Privacy Policy

---

Privacy Notice

Ravenstone Law Limited trading as Ravenstone Law

Effective date: 19 July 2026 Last updated: 19 July 2026

1. About Ravenstone Law

Ravenstone Law Limited, trading as Ravenstone Law (“Ravenstone Law”, “we”, “us” or “our”), is a business and dispute consultancy.

We provide legal support, commercial strategy and document assistance in connection with business, property, debt, insolvency and dispute-related matters.

Ravenstone Law is not authorised or regulated by the Solicitors Regulation Authority. We do not carry on reserved legal activities. Where a matter requires a reserved legal activity or the services of an authorised legal professional, we may recommend or work alongside an appropriately authorised solicitor, barrister or other professional.

This privacy notice explains how we collect, use, store and share personal information and describes the rights available to individuals under UK data-protection law.

2. Who is responsible for your personal information?

For the processing described in this notice, the data controller is:

Ravenstone Law Limited Trading as
Ravenstone Law 27 Old Gloucester Street London WC1N 3AX

Company number: 16486484
Website: www.ravenstonelaw.co.uk

Ravenstone Law will ordinarily act as a data controller when dealing with its own clients, prospective clients, business contacts and other individuals involved in a matter.

In some circumstances, we may process personal information solely on the documented instructions of another organisation, such as a professional firm or corporate client. In those circumstances, that organisation may be the controller and Ravenstone Law may act as its processor. Questions about that processing should ordinarily be directed to the relevant controller.

3. The personal information we collect

Depending on the nature of your enquiry or matter, we may collect and use:

• your name, address, telephone number, email address and other contact details;
• information about your occupation, business, company, directorships, shareholdings or commercial interests;
• information concerning a property, contract, debt, insolvency issue, complaint, dispute or prospective claim;
• correspondence, contracts, notices, invoices, accounts, company records, property records, court documents and other materials supplied to us;
• instructions, meeting notes, attendance notes and records of communications;
• information about counterparties, witnesses, employees, directors, shareholders, creditors, debtors, tenants, landlords, advisers and other persons connected with a matter;
• identity and verification information where reasonably required;
• billing, invoicing and payment information;
• information required to identify and manage conflicts of interest;
• enquiry, feedback and marketing-preference information; and
• technical information collected through our website, including IP address, browser type, device information, cookie identifiers and pages visited.

We do not receive or hold client money.

4. Special-category information

Some matters may involve special-category personal information, including information about:

• physical or mental health;
• racial or ethnic origin;
• religious or philosophical beliefs;
• political opinions;
• trade-union membership;
• sex life or sexual orientation;
• genetic information; or
• biometric information used for identification.

We will only process special-category information where it is necessary and where both:

1. an appropriate lawful basis under Article 6 of the UK GDPR applies; and
2. an additional condition under Article 9 of the UK GDPR applies.

Depending on the circumstances, the relevant Article 9 condition may include:

• processing necessary for the establishment, exercise or defence of legal claims;
• your explicit consent; or
• another condition permitted by data-protection legislation.

We will not collect or retain special-category information merely because it has been included in documents supplied to us. We will, where reasonably practicable, limit our use of that information to what is necessary for the relevant purpose.

5. Criminal-offence information

A dispute or insolvency-related matter may include allegations, investigations, proceedings, convictions or other information concerning criminal offences.

Criminal-offence information is not the same as special-category information and is subject to separate protection under Article 10 of the UK GDPR and the Data Protection Act 2018.

We will only process criminal-offence information where:

• an Article 6 lawful basis applies; and
• the processing is authorised by UK law, including where it is necessary for the establishment, exercise or defence of legal claims or another applicable statutory condition is satisfied.

Where required, we will maintain an appropriate policy document addressing our handling, retention and deletion of this information.

6. How we obtain personal information

We may obtain personal information:

• directly from you when you contact us, instruct us, complete a form, provide documents, attend a meeting or communicate with us;
• from a client where the information concerns another individual involved in the client’s matter;
• from your representatives, advisers, employees, agents, directors or shareholders;
• from solicitors, barristers, accountants, insolvency practitioners or other professional advisers;
• from counterparties, witnesses, landlords, tenants, creditors, debtors or others involved in a matter;
• from Companies House, HM Land Registry, court and tribunal records, public registers, published judgments, business websites and other publicly accessible sources;
• from third parties whom you have authorised to provide information to us; and
• through our website, including contact forms, cookies and analytics tools.

Where we obtain information about you from someone else, we will provide the information required by data-protection law unless an exemption applies.

7. How and why we use personal information

We use personal information for the following purposes and lawful bases:

Responding to enquiries and assessing whether we can assist

We use contact details and information about the proposed matter to respond to enquiries, consider whether our services are suitable and take steps at your request before entering into a contract.

