Last updated: 5th August 2026
This Privacy Notice explains how SR Consulting Services Limited, trading as SR Legal Services ("SR Legal Services", "we", "us", "our"), collects, uses, shares, and protects personal data in connection with the website srlegalservices.co.uk (the "Site") and our dealings with visitors, prospective clients, clients, and other contacts. It is written to comply with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 ("PECR").
Who we are
This website is owned and operated by SR Consulting Services Limited is a company registered in England and Wales under company number 11276408 with its registered office at SR Consulting Services Limited, 124 City Road, London, EC1V 2NX, trading as "SR Legal Services". We are the data controller for the personal data described in this Privacy Notice.
Data protection contact: privacy@srlegalservices.co.uk. Our ICO registration number is ZC209428.
Note: SR Consulting Services Limited is a data protection and AI governance consultancy. We are not a firm of solicitors and are not regulated by the Solicitors Regulation Authority. See our Website Terms of Use for our full regulatory status statement.
The Personal Data We Collect, How We Collect It, Why We Use It and Our Lawful Bases for Processing
SR Consulting Services Ltd is the Data Controller for the personal data we collect about you.
Depending on the services we provide and how you interact with us, we may collect, use, store and process the following categories of personal data:
Identity and Contact Information
This may include your name, postal address, email address, telephone number, date of birth, job title, employer, professional qualifications, employment history and any other information you choose to provide that is relevant to the services we deliver.
Financial Information
This may include bank account details, payment information, billing addresses and other financial information required to process payments, issue invoices, prevent fraud or comply with our legal and regulatory obligations.
Business Information
This includes information relating to your organisation, business activities or professional relationship with us, including information provided during enquiries, contracts, projects or ongoing client engagements.
Information Relating to Our Services
Where we provide legal, privacy, governance or compliance services, we may process personal data that is necessary to advise you, deliver our services, fulfil our contractual obligations or respond to your instructions.
Technical Information
When you visit our website, we may automatically collect technical information including your Internet Protocol (IP) address, browser type and version, operating system, device information, time zone settings and other diagnostic data. We may also collect information through cookies and similar technologies. You can manage your cookie preferences through our Cookie Settings.
Website Usage Information
We collect information about how you use our website, such as the pages you visit, links you click, search terms, time spent on pages, downloads, navigation paths and other analytics data. This helps us improve the performance, security and usability of our website.
Marketing and Communications Information
This includes your preferences for receiving marketing communications from us, your communication preferences and records of correspondence where you contact us or subscribe to our updates.
We only process your personal data where we have a lawful basis to do so under the UK General Data Protection Regulation (UK GDPR). Depending on the circumstances, this may include:
- Performing a contract with you or taking steps before entering into a contract.
- Complying with a legal or regulatory obligation.
- Pursuing our legitimate business interests where these are not overridden by your rights and freedoms.
- Your consent, where required by law (for example, for certain marketing communications or non-essential cookies).
- Establishing, exercising or defending legal claims where applicable.
How We Collect Your Personal Data
We collect personal data in a variety of ways, depending on how you interact with us and the services we provide. This may include when:
- You contact us to enquire about our services or engage us to provide privacy, governance, compliance, legal advisory or consultancy services.
- You, or the organisation you represent, enter into a contract with us or request a proposal, quotation or other information about our services.
- You provide information directly to us by email, telephone, video call, through our website, via social media, by post or during meetings and consultations.
- You complete a contact form, subscribe to our newsletters, download resources, register for webinars, training sessions or events, or otherwise interact with our website or online platforms.
- We receive your personal data from your employer or another organisation that has instructed us to provide services on its behalf.
- We receive your personal data from third parties where it is necessary to provide our services. For example, where your personal data forms part of a privacy assessment, regulatory matter, audit, investigation, contract review, data subject rights request or other consultancy engagement.
- You apply for employment or consultancy opportunities with us or express an interest in working with SR Consulting Services Ltd.
- You, or your organisation, provide goods or services to us, including where you are one of our suppliers, contractors or professional advisers.
- We obtain information from publicly available sources, professional networking sites, Companies House, regulatory bodies, government agencies or other reputable third-party sources were permitted by law and necessary for our legitimate business activities.
- We collect certain technical information automatically when you visit our website through cookies, analytics tools and similar technologies. Further information about our use of cookies can be found in our Cookie Policy.
