Data Controller

ICO Registration: ZA567603 — View on ICO register

Data Controller (Organisation): RH Law Limited

Data Controller (Individual): Rozita Hussain

For the purposes of data protection legislation, we are the data controller, and we will process your personal data in accordance with the UK General Data Protection Regulation (UK GDPR).

RH Law Ltd is registered with the Information Commissioner’s Office (ICO). Our ICO registration is ZA567603.

Key Contact Details

Address: 2a Egerton Crescent, Manchester, United Kingdom, M20 4PN

Telephone: 0330 127 1950

Email: contact@locksleylaw.co.uk

If you are dissatisfied at any time, please contact us and we will try our best to resolve your concerns. You also have the right to contact the ICO (UK supervisory authority): ico.org.uk.

Accuracy of Your Information

It is crucial that personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Changes to Our Privacy Policy

We may update this privacy policy at any time. Changes will be posted on this page. Please check back periodically for updates.

If we intend to use previously collected personal data for purposes unrelated to those originally notified, we will provide notice and, where required, seek your consent. If the change relates to your claim (for your benefit), we may process your personal data without your knowledge or consent where permitted by law.

Social Media

Our activities on external social media platforms are subject to each platform’s terms and privacy policies. Use such platforms with caution when supplying personal data.

Our site may use social sharing buttons. Use these at your discretion; platforms may track usage. We cannot be held liable for any damages from visiting shortened URLs.

Third-Party Links

Our website may include links to third-party websites, applications, and plug-ins. Clicking those links may allow third parties to collect or share data about you. We are not responsible for their privacy policies. Please review their notices when you leave our website.

What Data We Collect

Personal Data

We may collect and process personal data from:

• Website forms (name, telephone, email, enquiry details).
• Telephone enquiries (name, address, email, phone).
• Credit checks (with your consent) to obtain your credit report and verify eligibility.

Credit Check Providers (Soft Search)

• Experian
• Equifax
• TransUnion
• Valid8
• TAL Marketing

Note: Soft searches do not leave a mark on your credit file and can provide your vehicle finance agreements since 2007.

Categories of Personal Data

• Identity Data: title, names, marital status, gender, date of birth.
• Contact Data: current/previous addresses, email, phone numbers.
• Claims Related Data: information for financial mis-selling claims.
• Transaction Data: products and services engaged.
• Technical Data: IP address, login data, browser details, time zone, OS, device tech.
• Usage Data: site, product, and service usage.
• Marketing/Communications Data: your preferences.
• Additional Claims Data: information from DSARs relevant to future claims.

If you do not provide data required by law or under a contract, we may be unable to perform the contract and may need to cancel a product or service.

IP Address

We may collect device and IP information for fraud protection, system administration, and aggregate reporting. This statistical data does not identify individuals.

Special Categories (Vulnerable Customer)

If we identify you as a vulnerable customer, we may collect health data (with your consent) to tailor our service. If you are in an IVA, debt management plan, or similar, we may share this with lenders assigned to your case to meet legal/regulatory obligations.

We do not collect other special category data or information about criminal offences/convictions.

Aggregated Data

We may collect, use, and share aggregated data (e.g., demographics). If combined with personal data so you can be identified, we treat it as personal data.

Profiling Data

We may analyse your engagement within our group to improve customer experience.

How We Collect Personal Data

Direct Communications

• Appointing our services
• Requesting marketing information
• Providing feedback

Automated Technologies/Interactions

We collect technical data via cookies and similar technologies. See our Cookies Policy.

Third Parties/Public Sources

• Analytics providers (e.g., Google)
• Public sources (Electoral Register, Companies House), credit checks
• Data brokers inside the UK (including marketing referrers)

Using Your Personal Data

We only use personal data where permitted by law, typically to:

• Act with your consent.
• Perform a contract with you.
• Pursue legitimate interests (balanced against your rights).
• Comply with a legal obligation.

Purposes & Lawful Bases

Additional Requirements

We may identify further avenues to obtain information about you or your claim to maximise success without negatively impacting you.

You agree that your electronic signature may be used on Letters of Authority for your claim/enquiry.

1. You have instructed us to access your credit report on your behalf.
2. You have provided all information required to validate your identity.
3. You will inform us of any issues with using your data across multiple search companies.

Marketing, Advertising, and Promotions

We offer clear choices around marketing. We may rely on legitimate interests to recommend products/services, after assessing any impact on you. You can update preferences or opt out at any time (this does not affect service emails).

• Unsubscribe via links in communications, or
• Email contact@locksleylaw.co.uk with your name and contact details.

If you opt in to marketing, we may contact you for up to two years from consent.

Cookies

A cookie is a small data element websites store in your browser. See our Cookies Policy for details. Refusing cookies may affect site functionality.

We may use your personal data (legitimate interests) to:

• Provide requested information/services
• Enable interactive site features
• Present content effectively
• Improve our site
• Process complaints/enquiries

Sharing Your Personal Data

Examples of Recipients

Other Disclosures

We may share data with staff, affiliated entities, IT providers, professional advisers, HMRC/regulators, and in business transfers/mergers. We may disclose data to police, regulators, legal advisers, or others where legally required. We do not sell personal data.

We only share data in line with UK data protection laws and require third parties to use it lawfully and for intended purposes.

International Transfers

We do not generally transfer data outside the UK/EEA. If we do, we ensure an appropriate lawful basis (e.g., adequacy, SCCs, binding rules, consent, contract necessity, public interest, legal claims, vital interests, or public registers).

Data Security

We maintain technical and organisational measures to protect personal data against loss, unauthorised access, or misuse, limiting access to those who need it. All personal data breaches must be reported to our DPO; we will notify affected persons and regulators where required.

Data Retention

We keep personal data only as long as necessary for the purposes collected or as required by law. When no longer needed, we erase or securely dispose of it. For future claims activities, data from DSARs may be retained until no longer required.

Monitoring and Recording

We may monitor/record communications (calls, emails) for quality, training, fraud prevention, and compliance. For regulated claims activities, we keep personal data (including online enquiries, calls, emails) for at least 12 months after last contact. CCTV may be used on premises for crime prevention and health & safety.

Your Data Protection Rights

• Right of Access (DSAR)
• Right to be Informed
• Right to Rectification
• Right to Erasure (to be forgotten)
• Right to Restrict Processing
• Right to Object (incl. marketing)
• Right to Data Portability
• Right to Withdraw Consent

To exercise these rights, see Key Contact Details.

Information Security & Communications

We operate a “no-spam” policy. We may send service/administrative emails necessary to provide our services (you cannot opt out of these). We take appropriate security measures and restrict access to personal information to those who need it and are bound by confidentiality.

If we are involved in a merger, acquisition, or asset sale, we will provide notice before personal information is transferred and becomes subject to a different privacy policy.

For complaints submitted via our contact page, we will respond and, where necessary, cooperate with relevant authorities to resolve issues.

Data Subject Access Requests (DSAR)

What You’re Entitled To

• Confirmation we are processing your personal data
• A copy of your personal data
• Supplementary information

Requests may be made by a third party on your behalf (e.g., a solicitor) with appropriate authority.

Format & Timing

Electronic requests are provided in a commonly used electronic format unless you request otherwise. We will respond without undue delay and within one month (extensions apply for complex/multiple requests). We may request reasonable ID verification.

Fees

No fee for most requests. A reasonable fee may apply for manifestly unfounded/excessive requests or additional copies.

Contact Us

For questions about this policy or your personal data, contact our Data Protection Officer at contact@locksleylaw.co.uk.

You can also contact the ICO: https://ico.org.uk/global/contact-us