Privacy Notice
Transition Law Pragmatic · Proportionate · Professional
Last reviewed: October 2026
1. About this notice
Transition Law respects your privacy and is committed to protecting the personal information entrusted to us.
This notice explains how we collect, use, store and protect personal data when you visit our website, contact us, engage our professional services, supply goods or services to us, or otherwise interact with our practice.
We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable legislation, including the Privacy and Electronic Communications Regulations 2003 (PECR).
2. Who we are
Transition Law is an independent paralegal law practice providing legal services, data protection advice and governance support to individuals, businesses and organisations.
For personal data processed in connection with our own business activities and professional engagements, Transition Law is generally the data controller.
When providing data protection consultancy, DPO support or other services to an organisation, we may process personal data on that organisation's behalf. In those circumstances, the organisation may remain the controller and Transition Law may act as its processor, depending on the particular arrangements.
Contact details
Transition Law Law Chambers MV-036 The Exchange 73 Barton Street Tewkesbury GL20 5PY
Email: office@transitionlaw.com Telephone: 0330 2233 506
ICO registration number: ZC088793
Data protection enquiries may be addressed to our Data Protection Manager using the contact details above.
3. Personal data we collect
The information we process depends on the nature of our relationship with you.
It may include:
Names, addresses, telephone numbers, email addresses and other contact information.
Information supplied when making enquiries or requesting professional advice.
Identification, financial, contractual and transaction information.
Personal, family and financial circumstances relevant to Will drafting, estate planning or other legal services.
Correspondence, instructions, documents and records generated during professional engagements.
Information about representatives, beneficiaries, family members, employees or other individuals relevant to the services requested.
Business contact information relating to clients, suppliers and professional contacts.
Recruitment and employment information, where applicable.
Limited technical information associated with use and security of our website and communications systems.
Some professional engagements may involve special category personal data, such as information about health, or information relating to criminal convictions and offences.
We process such information only where necessary, with an appropriate lawful basis, any additional condition required by law, and suitable safeguards.
4. How we obtain personal data
We generally obtain personal data directly from you through correspondence, telephone conversations, consultations, documents or other communications.
Where appropriate, information may also be received from organisations engaging our services, professional representatives, authorised third parties, publicly available records or other legitimate sources.
When we receive information about another person, we consider the circumstances in which it was supplied and our responsibilities concerning that information.
5. Why we process personal data
We use personal data for the following purposes.
Enquiries and communications
To respond to enquiries, provide information about our services, arrange consultations and communicate with prospective clients.
Professional services
To assess instructions, provide advice, prepare documents, manage engagements and deliver agreed legal, data protection or governance services.
Business administration
To maintain client records, administer contracts, issue invoices, process payments, maintain accounts and manage business relationships.
Legal and regulatory compliance
To meet applicable legal obligations, maintain appropriate records, respond to lawful requests and address complaints or disputes.
Security and business protection
To protect confidential information, maintain the security of our systems, prevent misuse and establish, exercise or defend legal claims.
Professional communications
To maintain appropriate relationships with clients, suppliers and professional contacts, and communicate about relevant services where permitted by law.
6. Our lawful bases
We identify an appropriate lawful basis under Article 6 UK GDPR for each processing activity.
The principal bases used by Transition Law are:
Contract — Article 6(1)(b)
Where processing is necessary to take steps at your request before entering into a contract or to perform a contract with you.
Legal obligation — Article 6(1)(c)
Where processing is necessary to comply with an applicable legal obligation, including certain accounting, tax and regulatory requirements.
Legitimate interests — Article 6(1)(f)
Where processing is necessary for legitimate business or professional purposes, provided those interests are not overridden by individuals' rights and freedoms.
These interests may include responding to business enquiries, maintaining professional relationships, securing our systems, administering our practice and protecting our legal interests.
We assess the necessity and proportionality of such processing and apply appropriate safeguards.
Consent — Article 6(1)(a)
Where consent is the appropriate basis, including certain optional communications. Consent may be withdrawn at any time, without affecting processing already carried out lawfully.
Other lawful bases will be used only where genuinely applicable.
Where special category data or criminal offence data is processed, we will also identify and document the additional legal condition required.
7. Confidentiality and professional engagements
Information supplied to Transition Law in connection with professional engagements is treated confidentially and is accessible only where there is a legitimate need.
