Who is responsible
Strand Legal Consultancy Ltd, company number 09569225, is the controller of the personal information we use for the purposes below. Our address is 25 Southampton Buildings, London WC2A 1AL, United Kingdom. Our director, William O’Neill, oversees privacy requests. Contact info@strandlegal.com, or write to our address.
This notice covers website visits, enquiries and the records that follow from them. If we accept instructions, we explain any additional processing needed for that matter. Our cookie information describes browser storage and advertising choices.
Information we receive
You may give us your name, contact details and message. Employer enquiries can include your business, role, support needed, timescale, preferred language and contact method. Refusal enquiries can include the application type, decision date and any deadline you identify. We receive subsequent correspondence and may record the enquiry’s source, suitability, next step and whether you become a client.
Keep an initial enquiry brief. Do not send passport numbers, medical records, employee files or confidential documents through the short web forms. We explain how to provide documents if needed. Share another person’s information only where necessary and where you have authority. We may receive relevant information from an authorised representative, employer or family member and, during an agreed matter, authorities, professional advisers or public records. We explain a new source where required.
Hosting and security services can receive an IP address, browser/device details, requested page, time and security events. Optional advertising measurement receives the limited information described below. Providing enquiry details is voluntary, but without usable contact details and enough information about the request we may be unable to respond or assist. A form submission is not a marketing subscription.
Why we use information
We use a basis appropriate to each purpose; sending a form is not blanket consent.
| Purpose | UK GDPR basis |
|---|---|
| Respond to your request for an individual service, take steps you request before an engagement, and deliver an agreed service | Requested steps before a contract or performance of a contract: Article 6(1)(b). |
| Communicate with business representatives, coordinate enquiries, prevent duplicate approaches and keep proportionate service/outcome records | Legitimate interests: Article 6(1)(f). Our interests are responsive services, managing relationships and understanding which enquiries lead to useful work. We limit information and consider the effect on individuals. |
| Operate and protect the website, investigate abuse, resolve complaints and protect legal rights | Legitimate interests in reliable services, security and resolving disputes; a legal obligation where a specific duty requires processing. |
| Keep records required by applicable immigration-adviser regulation, company/tax rules and data-protection law | Legal obligation: Article 6(1)(c), limited to the required records. |
| Optional Google advertising measurement and marketing subscriptions you choose | Consent: Article 6(1)(a). Refusing or withdrawing does not prevent an enquiry. |
| Load an optional office map after your choice | Consent: Article 6(1)(a), for our optional map integration. You can leave maps unloaded and use the address or a separate directions link. |
We do not sell enquiry information or use legal-enquiry content to create advertising audiences. People handle service enquiries. Automated website security may reject a submission; it does not decide your case or eligibility for advice. Email and WhatsApp are alternative contact routes.
Sensitive information and children
A matter may require health, ethnicity, religion, sexual-orientation or other specially protected information. We use it only where necessary and an additional legal condition applies. For information necessary for legal advice or establishing, exercising or defending legal rights, we rely on Article 9(2)(f). Criminal-conviction, allegation or offence information is assessed separately under Article 10 and paragraph 33 of Schedule 1 to the Data Protection Act 2018. These conditions do not permit collecting information merely because it might be useful. We identify another valid condition before using it for a different purpose.
Access is limited to people who need the information. Unnecessary sensitive details in an initial message are restricted and reviewed for removal, not used for advertising. Where a matter involves a child, we consider the child’s rights and understanding and the authority of anyone acting for them. Contact us for a simpler explanation or help exercising a right.
Forms, security and measurement
Enquiries are sent to the firm’s email system and routed to the authorised team handling them. Google reCAPTCHA helps prevent automated abuse. Your browser connects to Google and our server checks its response before accepting a form. See Google’s privacy policy.
Employer and refusal enquiry pages offer separate advertising-measurement choices. If you allow measurement, Google can receive technical visit information, permitted advertising click identifiers, the page address and a random enquiry reference after a successful submission. Our measurement code does not send your name, email, phone number, business name, application details, dates or message to Google. It removes unrelated query parameters and restricts the referring address. Ad personalisation and matching of submitted contact details are disabled in this implementation. The reference can also appear in our enquiry record, so this is not a promise of anonymity.
Use the measurement-choice control on the relevant enquiry page to change your choice. Employer and refusal pages remember separate choices. Withdrawal stops new website conversion events; it does not itself erase data Google previously received. Contact us about that information or other data rights. See our cookie information.
