Imperia Law Ltd ("we", "our", "us") are committed to safeguarding your personal data. This Privacy Policy explains how we collect, use, store, and share your data in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and our obligations under the Solicitors Regulation Authority (SRA) Codes of Conduct. We handle your data with transparency and integrity, ensuring that we respect your privacy and data rights.

Data Controller: Imperia Law Ltd
SRA Number:  8011859
Registered Office: Office 109, The Shed, Sergeants Yard, Bordon, Hampshire, GU35 0DJ
Email: dataprotection@imperia-law.com

Telephone:  01252 958 731

1. What Personal Data We Collect

We collect various types of personal data to provide legal services, manage operations, and meet legal obligations.

• Identity Data: Name, date of birth, gender, nationality, passport details.
• Contact Data: Home and business addresses, email addresses, telephone numbers.
• Financial Data: Bank account details, payment history, source of funds for AML checks.
• Case-Related Data: Documentation, contracts, and other relevant information related to your legal matters.
• Special Category Data: Data relating to racial or ethnic origin, religious beliefs, or health information, where necessary.
• Technical Data: IP addresses, browser type, operating system, and website usage data.

2. How We Collect Your Data

We collect personal data through multiple channels, including:

• Direct Interactions: Consultations, emails, phone calls, and in-person meetings.
• Forms and Documents: Completion of forms, both physical and online.
• Third Parties: Other professionals (e.g., barristers, courts, AML/KYC providers), and regulatory bodies.
• LEAP CMS: Our case management system stores client data, case files, and time tracking records securely.
• Website Interactions: Use of cookies and analytics tools.

3. Lawful Basis for Processing Personal Data

We process your personal data based on the following lawful grounds:

4. How We Use Your Personal Data

We use your data to:

• Provide legal advice, representation, and related services.
• Conduct identity verification and AML/KYC checks, Process payments and manage financial records.
• Manage client records via LEAP CMS, including document management, time tracking, and billing.
• Communicate with courts, tribunals, barristers, and external legal professionals
• Conduct internal audits and regulatory compliance checks.
• Improve website functionality and user experience.
• Send relevant updates and marketing materials (where consent has been provided)

5. Data Sharing with Third Parties

We may share your data with trusted third parties where necessary to provide legal services or comply with legal obligations.

Third Parties We May Share Data With:

• Barristers, Counsel, and Expert Witnesses for case support.
• Courts, Tribunals, and Government Agencies for legal proceedings.
• AML/KYC Providers for identity verification and due diligence checks.
• Outsourced Administrative Services (e.g., transcription, file archiving) bound by confidentiality agreements.
• IT Providers supporting our LEAP CMS, secure email servers, and cloud storage.
• PII Insurers and Regulatory Authorities (e.g., SRA, ICO) when legally required.

All third parties are contractually obligated to maintain data confidentiality and comply with UK GDPR.

6. Data Retention

We only retain your personal data for as long as necessary to:

• Fulfil the purposes outlined in this Privacy Policy.
• Comply with legal, tax, and regulatory obligations.
• Defend against potential legal claims.
• Standard Retention Period: 6 years post-closure of a legal matter, unless longer retention is legally required (e.g., trust-related cases)

7. Data Security Measures

We implement strict data security protocols to prevent unauthorised access, data breaches, and loss of data.

• Encryption: All data stored within LEAP CMS and our email systems is encrypted.
• Access Controls: Data access is limited based on user roles and responsibilities.
• Two-Factor Authentication (2FA): Applied to critical systems.
• Regular Security Audits: Ensuring compliance with data protection best practices.
• Data Breach Response Plan: Immediate containment and notification protocols in line with ICO guidelines.

8. International Data Transfers

We may transfer data outside the UK or EEA if necessary (e.g., for cloud storage or international legal matters).

Safeguards Implemented: Standard Contractual Clauses (SCCs), Adequacy Decisions recognised by the UK Government, Data Processing Agreements with non-UK service providers.

9. Your Data Rights Under UK GDPR

You have the following rights regarding your personal data: