Privacy Policy

Watkins & Gunn Ltd is a company registered in England and Wales under company number 13198809. Our registered office is:

Watkins & Gunn Ltd
Glantorfaen House
Hanbury Road
Pontypool
Torfaen
NP4 6XY

For data protection purposes, Watkins & Gunn Ltd is the data controller responsible for the personal information covered by this policy.

Our Data Protection Manager is:

Clive Thomas
Telephone: 0300 1240 400
Email: [email protected]
Address: Glantorfaen House, Hanbury Road, Pontypool, Torfaen, NP4 6XY

General enquiries may also be sent to [email protected].

Personal information

Personal information means any information relating to an identified or identifiable individual. It may be held electronically or in an organised paper record.

Special category personal information

This is personal information that requires additional protection. It includes information concerning:

• health;
• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade union membership;
• genetic information;
• biometric information used to identify an individual;
• sex life; and
• sexual orientation.

Criminal offence information

This includes personal information relating to criminal convictions, alleged offences, proceedings, investigations and related security measures.

Processing

Processing includes collecting, recording, organising, storing, consulting, using, sharing, altering, retrieving and deleting personal information.

We may collect personal information when:

• you contact us by telephone, email, post, through our website or in person;
• you ask us to provide legal advice or representation;
• a person or organisation refers or introduces you to us;
• another party provides information relevant to a legal matter;
• you complete a form, questionnaire or survey;
• you register for or attend an event;
• you subscribe to a newsletter or other communication;
• you interact with us on social media;
• you make a payment;
• you visit one of our offices;
• you make a complaint or provide feedback; or
• you apply to work with us.

We may also collect information from publicly available sources and from third parties where this is lawful and relevant to our work.

We may receive personal information from:

• you;
• your family members, representatives or authorised agents;
• clients and potential clients;
• other parties to legal proceedings or transactions;
• solicitors, barristers and other legal representatives;
• courts and tribunals;
• the Legal Aid Agency;
• medical professionals and healthcare providers;
• experts and professional advisers;
• employers and trade unions;
• insurers;
• banks, lenders and financial institutions;
• estate agents, surveyors and property professionals;
• accountants and tax advisers;
• law enforcement agencies;
• government departments, regulators and public bodies;
• identity verification, anti-money laundering and fraud prevention providers;
• introducers, charities, referral partners and associated organisations;
• publicly available registers and databases; and
• other organisations involved in your matter.

Introducers and referral partners
We may receive personal information from an introducer, referral partner, employer, trade union, charity, estate agent or another organisation where:

• you have asked that organisation to refer you to us;
• you have agreed that your details may be provided to us;
• the organisation is acting on your behalf; or
• there is another appropriate lawful basis for the referral.

We may provide appropriate information to an introducer or referral partner where this is necessary to administer the referral, progress your matter or satisfy an agreed reporting arrangement. We will only do so where there is an appropriate lawful basis and subject to our duties of confidentiality and legal professional privilege.

The information we collect depends on the nature of our relationship with you and the legal services being provided. It may include:

• your name, address and contact details;
• your date of birth;
• identification documents, such as a passport or driving licence;
• proof of address;
• National Insurance, tax or other official identification numbers;
• information required for identity verification, conflict checks and anti-money laundering checks;
• your signature;
• family, relationship and household information;
• employment and professional information;
• financial information, including income, expenditure, assets, liabilities and bank details;
• payment and transaction information;
• information about property, businesses or other assets;
• communications between you and us;
• information about a legal problem, transaction, dispute, claim or proceeding;
• medical records and health information;
• information concerning children or vulnerable individuals;
• information obtained from courts, tribunals, experts and other professionals;
• information required by the Legal Aid Agency;
• information about how you use our website and electronic services;
• marketing and communication preferences;
• images captured by recorded CCTV;
• complaints, feedback and service information; and
• other information necessary for us to provide legal services or operate our business.

We aim to collect only the personal information that is adequate, relevant and reasonably necessary for the relevant purpose.

The nature of legal work means that we may need to process special category information or criminal offence information.

We will only process special category information where both a lawful basis and an appropriate additional condition apply. Depending on the circumstances, this may include processing that is necessary for:

• the establishment, exercise or defence of legal claims;
• the provision of legal advice;
• carrying out obligations and exercising rights in connection with employment or social protection law;
• protecting vital interests;
• reasons of substantial public interest; or
• another condition permitted by law

We may process criminal offence information where it is relevant to legal advice, legal proceedings, a client’s matter or our legal and regulatory obligations. We will only do so where the processing is authorised by law and appropriate safeguards are in place.

