GDPR Privacy Notice


At Freeman Box, we respect your privacy. We believe in transparency and are committed to being open about our privacy practices. This notice explains how we collect and use your personal information and has been prepared in accordance with the requirements of the EU General Data Protection Regulation (GDPR).

In this document, the expressions “we”, “us” and “our” refer to Freeman Box. The expressions “you” and “your” refer to the Data Subject.

Our Details

Freeman Box is registered as a Data Controller (registration no. Z7432712) on the public register held by the Information Commissioner, in accordance with the GDPR.

Address:                  8 Bentinck Street, London W1U 2BJ, UK.

Correspondence relating to personal data processing should be marked for the attention of the Privacy Manager

DX:                         9045 West End

Email address:         [email protected]

Telephone number:   020 7486 9041

Fax number:             020 7486 2552

We are authorised and regulated by the Solicitors Regulation Authority under number 48629.

Our Reliance on You to Inform Us of Changes

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

How We Collect Your Personal Information

The methods used by us to collect personal information from and about you are:

Directly from you – during your initial contact with us via telephone, email, website contact form, in writing or in person; as part of our client ID procedures; during the ongoing course of our instructions from you.

From third parties – via other professional advisers or other parties involved in a matter.

What happens if we do not receive the personal information we need from you?

At the commencement of all instructions, we are required under UK Anti-Money Laundering Regulations to obtain information which enables us to verify the identity of our client or, in the case of a company, the individuals who own or control it. If we do not receive that information, we cannot act for that client.

During the course of a transaction, if you fail to provide personal information when requested, we may not be able to fulfil our contract with you.

Personal Information Held About You

Personal information means any information about an individual from which that person can be identified.

The type of personal information we hold about you will depend upon the matter concerned and the nature of our instructions. As standard procedure, the information held will be:

  • Full name and title
  • Contact information including email address(es), home and work postal address(es), landline/mobile telephone number(s), fax number(s), previous address(es)
  • Identification and background information provided by you or collected as part of our client ID procedures, including personal photo ID documents and utility bills

As a matter progresses and depending on the matter type, the information may also include:

  • Employment information, such as the company you work for, position/title, employment history
  • Professional and personal interests
  • Date of birth
  • Marital status
  • Financial information such as bank details and transaction history
  • National Insurance Number
  • Gender
  • Any other relevant information relating to you which may be supplied to us or obtained by us in order to fulfil our instructions. This may include special category data such as race, ethnic origin, religion, sex life, sexual orientation, politics, criminal convictions, trade union membership, health information, and genetic data.

How We Use Your Personal Information

Your personal information will be used by us for the following purposes:-

  • To obtain evidence of your identity;
  • To establish a client relationship and communicate with you;
  • To make or receive payments during the course of a transaction;
  • In order to act on your behalf and fulfil our instructions.

The legal basis upon which we process your personal information is one or more of the following:

  • Necessary for the performance of a contract;
  • Necessary for compliance with legal or regulatory obligations;
  • To establish, exercise or defend legal claims or proceedings;
  • Necessary for our legitimate interests in performing our instructions;
  • Necessary for the legitimate interests of our client in us performing its instructions.

We do not rely on consent as a legal basis for processing your personal information.

We do not use your personal information for marketing purposes other than to invite you to occasional special events held by us. If you would prefer not to receive these invitations, please let us know by email

Change of Purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent where this is required or permitted by law.

