Data Protection Policy

Last updated: October 2026

1. Introduction

This policy sets out how Brewer Wallace Limited, trading as Brewer Wallace Solicitors ("we", "us", "our" or "the firm"), meets its obligations under data protection law, and the rights of our clients, website users, business contacts and other individuals whose personal data we handle ("data subjects").

The law that applies to us is the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications Regulations 2003 ("PECR") where we use cookies or send electronic marketing.

Brewer Wallace Limited is the data controller for the personal data described in this policy. We are a company registered in England and Wales under company number 07871750. Our registered office and head office is at 2 Parliament Street, Hull, HU1 2AP. We are authorised and regulated by the Solicitors Regulation Authority (SRA numbers 568415, 570289 and 620621).

We are registered with the Information Commissioner's Office as a data controller.

This policy applies to everyone who works for or on behalf of the firm, including partners, directors, employees, consultants, agents and contractors. We are committed to the spirit as well as the letter of the law, and to the fair, lawful and careful handling of personal data. Our duty of confidentiality to our clients as solicitors applies alongside, and in addition to, our duties under data protection law.

For details of how we use personal data collected through our website, please also read our Privacy Policy.

2. Key terms

• Personal data means any information relating to an identified or identifiable living individual. An individual may be identifiable directly, for example by name, or indirectly, for example by an identification number, location data, an online identifier or other information that relates to them.
• Special category data means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data used to identify a person, data concerning health, and data concerning a person's sex life or sexual orientation.
• Criminal offence data means personal data relating to criminal convictions and offences, or related security measures.
• Processing means anything done with personal data, including collecting, recording, storing, using, disclosing, sharing and deleting it.

3. The data protection principles

We process personal data in line with the principles in Article 5 of the UK GDPR. Personal data must be:

1. processed lawfully, fairly and in a transparent manner;
2. collected for specified, explicit and legitimate purposes, and not further processed in a manner that is incompatible with those purposes;
3. adequate, relevant and limited to what is necessary for the purposes for which it is processed;
4. accurate and, where necessary, kept up to date, with inaccurate data erased or corrected without delay;
5. kept in a form that permits identification of individuals for no longer than is necessary for the purposes for which it is processed; and
6. processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.

We are also responsible for, and must be able to demonstrate, compliance with these principles (the accountability principle).

4. Lawful bases for processing

We only process personal data where we have a lawful basis under Article 6 of the UK GDPR. The bases we rely on are:

• Contract: the processing is necessary to perform our contract with you, or to take steps at your request before entering into a contract, for example when you instruct us or ask us for a quote.
• Legal obligation: the processing is necessary for us to comply with the law, for example identity checks under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, our obligations to the Solicitors Regulation Authority, and our tax and accounting obligations.
• Legitimate interests: the processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your interests, rights and freedoms. Examples include responding to enquiries, running and improving our business and website, keeping our systems secure, and establishing or defending legal claims.
• Consent: where you have given clear consent for a specific purpose, for example to optional website analytics cookies or certain marketing. You may withdraw your consent at any time.
• Vital interests: in rare cases, where processing is necessary to protect someone's life.

Special category data and criminal offence data

Some of our work requires us to process special category data, such as health information in a lasting power of attorney, care or mental capacity matter, or criminal offence data. We only do so where we also meet a condition under Article 9 or Article 10 of the UK GDPR and, where required, Schedule 1 to the Data Protection Act 2018. The conditions we most commonly rely on are that the processing is necessary for the establishment, exercise or defence of legal claims, or for the purpose of obtaining legal advice, or that you have given your explicit consent.

5. The personal data we hold and why

We only hold personal data that is relevant to our dealings with the person concerned. Depending on the matter, this may include:

Type of personal data	Why we hold it
Identity and contact details, such as name, address, date of birth, telephone number and email address	To act for you, communicate with you and keep accurate client records
Identification documents and information needed for anti-money laundering and fraud checks	To meet our legal and regulatory obligations before and during a matter
Information about your legal matter, including information about other people involved in it	To provide legal advice and services
Financial information, such as bank details, source of funds and source of wealth information	To handle client money, complete transactions, meet our legal obligations and bill for our services
Special category data and criminal offence data, where relevant to your matter	To provide legal advice and services, and to establish, exercise or defend legal claims
Details of enquiries, quote requests and correspondence	To respond to you and, if you instruct us, to open your matter
Website usage information, such as pages visited and device information	To run, secure and improve our website, as described in our Privacy Policy
Contact details of business contacts, such as other solicitors, estate agents, lenders, barristers and experts	To carry out our work and manage our business relationships