Office maps are optional Google Maps embeds. We connect your browser to Google for a map only after you choose “Show map” for that office. Google receives technical connection information and may use cookies or other browser storage under its privacy policy. The map choice is separate from advertising measurement. “Hide map” removes the embed but does not erase Google’s earlier records or cookies. Addresses and external directions links remain available without loading an embed. See optional office maps in our cookie information.
Sharing, WhatsApp and subscriptions
Authorised staff and contracted support providers may receive information needed for their work. Relevant categories include hosting (GoDaddy), business email, secure file/case administration, IT support and backup providers. Google supplies reCAPTCHA and optional Ads measurement. External fonts, software resources and some article images may cause your browser to contact their providers; the cookie information explains this distinction.
For an agreed matter, necessary information may be shared with the relevant authority, court or tribunal, professional adviser, interpreter or person you authorise. Necessary disclosures may also go to regulators, insurers, accountants or legal advisers, or be required by law. We check the purpose and limit what is shared. A service request does not authorise unrelated disclosure.
WhatsApp links open an external messaging service, whose privacy policy applies to its processing. You may use email instead. Our blog includes public articles from The Mobility Brief. Reading an article does not subscribe you. Subscription links open Substack, which has its own privacy policy and may share subscriber information with the publisher. If Strand receives subscriber details, we use them to administer the subscription or your requests, not to add you to unrelated lists. Use the publication email’s unsubscribe control or contact its publisher; contact us for help with information Strand holds. An earlier website newsletter registration does not automatically become a Substack subscription.
Information outside the UK
Online services and people assisting a matter may be outside the UK. This can involve overseas processing or access; we do not promise all information stays in the UK. Where we arrange a restricted transfer, it must have a valid basis: applicable UK adequacy regulations, appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum with the required assessment, or a legally available exception for the circumstances. We assess the actual recipient and transfer rather than assume a provider’s brand establishes protection. Ask us for the relevant arrangement and a copy of applicable safeguards, with necessary confidential information removed. An external service you independently choose to visit explains its international processing in its own notice.
Retention
Our rules distinguish an unconverted enquiry from a record of legal advice.
| Record | Normal retention rule |
|---|---|
| Initial enquiry involving no advice and no client matter | 12 months after the last substantive contact or closure. |
| Client/advice file, including a free or paid consultation creating an advice record | At least six years after the matter closes, then secure destruction after checking for any continuing obligation or necessary legal hold. |
| Financial and tax records | Six years from the end of the relevant company financial year, or longer where a specific tax/legal rule requires. |
| Identifiable enquiry-attribution/outcome records kept separately for service reporting | 12 months after the recorded outcome, then deletion or anonymisation. A necessary reference in a client file follows that file’s rule. |
| Privacy-request and privacy-complaint records | Three years after closure, limited to what is needed to demonstrate handling. |
| Subscription details | While active. After withdrawal, only necessary evidence and a minimal suppression record to prevent unwanted messages, with regular necessity reviews. |
Ordinary technical logs are limited to the period needed to deliver services, detect abuse and investigate a specific incident. Relevant extracts may be preserved for a documented incident or legal claim. Backups are restricted recovery copies, expire through the applicable backup cycle and are not used to revive deleted information. Browser-storage durations are in our cookie information.
We regularly review expired records. A specific legal, regulatory, insurance or dispute-related need may justify longer retention of relevant material. We record why and review the hold; we do not keep everything indefinitely just in case. Children’s rights or continuing legal rights may need individual assessment. Irreversibly anonymised statistics may be retained because they no longer identify anyone.
Rights and complaints
Depending on the circumstances, you can request access, correction, erasure, restricted use or a portable copy where portability rules apply. You may object to legitimate-interest processing and object at any time to direct marketing. You may withdraw consent without affecting lawful use before withdrawal. Rights have conditions: necessary legal records may not be immediately erasable; another person’s information or legally protected material may need separate treatment. We explain any applicable limitation.
Contact info@strandlegal.com or any usual contact channel. No special form or legal wording is required. We may seek proportionate identity or authority verification. We normally respond to rights requests within one month; we explain any legally permitted extension within the original period. Requests are normally free.
If you are unhappy with our handling of information, tell us so we can investigate. We acknowledge a privacy complaint within 30 days and respond without undue delay, keeping you informed if more time is needed. You may also complain to the Information Commissioner’s Office and seek a court remedy. Complaining to us does not remove those rights.
Changes
We show the date of this notice and explain material changes when required. Continued website use does not consent to a new advertising or marketing purpose.