We may use personal information to:

• decide whether we can act for you;
• conduct conflict and identity checks;
• conduct anti-money laundering, fraud prevention and sanctions checks;
• provide legal advice, assistance and representation;
• communicate with you and others involved in your matter;
• manage legal proceedings, transactions and claims;
• manage our relationship with clients and potential clients;
• administer legal aid;
• receive and make payments;
• instruct barristers, experts and other service providers;
• comply with court orders and legal requirements;
• comply with our professional and regulatory obligations;
• respond to regulators, auditors and quality assessors;
• protect and enforce legal rights;
• prevent and detect crime, fraud and misuse of our services;
• maintain the security of our offices, staff, visitors, systems and information;
• manage enquiries, feedback and complaints;
• train staff and monitor the quality of our services;
• manage our business, records and professional indemnity arrangements;
• improve and develop our services and systems;
• provide legal updates, invitations and information about our services where permitted; and
• establish, exercise or defend legal claims.

We only process personal information where the law permits us to do so. The applicable lawful basis depends on the purpose and circumstances of the processing.

Contract
We process information where this is necessary:

• to take steps at your request before entering into a contract;
• to provide services under our agreement with you; or
• to meet contractual obligations connected with your matter, including obligations relating to legal aid.

Legal obligation
We process information where necessary to comply with legal, professional or regulatory obligations. These include requirements concerning:

• anti-money laundering;
• counter-terrorist financing;
• sanctions;
• fraud prevention;
• taxation and accounting;
• court and tribunal proceedings;
• professional regulation;
• data protection; and
• record retention.

Legitimate interests
We may process information where this is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and interests.

Our legitimate interests may include:

• operating and managing a legal practice;
• delivering and improving our services;
• ensuring the quality of our work;
• protecting our staff, clients, visitors, premises and systems;
• preventing fraud and other unlawful activity;
• securing our information and technology;
• maintaining business records;
• responding to audits and quality assessments;
• establishing, exercising and defending legal rights; and
• communicating with clients and potential clients about relevant services, events and developments where permitted by law.

Where appropriate, we assess and document whether our interests are necessary and balanced against the rights of the individuals affected.

Consent
We may rely on consent where this is appropriate, including for certain forms of electronic marketing.

Where we rely on consent, you may withdraw it at any time. Withdrawal will not affect the lawfulness of processing undertaken before consent was withdrawn.

Vital interests and public interest
In limited circumstances, we may process information to protect someone’s vital interests or where processing is necessary for a task carried out in the public interest or under an official authority.

Where we need personal information to provide legal services or comply with a legal requirement, a failure to provide it may prevent us from:

• accepting your instructions;
• continuing to act;
• progressing your matter;
• completing required checks; or
• complying with our legal and regulatory obligations.

We will explain where information is required and the possible consequences of not providing it.

We may share relevant information with trusted third parties where necessary and lawful, including:

• barristers;
• other solicitors and legal representatives;
• courts and tribunals;
• the Legal Aid Agency;
• medical professionals;
• experts and professional advisers;
• costs lawyers and costs draftspersons;
• translators and interpreters;
• process servers;
• tracing and investigation providers;
• search, identity verification, credit reference and fraud prevention providers;
• anti-money laundering and sanctions screening providers;
• insurers;
• lenders and financial institutions;
• estate agents, surveyors and other property professionals;
• accountants and tax advisers;
• regulators and professional bodies;
• auditors and quality assessors;
• government departments and public authorities;
• law enforcement agencies;
• IT, communications and cybersecurity providers;
• cloud, document management and case management providers;
• secure storage, archiving and destruction providers;
• payment service providers; and
• other people or organisations necessary for the provision of legal services or operation of our practice.

Where a supplier processes personal information on our behalf, we require it to:

• process the information only for authorised purposes;
• maintain appropriate security;
• comply with applicable data protection obligations;
• assist us in protecting individuals’ rights; and
• delete or return information when appropriate.

We may also disclose information:

• where required or permitted by law;
• under a court order;
• in connection with legal proceedings;
• to prevent or investigate crime or fraud;
• to protect someone’s safety;
• as part of a business reorganisation, merger or transfer; or
• where you have authorised us to do so.

Our ability to disclose information may be restricted by duties of confidentiality and legal professional privilege.

Our information and physical servers are ordinarily hosted within the United Kingdom. Some approved technology, cloud or professional service providers may, however, process information outside the United Kingdom.

Where personal information is transferred outside the United Kingdom, we will ensure that the transfer is lawful. Depending on the destination and circumstances, this may involve:

• a UK adequacy regulation;
• the UK International Data Transfer Agreement;
• the UK Addendum to the EU Standard Contractual Clauses;
• another legally recognised safeguard; or
• an applicable exception provided by data protection law.

We will also take appropriate steps to assess and protect the information transferred.

Information security 

We take the security and confidentiality of personal information seriously. Legal files may contain sensitive information and may be protected by duties of confidentiality and legal professional privilege.