6. How we handle personal data

The firm shall ensure that:

• all personal data is collected and processed fairly and lawfully, and only to the extent necessary for the purpose for which it is required;
• individuals are told why their personal data is being collected and how it will be used, through this policy, our Privacy Policy and our client care information;
• personal data is accurate when collected and kept accurate and up to date; where we have regular contact with a client, we confirm their details at the start of each new instruction;
• personal data is shared within the firm only with those who reasonably need it for the purpose for which it was collected;
• personal data is not kept for longer than necessary (see section 9);
• cookies and similar technologies on our website are used in line with PECR, with clear information provided in our Privacy Policy;
• personal data is held and transferred securely, whether electronically or on paper; and
• individuals can exercise their data protection rights easily and without unnecessary obstacles.

Information such as IP addresses, online identifiers and data collected by cookies will be handled to the same standard as other personal data.

7. Sharing personal data

We do not sell personal data. We share it only where we have a lawful basis to do so and, where it relates to a client matter, in a way that is consistent with our duty of confidentiality. Depending on the matter, we may share personal data with:

• other parties to the matter and their advisers, such as solicitors acting for the other side, estate agents, mortgage lenders, barristers, experts, courts and tribunals;
• organisations that carry out identity, anti-money laundering and search services for us;
• our professional advisers, insurers and auditors;
• our regulators and other authorities, such as the Solicitors Regulation Authority, HM Land Registry, HM Revenue and Customs and law enforcement agencies, where we are required or permitted by law to do so; and
• service providers who process data on our behalf, such as providers of IT, website, case management, storage and communication services.

Where a service provider processes personal data on our behalf, we will only use providers that give sufficient guarantees about the security of the data, and we will have a written contract in place that meets the requirements of Article 28 of the UK GDPR.

8. International transfers

We aim to keep personal data within the United Kingdom. We will only transfer personal data outside the United Kingdom where the destination is covered by UK adequacy regulations, or where appropriate safeguards are in place, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or where another lawful transfer mechanism applies.

9. How long we keep personal data

We keep personal data only for as long as is necessary for the purpose for which it was collected, including to meet our legal, regulatory, accounting and insurance requirements. The length of time depends on the type of matter. For example, client files are generally kept for a period after a matter ends that reflects the nature of the work and the time within which a claim could be brought, and records of anti-money laundering checks are kept for at least five years after the end of the business relationship, as required by law. Some documents, such as original wills and deeds held in safe keeping, are kept for as long as we hold them on your behalf.

When personal data is no longer needed, it is securely deleted or destroyed. Paper records are shredded or otherwise securely destroyed, and electronic records are securely deleted.

10. Security of personal data

We take appropriate technical and organisational measures to protect personal data. Everyone who works for or on behalf of the firm must follow these rules:

• personal data must only be accessed by those who need it to carry out their duties, and access to systems is controlled by individual user accounts;
• personal data must only be sent over secure networks and by secure means, and particular care must be taken to check recipient details before sending;
• passwords must be strong, kept confidential and never shared;
• computers must be locked when left unattended, and personal data must not be left on view to anyone not authorised to see it;
• paper records must be stored securely in locked or access controlled areas, and must not be removed from the office without good reason and appropriate safeguards;
• personal data must not be stored on personal devices, except through systems and controls approved by the firm;
• electronic data must be backed up securely; and
• unwanted copies of personal data must be disposed of securely.

Personal data breaches

Anyone who becomes aware of an actual or suspected personal data breach must report it immediately to our Data Protection Lead. Where a breach is likely to result in a risk to the rights and freedoms of individuals, we will report it to the Information Commissioner's Office without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to individuals, we will also tell the individuals affected without undue delay. We keep a record of all personal data breaches.

11. Organisational measures

The firm has a Data Protection Lead with responsibility for overseeing data protection and compliance with this policy. The Data Protection Lead is responsible in particular for:

• overseeing the implementation of, and compliance with, this policy, working with the firm's managers, staff and any third parties working on our behalf;
• arranging suitable and regular data protection training and awareness;
• handling requests from individuals exercising their rights, and complaints about our use of personal data;
• managing personal data breaches; and
• reviewing this policy and related procedures at least once a year.

