Privacy Policy & Data Protection Notice

1. Who We Are & Data Controller Details

Sky Solicitors Ltd (“we”, “us”, “our”) is a private limited company registered in England and Wales under Company No. 07845593, with its Registered Office at 169 High Road, Ilford, Essex, IG1 1DG, and is authorised and regulated by the Solicitors Regulation Authority (SRA ID: 566084).

For the purposes of the UK GDPR and the Data Protection Act 2018, Sky Solicitors Ltd is the Data Controller responsible for your personal data. Our Data Protection Compliance Principal is Mr Salman Randhawa.

2. Personal Data & Special Category Data We Collect

Depending on the nature of your interaction with our law firm, we may collect and process:

• Identity & Contact Details: Full legal name, date of birth, postal address, email address, telephone numbers, and government-issued identification (passport, eVisa details, driving licence) required for Client Due Diligence.
• Matter-Specific Information: Immigration history, Home Office reference numbers, employment details, corporate and financial records, property title details, family details, and litigation documentation.
• Special Category & Criminal Offence Data: Where strictly necessary for the establishment, exercise, or defence of legal claims (such as asylum, human rights, medical evidence in family/immigration matters, or criminal disclosures), we may process Special Category Data under Article 9(2)(f) of the UK GDPR and Schedule 1 of the Data Protection Act 2018.
• Financial & AML Data: Bank statements, source of funds documentation, and billing records required under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.
• Website Enquiry & Technical Data: Details submitted via our Consultation, Contact, Fee Calculator, or Newsletter forms, together with essential technical logs and cookie consent preferences.

3. Lawful Basis for Processing (UK GDPR Articles 6 & 9)

We process your personal information only when we have a valid lawful basis under Article 6 (and, where applicable, Article 9) of the UK GDPR:

• Performance of a Contract (Art. 6(1)(b)): Taking steps at your request prior to entering into a retainer (such as responding to consultation requests) and performing our legal engagement with you.
• Legal & Regulatory Obligation (Art. 6(1)(c)): Complying with statutory and regulatory obligations imposed by the Solicitors Regulation Authority, HMRC, Companies House, and UK Anti-Money Laundering legislation.
• Legitimate Interests (Art. 6(1)(f)): Managing firm operations, conflict checking, maintaining professional indemnity insurance, and defending legal claims.
• Legal Claims (Art. 9(2)(f)): Processing Special Category Data where necessary for the establishment, exercise, or defence of legal claims or whenever courts/tribunals are acting in their judicial capacity.
• Consent (Art. 6(1)(a)): Sending legal briefings or newsletters where you have explicitly opted in (which you may withdraw at any time).

4. Recipients of Your Personal Data & International Transfers

Subject to strict duties of solicitor-client confidentiality and legal professional privilege, we may share personal data only where necessary to progress your matter or comply with law, including with:

• Courts, HM Courts & Tribunals Service (HMCTS), the Home Office (UKVI), HM Land Registry, Companies House, and HMRC;
• Barristers (Counsel), medical or forensic experts, translators, and agents instructed on your behalf;
• Our regulator (the SRA), external auditors, and our Qualifying Professional Indemnity Insurers;
• Secure UK/EEA-compliant IT, case management, and electronic ID verification providers bound by written Data Processing Agreements.

We do not routinely transfer personal data outside the United Kingdom. Where an international transfer is necessary for your legal matter (for example, corresponding with overseas authorities or sponsors), we rely on UK Adequacy Regulations, the UK International Data Transfer Agreement (IDTA), or explicit derogations for the establishment, exercise, or defence of legal claims under Article 49(1)(e) of the UK GDPR.

5. Data Retention & Security

We implement strict technical and organisational safeguards including access controls, encrypted storage, and segregated physical archives. In accordance with Law Society guidelines, SRA regulatory requirements, and the Limitation Act 1980, closed client matter files are normally retained for 6 years (or up to 15 years for conveyancing, wills, and probate matters) following file closure, after which they are securely destroyed. Website enquiry records that do not proceed to a formal retainer are retained for no longer than 12 months.

6. Your Statutory Rights & Complaining to the ICO

Under the UK GDPR, you have the right to: (a) request access to your personal data (Subject Access Request); (b) request rectification of inaccurate data; (c) request erasure (subject to statutory/regulatory retention rules); (d) request restriction of processing; (e) request data portability; and (f) object to processing based on legitimate interests or withdraw consent at any time.