If You Do Not Provide Personal Data
In some circumstances, we are required by law or under the terms of our contract with you to collect certain personal data. This information may also be necessary to respond to your enquiry, provide our services or fulfil our contractual obligations.
If you choose not to provide the personal data we request, we may be unable to provide the services you have asked for, carry out your instructions or enter into, or continue, a contract with you.
Where this applies, we will let you know at the earliest opportunity and explain the potential impact, which may include delaying or ending our engagement if we are unable to provide our services effectively or comply with our legal obligations.
How We Use Your Personal Data
We only use your personal data where the law allows us to. Depending on how you interact with SR Consulting Services Ltd, we may use your information for the following purposes.
To Provide Our Services
We use your personal data to respond to your enquiries, prepare proposals, deliver our consultancy services and manage our relationship with you throughout our engagement.
Our lawful basis: Processing is necessary to perform a contract with you or to take steps at your request before entering into a contract. Where appropriate, we also rely on our legitimate interests in managing our client relationships and delivering our services efficiently.
To Manage Payments and Accounts
We use your information to issue invoices, process payments, maintain financial records and recover outstanding payments where necessary.
Our lawful basis: Processing is necessary to perform our contract with you, comply with our legal obligations relating to tax and accounting, and pursue our legitimate interests in managing our business finances.
To Operate and Improve Our Business
We use personal data to administer our business, manage client and supplier relationships, improve our services, maintain accurate records and ensure our internal processes operate effectively.
Our lawful basis: Processing is necessary for our legitimate interests in operating, developing and improving our business.
To Keep Our Systems Secure
We process personal data to protect our website, IT systems and business from fraud, cyber threats and other security risks, and to investigate and resolve technical issues where necessary.
Our lawful basis: Processing is necessary for our legitimate interests in maintaining the security and integrity of our systems and services.
To Meet Our Legal and Regulatory Obligations
We may process your personal data where we are required to comply with applicable laws, regulatory requirements, court orders or requests from public authorities.
Our lawful basis: Processing is necessary to comply with a legal obligation.
To Protect Our Legal Rights
Where necessary, we may use personal data to establish, exercise or defend legal claims or to resolve disputes.
Our lawful basis: Processing is necessary for our legitimate interests in protecting our legal rights and business interests.
Recruitment
If you apply to work with us, we will use your personal data to assess your application, communicate with you during the recruitment process and make employment or consultancy decisions.
Our lawful basis: Processing is necessary to take steps before entering into a contract with you, comply with our legal obligations and pursue our legitimate interests in recruiting suitable candidates.
Marketing and Business Updates
If you have requested information from us, are an existing client or have agreed to receive updates, we may send you newsletters, insights, invitations to events and information about our services.
Our lawful basis: We rely on your consent where required by law, or our legitimate interests to promote our services were permitted under UK GDPR and the Privacy and Electronic Communications Regulations (PECR).
You can unsubscribe from our marketing communications at any time by clicking the unsubscribe link in our emails or by contacting us directly.
Website Analytics and Cookies
We use cookies and similar technologies to understand how visitors use our website, improve its performance and enhance your browsing experience.
Our lawful basis: We rely on your consent for non-essential cookies. Strictly necessary cookies are processed because they are required for our legitimate interests in operating a secure and functional website.
For more information, please see our Cookie Policy.
Cookies
We use cookies and similar technologies on the Site. Full details, including how to manage your preferences, are set out in our Cookie Policy and Cookie Notice.
When We Share Your Personal Data
We treat your personal data as confidential and will only share it where necessary, lawful and proportionate.
We may share your personal data with the following categories of recipients:
Our Clients
Where we process personal data as part of providing services to one of our clients, we may share relevant information with that client where this is necessary to deliver the services they have engaged us to provide.
Our Professional Advisers
We may share personal data with our legal advisers, accountants, insurers, auditors or other professional advisers where necessary to obtain professional advice, protect our legal rights or comply with our legal obligations.
Our Service Providers
We use carefully selected third-party service providers to support our business. These may include providers of:
- IT systems and cloud hosting
- Email and communication platforms
- Customer relationship management (CRM) systems
- Document management and secure file sharing
- Accounting and payment processing services
- Website hosting and analytics
- Cyber security and technical support
These providers only process personal data on our behalf and in accordance with our instructions. They are required to keep your information secure and confidential.
