Privacy notice for the people at law firms we talk to

This notice is for the people at law firms with whom Bracton Limited discusses its software, whether partners, members, directors, practice managers, compliance officers or sole practitioners, and for anyone who introduces a firm to us. It explains what we hold about you, where it came from, what we do with it and how to stop it. Our website has its own notice, and a law firm’s client data inside the Bracton platform follows that firm’s notice and our data processing agreement with the firm. Dated 17 October 2026.

Who we are

The controller is Bracton Limited, registered in England and Wales as Bracton Ltd under company number 17360622, whose registered office is at Arden Hall, Brooklands Road, Sale M33 3SJ. We are registered with the Information Commission under number ZC227137. We have not appointed a data protection officer. Our privacy contact deals with anything about your personal data, and you reach that contact by email at dpo@bractonlegal.co.uk, by telephone on 0161 520 2700 or by post to the registered office.

What we hold about you

We hold your name, your role and your firm, your work email address and telephone number, and your mobile number if you gave it to us. Alongside those we keep a note of where each detail came from and when, notes of our calls and meetings with you, the emails we have sent you, the stage our discussions with your firm have reached, any consent or opt out you have given for email, the result of checking your number against the telephone preference registers, and any objection, complaint or request you make. We do not seek anything about your health, beliefs or other special category data, and our team is told not to record it.

Where your details came from

Some details come from you, when you send the enquiry form on our website, call us, leave a message on our out of hours line, write to us or hand us your card. Others we gather elsewhere, and our first message to you names the source.

Your firm’s own website is one such source, and it is public. The register of firms kept by the Solicitors Regulation Authority is another public source, from which we take facts about your firm such as its name, constitution, address and SRA number, and we never send marketing email to an address whose only source is that register. Companies House, also public, gives us the names of directors and LLP members and the registered office. A referral comes from someone who knows you, and our first message tells you who referred you. An event means a conference or meeting where you gave us your card or appeared on the published programme. We do not use the Law Society’s Find a Solicitor directory, and we do not buy or scrape lists.

When your details reach us from somewhere other than you, you receive this notice within one month, or in our first message to you if that comes sooner.

Our website form and our out of hours line

When you send the enquiry form on our website, the submission passes through Netlify, the company that hosts our website, to our own server. Netlify deletes it once it has reached us, within minutes in the ordinary course and within two days at the latest. If you ask us through the website to write once before your current agreement ends, we keep your details for that note alone and do not treat you as a sales contact.

Outside 7am to 7pm on weekdays, an automated voice answers 0161 520 2700. It tells you that it is automated and that the call is transcribed, and it takes your name, your firm, a number to call you back on, the reason for your call and whether the matter is urgent. Only those five details reach our records, and we call you back on the next working day. No recording of the call is made. The transcript stays with ElevenLabs, the company that runs the line for us, and it deletes the transcript seven days after the call. If you call about a system your firm already uses with us, your message goes to our support team and not to our sales records.

Why we use your details, and on what basis

We use your details to tell you and your firm about Bracton, to arrange demonstrations and trials, to keep an accurate record of our discussions, to prepare agreements with your firm if it decides to go ahead, and to show that we respected your choices. The lawful basis is our legitimate interest in offering Bracton to law firms and keeping proper records of how we do it, under Article 6(1)(f) of the UK GDPR. We have weighed that interest against yours in a written assessment, which we send you on request. If you object to marketing, we keep a short do not market entry because the law requires us to honour your objection, and that entry rests on legal obligation under Article 6(1)(c).

How we contact you

Whether we email you depends on how your firm is constituted. Where it is a company or an LLP, we may email your work address without your prior consent, and every email offers a one click way to stop. Where you are a sole practitioner or a partner in a traditional partnership, or where the address is a personal one, we send you marketing email only with your consent or after you have asked us about our services, and you may withdraw consent at any time. Before we call a number for marketing, we check it against the Telephone Preference Service and the Corporate Telephone Preference Service, and we do not call a listed number unless you have told us you are happy to hear from us. Our calls always show our number.

Your right to object to direct marketing

You may object at any time to our using your details for direct marketing, and we stop as soon as you do. There is no test to meet and no exception. Reply to any of our emails, use the unsubscribe link, call 0161 520 2700 or email our privacy contact at dpo@bractonlegal.co.uk. We then keep only your email address or telephone number, your firm’s name and the date and manner of your objection, so that we never contact you again by mistake, even if your details reach us later from another source.

Who sees your details

Only Bracton’s own sales team sees your details. Some of our providers see them too, each acting as our processor under written terms. Our records sit on servers in London run by our hosting provider, and our email and calendars run on Microsoft 365. Netlify, Inc. holds a website enquiry in the United States until our server collects it, and ElevenLabs holds the transcript of an out of hours call in the United States for seven days. Those two transfers take place under the UK Extension to the EU-US Data Privacy Framework, which UK law treats as giving adequate protection, where the provider takes part in it, and otherwise under the International Data Transfer Addendum to the EU standard contractual clauses that each provider’s terms contain. Where any other provider reaches the data from outside the United Kingdom, the same safeguards apply. We send you a copy of the safeguard on request. We do not sell your details or share them with anyone for their own marketing, and we make no decision about you by automated means.

How long we keep your details

We keep the record while our discussions with your firm are open. If twelve months pass after our last exchange with no further contact, we reduce the record to your firm’s name and any do not market entry, unless we have recorded a reason to keep the discussion open. The same applies to an enquiry or a message on our out of hours line that comes to nothing. If your firm decides not to go ahead, we keep the full record for twelve months, so that any later conversation starts from what was said, and then reduce it to your firm’s name, the reason and any do not market entry. If you asked us to write once before your agreement ends, we delete your details 30 days after we write unless you reply. A message left by mistake, or by someone selling to us, is deleted within 30 days. If your firm becomes a customer, the record moves to our customer file and the history of the sale is kept for six years after the contract ends, the period in which a claim about it might be brought. A do not market entry has no end date, because an objection does not expire.

Your other rights

You may ask our privacy contact for a copy of what we hold about you, have it corrected or erased, restrict how we use it, or object to our using it on grounds relating to your particular situation. Where you gave us something on the strength of your consent, you may also ask for it in a portable form. We answer within one month, and where a request is complex we tell you within that month that we need up to two months more. Erasure removes your record, our notes and our emails to you, leaving only the do not market entry if you objected and any contract record we must keep for legal claims. You are not obliged to give us any details, and the only consequence of declining is that we cannot discuss Bracton with you.

Complaints

If you are unhappy with how we have handled your data, tell our privacy contact first at dpo@bractonlegal.co.uk, on 0161 520 2700 or by post to the registered office. Section 164A of the Data Protection Act 2018 gives you that right, and we acknowledge your complaint within 30 days, look into it and tell you the outcome. You may also complain to the Information Commission at ico.org.uk or on 0303 123 1113, whether or not you have come to us first.

Changes to this notice

When this notice changes, the new version carries a new date, and if the change affects you we say so in our next message to you.