Privacy Policy

1. Who We Are — Data Controller

MCW Lawyers is the data controller for personal data collected through this website and in the course of providing our services.

If you have any questions about how we handle your personal data, or wish to exercise your data rights, please contact us at the address above or email us with the subject line "Data Protection Enquiry".

2. What Personal Data We Collect

Depending on how you interact with us, we may collect the following categories of personal data:

• Identity data: full name, job title, professional credentials;
• Contact data: email address, telephone number, postal address;
• Organisation data: company name, company size, industry sector;
• Communications data: messages, emails, notes from calls or meetings;
• Technical data: IP address, browser type, operating system, pages visited, timestamps (collected automatically via server logs);
• Engagement data: details of services requested, matters handled, documents exchanged;
• Financial data: billing information, invoice records (not full payment card data).

We do not knowingly collect personal data from individuals under the age of 18. This website is directed at business professionals.

3. How We Collect Your Data

We collect personal data through the following means:

• Contact forms: when you submit an enquiry or consultation request on this website;
• Email and telephone: when you contact us directly;
• Client engagements: information you provide when engaging our services;
• Automatic collection: technical data collected automatically when you browse our website via server logs and analytics;
• Third parties: we may receive your data from referral partners, professional networks, or publicly available sources (e.g. company registers) where relevant to a potential engagement.

4. How We Use Your Personal Data

We use your personal data for the following purposes:

• To respond to your enquiries and assess whether we can assist you;
• To provide and manage our legal and cyber risk advisory services;
• To communicate with you about your matter or engagement;
• To issue invoices and manage payments;
• To comply with our legal, regulatory, and professional obligations;
• To improve our website and services through anonymised analytics;
• To send relevant updates, insights, or service information where you have consented or where we have a legitimate interest in doing so.

5. Legal Basis for Processing

We rely on the following lawful bases under the Personal Information Protection Act (PIPA) of British Columbia to process your personal data:

• Contract performance (Art. 6(1)(b)): processing necessary to perform a contract with you or to take steps at your request before entering into a contract;
• Legal obligation (Art. 6(1)(c)): processing necessary to comply with our legal and regulatory obligations (e.g. anti-money laundering, SRA requirements);
• Legitimate interests (Art. 6(1)(f)): processing necessary for our legitimate business interests, including responding to enquiries, improving our services, and maintaining client relationships — where these are not overridden by your interests or rights;
• Consent (Art. 6(1)(a)): for marketing communications and cookies, where you have given explicit consent.

Where we process special category data (e.g. data concerning legal matters), we rely on the additional condition of legal claims (Art. 9(2)(f)) or your explicit consent.

6. Disclosure and Sharing of Data

We do not sell your personal data. We may share your data with:

• Service providers: IT, cloud hosting, email, and accounting providers who process data on our behalf under strict data processing agreements;
• Professional advisors and experts: barristers, forensic specialists, or co-counsel engaged in connection with your matter, subject to confidentiality obligations;
• Regulatory bodies: where required by law, court order, or our professional regulatory obligations (e.g. SRA, ICO, FCA);
• Law enforcement: where required by applicable law or for the prevention or detection of crime.

We require all third parties to respect the security of your data and to treat it in accordance with applicable data protection law.

7. International Data Transfers

Your personal data is primarily stored and processed within the United Kingdom and the European Economic Area (EEA). Where we engage service providers outside these territories, we ensure appropriate safeguards are in place, such as:

• UK Adequacy Regulations or EU adequacy decisions;
• Standard Contractual Clauses (SCCs) approved by the ICO or European Commission;
• Other legally recognised transfer mechanisms.

You may request details of the safeguards we rely on for international transfers by contacting us at [email protected].

8. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law or professional obligations. Our standard retention periods are:

• Client matter files: 7 years from the close of the matter (in line with SRA guidance and limitation periods);
• Financial records: 7 years (HMRC requirements);
• Website enquiries not resulting in an engagement: 12 months;
• Marketing data (with consent): until consent is withdrawn or 3 years from last interaction, whichever is sooner;
• Technical/server logs: up to 12 months.

When personal data is no longer required, it is securely deleted or anonymised.

9. Your Data Protection Rights

Under the Personal Information Protection Act (PIPA) of British Columbia, you have the following rights in relation to your personal data:

• Right of access: request a copy of the personal data we hold about you (Subject Access Request);
• Right to rectification: request correction of inaccurate or incomplete data;
• Right to erasure: request deletion of your data in certain circumstances ("right to be forgotten");
• Right to restrict processing: request that we restrict how we use your data in certain circumstances;
• Right to data portability: receive your data in a structured, commonly used format where processing is based on consent or contract;
• Right to object: object to processing based on legitimate interests or for direct marketing purposes;
• Right to withdraw consent: where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at [email protected]. We will respond within one month of receiving your request. We may need to verify your identity before processing your request.

10. Cookies

This website uses cookies — small text files placed on your device — to ensure the website functions correctly and to help us understand how it is used. We use the following categories of cookies:

• Strictly necessary cookies: essential for the website to operate (e.g. session management, theme preference). These do not require consent.
• Analytics cookies: used to understand how visitors interact with our website (e.g. pages visited, time spent). We use anonymised analytics only. These require consent.

You can manage or withdraw your consent for non-essential cookies at any time via your browser settings. Disabling cookies may affect certain website functionality.

11. Security

We take the security of your personal data seriously. We maintain an information security programme certified to ISO 27001:2022 and implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction, or alteration.

These measures include encrypted data transmission (TLS/HTTPS), access controls, staff training, and regular security assessments. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

If you suspect a data breach affecting your personal data, please contact us immediately at [email protected].

12. Third-Party Links

Our website may contain links to third-party websites. This Privacy Policy applies only to our website. We are not responsible for the privacy practices or content of third-party sites, and we encourage you to read their privacy notices.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by posting the updated policy on this page with a revised "last updated" date. We encourage you to review this policy periodically.

14. Complaints

If you are dissatisfied with how we have handled your personal data, you have the right to lodge a complaint with the data protection supervisory authority:

We would, however, appreciate the opportunity to address your concerns before you approach the supervisory authority. Please contact us first at [email protected].

15. Contact Us