About Bratby Law
Privacy notice
This notice explains what personal data Bratby Law collects, why we use it, who we share it with and the rights you have. Our use of AI is described in more detail on How we use AI.
Data controller
Bratby Law Ltd
Company number 12539220
ICO registration ZA745605
ops@bratby.law · +44 20 4604 3343
Last updated 30 October 2026
Who we are
Bratby Law is a trading name of Bratby Law Ltd (company number 12539220), a company incorporated in England and Wales. Our registered office is at 5th Floor, 167-169 Great Portland Street, London W1W 5PF. Bratby Law Ltd is the data controller for the personal data described in this notice. Contact: Rob Bratby, ops@bratby.law, +44 20 4604 3343.
In addition to our obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025), we have professional duties under the SRA Code of Conduct for Solicitors (paragraphs 6.3 to 6.5) to keep all client information confidential, whether or not it constitutes personal data.
We are a virtual organisation that makes extensive use of cloud computing and artificial intelligence. We have documented and implemented an information security and AI use policy in line with guidance from the Solicitors Regulation Authority, the Law Society, the Information Commission (the ICO) and the National Cyber Security Centre, and we review it regularly.
We use business AI services to improve the accuracy and efficiency of our legal work. Some of those services act as assistants that we authorise, under supervision, to read and organise our email, our document management system and our internal matter database. AI output never reaches a client without a solicitor’s review, and we remain fully responsible for all professional advice we provide. Only AI providers that act as our processors under written contracts handle client data, and under those contracts client data is not used to train, fine-tune or improve AI models.
What personal data we collect, and where from
We collect personal data from our clients, their employees, advisors, customers, suppliers and partners; users of our website and newsletter subscribers; attendees at events and conferences; publicly available sources including internet searches and published data; credit rating and anti-money laundering agencies; government bodies and regulators; and individuals we meet or interact with in the course of business.
Identity and contact details
Name, job title, employer, email address, telephone number and postal address.
Matter information
Instructions, correspondence, documents, and recordings and transcripts of meetings, including information about other people involved in a matter.
Identity checks
Identity documents and the results of anti-money laundering and sanctions checks.
Billing and financial details
Billing contacts, invoices, payment records and the descriptions of work in our time records.
Relationship records
A record of our dealings with clients and professional contacts, including correspondence, meetings and the content we have shared, with a note of the topics likely to interest them.
Website and newsletter data
Analytics data collected with your consent, and the details you give when you subscribe to our updates.
A client matter may contain special category data or criminal offence data. We process special category data only where it is necessary to establish, exercise or defend legal claims (Article 9(2)(f) UK GDPR). We process criminal offence data only where it is necessary for legal proceedings, for obtaining legal advice, or for establishing, exercising or defending legal rights (paragraph 33 of Schedule 1 to the Data Protection Act 2018).
Why we use your data, and on what legal basis
Each purpose below has its own legal basis under Article 6(1) UK GDPR.
| Purpose | Legal basis | What this covers |
|---|---|---|
| Acting for our clients and working with our suppliers | Contract (Article 6(1)(b)) | Service delivery, billing and collections. |
| Running the firm and providing legal advice | Legitimate interests (Article 6(1)(f)) | Due diligence and risk assessment; conflict checking; client care; recruitment and retention of staff and consultants; professional indemnity insurance and claims; accounting and audits; and the defence or pursuit of legal claims. Our interest is in running a sound and compliant legal practice. |
| Keeping in touch with clients and professional contacts | Legitimate interests (Article 6(1)(f)) | Occasional, relevant updates on regulatory developments and on our services. Our interest is in maintaining and developing our professional relationships. See Marketing and updates below. |
| Recording and transcribing meetings | Contract (Article 6(1)(b)) for client matters; otherwise legitimate interests (Article 6(1)(f)) | Keeping an accurate record of meetings and of advice given, and preparing minutes and follow-up actions. |
| Meeting our legal and regulatory duties | Legal obligation (Article 6(1)(c)) | Duties imposed by the Solicitors Regulation Authority, anti-money laundering law, company law, tax and accounting rules, and the prevention of crime. |
| Newsletter, analytics and other optional processing | Consent (Article 6(1)(a)) | We say clearly what you are consenting to. You may withdraw consent at any time by contacting ops@bratby.law. |
We do not take decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. We do record topic preferences for our newsletter, which is profiling within the meaning of Article 4(4) UK GDPR, and you may object to it at any time.