Our lawful bases are:

• steps taken at your request before entering into a contract; and
• our legitimate interests in responding to enquiries, understanding potential instructions and operating our consultancy.

Providing consultancy services

We use personal information to:

• understand and assess the matter;
• review and organise documents;
• prepare correspondence, chronologies, issue summaries and draft documents;
• prepare commercial assessments, settlement proposals, risk assessments and practical action plans;
• communicate with the client, professional advisers and other persons involved;
• manage instructions and maintain an appropriate record of the work undertaken.

Where the client is an individual, our principal lawful basis will ordinarily be performance of our contract with that individual.

Where the client is a company, partnership or other organisation, our lawful basis will ordinarily be our legitimate interests and those of the client in obtaining and providing the consultancy services.

Administration, billing and record keeping

We use personal information to administer matters, issue invoices, record payments, maintain business records and deal with accounting and taxation requirements.

Our lawful bases are:

• performance of a contract;
• compliance with legal obligations; and
• our legitimate interests in administering our business and recovering sums due to us.

Conflicts, complaints, disputes and legal claims

We may use personal information to identify and manage conflicts, respond to complaints, obtain professional advice, protect our legal position and establish, exercise or defend legal claims.

Our lawful bases are:

• our legitimate interests in protecting our business and managing risk;
• compliance with legal obligations; and
• where relevant, the establishment, exercise or defence of legal claims.

Fraud prevention and security

We may use personal information to verify identity where necessary, prevent fraud or misuse, protect confidential information, maintain system security and investigate suspected security incidents.

Our lawful bases are our legitimate interests in protecting our clients, systems and business and, where applicable, compliance with legal obligations.

Improving our services and website

We may use appropriately limited information to improve our services, website, systems and internal procedures.

Our lawful basis is our legitimate interest in improving and managing our business. Where non-essential cookies or similar technologies are involved, we will obtain consent where required.

Marketing

We may send information about our services where you have requested it, consented to receive it or where marketing is otherwise permitted by law.

Depending on the circumstances, we may rely upon consent or our legitimate interests. We will also comply with the Privacy and Electronic Communications Regulations 2003 when sending electronic marketing.

You may object to or unsubscribe from direct marketing at any time.

8. Information you are required to provide

You are not generally under a statutory obligation to provide personal information to us.

However, certain information may be necessary for us to:

• assess an enquiry;
• enter into or perform a contract;
• identify relevant parties and conflicts;
• verify identity where reasonably required;
• provide the requested services; or
• comply with a legal obligation.

If you do not provide information that is reasonably necessary, we may be unable to accept an instruction or continue providing services.

9. Sharing personal information

Where necessary and lawful, we may share personal information with:

• solicitors, barristers and other authorised legal professionals;
• accountants, tax advisers and insolvency practitioners;
• experts, investigators, mediators and other professional advisers;
• IT, hosting, email, cloud-storage, document-management and cybersecurity providers;
• administrative and business-support providers;
• payment processors, banks and accounting providers;
• insurers and risk advisers;
• courts, tribunals, Companies House, HMRC, regulators, law-enforcement bodies and other public authorities;
• counterparties and their representatives;
• landlords, tenants, creditors, debtors, agents, directors, shareholders, witnesses or others involved in a matter; and
• authorised professionals where a matter requires regulated or reserved work that Ravenstone Law cannot undertake.

We will only share information where there is a proper purpose and an appropriate lawful basis. We will limit the information shared to what is reasonably necessary.

Service providers acting on our behalf are required to protect personal information and use it only for authorised purposes.

We do not sell personal information.

10. Practice -management and technology-assisted services 

We use specialist cloud-based practice-management, document-management and AI-assisted legal technology designed for legal and professional services.

These systems help us manage enquiries, client and matter information, correspondence, documents, billing and administrative records. We may also use AI-assisted functionality to undertake research, organise, search, summarise, compare and analyse documents, extract relevant information and assist in preparing draft material.

We do not place personal information or client documents into publicly accessible, general-purpose AI services. The specialist systems we use employ enterprise-grade security measures, including encryption while information is being transmitted and while it is stored, access controls, and security standards certified under SOC 2 Type II and ISO 27001.

Where third-party AI model providers are used within those systems, zero-retention arrangements apply. Client information is not made publicly available and is not used to train external general-purpose AI models.

We limit the information processed to what is reasonably necessary for the relevant purpose. Our technology providers process personal information on our behalf under contractual obligations concerning confidentiality, security and data protection.

We remain responsible for determining how and why personal information is used in connection with our services.

11. International transfers 

Some of our technology or service providers may store or process personal information outside the United Kingdom.

Where personal information is transferred outside the United Kingdom, we will ensure that the transfer is made using a lawful mechanism. Depending on the destination and provider, this may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to the European Commission’s Standard Contractual Clauses; or
• another transfer mechanism permitted by UK data-protection law.

Where required, we will also undertake an appropriate assessment of the protection available in the destination country.

