Privacy Policy

Last updated: 14 August 2026

1. Who We Are

Harold & McCormack Law (“we”, “us”, “our”) is a regulatory defence law firm. We are the data controller of the personal data described in this policy, meaning we determine how and why it is processed.

Company registration number: 15573784

SRA number: 8007840

Contact details: office@haroldandmccormacklaw.com

Telephone: 0203 745 2456

Address: 167-169 Great Portland Street, 5th Floor, London W1W 5PF.

2. Scope of This Policy

This policy explains how we collect, use, share and protect personal data when you:

• visit or use www.haroldandmccormacklaw.com;
• submit an enquiry through our contact or callback forms;
• subscribe to our newsletter or insight updates; or
• are otherwise connected to a matter we handle, including as a represented individual, witness,or third party referenced within a matter for an organisation we act for.

 

Where we act for you or your organisation under a formal instruction, this policy sits alongside and does not replace the data handling terms in your engagement letter or terms of business.

3. Information We Collect

We may collect and process the following categories of personal data:

• Identity and contact data: name, job title, organisation, email address, telephone number, postal address.
• Enquiry and matter data: the content of any message, form submission or correspondence you send us and information provided in the course of a matter.
• Technical data: IP address, browser, device information and pages visited, collected via cookies and similar technologies (see Section 9).
• Marketing preferences: whether you have opted in or out of our newsletter or updates.
• Special category data: in the course of your contact with us, we may process information about criminal offences, allegations or other special category data where this is necessary (see Section 5).

4. How We Use Your Information and Our Lawful Basis

We only process personal data where we have a lawful basis to do so under UK GDPR. The main purposes are as follows:

Responding to your enquiry: legitimate interests (responding to enquiries about our services) or, where you are asking us to take steps before entering a contract, contractual necessity.

Acting on your instructions: performance of a contract with you and compliance with our legal and regulatory obligations as a firm of solicitors.

Sending newsletters and insight content: consent, which you may withdraw at any time (see Section 7). Where you are an existing client or have made a similar enquiry, we may rely on the “soft opt-in” under PECR, with an unsubscribe option on every communication.

Website analytics and improvement: consent (for non-essential cookies) or legitimate interests (for strictly necessary functionality).

Complying with our legal and professional obligations: including anti-money laundering checks, SRA regulatory requirements and accounting requirements.

5. Special Category and Criminal Offence Data

Given our practice areas, we may process special category data as part of a matter. Where we do, we rely on one or more of the following conditions under Article 9 UK GDPR and Schedule 1 of the Data Protection Act 2018:

• processing is necessary for the establishment, exercise or defence of legal claims;
• processing is necessary for reasons of substantial public interest, including the prevention or detection of unlawful acts, or regulatory requirements relating to unlawful acts or dishonesty; or
• you have given your explicit consent for a specific purpose.

Where we process criminal offence data, we do so under the conditions in Schedule 1 of Data Protection Act 2018, principally in connection with legal proceedings, legal advice or the establishment, exercise or defence of legal rights.

6. How We Share Your Information

We do not sell or rent your personal data. We share personal data only where necessary, with the following categories of recipient. Each third-party processor is bound by a data processing agreement requiring data protection:

• Practice management: Clio Legal Software (matter management, billing and case records).
• Productivity and email: Microsoft 365 (email, document storage and collaboration tools).
• Email marketing: Mailchimp (newsletter and insight distribution) only for those who have subscribed.
• Website hosting, maintenance and development including analytic tools, used to understand website usage.
• Matter progression: where necessary to comply with a legal obligation.
• Professional advisers: our own insurers, auditors and professional indemnity insurers, where relevant to a claim or renewal.
• Professional Compliance: where necessary and to comply with a legal obligation.

 7. International Transfers

Some of the providers listed in Section 6 may store or process data outside the UK in the ordinary course of providing their services to us (such as Clio Legal Software, Mailchimp and Microsoft). Where this happens, we ensure the transfer is protected by an appropriate safeguard recognised under UK GDPR which will be one of the following:

• a UK adequacy regulation confirming the destination country provides an adequate level of protection; or
• standard contractual clauses (SCCs), the UK International Data Transfer Agreement, or the UK Addendum to the EU SCCs; or
• another lawful transfer mechanism recognised under UK GDPR.

 

We review the safeguards relied on by our key suppliers periodically, including as part of onboarding any new supplier that processes personal data on our behalf. Details of the specific safeguard relied on for a particular transfer are available on request.

8. Data Retention

We retain personal data only for as long as necessary for the purposes it was collected, including to satisfy legal, accounting, insurance or regulatory requirements. As a guide:

• Client and matter files: 6 years from matter closure.
• General website enquiries that do not proceed to instruction: 12 months.
• Newsletter subscriber data: until you unsubscribe, plus a short period to record that withdrawal.

Retention periods vary by matter type. For example, matters involving minors may need to be held longer than standard retention periods. We review retained data periodically and securely delete or anonymise it once it is no longer required.

9. Cookies and Similar Technologies

Our website uses cookies and similar technologies for the following purposes:

• Strictly necessary: required for the website to function correctly. These are used without consent, as they are essential to the site’s operation.
• Analytics and performance: help us understand how visitors use the site, so we can improve it. Used only with your consent.
• Advertising and targeting: used only with your consent to measure the effectiveness of marketing campaigns and, where applicable.

 

We use a consent management tool to collect and record your cookie preferences by category. You can give, withdraw, or amend your consent at any time via the cookie preference settings available on our website, typically accessible through a link in the website footer or the cookie banner itself.

For a full list of the specific cookies we use, the third parties that set them, and how long they are retained, see our Cookie Policy.

10. Security

We maintain appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse, including access controls, encryption where appropriate, and staff training.

Harold & McCormack Law holds Cyber Essentials certification, a UK government-backed standard confirming we have the key technical controls in place to protect against common cyber threats.

Access to personal data is restricted to staff who need it to carry out their role.

11. Your Rights

Under UK GDPR, you have the right to:

• be informed about how your data is used (as set out in this policy);
• access the personal data we hold about you;
• have inaccurate data corrected, or incomplete data completed;
• have your data erased in certain circumstances;
• restrict or object to processing in certain circumstances;
• receive your data in a portable format, where processing is based on consent or contract and carried out by automated means;
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
• object to direct marketing at any time.

 

Some of these rights do not apply, or are limited, where personal data is processed in connection with active legal proceedings or is subject to legal professional privilege. We will explain this if it applies to your request.

12. Making a Request

To exercise any of the rights above, or to make a subject access request, contact us at office@haroldandmccormacklaw.com or 0203 745 2456.

• We do not charge a fee for a standard subject access request.
• We will respond within one calendar month of receiving your request and verifying your identity. This may be extended by a further two months for complex or numerous requests, and we will explain why if so.
• We may ask you to verify your identity before actioning a request.

13. Complaints

If you have concerns about how we handle your personal data, please contact us in the first instance so we can try to resolve the issue directly.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection:

• Website: ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

14. Changes to This Policy

We may update this policy from time to time, including to reflect changes in our practices or legal requirements. The “last updated” date at the top of this policy shows when it was last revised.