1. Data controller
The data controller is Ezrick Evon Saunders, a sole trader trading as The Legal Desk, Office 1, 14-16 Swan Street, Manchester, M4 5JN, United Kingdom.
For privacy questions or to exercise a data-protection right, email contact@thelegaldesk.co.uk with “Data protection request” in the subject line.
2. Information we may collect
Depending on how you use the service, we may collect:
- identity and contact details, including your name, email, telephone number and postal address;
- enquiry and case information, dates, chronology, desired outcome and information about other people or organisations;
- documents, correspondence, contracts, photographs and other material you choose to provide;
- the case reference, secure-access status, service, order, payment status and transaction records (but not full payment-card details handled by Stripe);
- electronic acceptance records, including the version of terms accepted and the date and time;
- communications, complaints, feedback and records of work supplied; and
- basic technical and security information such as IP address, device/browser data and necessary cookie or access logs.
Case material may contain special-category information, allegations or information about criminal offences, health, disability, trade-union membership, beliefs, ethnicity, sexuality or other sensitive matters. Please provide only what is reasonably necessary for the requested service.
3. How and why information is used
| Purpose | Typical information | Legal basis |
|---|---|---|
| Respond to an enquiry and assess suitability | Contact details, issue summary, parties and deadlines | Steps at your request before a contract; legitimate interests in assessing and managing enquiries |
| Accept, manage and supply a service | Case information, documents, order and communications | Performance of a contract and steps requested before it |
| Take payment and keep accounts | Order, invoice, payment status and transaction reference | Contract, legal obligations and legitimate business administration |
| Manage security, conflicts, complaints and legal claims | Identity, case file, logs, work record and correspondence | Legitimate interests, legal obligations, and establishing, exercising or defending legal claims |
| Comply with law and regulatory requests | Information required by the relevant obligation or lawful request | Legal obligation and, where applicable, public-interest or legal-claims conditions |
Where sensitive or criminal-offence information is necessary, it is processed only where data-protection law permits—for example, where necessary for legal advice or for establishing, exercising or defending legal claims—and with appropriate safeguards. If no lawful basis and condition applies, the information will not be used for that purpose.
4. Where information comes from
Most information comes directly from you. It may also come from a person acting with your authority, a document you supply, publicly available registers or websites, an opposing party’s correspondence, a court or tribunal document, or a regulated professional involved in the matter.
If you provide information about another person, you should do so only where it is relevant and lawful. Do not provide excessive private information merely because it is available.
5. Sharing information
Information is not sold. It may be shared only where reasonably necessary with:
- providers supporting website hosting, secure storage, email, communications, document processing, payment and business administration;
- a solicitor, barrister or other professional where you request or authorise an introduction or where sharing is necessary to take a step you have asked us to take;
- professional advisers, insurers or dispute-resolution providers where necessary to obtain advice or deal with a complaint or claim;
- courts, regulators, law-enforcement bodies or public authorities where disclosure is required or permitted by law; and
- another recipient where you give specific authority.
A professional introduced to you normally becomes a separate data controller for information used in their own retainer. Their privacy notice will apply.
The current online workflow uses OpenAI Sites and Cloudflare infrastructure for website delivery, the case database and private object storage, and Stripe for hosted payment checkout. A transactional-email provider may be used to send the secure case link and service notifications. Payment-card details are entered on Stripe’s hosted page and are not stored in The Legal Desk case database.
6. International transfers
Some technology suppliers may process information outside the United Kingdom. Where that happens, we require a lawful transfer mechanism, such as an adequacy regulation or approved contractual safeguards, together with proportionate security measures.
You may ask for information about the relevant safeguard by using the privacy contact address above.
7. Retention and deletion
We use the following standard periods unless a longer or shorter period is reasonably required:
| Record | Standard period | Reason |
|---|---|---|
| Enquiry information where no order is accepted | 90 days after the enquiry closes | Follow-up, conflict checking and enquiry administration |
| Uploaded source documents and working copies | 90 days after final delivery | Short post-delivery query and correction period |
| Final report or deliverable, Order Summary, accepted terms/status statement, essential correspondence and transaction record | Six years after completion | Contract records, complaints, tax/accounting and legal claims |
| Complaint record | Six years after the complaint closes | Quality control and legal claims |
| Security and access logs | A shorter period set according to security need | Fraud prevention, service integrity and incident investigation |
A record may be retained longer where required for a complaint, dispute, legal hold, tax or accounting requirement, safeguarding issue or other legal obligation. Information that is unnecessary, duplicated or provided in error may be deleted sooner.
Keep your own copies. The Legal Desk is not a permanent document-storage or archiving service and may not be able to restore deleted files.
8. Security
Reasonable technical and organisational measures are used to protect information. The intake creates an immutable case reference; uploaded files are held in private object storage rather than sent as email attachments; the client portal uses a long, personal, time-limited access link; and the owner dashboard requires an authorised signed-in account. Order, acceptance and Stripe payment identifiers are recorded against the same case reference. No internet transmission or storage system can be guaranteed completely secure.
A personal case link gives access to sensitive information and should be treated like a password. Do not forward it, publish it or use a shared device without signing out or closing the browser. Ask for a replacement if you believe the link has been exposed; issuing a replacement revokes the previous link.
If you believe information has been sent to the wrong place or compromised, email contact@thelegaldesk.co.uk promptly with “Urgent data security issue” in the subject line. Do not include additional sensitive documents in that first message.
9. Cookies and website data
The site uses a strictly necessary secure, HTTP-only cookie after a valid personal case link is opened, so that the client can use the case portal without a password. The owner dashboard also depends on authenticated access. Non-essential analytics or marketing cookies should not be set without any consent required by law.
External links take you to third-party websites with their own privacy and cookie practices.
10. Automated decisions
The suitability checker may display routing information based on answers such as matter type and deadline. It does not make a legally significant decision, assess merits or automatically accept a client. Paid work is subject to human review and acceptance.
11. Your rights
Depending on the circumstances, you may have rights to request access, correction, erasure, restriction, portability or objection, and to withdraw consent where consent is relied upon. Some rights are limited—for example, where information must be retained for a legal obligation or legal claim.
We may need to verify your identity and clarify a request. There is normally no fee, but a reasonable fee may be charged or a request refused where the law permits because it is manifestly unfounded or excessive.
You may complain to the Information Commissioner’s Office. We would appreciate the opportunity to address the issue first.
12. Children and changes to this notice
The direct online service is intended for people aged 18 or over. Information about a child should be supplied only where relevant, lawful and necessary for an adult client’s matter.
This notice may be updated as services or suppliers change. The effective date at the top identifies the current version. Material changes affecting an active order will be communicated where required.