Be Legal Limited – Privacy Policy 

(2026 version)

 

About this policy

As a law firm, client confidentiality has always been central to what we do, and we treat your personal information with the same care.

This Privacy Policy explains how Be Legal Limited (“we”, “us”, “our”) collects, uses and protects personal information about our clients and others we deal with. It applies to all personal information we handle in the course of our services, including through this website.

It is written to comply with UK data protection law, meaning the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025 and the Privacy and Electronic Communications Regulations 2003 (PECR) (together, “Data Protection Laws”).

​

Contacting us

If you have any questions about this policy or how we use your personal information, please contact us:

• By email: info@be-legal.com

• By telephone: +44 (0) 1273 704 525

• By post: Be Legal Limited, The Sussex Innovation Centre, Science Park Square, Falmer, Brighton, East Sussex BN1 9SB

Clare Hancox is responsible for data protection at Be Legal Limited and will respond to your enquiry promptly.

 

Our role

We are the “controller” of the personal information we collect in connection with our services and website. This means we decide how and why it is used, unless we agree otherwise with you or the context makes clear that someone else is the controller.

Where we engage suppliers to process personal information on our behalf, they act as our “processors” and may only use it on our instructions.

​

What we collect and how

We collect personal information when:

• you submit a contact form on our website (this arrives as an email in our main inbox);

• you engage us to act for you;

• we buy goods or services from you;

• you contact us by telephone, email or post, or otherwise deal with us, whether as a client or in a professional capacity (for example, as the other party in a contract negotiation or dispute).

 

The information we collect may include:

• your name, job title and organisation;

• contact details such as telephone number, email address and postal address;

• identity documents and information needed for anti-money laundering and conflict checks;

• billing and payment details;

• information relevant to the legal matter we are handling;

• information provided about you by others, such as our clients, other parties, their advisers, or public registers like Companies House.

​

Special category and criminal offence information. Some matters require us to handle more sensitive information, such as health information or details of criminal allegations. We only do this where it is necessary for a legal matter, including to establish, exercise or defend legal claims or to obtain legal advice, and with appropriate safeguards in place.

​

What we do not collect. Our website is a simple brochure site. We do not use it to collect analytics, tracking or browsing information about you.

 

How we use your information and why

The table below sets out what we use your information for and the lawful basis we rely on under UK GDPR.

​

Purpose:

​

Responding to enquiries and giving initial advice by telephone, email or meeting:  Legitimate interests (responding to people who contact us); steps before entering a contract

​

Providing legal services to our clients: Performance of a contract

​

Communicating with other parties and advisers on a matter: Legitimate interests (acting effectively for our clients)

 

Identity, anti-money laundering and conflict checks: Legal obligation

​

Telling you about changes to our services, terms or this policy: Performance of a contract; legitimate interests

 

Running our business, including accounts, audit, insurance and regulatory compliance: Legal obligation; legitimate interests

​

Maintaining our website and IT systems and keeping them secure: Legitimate interests

 

Using carefully selected technology tools, including AI tools, to support our work (see below): Legitimate interests (providing efficient, high-quality services); performance of a contract

​

Handling complaints, claims and disputes: Legal obligation; legitimate interests

 

Preventing fraud and crime: Legal obligation; legitimate interests

 

Where we rely on legitimate interests, we have considered whether they are outweighed by your interests and rights. Where we rely on your consent, you may withdraw it at any time.

​

We do not use your information for marketing, and we do not share it with anyone for their marketing or commercial purposes.

 

Our use of artificial intelligence

We use Claude, an AI assistant provided by Anthropic, to support some elements of our legal work. Examples include summarising documents, reviewing first drafts and helping with legal research.

​

When we do this:

• A lawyer stays responsible. Claude helps our lawyers work more efficiently, but it does not give advice to you. Everything it produces is reviewed by a qualified member of our team, who remains responsible for the work.

• No automated decisions. We do not use AI to make decisions about you that have legal or similarly significant effects.

• Anthropic acts as our processor. We use Claude under Anthropic’s commercial terms and its Data Processing Addendum (DPA). Under these terms, Anthropic processes information only on our instructions to provide the service and must keep it secure and confidential.

• Your information is not used to train AI models. Under Anthropic’s commercial terms, the information we submit is not used to train its models.

• Limited retention. Anthropic keeps the information only for the limited period set out in our agreement with it, after which it is deleted.

• We minimise what we share. We only input the information needed for the task, and we consider whether information should be removed or anonymised first, particularly for sensitive matters.

 

Anthropic is based in the United States. Transfers of personal information to Anthropic are protected by the safeguards described in “International transfers” below.

 

If you would prefer that we do not use AI tools on your matter, please tell us and we will discuss this with you.

