Privacy Statement

Introduction

This Privacy Statement explains how DK Legal Ltd (DK Legal, we, us and our) collects, uses, shares and protects personal data, and the rights that individuals have in relation to it. DK Legal Ltd is a company registered in England and Wales with company number 10262333, whose address is 36 Long Lodge Drive, Walton on Thames, Surrey KT12 3BY. We own and operate the website www.dklegal.co.uk (the Website).

This Privacy Statement applies to personal data about:

our clients, and the directors, trustees, members, officers, beneficial owners and employees of our clients;
other individuals whose personal data we receive in the course of our work, such as counterparties, their advisers and other people named in documents;
people who contact us or visit the Website; and
our suppliers and other business contacts.

DK Legal is the controller of the personal data described in this Privacy Statement. We are registered with the Information Commissioner’s Office (ICO) under registration number ZA242229. This Privacy Statement should be read together with our Cookies Statement and Terms of Use. If you are a client, it should also be read together with our engagement letter and Terms of Business.

How to contact us

David Kirby, Director, is responsible for data protection at DK Legal. We are not required to appoint a data protection officer. If you have any questions about this Privacy Statement or wish to exercise any of your rights, please contact us:

by email at enquiries@dklegal.co.uk
by post to DK Legal Ltd, 36 Long Lodge Drive, Walton on Thames, Surrey KT12 3BY
by telephone on 020 3920 8399.

Personal data we collect

Depending on our relationship with you, we may collect and use the following personal data:

Identity and contact details: your name, title, job title or role, postal address, email address and telephone number.
Role and appointment details: information about your role in an organisation, such as your appointment as a director, trustee, member or person with significant control, including your date of birth, nationality, country of residence and service address where these are needed for filings with Companies House, the Charity Commission or other registers.
Matter information: information contained in correspondence and documents relating to the legal services we provide, including information about other individuals.
Identity verification and due diligence information: copies of passports, driving licences, utility bills, bank statements and other identity documents; the results of electronic identity checks, which may include a biometric check comparing a photograph of you with your identity document; and the results of checks on whether you are a politically exposed person or subject to sanctions.
Financial and billing details: billing addresses, records of fees, invoices and payments, and details of the bank account from which you pay us.
Communications: records of your correspondence with us, including emails and notes of telephone calls and meetings.
Website and technical data: information you submit through the contact form on the Website, and information collected through cookies and similar technologies, such as your IP address, browser type and operating system, and the pages you visit.

We do not usually seek to collect special category data (such as information about health, ethnicity, religion or sexual orientation) or information about criminal convictions and offences. We may, however, receive such information in the course of a matter, and identity verification and due diligence checks may reveal information about criminal offences or sanctions. Biometric data used in identity checks is also special category data. We handle such information only where permitted by data protection law, as described below.

Where we obtain personal data

We collect personal data directly from you, for example when you contact us, instruct us or provide documents to us. We may also obtain personal data from:

our clients and the organisations with which you are connected;
other professional advisers and the people with whom we deal in the course of a matter;
organisations that refer clients to us;
public registers and sources, such as Companies House, the Charity Commission and the internet; and
identity verification, sanctions and politically exposed person screening providers.

How we use personal data and our legal bases

Data protection law requires us to have a legal basis for each use of personal data. We use personal data for the following purposes and on the following legal bases:

To respond to enquiries made by email, telephone or through the Website: our legitimate interests in responding to enquiries and developing our business, or taking steps at your request before entering into a contract.
To provide legal services to our clients, including advice, drafting and filings with registers: performance of our contract with you where you are our client; otherwise, our legitimate interests (and those of our client) in the provision of legal services.
To carry out identity checks, client due diligence and ongoing monitoring: compliance with our professional obligations and with our legal obligations under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 and related legislation.
To check for conflicts of interest: compliance with our professional obligations, and our legitimate interests in managing our practice.
To record time, issue invoices, manage payments and recover debts: performance of our contract with you, our legitimate interests in being paid, and our legal obligations to keep accounting and tax records.
To meet our regulatory and professional obligations and manage our practice, including dealing with complaints and claims, maintaining insurance, and responding to our regulators: compliance with our legal obligations and our legitimate interests in operating our practice properly.
To use technology, including artificial intelligence tools, to assist in providing our services: our legitimate interests in providing our services efficiently and to a high standard (see Use of artificial intelligence below).
To operate, maintain and improve the Website: our legitimate interests in running an effective website. Where we use non-essential cookies, such as analytics cookies, we do so with your consent where the law requires it (see our Cookies Statement).

Where we rely on legitimate interests, we have considered whether those interests are outweighed by your interests, rights and freedoms, and have concluded that they are not. You may ask us for more information about this assessment.

Where we process special category data or criminal offence data, we do so only where an additional condition applies. These include where the processing is necessary for the establishment, exercise or defence of legal claims or for the purpose of obtaining legal advice; where it is necessary to comply with our anti-money laundering and other regulatory obligations, including preventing or detecting unlawful acts; and, for biometric identity checks, where you have given your explicit consent (including via the provision of the information necessary to complete the check and/or by completing a check issued by a third party at our request).

We do not currently send marketing emails. If we decide to do so in the future, we will do so only in accordance with the law, and you will be able to unsubscribe at any time.