Your Rights

The GDPR provides the following rights for individuals:

  1. Right to be informed – you have the right to be informed about what personal information we collect and how we use it. This notice discharges that obligation.
  2. Right of access – you have the right to request a copy of the personal information that we hold about you and to check that we are lawfully processing it.
  3. Right to rectification – if you believe the information we hold about you is inaccurate or incomplete, please advise us so that we may rectify this. Please note we may need to verify the accuracy of the new data you provide to us.
  4. Right to erasure (the ‘right to be forgotten’) –you can ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Please note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
  5. Right to restrict processing – you can ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
  6. Right to data portability – you have the right to have the personal information we hold about you transferred to another organisation. Information will be provided in a structured, commonly used and machine readable format.
  7. Right to object – you have the right to object to our processing your personal data where we are relying on legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

If you wish to exercise any of these rights, please make a written request here. We will respond to your request within one month. Requests for copy information will be provided free of charge and, where possible, copies will be in electronic form. Please note, we reserve the right to charge a reasonable administration fee for further copies requested, or if the information requested is excessive. In circumstances where the requests are numerous or complex, we reserve our right to extend the period of compliance by a further two months; we will inform you of this within one month of your request and explain why the extension is necessary.

Disclosure of Your Personal Information

From time to time during the conduct of a matter, we will need to share your personal information with third parties in order to fulfil our contract with you, in particular:

  • Other parties involved and/or their professional advisers;
  • Our own professional advisers and consultants, including Counsel, accountants, auditors, insurers and professional experts;
  • Our bank;
  • Government bodies, including Courts, local authorities, the Land Registry, HMRC, tribunals;

Where required of us under UK law or regulation, we may also have to share your information with UK law enforcement agencies and regulatory bodies.

Your personal information may also be accessible to contractors employed by us in relation to our office technology and computer systems, such as IT contractors, communications providers and software providers, who are required to remotely access our servers in order to provide their services to us and fulfil their contracts with us. All contractors employed by us who have access to our servers are required to have their own GDPR compliant Privacy Policies as Data Processors on our behalf, under which your rights are protected.

In the event of a sale or restructuring of our business, we will share your personal information with the other parties if and to the extent required under the terms of the transaction.

International Transfers

We will not transfer your personal information to a country which is outside the European Economic Area (EEA) unless:

  • The third country, region or sector is approved by the European Commission as providing adequate protection (GDPR Article 45);
  • Appropriate safeguards meeting the requirements of GDPR Article 46 have been put into place by us or by the individual on whose behalf we would transfer the information.
  • One of the derogations relating to specific circumstances under GDPR Article 49 applies, which include:
  • You have explicitly consented to the proposed transfer, having been advised of the possible risks;
  • The transfer is necessary for the performance of a contract between us and you, or between us and a third party where the contract is in your interests;
  • The transfer is necessary for the establishment, exercise or defence of legal claims;
  • The transfer is necessary to protect your vital interests.

Retention of Personal Information

All closed client matter files will be retained for a period of not less than 12 years from the date of file closure. After 12 years, the file will be securely destroyed unless there is a compelling reason for us to retain it and this reason complies with GDPR.

Personal Information collected by us as part of our client ID procedures will be retained in accordance with the UK Anti-Money Laundering Regulations.

Where we are instructed to store original wills or deeds and original documents by a client, these will be retained for an unlimited period.


We have put in place an appropriate system of physical, electronic and managerial measures to protect the security of the personal information we process on your behalf, whether in electronic or in paper format, to ensure that your information cannot be accessed or used in an unauthorised way, altered, disclosed or lost. We limit access to your information to those individuals and entities employed or instructed by us, or third parties involved in a matter, as necessary to fulfil our contract with you or who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Your Right to Complain

If you believe that we are processing your personal information unlawfully, you have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

Information Commissioner's Office
Wycliffe House
Water Lane
Tel: 0303 123 1113

Further information is available on their website

Automatic Decision Making

We do not envisage that any decisions will be taken about you using automated means, however we will notify you in writing if this position changes

Website and Cookies

For more information about the cookies we use, please see our Cookie Policy. You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of our website may become inaccessible or not function properly.

Our website contains links to third party websites which we consider may be of interest to you. However, once you have used these links and leave our website, you should note that we have no control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites. This Privacy Notice does not govern those sites and you should always familiarise yourself with each individual site’s privacy policy.


Updated:  May 2018