In addition:

• everyone working for or on behalf of the firm is made aware of their responsibilities under data protection law and this policy, and is appropriately trained and supervised;
• everyone handling personal data is bound by duties of confidentiality;
• our methods of collecting, holding and processing personal data are regularly reviewed; and
• where we introduce new processing that is likely to result in a high risk to individuals, we carry out a data protection impact assessment before we begin.

12. Your rights

Under the UK GDPR you have the following rights, subject to certain conditions and exemptions:

• Right to be informed: to be told how we collect and use your personal data.
• Right of access: to obtain a copy of your personal data and information about how we use it (see section 13).
• Right to rectification: to have inaccurate personal data corrected and incomplete data completed.
• Right to erasure: to ask us to delete your personal data in certain circumstances.
• Right to restrict processing: to ask us to limit how we use your personal data in certain circumstances.
• Right to data portability: to receive personal data you have provided to us in a structured, commonly used and machine readable format, or to have it sent to another organisation, where the processing is based on consent or contract and is carried out by automated means.
• Right to object: to object to processing based on our legitimate interests, and an absolute right to object to direct marketing at any time.
• Rights relating to automated decision making: we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
• Right to withdraw consent: where we rely on your consent, you may withdraw it at any time. This does not affect processing carried out before you withdrew it.

Some rights may be limited where, for example, we are required by law to keep information, or where information is subject to legal professional privilege. If we cannot comply with a request in full, we will explain why.

We will respond to requests without undue delay and in any event within one month of receiving them. We may extend this by up to two further months where a request is complex or you have made a number of requests, in which case we will tell you within the first month and explain why.

We do not charge a fee for dealing with requests. We may charge a reasonable fee based on our administrative costs, or refuse to act, where a request is manifestly unfounded or excessive, and we may charge a reasonable fee for further copies of the same information.

13. Subject access requests

You may make a subject access request at any time to find out what personal data we hold about you. A request may be made in writing, by email or verbally, although putting it in writing helps us to deal with it accurately. Requests should be sent to our Data Protection Lead:

• by post: Data Protection Lead, Brewer Wallace Solicitors, 2 Parliament Street, Hull, HU1 2AP
• using our contact form
• by telephone: 01482 228808

We may need to ask for proof of your identity before responding. If someone is making a request on your behalf, we will need evidence that they are authorised to act for you. If we need to confirm your identity or ask you to clarify your request, the time limit for our response will begin once we have received the information we need.

We will carry out a reasonable and proportionate search for the information you have asked for. Where we hold personal data about you, we will provide:

• confirmation that we are processing your personal data, and a copy of it;
• the purposes for which we process it and the categories of personal data concerned;
• the recipients or categories of recipients to whom it has been or will be disclosed;
• how long we expect to keep it, or the criteria we use to decide this;
• your rights to rectification, erasure, restriction and objection, and your right to complain to the Information Commissioner's Office; and
• where we did not collect the data from you, any available information about its source.

We will not provide information that would reveal personal data about another person, unless they have consented or it is reasonable to do so without their consent, or information that is exempt from disclosure, such as information subject to legal professional privilege.

14. Complaints

If you are unhappy with how we have handled your personal data, please contact our Data Protection Lead using the details in section 13. We will acknowledge your complaint within 30 days of receiving it, look into it and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection:

• website: ico.org.uk
• telephone: 0303 123 1113
• post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

The ICO will usually expect you to have raised your concern with us first, but you are not required to do so.

15. Registration with the Information Commissioner's Office

As a data controller, the firm is registered with the Information Commissioner's Office and pays the data protection fee required by the Data Protection (Charges and Information) Regulations 2018. The Data Protection Lead is responsible for keeping the firm's registration up to date and renewing it each year.

16. Our offices

This policy applies to personal data handled at all of our offices:

• Hull (head office): 2 Parliament Street, Hull, HU1 2AP
• Bridlington: Unit 22, Bridlington Business Centre, Enterprise Way, Bridlington, YO16 4SF
• Hornsea: 9-10 Southgate Court, Hornsea, HU18 1RP

17. Review of this policy

We review this policy at least once a year and when the law or our working practices change. The current version will always be available on our website.