1. BBW Law LLP provides expert legal advice to businesses, families and individuals, from offices in Stevenage, Letchworth and Biggleswade.
  2. This privacy notice provides information about the personal information we process as a data controller, in compliance with the General Data Protection Regulation (GDPR).
  3. Our ICO registration number is Z9488116

What personal data do we process?

  1. The personal data we process include
  • Names, contact details and dates of birth;
  • Identity documents;
  • Financial information;
  • Health information;
  • Information about race, ethnic origin and sex;
  • Curricula vitae, references and appraisals;

Why do BBW Law LLP  process personal data and what is the legal basis for doing so?

  1. We process the personal data of client individuals who instruct us to provide legal advice or represent them in connection with a legal dispute. Our contract with the individual provides the legal basis for us processing this information.
  2. The Money Laundering Regulations 2017 require us to check the identity of individuals before they instruct us. We retain copies of documents used to carry out these checks in accordance with the provisions of the Regulations.
  3. We may also process the personal information of other individuals who are not our clients, since it is in our legitimate interests as a firm of solicitors to do so. In other words, we need this information in order to carry out our legal work.
  4. The processing of any special category personal information, such as health records or information concerning, race, ethnic origin, or sex, are processed lawfully since they fall within the legal claims exemption.
  5. We hold the personal data of employees pursuant to their contract of employment. Any health information is lawfully processed in order to assess working capacity.
  6. Occasionally we may hold personal data pursuant to the individual’s consent, such as data held on our client relationship management system. Where consent has been given, it may be withdrawn at any time by contacting Maria Chryssafi, who is responsible for the firm’s data protection. Her email address is set out below.

Whom do we share personal data with?

  1. We share personal data internally strictly on a need to know basis.
  2. Special category data and personnel files held electronically are encrypted with restricted access. Hard copy personal data are stored securely with restricted access.
  3. We do not share personal data with anyone external to the firm other than with IT and other support providers, pursuant to GDPR compliant contracts. Our contractors are subject to a duty of confidentiality.

How long does BBW keep personal data for?

  1. We generally keep personal data for a minimum of six years, and a maximum of fifteen years, depending on the type of case. Very occasionally it may be necessary to keep personal data for longer.

Your rights

  1. We are committed to protecting your rights to privacy. They include:
  • Right to be informed about what we do with your personal data;
  • Right to have a copy of all the personal information we process about you;
  • Right to rectification of any inaccurate data we process, and to add to the information we hold about you if it is incomplete;
  • Right to be forgotten and your personal data destroyed;
  • Right to restrict the processing of your personal data;
  • Right to object to the processing we carry out based on our legitimate interest;
  1. Personal data that are covered by legal professional privilege, and personal data that we process so as to provide legal advice or representation may fall outside these rights. In other words, we may not be able to accede to data subject requests concerning these categories of data.

Information Commissioner’s Office

  1. If you have questions, requests or concerns about the way your personal information has been processed, please contact Maria Chrysaffi at
  2. Alternatively, you may contact the Information Commissioner’s Office on 0303 123 1113.


May 2018