Our safeguards include, where appropriate:

• access controls;
• password protection and multi-factor authentication;
• encryption;
• secure case and document management systems;
• email and network security;
• cybersecurity monitoring;
• vulnerability assessment and penetration testing;
• data protection and information security policies;
• staff training;
• supplier due diligence;
• secure storage and destruction arrangements;
• incident response procedures; and
• regular compliance and quality reviews.

Access to personal information is restricted to people who need it for authorised purposes.

No system can be guaranteed to be completely secure. If a personal data breach occurs, we will assess and manage it in accordance with applicable law and notify affected individuals and the Information Commissioner’s Office where required.

Artificial Intelligence

We may use approved artificial intelligence tools to support legal and administrative work. This may include assistance with:

• legal research;
• document review;
• document drafting;
• summarising information;
• information extraction;
• transcription;
• administrative processes; and
• internal productivity.

Where AI involves personal information, data protection legislation applies to its use. The ICO confirms that personal information used to train, test or deploy AI systems remains within the scope of data protection law.

We will only use AI systems where:

• there is an appropriate lawful basis;
• the proposed use is consistent with our professional duties;
• appropriate security and confidentiality protections are in place;
• the use is proportionate to the purpose;
• any necessary risk assessment has been completed; and
• appropriate human review and professional oversight are maintained.

AI-generated or AI-assisted output will not be treated as a substitute for professional judgment. It will be reviewed as appropriate before being relied upon or provided to a client.

We do not ordinarily use solely automated decision-making to make decisions about clients that produce legal or similarly significant effects. If we introduce such processing, we will provide appropriate information and safeguards as required by law.

The Data (Use and Access) Act 2025 expanded the lawful bases potentially available for significant automated decision-making, except in relation to the more protected treatment of special category information. Appropriate safeguards must continue to be applied.

We use CCTV and camera systems at some of our premises for security, safety and access-control purposes.

Pontypool external cameras
External CCTV cameras at our Pontypool office record images in areas around the premises.
The purposes of this recording are:

• protecting staff, clients and visitors;
• protecting the premises and property;
• maintaining security; and
• preventing, detecting and investigating crime and security incidents.

The lawful basis relied upon is normally our legitimate interest in maintaining the safety and security of our people, premises and property.

Recordings are normally retained for one month and are then securely deleted or overwritten. Particular footage may be retained for longer where this is necessary and lawful, including where it relates to:

• a security or safety incident;
• suspected criminal activity;
• an internal or external investigation;
• a legal claim;
• a complaint;
• a request from law enforcement; or
• another legal or regulatory requirement.

Access to recorded footage is restricted to authorised individuals. Footage will only be viewed, used or disclosed where there is an appropriate reason and lawful basis.

The ICO does not prescribe a universal minimum or maximum CCTV retention period. The retention period must instead be justified by the purposes of the recording.

Pontypool internal cameras
The internal cameras at our Pontypool office do not record footage. They are used for access and security purposes only.

Newport camera
The camera at our Newport office does not record footage. It is used for access purposes only.

Although the Pontypool internal cameras and Newport access camera do not record footage, live viewing of identifiable people may still involve personal information. ICO guidance encompasses systems used for recording or viewing images for surveillance purposes.

Appropriate signs are displayed where recording takes place. Individuals may exercise their applicable data protection rights in relation to recorded footage, although these rights may be limited where disclosure would affect another person’s rights or interfere with an investigation or legal obligation.

A cookie is a small file placed on a device when a website is used. Cookies may support the operation of a website, remember preferences, provide functionality or help analyse how the website is used.

Some cookies are necessary for the website to function. Other cookies or similar technologies will only be used where permitted by law and, where required, with your consent.

You can manage your cookie preferences through our website’s cookie controls and your browser settings. Disabling some cookies may affect website functionality.

Please see our separate Cookies Policy for information about the cookies and similar technologies used on our website.

We may collect technical information when you use our website, including:

• IP address;
• browser and device type;
• operating system;
• pages visited;
• date and time of access;
• referring website;
• interaction and usage information; and
• cookie or consent preferences.

We use this information to operate, secure, understand and improve the website, subject to applicable law.

We may send information about our services, events, legal developments and other matters that may be relevant to you where we are permitted to do so.

We may rely on:

• your consent;
• the limited soft opt-in available under electronic marketing law;
• our legitimate interests where appropriate; or
• another lawful basis.

You may object to direct marketing or withdraw your consent at any time by:

• using the unsubscribe facility in an electronic communication;
• emailing [email protected]; or
• contacting our Data Protection Manager.

Stopping marketing will not prevent us from sending communications that are necessary to deal with your legal matter, administer our relationship or meet legal and regulatory obligations.

We keep personal information only for as long as reasonably necessary for the relevant purposes, including meeting legal, regulatory, tax, accounting, insurance and professional requirements and establishing or defending legal claims.

