call, you will be informed that it may be recorded and transcribed.

23. Retention and access
23.1. Recordings and transcripts are stored securely and are accessible only to authorised members of staff, such as partners, managers, or compliance personnel.
23.2. They are normally retained for six months from the date of the call and deleted thereafter, unless linked to a client matter, complaint, or regulatory requirement – in which case they may be retained for up to twelve months before secure deletion.

24. Special categories and payment information
24.1. We do not record or retain payment card details. Where sensitive personal data (for example, information about health or family matters) is shared during a call, it is handled in accordance with our data protection policies and protected by additional safeguards.

25. Transcription processing
25.1. Transcriptions are created automatically from the call recording using secure speech-to-text software.
25.2. Where an external service provider is used, that provider acts strictly as our data processor under a written agreement that ensures compliance with UK data protection law and confidentiality obligations.
25.3. Transcripts are subject to the same security, access, and retention standards as the corresponding audio recordings.