Who we share your information with

 

We use carefully selected suppliers to perform services on our behalf. They receive only the information they need, act on our instructions and are contractually bound to keep it confidential and secure.

 

AI assistant for legal work - Anthropic (Claude) - United States

Website hosting - Sitemaker Software Limited (Moonfruit) - UK

Email hosting - Fasthosts Internet Limited - UK

Document storage and management - Livedrive Internet Limited - UK

IT support - Dolphin Computer Upgrades Limited - Brighton, UK

Book-keeping and invoicing - Xero Limited -  UK

Accountancy - SJF Accounting, East Sussex, UK UK

 

We may also share information with other law firms, barristers, IP attorneys, experts and other professionals where needed for your matter, and with other suppliers appropriate to specific cases.

 

We may also disclose your information:

• to our regulators, insurers, courts, law enforcement agencies or other authorities where required or permitted by law;

• to comply with a legal obligation, enforce our terms, or protect the rights, property or safety of us, our clients or others, including to prevent fraud;

• to a prospective buyer or successor in connection with a sale or restructuring of our business, on terms that protect your information in line with this policy.

 

Where your information is stored and international transfers

 

Our paper files are held at our office in East Sussex. Our electronic systems, including our website, email and document storage, are hosted in the UK.

 

Some suppliers, including Anthropic, may process personal information outside the UK. We only transfer personal information outside the UK where Data Protection Laws allow, for example where:

• the UK government has recognised the destination as providing adequate protection, including the UK Extension to the EU-US Data Privacy Framework (the “UK-US Data Bridge”) for certified US organisations; or

• appropriate safeguards are in place, such as the ICO’s International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with any additional measures needed.

 

You can ask us for more information about these safeguards at any time.

 

Keeping your information safe

We have appropriate technical and organisational measures to protect personal information against loss, theft, and unauthorised access, use, disclosure or alteration. Access is restricted to people who need it for their work, and we regularly review our security, storage and processing practices, including physical security.

 

How long we keep your information

We keep personal information only for as long as necessary for the purposes we collected it for, and to meet our legal, regulatory and insurance requirements.

 

As a law firm, we often need to keep files for long periods because of the limitation periods for legal claims. We normally keep client files for at least six years after a matter ends. Some files are kept longer, for example, if we drafted a five-year contract for you, we will keep the file for the life of the contract and at least six years after it ends. Anti-money laundering records are kept for at least five years after the business relationship ends, as the law requires.

 

We regularly review what we hold. When information is no longer needed, we securely delete it or destroy it by shredding or other approved methods. You may ask us to return original documents we hold for you.

 

Cookies

Our website does not use analytics or advertising cookies. It may use cookies that are strictly necessary for the site to work, which do not require your consent under PECR.

 

Your rights

You have the following rights over your personal information. Some apply only in certain circumstances, and some may be limited where we owe duties of confidentiality or legal professional privilege to others.

• Access: to ask whether we hold your information and for a copy of it.

• Rectification: to have inaccurate or incomplete information corrected.

• Erasure: to ask us to delete your information, for example where we no longer need it, you have withdrawn consent, or it has been processed unlawfully.

• Restriction: to ask us to limit how we use your information.

• Portability: to receive information you gave us in a structured, machine-readable format, or have it sent to another organisation, where we process it by automated means based on your consent or a contract with you.

• Objection: to object to processing based on our legitimate interests.

• Withdrawing consent: where we rely on consent, to withdraw it at any time.

• Automated decisions: not to be subject to decisions based solely on automated processing that have legal or similarly significant effects. We do not make such decisions.

 

Where we correct, erase or restrict your information, we will tell anyone we have shared it with, unless this is impossible or involves disproportionate effort.

 

How to exercise your rights

Contact us using the details in “Contacting us”. We may ask for proof of identity where we need it to confirm who you are, and we will only ask for what is reasonable.

 

We will respond within one month of receiving your request. We may extend this by up to two further months for complex or multiple requests, and will tell you if we do. We carry out reasonable and proportionate searches for information. Requests are normally free, but we may charge a reasonable fee, or refuse, if a request is manifestly unfounded or excessive.

 

Complaints

If you are unhappy with how we have handled your personal information, please contact us first so that we can try to put things right. We will acknowledge your complaint within 30 days and respond without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO) at www.ico.org.uk or on 0303 123 1113.

​

Data breaches

We have procedures for investigating and responding to personal data breaches. If a breach occurs, we will act quickly to contain it, which may include suspending access to our systems.

Where required, we will report the breach to the ICO within 72 hours of becoming aware of it. If a breach is likely to result in a high risk to your rights and freedoms, we will tell you without undue delay, explaining clearly what happened, the likely consequences and what we are doing about it.

​

Changes to this policy

We will post any changes to this policy on this page, and our terms of engagement incorporate it. Where changes are significant, we will tell our current clients directly.