We may receive information concerning individuals other than our immediate clients. Such information is handled in accordance with applicable data protection obligations, confidentiality requirements and the purposes of the engagement.
Our confidentiality obligations do not prevent disclosures required or permitted by law.
8. Sharing personal data
We do not sell personal data.
Where necessary, personal data may be shared with:
IT, hosting, communications and other service providers supporting our operations.
Professional advisers, accountants and appropriate specialist practitioners.
Organisations or individuals involved in delivering agreed services, where appropriate.
Regulatory bodies, courts, law enforcement agencies or public authorities where disclosure is required or otherwise lawful.
Other parties where disclosure is necessary and properly authorised.
We limit disclosures to what is necessary and apply appropriate contractual, technical or organisational safeguards.
Where another organisation acts as a processor on our behalf, we seek to ensure suitable data processing arrangements are in place.
9. International transfers
Some service providers may process or access personal data outside the United Kingdom.
Where a restricted international transfer occurs, we ensure that an appropriate transfer mechanism or lawful exception applies, such as UK adequacy regulations, recognised contractual safeguards or another mechanism permitted by UK data protection law.
Additional information about relevant transfer arrangements is available on request.
10. How long we retain information
We retain personal data only for as long as reasonably necessary for the purposes for which it is processed.
Retention periods depend on the nature of the information, the services provided, applicable legal obligations, contractual requirements and the potential need to establish, exercise or defend legal claims.
For example, professional engagement records may require longer retention than routine enquiries that do not result in an engagement.
Information is securely deleted, destroyed or anonymised when it is no longer required, subject to applicable retention obligations.
Further information about relevant retention periods is available on request.
11. Information security
We use appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, misuse, alteration or disclosure.
These measures include proportionate access controls, secure communications and storage arrangements, and procedures for identifying and responding to information security incidents.
No electronic system can be guaranteed to be completely secure, but we take reasonable steps to manage the risks associated with the information we hold.
12. Our website and cookies
Our website is designed to respect visitors' privacy.
We do not use advertising trackers, behavioural profiling or third-party visitor analytics.
We do not intentionally deploy optional cookies for marketing, analytics or tracking purposes.
Our website hosting provider may process limited technical information, including IP addresses, browser information and network request records, where necessary to deliver the website, maintain security and prevent misuse.
Essential technical or security mechanisms may operate where required for these purposes.
We will review this section if the website's technical arrangements change.
13. Marketing communications
We may communicate with clients and professional contacts about our services where permitted by PECR and UK data protection law.
Where consent is required, we will obtain it before sending the relevant communications.
Where an applicable statutory exception permits communications without prior consent, we will comply with its conditions.
You may object to direct marketing or opt out of marketing communications at any time by contacting us.
We do not sell or provide contact lists to third parties for their own marketing.
14. Your data protection rights
Subject to the circumstances and any applicable statutory restrictions, you may have the right to:
Be informed about the processing of your personal data.
Request access to your personal data.
Request correction of inaccurate or incomplete information.
Request erasure of personal data in appropriate circumstances.
Request restriction of processing.
Object to certain processing activities.
Request data portability where the legal conditions apply.
Exercise rights relating to qualifying automated decision-making.
You may also withdraw consent where processing relies upon consent.
To exercise your rights, please contact us using the details in Section 2.
We may need to verify your identity or obtain information reasonably necessary to understand your request.
We will respond in accordance with applicable statutory timescales and requirements.
15. Automated decision-making
Transition Law does not carry out solely automated decision-making that produces legal or similarly significant effects on individuals.
We may use technology to support administrative or professional activities, but decisions requiring professional judgement remain subject to appropriate human oversight.
16. Children's information and safeguarding
Some professional services may involve information relating to children or individuals in vulnerable circumstances.
Where such information is processed, we apply appropriate confidentiality, security and data protection safeguards, taking account of the nature and sensitivity of the information.
We do not intentionally use our public website to solicit personal information from children.
17. Complaints and concerns
If you have a question or concern about our handling of personal data, please contact:
office@transitionlaw.com
We will consider complaints and respond in accordance with our applicable legal obligations.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.
Website: www.ico.org.uk
18. Changes to this notice
We review this notice periodically and update it where necessary to reflect changes in our processing activities, technology, services or applicable legal requirements.
The current version will be published on our website.
Where a change materially affects how personal data is processed, we will take appropriate steps to provide additional information where required.