Privacy Policy

1. Introduction

HRJ Foreman Laws LLP (“the Firm”, “we”, “us” or “our”) is committed to protecting the privacy, confidentiality and security of your personal information.

This Privacy Notice explains how we collect, use, store, share and protect personal data when we provide legal services or otherwise interact with you.

We process personal data in accordance with:

• UK General Data Protection Regulation (UK GDPR);
• Data Protection Act 2018;
• Data (Use and Access) Act 2025;
• Solicitors Regulation Authority (SRA) requirements; and
• Other applicable legal and regulatory obligations.

This notice should be read alongside our Terms of Business, Data Protection Policy and other information provided to you during our relationship.

2. Who We Are

HRJ Foreman Laws LLP is the data controller responsible for your personal information.

Head Office Address:
25 Bancroft, Hitchin, Hertfordshire SG5 1JW

Telephone:
01462 458711

Email:  info@hrjforemanlaws.co.uk

We have appointed Andrew Dongworth as our Data Protection Officer (DPO).

If you have any questions about this Privacy Notice or our handling of your personal information,

Please contact:  Andrew.Dongworth@hrjforemanlaws.co.uk

3. What Information We Collect

We may collect, use, store and process the following categories of personal information:

Personal Information

• Name, title and contact details;
• Date of birth;
• Gender;
• Marital and family information where relevant;
• Employment details;
• Identification documents, including passports and driving licences;
• Contact and communication records;
• Information relating to your legal matter;
• Financial information, including bank details and payment information;
• Court, tribunal or regulatory information;
• Records of meetings, telephone calls and correspondence.

Anti-Money Laundering and Compliance Information

We may collect:

• Identity verification information;
• Source of funds information;
• Source of wealth information;
• Beneficial ownership information;
• Politically Exposed Person (PEP) information;
• Sanctions screening information;
• Electronic verification records; and
• Information required for ongoing due diligence and risk assessment.

Vulnerability and Accessibility Information

Where relevant, we may collect information concerning:

• Disabilities;
• Accessibility requirements;
• Communication preferences;
• Vulnerability considerations;
• Safeguarding matters; and
• Reasonable adjustment requirements. 

Special Category Data

In certain matters we may process special category personal data, including:

• Health information;
• Genetic data;
• Biometric data;
• Racial or ethnic origin;
• Religious or philosophical beliefs;
• Trade union membership;
• Information concerning sex life or sexual orientation; and
• Other information necessary for the establishment, exercise or defence of legal claims.

We may also process criminal offence data where necessary and lawful.

4. How We Collect Your Information

We obtain personal information from a variety of sources, including:

Information Provided Directly by you:

• Client onboarding forms;
• Enquiries;
• Instructions;
• Correspondence;
• Meetings; and
• Documents supplied by you.

Information Obtained From Third Parties

We may obtain personal information from:

• Solicitors, barristers and other professional advisers;
• Courts and tribunals;
• Government agencies;
• Public records and public registers;
• Employers and financial institutions;
• Opposing parties and their representatives;
• Witnesses and experts; and
• Other individuals connected with your matter. 

Electronic Verification and Compliance Providers

We may obtain information from:

• Identity verification providers;
• Anti-money laundering providers;
• Fraud prevention providers;
• Sanctions screening providers; and
• Thirdfort and other approved due diligence providers. 

Technology Platforms

Information may also be generated through your use of our website, email communications or client portals. 

5. How We Use Your Information

We will only process your personal information where permitted by law.

We may use your personal information to:

• Provide legal advice and legal services;
• Manage and administer your matter;
• Verify identity;
• Comply with anti-money laundering obligations;
• Conduct source of funds and source of wealth enquiries;
• Undertake sanctions and fraud screening;
• Communicate with you;
• Manage billing, payments and accounts;
• Carry out risk assessments;
• Maintain information and cyber security;
• Protect against fraud and financial crime;
• Exercise or defend legal claims;
• Fulfil contractual obligations; and
• Comply with our legal, professional and regulatory duties.

6. Use of Technology and Artificial Intelligence

The Firm uses approved technology systems to assist with the delivery of legal services and management of our business.

These may include:

• LEAP Case Management;
• Microsoft 365;
• Microsoft Copilot;
• LawY;
• Matter AI;
• Thirdfort;
• HighQ;
• LawConnect; and
• Other approved systems.