Our usual retention periods include:

Legal matters and client files
Information held in a matter file or on our case management system will usually be retained for six years after the matter ends, unless a longer period is appropriate.

A longer period may apply where:

• the client or relevant person is under 18;
• the matter concerns a trust, will, estate or property;
• the matter involves a continuing liability or obligation;
• the information is relevant to another matter;
• there is a complaint, dispute or potential legal claim;
• an insurer, regulator or authority requires longer retention; or
• another lawful reason applies.

Where the relevant person is a child, information may need to be retained until at least six years after they reach the age of 18, depending on the nature of the matter.

Anti-money laundering and fraud prevention records
Information obtained for anti-money laundering, crime or fraud prevention purposes will generally be retained for five years from the end of the relevant business relationship or completion of the relevant transaction, subject to legal requirements and permitted extensions.

Enquiries where we do not accept instructions
Information concerning enquiries where we do not take on the matter will usually be retained for 18 months, unless a different period is justified.

Complaints
A complaint file will usually be retained for six years after the complaint is concluded, together with or linked to the relevant matter file where appropriate.

Financial records
Financial and transaction records will generally be retained for seven years to satisfy tax, accounting and audit requirements.

Payment card information will ordinarily be destroyed or removed once the transaction has been processed, unless lawful and secure retention is necessary.

CCTV
Recorded footage from the external Pontypool CCTV system is normally retained for one month, unless a longer period is necessary for a specific incident, investigation, claim or lawful request.

We periodically review our retention arrangements. When information is no longer required, it will be securely deleted, destroyed or anonymised.

Depending on the circumstances, you may have the following rights:

The right to be informed
You have the right to receive clear information about how we process your personal information.

The right of access
You may request confirmation that we process your personal information and obtain a copy of that information, together with other relevant information about its use.

The right to rectification
You may ask us to correct inaccurate personal information or complete information that is incomplete.

The right to erasure
In certain circumstances, you may ask us to delete personal information.

This is not an absolute right. We may need to retain information to provide legal services, comply with legal and regulatory obligations, preserve evidence or establish, exercise or defend legal claims.

The right to restrict processing
You may ask us to restrict the use of personal information in certain circumstances.

The right to data portability
Where applicable, you may request personal information you have provided to us in a structured, commonly used and machine-readable format or ask us to transmit it to another controller.

The right to object
You may object to processing based on legitimate interests or a task carried out in the public interest. We may continue processing where we can demonstrate compelling legitimate grounds or where the processing is required for legal claims.

You have an absolute right to object to the use of your personal information for direct marketing.

Rights concerning automated decision-making
Where applicable, you may have rights and safeguards concerning solely automated decisions that have legal or similarly significant effects.

The right to withdraw consent
Where processing is based on consent, you may withdraw that consent at any time.

These rights are subject to statutory conditions and exemptions. In particular, our ability to provide information may be restricted by:

• legal professional privilege;
• duties of confidentiality owed to another person;
• court orders;
• the prevention or detection of crime;
• legal and regulatory obligations; or
• the rights and freedoms of other individuals.

We will not ordinarily charge a fee for exercising a data protection right. We may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive, where permitted by law.

We may ask for information to confirm your identity and locate the relevant records.

Requests should be sent to our Data Protection Manager using the contact details in section 2.

Our website may contain links to websites operated by other organisations.

Once you leave our website, we do not control how another organisation collects or uses your information. This Privacy Policy does not apply to those external websites.

You should review the relevant organisation’s privacy information before providing personal information to it.

If you are dissatisfied with the way we have used your personal information or handled a data protection request, you may make a data protection complaint to our Data Protection Manager:

Clive Thomas
Email: [email protected]
Telephone: 0300 1240 400
Address: Glantorfaen House, Hanbury Road, Pontypool, Torfaen, NP4 6XY

We will:

• provide a clear way for you to raise a data protection complaint;
• acknowledge receipt of the complaint within 30 days;
• take appropriate steps to investigate it without undue delay;
• keep you appropriately informed about its progress; and
• tell you the outcome without undue delay.

These requirements became legally effective on 19 June 2026 under the Data (Use and Access) Act 2025.

We will keep an appropriate record of the complaint, our investigation, our decision and any action taken.

You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Telephone: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint/

We would appreciate the opportunity to consider and resolve your concerns first, but you are not required to contact us before approaching the Information Commissioner’s Office.

Clive Thomas is responsible for this policy and will review it annually. We may update this Privacy Policy to reflect changes in:

• legislation or regulatory guidance;
• our services and working practices;
• technology;
• the organisations with which we work; or
• the ways in which we process personal information.

The current version will be published on our website. Where a change materially affects ongoing clients or the way we use their information, we will provide further information where appropriate.

We will not treat continued instructions as consent to new processing where the law requires a specific lawful basis or consent.