Regulatory Bodies and Public Authorities
We may disclose personal data where required to do so by law, regulation or court order, or where requested by law enforcement agencies, regulators or other public authorities with the appropriate legal authority.
Protecting Our Legal Rights
We may share personal data where necessary to establish, exercise or defend legal claims, protect our legal rights, prevent fraud or investigate suspected unlawful activity.
International Transfers
Where we transfer personal data outside the United Kingdom, we will ensure that appropriate safeguards are in place in accordance with the UK GDPR. These safeguards may include the use of the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or transfers to countries that have been recognised as providing an adequate level of protection.
Our Third-Party Service Providers
Where a third-party organisation processes personal data on our behalf, it acts as our Data Processor. We only appoint processors that provide sufficient guarantees that they will protect your personal data and comply with applicable data protection laws. They may only process your personal data in accordance with our written instructions and must keep it secure and confidential.
How We Store Your Personal Data and How Long We Keep It
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse, alteration or disclosure.
We will only collect and retain the personal data that is necessary for the purpose for which it was collected. Where possible, personal data is stored securely on systems located within the United Kingdom or other jurisdictions that provide an appropriate level of data protection.
How Long We Keep Your Information
We only keep your personal data for as long as it is needed to fulfil the purpose for which it was collected, including to meet our legal, regulatory, accounting or reporting obligations.
As a general guide:
- Enquiries and general correspondence are normally retained for up to three years from the date of our last communication.
- Client records and information relating to our services are normally retained for six years after our engagement with you has ended, unless a longer retention period is required by law or is necessary to establish, exercise or defend legal claims.
- Recruitment information is retained only for as long as necessary to manage the recruitment process and comply with applicable employment laws.
- Marketing preferences are retained until you unsubscribe or ask us to stop contacting you.
When your personal data is no longer required, we will securely delete, anonymise or otherwise dispose of it in accordance with our data retention procedures.
In some circumstances, we may retain your personal data for longer where this is necessary to comply with a legal or regulatory obligation, resolve disputes, enforce our legal rights, or establish, exercise or defend legal claims.
Keeping your data secure
We use appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, including access controls, encryption in transit, and staff awareness of data protection obligations.
Your Data Protection Rights
Under the UK General Data Protection Regulation (UK GDPR), you have a number of rights in relation to your personal data. These rights are not absolute and may only apply in certain circumstances.
Your Rights
You have the right to:
- Access your personal data – You can ask us for a copy of the personal data we hold about you.
- Correct inaccurate information – If you believe any personal data we hold is inaccurate or incomplete, you can ask us to correct or update it.
- Request erasure – You can ask us to delete your personal data where there is no lawful reason for us to continue processing it. This is sometimes referred to as the "right to be forgotten".
- Restrict processing – You can ask us to temporarily limit how we use your personal data in certain circumstances, for example while we investigate a request to correct your information.
- Object to processing – You have the right to object to our processing of your personal data where we rely on legitimate interests as our lawful basis. You also have the right to object to direct marketing at any time.
- Data portability – Where processing is based on your consent or a contract and is carried out by automated means, you can ask us to provide your personal data in a structured, commonly used and machine-readable format, or transfer it to another organisation where technically feasible.
- Withdraw your consent – Where we rely on your consent to process your personal data, you can withdraw that consent at any time. This will not affect the lawfulness of any processing carried out before your consent was withdrawn.
Contact Us About Your Personal Data
If you would like to exercise any of your data protection rights, or if you have any questions about how we process your personal data, please contact us using the details below:
Email: privacy@srlegalservices.co.uk
We will respond to your request as soon as possible and, in most cases, within one month of receiving it, in accordance with the UK GDPR.
Making a Complaint
If you are unhappy with how we have handled your personal data, we encourage you to contact us first so that we can try to resolve your concerns. Please contact privacy@srlegalservices.co.uk .
You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's independent regulator for data protection matters.
You can find further information or submit a complaint by visiting www.ico.org.uk or by contacting the ICO directly.
Changes to This Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our services, legal or regulatory requirements, or the way we process personal data.
Any updates will be published on this page, and the revised version will take effect from the date it is published. We encourage you to review this Privacy Notice periodically to stay informed about how we protect your personal data.
Where we make significant changes that affect how we process your personal data, and where we are required to do so by law, we will take appropriate steps to notify you.