1. Who we are
WK Legal is operated by Mary Wambui Kimani, trading as WK Legal, of 10 Silas Court, Lockhart Road, Watford, England, WD17 4BQ. For UK data protection law, Mary Wambui Kimani, trading as WK Legal is the controller of the personal information described in this policy.
Email: wambui@wkglawadvocates.com
We provide independent legal advice ("ILA"), contract drafting and review, Companies House identity verification as an Authorised Corporate Service Provider ("ACSP"), and other expressly agreed professional services. The solicitor and applicable regulatory status will be identified in the engagement documentation.
2. Scope
This policy applies to website visitors, enquirers, prospective and current clients, people whose identity we verify, directors and persons with significant control, professional referrers, transaction participants, suppliers and other business contacts. We process personal information under the UK GDPR, Data Protection Act 2018 and other applicable law.
3. Information we collect
Depending on the service, we may collect:
- identity and contact information, including names, previous names, addresses, email, telephone, date of birth, nationality, residence, occupation and company role;
- identity-verification information, including passports, driving licences, identity cards, residence documents, proof of address, document details, photographs, video or live images, authenticity results, likeness or facial-matching results, and records of successful or failed checks;
- legal and transactional information, including contracts, guarantees, mortgages, facility and security documents, company documents, correspondence, lender requirements, advice notes, certificates and signed documents;
- financial information, including invoices, payment and transaction details and financial obligations appearing in documents provided to us;
- compliance information for conflicts, anti-money laundering, sanctions, fraud prevention, ACSP and professional requirements;
- communications, including enquiries, emails, call notes, appointments, video-meeting details, complaints and feedback; and
- technical website information, including IP address, browser/device type, pages visited, referrer, approximate location, security logs, cookie choices and analytics data.
Biometric information used uniquely to identify a person may be special-category data. We will process it only where an appropriate lawful basis and additional condition apply. Complete payment-card details are ordinarily handled by our payment provider rather than retained by us.
4. Sources
We may obtain information directly from you; through our website, booking or secure-upload systems; during calls or video meetings; from lenders, brokers, solicitors, accountants, employers or companies; from Companies House and other public registers; from identity, fraud or compliance providers; and from other lawful public sources. A referral does not itself mean that we have accepted instructions.
5. Purposes
We use information to respond to enquiries; assess and accept work; check conflicts and identity; provide legal and ACSP services; review documents; conduct appointments; advise and issue certificates; meet lender or transaction requirements; submit verification information to Companies House; comply with legal, regulatory, AML, sanctions and professional duties; prevent fraud; process payments; handle complaints; secure and administer our systems; keep business records; establish or defend claims; improve services; and send lawful marketing.
6. Lawful bases
Depending on the circumstances, we rely on:
- Contract: to take requested pre-contract steps or perform our agreement with you.
- Legal obligation: to meet duties imposed by law or applicable regulation.
- Legitimate interests: for proportionate practice administration, security, fraud prevention, referrals, records and legal claims, where your rights do not override those interests.
- Consent: where consent is appropriate or required, including certain marketing, cookie or biometric uses.
Where special-category or criminal-offence information is processed, we will identify any additional condition required by law.
7. Companies House ACSP verification
For Companies House verification, we collect and assess the evidence needed to meet the applicable identity-verification standard. Companies House currently requires ACSPs to retain the information and evidence used for verification, including relevant failed attempts, for seven years from completion of the check.
We may retain document copies and extracted data, authenticity and electronic-check results, identity or likeness evidence, submission details and the reasoning supporting our decision. We may have to provide this material to Companies House. A request for erasure cannot override a mandatory retention duty.
Where verification succeeds, we submit required information to Companies House. Companies House is responsible for its own subsequent processing under its privacy arrangements.
8. Verification and technology providers
We may use providers to authenticate documents, conduct electronic checks, compare data, perform likeness or liveness checks and conduct fraud, sanctions or compliance screening. A processor acts under contractual instructions; an independent controller applies its own privacy notice. The provider used should be identified during the relevant process.
9. Sharing
Where necessary and lawful, we may share information with Companies House; the Solicitors Regulation Authority ("SRA"); Legal Ombudsman; Information Commissioner's Office ("ICO"); Solicitors Regulation Authority; courts, law enforcement and public authorities; insurers; advisers, auditors and accountants; and our IT, cybersecurity, cloud, signature, identity, booking, video, payment and communications providers.
For a matter, authorised or otherwise lawful sharing may include the lender, lender's solicitor, conveyancer, broker, transaction solicitor or another involved professional. We do not sell personal information.
10. Confidentiality and privilege
Legal-service information is also protected by professional confidentiality, subject to lawful and regulatory exceptions. Not every communication with us attracts legal professional privilege.
11. International transfers
Some providers may process information outside the UK. Where required, we use a lawful safeguard such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved clauses or another permitted mechanism.
12. Retention
We retain information only as long as reasonably necessary for its purpose and applicable legal, regulatory, insurance and professional requirements. Our anticipated schedule is:
- ACSP verification records: seven years from completion of the check;
- legal matter files: ordinarily six years after closure, unless another period is appropriate;
- unsuccessful enquiries: ordinarily 12 months;
- complaints: ordinarily six years after closure;
- accounting and tax records: the legally required period; and
- website security logs: 12 months.
Litigation, investigation, insurance or legal-hold requirements may justify longer retention.
13. Security
Safeguards may include encrypted transmission, secure cloud services, restricted access, multi-factor authentication, secure portals, password controls, logging, malware protection and secure deletion. Use a secure upload facility for identity documents whenever one is supplied rather than ordinary email.
14. Your rights
Subject to legal limits, you may have rights to information, access, correction, erasure, restriction, objection, portability and withdrawal of consent. These rights are not absolute; for example, required ACSP records cannot be erased early.
To exercise a right, contact wambui@wkglawadvocates.com. We may need to verify your identity. You may also complain to the ICO at https://ico.org.uk/.
15. Automated decisions
We do not make solely automated decisions with legal or similarly significant effects unless lawful, disclosed and appropriately safeguarded. Verification software may assist, but Mary Wambui Kimani remains responsible for meeting the Companies House standard.
16. Marketing and cookies
We may send marketing where permitted. You may unsubscribe at any time; this does not stop necessary service or regulatory messages. See our separate Cookie Policy for website technologies.
17. Changes
We may update this policy for changes to law, regulation, services, technology or processing. The current version will be published on the website.