Privacy Notice | Irvine Yates

privacy notice

Irvine Yates Limited respects your privacy and is committed to protecting personal data. This Privacy Notice explains how we collect, use, store and share personal data in connection with our website, enquiries, client matters, business operations and business-to-business marketing.

This Privacy Notice applies to personal data relating to:

visitors to our website;
people who contact us through the website, by email, by telephone or otherwise;
prospective clients;
clients;
directors, officers, employees, shareholders and beneficial owners of clients and prospective clients;
witnesses, experts, counsel, opponents, beneficiaries, counterparties and other individuals involved in legal matters;
suppliers, referrers and professional contacts; and
business contacts who receive business-to-business marketing communications from us.

1. Information About Us

Irvine Yates Limited is a limited company registered in England and Wales under company number 10881368.

Registered office:
Irvine Yates Limited
937 Oldham Road
Rochdale
OL16 4SE

VAT number: 278 5524 64

We are authorised and regulated by the Solicitors Regulation Authority as a recognised body under SRA number 642919.

We are registered with, but not authorised by, the FCA as an exempt professional firm under FCA number LS 642919.

For data protection purposes, Irvine Yates Limited is the controller of the personal data described in this Privacy Notice.

You can contact us about data protection matters using the following details:

Email: kate@irvineyates.co.uk
Telephone: 0161 669 3222
Post: Irvine Yates Limited
937 Oldham Road
Rochdale
OL16 4SE

2. Personal data we collect

Depending on the nature of our relationship with you, we may collect and use the following categories of personal data.

name;
email address;
telephone number;
details provided in website forms;
correspondence and enquiry details;
technical data such as IP address, device information and website usage information, where collected.

name, address, email address and telephone number;
date of birth;
job title, employer and business contact details;
identification documents;
proof of address;
financial information;
source of funds and source of wealth information;
bank details;
matter instructions;
documents, correspondence and evidence relating to legal matters;
information about family members, business associates or other people connected with a matter;
information relating to claims, disputes, transactions, assets, liabilities or legal rights.

health information;
information about racial or ethnic origin;
political opinions;
religious or philosophical beliefs;
trade union membership;
sex life or sexual orientation;
biometric data, where relevant;
criminal offence data;
allegations, investigations, proceedings or convictions.

Where we undertake B2B marketing, we may process:

name;
job title;
employer or company name;
company address;
business email address;
business telephone number;
LinkedIn or professional profile information;
sector or business interest information;
marketing preferences;
opt-out and suppression records.

3. How we collect personal data

We may collect personal data:

directly from you;
through our website contact form;
by email, telephone, post or in meetings;
from clients, prospective clients or their representatives;
from other parties in legal matters;
from courts, tribunals, public authorities and regulators;
from counsel, experts, accountants, insurers and other professional advisers;
from Companies House, HM Land Registry and other public registers;
from identity verification, anti-money laundering and compliance providers;
from publicly available sources, including company websites, professional directories, LinkedIn and Companies House;
from referrals, networking and business development activity;
from reputable third-party business data providers, where used.

4. How we use personal data

We may use personal data for the following purposes:

Website and enquiries

to respond to enquiries;
to communicate with prospective clients;
to assess whether we can assist;
to manage conflicts checks;
to maintain records of enquiries.

Client matters

to provide legal services;
to take instructions and advise clients;
to open and manage client files;
to conduct identity, anti-money laundering, sanctions and conflict checks;
to correspond with clients and third parties;
to prepare documents and correspondence;
to conduct litigation, negotiations, transactions and other legal work;
to instruct counsel, experts and other professional advisers;
to comply with professional, legal and regulatory obligations;
to manage billing, accounting, credit control and payment processing;
to maintain records for regulatory, insurance and risk management purposes.

Business administration

to manage our business;
to maintain IT, security and communications systems;
to keep accounting and tax records;
to manage complaints;
to deal with insurance, audit, regulatory and professional obligations;
to protect our legal rights and interests.

to identify limited companies and corporate contacts who may have a professional interest in our services;
to send B2B marketing communications to corporate organisations and business contacts;
to manage responses to marketing;
to maintain marketing suppression lists;
to ensure that we do not contact people who have objected or opted out.

5. Lawful bases for processing

We must have a lawful basis for processing personal data. Depending on the circumstances, we may rely on one or more of the following lawful bases.

Purpose	Personal data used	Lawful basis
Responding to enquiries	Name, contact details, enquiry information	Legitimate interests
Opening and managing client matters	Contact details, instructions, matter documents	Contract and legitimate interests
Providing legal services	Client and matter data	Contract, legitimate interests and/or legal obligation
Conflict checks	Names, matter details, related party information	Legitimate interests and legal obligation
Anti-money laundering, identity, sanctions and compliance checks	ID documents, date of birth, address, ownership and financial information	Legal obligation and legitimate interests
Legal claims, disputes and transactions	Matter documents, correspondence, evidence and relevant personal data	Legitimate interests, legal obligation and establishment, exercise or defence of legal claims
Processing special category data where required for legal work	Health, equality, family, employment, financial or other sensitive data	Establishment, exercise or defence of legal claims; legal services; substantial public interest conditions where applicable
Processing criminal offence data where required for legal work	Allegations, proceedings, convictions or related information	Legal claims, legal services, regulatory obligations and authorised processing under applicable law
Billing, accounting and payment	Contact details, payment details, billing records	Contract, legal obligation and legitimate interests
Complaints handling	Contact details, file records, correspondence	Legal obligation and legitimate interests
B2B marketing to limited companies and corporate contacts	Business contact details and marketing preferences	Legitimate interests
Maintaining marketing suppression lists	Name, email, company and opt-out details	Legitimate interests and compliance with legal obligations
Website security and administration	Technical data and usage data	Legitimate interests

6. Business-to-business direct marketing

We may send business-to-business marketing communications to limited companies and other corporate organisations where we consider that the organisation or relevant business contact may have a professional interest in our legal services.

