Lightfoots LLP | Privacy Policy


Lightfoots LLP respects your privacy and is committed to protecting your personal data. This privacy policy explains when and why we collect personal data about you, how we use it, how we look after it and keep your personal data secure, and when and who we may share it with.  This policy also tells you about your privacy rights and how the law protects you.

This privacy policy is intended for clients and prospective clients only.  For clients of this firm you should read this policy together with our general terms and conditions.  If you are using our website, you should also read our Cookies and Other Tracking Technologies Notice.


Lightfoots LLP is a limited liability partnership, authorised and regulated by the Solicitors Regulation Authority, authorisation number 508443. You can find our address and main contact details on our ‘Contact Us‘ page.

In order to provide legal services, we collect, process and store personal data.  We are classed as a “data controller” and are responsible for your personal data (“we”, “us” or “our” in this privacy policy).

If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact our Data Protection Officer, Ian Norman, using the details set out below.

Email address:

Postal address: 1-3 High Street Thame Oxon OX9 2BX

If you have any concerns about our use of your personal information, you can make a complaint to our Data Protection Officer using the contact details above.

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:           

Information Commissioner’s Office

Wycliffe House

Water Lane




ICO helpline number: 0303 123 1113

ICO website:


Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

What information we will need about you will depend on the scope of our instructions.

This information may include:

  • Identity Data includes first name, maiden name, last name, marital status, title, gender and date of birth, along with (if requested) copies of passports, driving licences, utility bills and similar documents required to verify your identity
  • Contact Data includes your address, email address and telephone numbers, along with (if requested) evidence of address
  • Financial Data includes bank account details and evidence of source of funds to comply with our obligations under Anti Money Laundering Regulations
  • Transaction Data includes details about payments to and from you

Certain personal data by its nature is considered sensitive personal data (or ‘special category data’). This includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data. In the majority of cases we do not expect to collect such sensitive personal data.  We will only ever request sensitive personal data if it is directly relevant to and required as part of our instruction or necessary to comply with a legal obligation and will explain to you when requesting this information why we need it.


Where we need to collect personal data by law, or in order to provide you with the requested legal services and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you. In that instance, we may have to decline to act for you and will notify you of this.


It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.


We expect the personal data collected to come from the following sources:

  • You may volunteer the information to us, verbally or in writing and should ensure when doing so that it is complete, accurate and up to date.
  • We may receive the information from third parties as part of our instruction for example, banks, building societies or other financial institutions, panel providers who allocate work to law firms, organisations who have referred work to us or individuals who have your authority to provide information to us.


We will only use your personal data when the law allows us to.  The primary reason for asking you to provide personal data will be so that we can carry out your legal work or so that we can respond to a request for information, if you are a prospective client, such as to provide you with a quote, which is recognised as a lawful ground to process your data.  The law also allows us to use your personal data:

  • With your consent
  • If it is necessary to protect our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. Legitimate Interest means in the interest of conducting and managing our business, including but not limited to fraud prevention, direct marketing, data analysis to help us modify and improve our services, identify usage trends, and determine the effectiveness of marketing campaigns. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).  You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us; or

It is necessary to comply with a legal or other regulatory obligation placed on us by law, for example, our obligations in relation to anti-money laundering legislation.

It is necessary in order to protect your vital interests or the vital in interests of another individual e.g. if you or a family member’s life is in danger.

Most commonly, we will use your personal data in the following circumstances:

  • To verify your identity
  • To obtain your initial instructions and establish whether we can act for you
  • To carry out your legal work/instructions (as above)
  • To provide the legal services requested including, for example, general communications with you as well as (depending on the nature of our instruction) providing you with legal advice, conducting litigation on your behalf, preparing legal documents or completing a legal transaction
  • To establish funding and verify source of funds
  • To obtain insurance policies on your behalf
  • To keep financial records of your transactions and to make payments due to you. We do not store payment card information
  • To seek advice from third parties such as barristers or other experts
  • To respond to any complaint or allegation of negligence against us
  • To recover monies owing to us
  • To help with the internal management of our practice such as resource management, keeping records of sources of work and new enquiries, storage and archiving of files and documents
  • The detection of fraud


We may from time to time send you information which we think might be of interest to you and relating to the services we offer.  Any direct marketing material will be limited to email or post which we will seek your consent for and you can withdraw your consent at any time by notifying us in writing via the contact details above. Please also be assured we will never pass on or sell your details to any third parties for marketing purposes.


We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.


Please be assured we will keep your personal data secure and will not share your information with third parties for marketing purposes.

On occasion, however, we may have to share your personal data with third parties where this is connected to carrying out legal work on your behalf, examples of which include:

  • the Court and Tribunal Service
  • Barristers or other third-party advocacy firms instructed to provide advice or to represent you

Non legal experts to provide advice, assistance or court ordered reports.

  • The Land Registry, when registering a property transaction
  • HM Revenue and Customs e.g. payment of stamp duty
  • Solicitors or barristers acting on the other side of a transaction or litigation
  • Translation agencies
  • Dictation services
  • External auditors (we currently use Wellers Accountants) or our Regulators e.g. SRA, ICO etc
  • Bank or Building Societies or other financial institutions
  • Insurance Companies
  • Providers of identity verification services
  • Transcription agencies
  • Any disclosure required by law or regulation, e.g. suspicious activity reports to the National Crime Agency
  • If there is an emergency and we think you or others are at risk
  • Card processing services

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.


We do not envisage that any decisions will be taken about you using automated means, however we will notify you in writing if this position changes.


Unless you are resident outside the European Economic Area (EEA) or the scope of any particular instruction requires us to communicate with parties outside of the EEA we do not as standard transfer Personal Data outside of the EEA.

Should we have need at any time to transfer your Personal Data outside of the EEA we will notify you of this and will ensure that appropriate security measures are put in place to ensure your Personal Data has a similar level of protection as provided for by data protection laws when transferring Personal Data within the EEA.  If we cannot guarantee such protections your explicit consent to continue with the transfer will be requested.  If explicit consent is not received and we are unable to ensure the protection of your personal data in relation to any required transfer outside of the EEA, we may have to decline to act for you.


We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Keep in Touch