When we record or transcribe a meeting, using Microsoft Teams or Granola, we tell participants at the start of the meeting.
Who we share your data with
We use cloud service providers as processors, each under a written contract with appropriate technical and organisational controls under Article 28 UK GDPR. The providers below handle client matter content. We also use providers of website hosting and content delivery, email marketing, banking and identity verification; a current list is held in our record of processing activities and is available on request.
| Provider | What we use it for | Contract | Location and transfer safeguard |
|---|---|---|---|
| Anthropic, PBC | Claude, on the Claude Team plan, for document analysis and drafting, with supervised assistant access to our email, document management system and matter database | Commercial Terms and data processing addendum | United States; EU standard contractual clauses with the UK Addendum |
| OpenAI | ChatGPT Business and Codex for document analysis, research, drafting and software work, with supervised assistant access to our email, document management system and matter database | Business Terms and data processing addendum | United States; EU standard contractual clauses with the UK Addendum |
| Website analytics; Gemini and NotebookLM for research and analysis; the Gemini API on Google’s paid terms, with supervised assistant access to our email, document management system and matter database | Google’s data processing terms, including the Data Processing Addendum for Products Where Google is a Data Processor | United States; UK extension to the EU-US Data Privacy Framework | |
| SpaceX Super Intelligence LLC (xAI) | Grok, on business seats, for research, analysis, drafting and software work | Terms of Service (Enterprise) and Data Processing Addendum | United States; EU standard contractual clauses with the UK Addendum |
| Granola, Inc. | Transcription and summaries of meetings, including client meetings | Granola data processing addendum | United States and other countries where Granola’s sub-processors operate; EU standard contractual clauses with the UK Addendum |
| Legalesign Limited | Electronic signature of engagement letters and other documents | Written processing terms under Article 28 UK GDPR | European Economic Area; UK adequacy regulations |
| Microsoft | Email, document creation and storage, Teams meetings and their transcription, and device security and management | Microsoft 365 Business Premium under the Microsoft Products and Services Data Protection Addendum | EU standard contractual clauses with the UK International Data Transfer Addendum; Microsoft is also certified to the UK extension to the EU-US Data Privacy Framework |
| Supabase Pte. Ltd | Database holding our internal client and matter records | Supabase Data Processing Addendum | Hosted in London (AWS eu-west-2); EU standard contractual clauses with the UK Addendum cover any access from outside the UK |
| Vercel B.V. | Hosting for our internal matter management application | Vercel data processing addendum | London (lhr1); sub-processors at security.vercel.com |
| Xero (UK) Limited | Accounting, time recording and invoicing, including the descriptions of work in our time records and invoices | Xero data processing terms | United States; EU standard contractual clauses with the UK Addendum |
We may also disclose personal data to regulators, law enforcement authorities and professional advisors where the law requires it or to protect our legal rights.
Where personal data leaves the United Kingdom, we use the safeguard shown for each provider. Transfers to the United States rely on the UK extension to the EU-US Data Privacy Framework, where the recipient is certified, or on the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Transfers to countries covered by UK adequacy regulations proceed on that basis.
How long we keep your data
We keep personal data only as long as the purpose requires, and then delete it permanently.
| Data | How long we keep it |
|---|---|
| Client matter files, including meeting recordings and transcripts | Six years after the matter ends, in line with the limitation periods under the Limitation Act 1980, unless client instructions, a legal or regulatory duty, or an actual or potential dispute requires longer |
| Anti-money laundering records | Five years from the end of the business relationship or the completion of the transaction, as regulation 40 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 requires |
| Newsletter subscriber data | Until you unsubscribe; we then delete it within 30 days |
| Professional contact and relationship records | While the relationship continues; deleted once no longer needed, or when you object |
| Website analytics | Google Analytics keeps event-level data for two months and user-level data for 14 months, the 14 months restarting with each new visit |
Cookies and similar technologies
This website uses cookies and similar storage and access technologies on your device. Our use of them is governed by regulation 6 of, and Schedule A1 to, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). Regulation 6 was replaced, and Schedule A1 inserted, on 5 February 2026 by the Data (Use and Access) Act 2025. Where we process personal data obtained through those technologies, the UK GDPR also applies.