We rely on our legitimate interests in promoting our services to corporate organisations and business contacts. We will not knowingly send unsolicited electronic marketing to sole traders, individual partners or other individual subscribers unless permitted by law.

Where we send marketing emails to corporate subscribers, we will comply with the Privacy and Electronic Communications Regulations 2003. Our marketing emails will identify us as the sender and will include a clear way to opt out of future marketing.

You may object to direct marketing at any time by emailing kate@irvineyates.co.uk.

If you object to marketing, we will stop using your personal data for that purpose. We may retain limited details on a suppression list to ensure that we do not contact you again for marketing.

7. Who we share personal data with

We may share personal data where necessary and lawful, including with:

clients and their authorised representatives;
courts, tribunals and dispute resolution bodies;
opposing parties and their representatives;
counsel, experts, costs draftsmen, process servers and other professional advisers;
accountants, auditors and tax advisers;
banks and payment providers;
identity verification, anti-money laundering and compliance providers;
insurers and insurance brokers;
the Solicitors Regulation Authority;
the Legal Ombudsman;
HM Revenue & Customs;
Companies House, HM Land Registry and other public bodies or registries;
IT, email, hosting, case management, document management and cloud service providers;
marketing, CRM or email platform providers;
archive, storage and confidential waste providers;
law enforcement agencies, regulators and public authorities where required or permitted by law.

We do not sell personal data.

Where we use third-party service providers to process personal data on our behalf, we require them to protect personal data appropriately and to process it only in accordance with our instructions.

8. Legal professional privilege and confidentiality

As a regulated law firm, we owe duties of confidentiality to our clients. Some information we process may also be protected by legal professional privilege.

We will only disclose client information where authorised, required or permitted by law, regulation, professional obligations, court order, client instruction, or where otherwise necessary for the provision of legal services.

Data protection rights may be subject to limitations where legal professional privilege, confidentiality, legal proceedings, regulatory obligations or other legal exemptions apply.

9. International transfers

Your personal data will usually be stored in the United Kingdom.

Where we use service providers or systems that involve the transfer of personal data outside the United Kingdom, we will ensure that appropriate safeguards are in place, such as adequacy regulations, standard contractual clauses, or other lawful transfer mechanisms.

10. How long we keep personal data

We will keep personal data only for as long as necessary for the purposes for which it was collected and to comply with legal, regulatory, professional, insurance, accounting and reporting obligations.

Indicative retention periods include:

Type of data	Retention period or criteria
Website enquiry data	For as long as necessary to respond to the enquiry and manage any resulting relationship, and then for a reasonable period for record-keeping and risk management
Prospective client data where no matter is opened	For a reasonable period to record the enquiry, conflicts position and any advice or information provided
Client matter files	In accordance with our file retention policy, regulatory obligations, insurance requirements and the nature of the matter
Anti-money laundering and identity verification records	Usually for at least five years after the end of the business relationship or completion of the relevant transaction, unless a longer period is required or permitted
Billing and accounting records	Usually for at least six years for tax, accounting and regulatory purposes
Complaints records	For as long as necessary to manage the complaint and meet regulatory, professional indemnity and risk management requirements
B2B marketing data	For as long as we have a legitimate business need to retain it for marketing, unless you object or opt out earlier
Suppression and opt-out records	For as long as necessary to ensure that your objection or opt-out is respected

The precise retention period may vary depending on the nature of the matter and any legal, regulatory, professional indemnity or limitation considerations.

11. Your rights

Subject to certain limitations, you have the following rights under data protection law:

the right to be informed about how your personal data is used;
the right of access to your personal data;
the right to rectification of inaccurate or incomplete data;
the right to erasure;
the right to restrict processing;
the right to object to processing;
the right to data portability, where applicable;
rights relating to automated decision-making and profiling;
the right to withdraw consent where processing is based on consent.

You also have an absolute right to object to the use of your personal data for direct marketing. If you object, we will stop using your personal data for that purpose.

Some rights may be limited where legal professional privilege, confidentiality, legal proceedings, regulatory obligations, crime prevention, legal claims, or other exemptions apply.

To exercise your rights, please contact us using the details in section 1.

12. Subject access requests

You have the right to request a copy of personal data that we hold about you. This is known as a subject access request.

Requests should be sent to:
Email: kate@irvineyates.co.uk
Post: Irvine Yates Limited
937 Oldham Road
Rochdale
OL16 4SE

We will usually respond within one month. In some cases, where a request is complex or where multiple requests have been made, we may extend the response period by up to a further two months. If an extension is required, we will inform you.

We may ask for information to verify your identity before responding.

There is normally no fee for making a subject access request. However, we may charge a reasonable fee or refuse to respond where a request is manifestly unfounded or excessive.

13. Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

Access to personal data is limited to those who need it for legitimate business, legal or regulatory purposes.

13. Complaints

If you have concerns about how we use your personal data, please contact us first so that we can consider and respond to your concerns.

You also have the right to complain to the Information Commissioner’s Office.
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: https://ico.org.uk
Telephone: 0303 123 1113

13. Changes to this Privacy Notice

We may update this Privacy Notice from time to time. Any changes will be posted on our website.

This Privacy Notice was last updated on 25 June 2026