Where approved artificial intelligence tools are used, they remain subject to:

• Confidentiality obligations;
• Information security controls;
• Professional conduct requirements;
• Data protection legislation; and
• The Firm’s Artificial Intelligence Use Policy.

AI tools are not used as a substitute for professional judgement and any output is subject to appropriate review and verification.

7. If You Fail to Provide Information

If you do not provide personal information requested by us, we may be unable to:

• Accept instructions;
• Continue acting on your behalf;
• Comply with anti-money laundering requirements;
• Meet regulatory obligations; or
• Provide legal services effectively.

8. How We Use Special Category Data

Special category data receives additional protection under data protection law.

We will only process this information where:

• It is necessary for the establishment, exercise or defence of legal claims;
• It is necessary for substantial public interest reasons;
• It is necessary to comply with employment or social protection obligations;
• It is required by law; or
• You have provided explicit consent where consent is the relevant legal basis.

Where consent is relied upon, you may withdraw your consent at any time.

The Firm maintains appropriate safeguards when handling special category data, including restricted access, staff training and security controls. 

9. Change of Purpose

We will ordinarily use personal information only for the purposes for which it was collected.

If we need to process information for a different but compatible purpose, we will do so only where permitted by law and, where appropriate, notify you. 

10. Lawful Bases for Processing

The lawful bases relied upon may include:

• Performance of a contract;
• Compliance with legal obligations;
• Legitimate interests;
• Establishment, exercise or defence of legal claims;
• Substantial public interest; and
• Consent where required.

The applicable lawful basis will depend upon the particular circumstances. 

11. Sharing Your Information

We may share your personal information where necessary with:

• Barristers and experts;
• Courts and tribunals;
• Opposing solicitors;
• Regulators;
• Government agencies;
• Law enforcement agencies;
• Auditors and insurers;
• Banks and payment providers;
• Identity verification providers;
• Anti-money laundering providers;
• Thirdfort;
• LEAP;
• HighQ;
• LawConnect;
• Approved cloud and document management providers;
• IT support providers; and
• Other professional advisers connected with your matter.

All third parties are required to protect personal information and process it lawfully and securely. 

12. International Transfers

Where personal information is transferred outside the United Kingdom, we will ensure that appropriate safeguards are in place.

These may include:

• Countries subject to adequacy regulations;
• International Data Transfer Agreements;
• Standard contractual clauses; or
• Other lawful transfer mechanisms recognised under UK data protection legislation. 

13. Data Security

We maintain appropriate technical and organisational security measures to protect personal information.

These measures include:

• Multi-factor authentication;
• Encryption where appropriate;
• Staff training;
• Role-based access controls;
• Secure cloud systems;
• Cyber security monitoring;
• Incident response procedures;
• Audit trails; and
• Periodic security reviews.

Access to personal information is restricted to those with a genuine business need.

The Firm maintains procedures for identifying, investigating and responding to suspected personal data breaches. 

14. Data Retention

We retain personal information only for as long as necessary to:

• Provide legal services;
• Comply with legal obligations;
• Satisfy regulatory requirements;
• Resolve disputes; and
• Protect legal rights and interests.

Personal information will be retained and securely disposed of in accordance with the Firm’s Data Retention and Destruction Policy and applicable legal and regulatory requirements. 

15. Your Rights

Subject to applicable law, you may have the right to:

• Access your personal information;
• Correct inaccurate information;
• Request deletion of personal information;
• Restrict processing;
• Object to processing;
• Request data portability;
• Withdraw consent where processing is based on consent; and
• Challenge certain automated decisions.

To exercise your rights, please contact our Data Protection Officer.

16. Data Protection Complaints

If you have concerns regarding how we process your personal information, please contact our Data Protection Officer in the first instance.

Concerns will be handled in accordance with the Firm’s Data Protection Complaints Procedure.

You also have the right to complain to the Information Commissioner’s Office (ICO):

Information Commissioner’s Office

 17. Updates to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in:

• Legislation;
• Regulatory requirements;
• Technology;
• Business operations; or
• Firm procedures.

The latest version will be available upon request. 

18. Contact Details

If you have any questions regarding this Privacy Notice or your personal information, please contact:

Data Protection Officer Andrew Dongworth
Email: Andrew.Dongworth@hrjforemanlaws.co.uk

—————-

Our Cookie Policy

Read our cookie policy here.