Where we need personal data to comply with our legal obligations (for example, to verify identity) or to perform a contract with you, and the data is not provided, we may be unable to act for you or our client.

Use of artificial intelligence

We may use artificial intelligence (AI) tools to assist us in providing legal services, for example in preparing drafts, reviewing documents and carrying out research. We currently use Claude, a business service provided by Anthropic. Anthropic Ireland, Limited acts as our data processor under a data processing agreement. It is required to keep our information confidential and is contractually prohibited from using it to train its AI models.

When we use AI tools:

we enter only the information needed for the task, and we do not enter identity documents, anti-money laundering evidence, bank or payment details, or special category or criminal offence data;
all material produced with the assistance of AI is carefully reviewed before it is used or issued, in accordance with our policy on the use of AI;
we do not use AI to make decisions about you based solely on automated processing which produce legal effects concerning you or similarly significantly affect you; and
records of our use of AI on a matter are saved to the client file and deleted from the AI tool as soon as reasonably practicable and, at the latest, on completion of the file.

Information entered into AI tools is stored in the United States and may be processed in other countries (see International transfers below). Our clients may opt out of the use of AI on their matters at any time by contacting us. If you are not a client but have any concerns about our use of AI, please contact us.

Who we share personal data with

We keep our clients’ affairs confidential in accordance with our professional obligations. We share personal data only where necessary and as follows:

Service providers acting on our behalf, who process personal data on our instructions under contracts that require them to keep it secure and confidential. These include providers of email, document storage and office software (Microsoft 365 and Google Workspace); data backup (Backblaze); time recording (Toggl); accounting and invoicing software (Quickbooks); electronic identity verification (Veriphy); and AI tools (Anthropic).
Registers and public bodies to which we make filings on our clients’ instructions, such as Companies House and the Charity Commission. Information filed on public registers may be made available to the public by those bodies.
Other parties to a matter, such as other professional advisers, counterparties and their advisers, where this is necessary to provide our services.
Our professional advisers, auditors and insurers, for example in connection with a claim or complaint.
Regulators and law enforcement, including the Solicitors Regulation Authority, HM Revenue & Customs (our anti-money laundering supervisor), the Legal Ombudsman, the National Crime Agency and the police, where we are required or permitted by law to do so.
A purchaser or successor of all or part of our business, subject to appropriate confidentiality arrangements.
Anyone else where you have asked us to or have agreed.

We do not sell personal data.

International transfers

Some of our service providers store or process personal data outside the United Kingdom, including in the European Economic Area and the United States. In particular, our AI service provider stores data in the United States and may process it in other countries, including in Europe, Asia and Australia.

Where personal data is transferred outside the UK, we ensure that it is protected either by UK regulations recognising the destination (or, for certain US organisations, the UK-US data bridge) as providing adequate protection, or by appropriate safeguards approved under UK data protection law, such as standard contractual clauses together with the International Data Transfer Addendum issued by the Information Commissioner. Please contact us if you would like more information about these safeguards.

How long we keep personal data

We keep personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, regulatory, accounting and insurance requirements. In general:

client files and matter records are kept for 12 years from the end of the matter, after which they are securely destroyed or deleted, save for original documents which remain in force;
identity verification and client due diligence records are kept for five years from the end of our business relationship with the client, as required by the Money Laundering Regulations 2017, unless we are required to keep them for longer;
accounting and billing records are kept for at least six years from the end of the financial year to which they relate;
enquiries that do not lead to an instruction are kept for up to six years; and
AI records are saved to the client file and deleted from the AI tool as described under Use of artificial intelligence

Information collected through cookies is kept as described in our Cookies Statement.

How we protect personal data

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse. These include multi-factor authentication, encryption, access controls, secure backups and confidentiality obligations on everyone who works for us. We require our service providers to apply appropriate safeguards to the personal data they process on our behalf.

Your rights

Subject to certain conditions and exemptions, you have the right to:

request access to the personal data we hold about you;
ask us to correct personal data that is inaccurate or incomplete;
ask us to erase your personal data;
ask us to restrict our use of your personal data;
object to our use of your personal data where we rely on legitimate interests;
ask us to transfer personal data you have provided to us to you or another organisation, in a structured and commonly used electronic format, where we process it on the basis of consent or contract by automated means;
withdraw your consent at any time, where we rely on consent (this will not affect processing carried out before you withdraw it); and
not be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you.

Some of these rights are limited. For example, we may not be able to disclose information that is subject to legal professional privilege or our duty of confidentiality to a client, or to erase information that we are required to keep by law, including for anti-money laundering purposes.

To exercise any of these rights, please contact us using the details above. We may need to verify your identity before responding. We will respond within one month of receiving your request, although this may be extended by up to two further months for complex requests, in which case we will tell you. We do not usually charge a fee.

Complaints

If you have concerns about how we use your personal data, please contact us first so that we can try to resolve them. We will acknowledge your complaint and respond to it without undue delay.

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection, at ico.org.uk/make-a-complaint or by telephone on 0303 123 1113.

Links to third party websites

The Website may contain links to third party websites. If you follow a link to a third party website, please be aware that it will have its own privacy policy and that we do not accept any responsibility or liability for that website or its policies.

Changes to this Privacy Statement

We may update this Privacy Statement from time to time. The current version will always be available on the Website, and where appropriate we will notify our clients of significant changes. This Privacy Statement was last updated on 29 October 2026.