You may request further information about the relevant transfer safeguards, including how to obtain a copy, by contacting us.

12. How long we retain personal information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and to satisfy legal, accounting, tax, complaints, insurance and risk-management requirements.

Our usual retention periods are:

• unsuccessful or unconverted enquiries: up to two years after the last substantive contact;
• client matter files: ordinarily six years after the matter ends;
• invoices, payment records and accounting information: ordinarily six years after the end of the relevant accounting period;
• complaints and information relevant to disputes or legal claims: for as long as reasonably necessary in light of the applicable limitation period and circumstances;
• marketing contact information: until you unsubscribe or object, subject to retaining limited suppression information to ensure that your preference is respected;
• website and cookie information: for the period specified in our cookie information or by the relevant tool.

We may retain information for longer where reasonably necessary because of litigation, a complaint, a regulatory or legal requirement, the nature of the matter or a continuing risk of a claim.

We will securely delete, destroy or anonymise personal information when it is no longer required.

13. Security

We use appropriate technical and organisational measures to protect personal information against unauthorised access, accidental loss, destruction, alteration or disclosure.

Depending on the nature of the information, these measures may include:

• access controls and password protection;
• multi-factor authentication;
• encryption and secure storage;
• secure backup arrangements;
• restrictions on access to client information;
• confidentiality obligations;
• supplier assessment and contractual controls; and
• procedures for identifying and responding to personal-data breaches.

If a matter involves particularly sensitive documents, please contact us before sending them so that an appropriate transfer method can be agreed.

No method of electronic communication or storage can be guaranteed to be completely secure.

14. Your data-protection rights

Subject to the conditions and exemptions in data-protection law, you may have the right to:

• be informed about how we use your personal information;
• obtain access to your personal information;
• have inaccurate information corrected and incomplete information completed;
• request erasure of your personal information;
• request restriction of processing;
• receive certain information in a portable format and have it transmitted to another controller;
• withdraw consent at any time where processing is based on consent; and
• obtain safeguards in relation to qualifying automated decision-making.

These rights do not apply in every circumstance. For example, we may be entitled or required to retain information where it is needed to comply with a legal obligation or establish, exercise or defend legal claims.

To exercise a right, contact us at:

Ravenstone Law Limited, 27 Old Gloucester Street, London WC1N 3AX

We may ask for information reasonably necessary to verify your identity. We will respond within the time required by data-protection law.

Your right to object

You have the right to object at any time to our use of your personal information for direct marketing.

You may also object to processing based on legitimate interests. If you do so, we will stop the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is required for the establishment, exercise or defence of legal claims.

15. Automated decision-making

We do not make decisions about individuals based solely on automated processing where the decision produces legal or similarly significant effects.

16. Marketing communications

We may send relevant information about our services where:

• you have asked us to do so;
• you have provided valid consent;
• the communication is permitted under the existing-client or “soft opt-in” provisions; or
• the communication is directed to a corporate contact and is otherwise permitted by law.

You may opt out at any time by:

• using the unsubscribe facility in the communication;
• writing to Ravenstone Law Limited at the address above.

Withdrawing from marketing will not prevent us from sending necessary administrative or matter-related communications.

We may retain limited suppression information after you unsubscribe to ensure that we continue to respect your preference.

17. Cookies and website information

Our website may use cookies and similar technologies that are necessary for its operation and security.

We may also use non-essential cookies for analytics or other optional purposes. Where consent is required, those cookies will not be placed unless and until you provide consent.

Our cookie information should identify:

• the cookies and technologies actually used;
• the relevant providers;
• their purposes;
• how long they remain active; and
• how you can accept, reject or withdraw consent.

You can also control cookies through your browser settings. Disabling necessary cookies may affect the operation of parts of the website.

18. Data-protection complaints

You have the right to complain to us if you consider that we have infringed your rights under data-protection law or have not handled your personal information properly.

We will facilitate the making of complaints through the following methods:

Post: Privacy Complaints, Ravenstone Law Limited, 27 Old Gloucester Street, London WC1N 3AX 

Please provide sufficient information for us to understand the complaint, identify the relevant information or matter and investigate what has happened.

We will:

• acknowledge receipt of your complaint within 30 days;
• make appropriate enquiries into its subject matter;
• take appropriate steps to respond without undue delay;
• keep you informed of material progress where appropriate; and
• notify you of the outcome.

You may also complain to the Information Commissioner’s Office. You are not required to complete our complaints process before exercising your right to approach the Information Commissioner.

Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF

Website: www.ico.org.uk Telephone: 0303 123 1113

19. Changes to this privacy notice

We may update this privacy notice to reflect changes in our services, working practices, technology or legal obligations.

The current version will be published on our website. Any material changes will take effect from the effective date shown at the beginning of the updated notice.

Where appropriate, we may also notify affected individuals of a material change by email or another suitable method.