Always on
Strictly necessary
Required to deliver the website, operate the cookie preference banner and maintain basic security and session state. They fall within the exception for storage or access strictly necessary to provide a service you have requested (paragraph 4 of Schedule A1 to PECR), and you cannot switch them off through the banner.
With your consent
Analytics
Google Analytics 4 shows us at an aggregate level how visitors use the site, including pages visited, time on site and referral sources. We use the results only to improve the site and our content. Before you consent, Google Consent Mode v2 is configured so that no analytics cookies are written and no identifiable data is sent to Google.
With your consent
Functional
A small number of cookies remember preferences you have set on the site, such as your cookie preferences themselves.
Only if you accept all
Advertising and personalisation
We do not set these by default. Google Consent Mode v2 keeps ad_storage, ad_user_data and ad_personalization denied unless you accept all cookies.
Where we rely on consent under paragraph 2 of Schedule A1 to PECR, we also rely on your consent under Article 6(1)(a) UK GDPR for any related processing of personal data. Where we rely on the strictly necessary exception, we rely on our legitimate interests under Article 6(1)(f) UK GDPR in operating and securing the website. You can change your choices at any time through the “Cookie preferences” link in the footer of every page, or block or delete cookies in your browser. Analytics data may be transferred to Google LLC in the United States, under the UK extension to the EU-US Data Privacy Framework, to which Google LLC is self-certified.
Our pages may include content embedded from other websites, such as videos or social media feeds. Embedded content behaves as if you had visited the originating site, which may set its own cookies and collect data about you under its own privacy and cookie notices.
Marketing and updates
Consent
Our newsletter
You can subscribe on our blog pages to notifications of new posts on UK telecoms regulation, data protection and payments regulation. We collect your name and email address, optionally your company and position, and your topic preferences. MailPoet, a service operated by Automattic Inc., processes this data for us under a data processing agreement. We send newsletters on the basis of your consent (Article 6(1)(a) UK GDPR), obtained by double opt-in, which also meets regulation 22 of PECR. You can unsubscribe through the link in every email or by writing to ops@bratby.law.
Legitimate interests
Updates to professional contacts
We send occasional updates on developments in telecoms, data protection and payments regulation, and on our services, to clients, former clients and professional contacts with whom we have an existing or prior relationship, matched to the topics likely to be relevant to each. We rely on our legitimate interest in maintaining those relationships (Article 6(1)(f)), and our legitimate interests assessment is available on request. For sole traders and people using a personal email address, we send these only with consent or under the PECR soft opt-in.
Every update carries a one-click unsubscribe. We do not use tracking pixels in these messages, we do not buy mailing lists, and we do not share your details with anyone for their own marketing.
Your right to object
You may object at any time to our processing of your personal data on the basis of our legitimate interests. Your right to object to direct marketing, including the profiling linked to it, is absolute: if you object or unsubscribe, we stop at once and add you to our suppression list. To object, write to ops@bratby.law.
Your other rights
Access
You may ask for copies of your personal data.
Rectification
You may ask us to correct inaccurate data or complete incomplete data.
Erasure
You may ask us to delete your personal data in certain circumstances.
Restriction
You may ask us to restrict processing in certain circumstances.
Data portability
You may ask for your data in a structured, commonly used format, to pass to another organisation, in certain circumstances.
Withdrawing consent
Where we rely on consent, you may withdraw it at any time. This does not affect processing carried out before you withdraw.
There is no charge for exercising your rights, and we respond to any request within one calendar month. Contact us at ops@bratby.law or +44 20 4604 3343.
Giving us personal data is not a statutory requirement. Where we need it to enter into or perform a contract with you, including for anti-money laundering checks, we may be unable to act for you without it.
Complaints
You have the right to complain to us about how we handle your personal data. Write to ops@bratby.law or call +44 20 4604 3343. We acknowledge a complaint within 30 days, deal with it under our written complaints procedure, which is available on request, and tell you the outcome without undue delay.
You may also complain to the Information Commission, the UK data protection regulator, which continues to operate as the ICO: telephone 0303 123 1113, or online at ico.org.uk/make-a-complaint.
Changes to this notice
We update this notice from time to time, and the current version is always on this page. This notice was last updated on 30 October 2026.