How we look after your personal information - in plain language.
Keith Legal Limited ("Keith", "we", "us") is a conveyancing practice regulated by the Council for Licensed Conveyancers. We are registered with the UK Information Commissioner's Office (ICO) as a data controller.
Your privacy matters to us. This policy explains what personal information we collect, why we need it, what we do with it and what rights you have.
Our Data Protection Officer is Sam Tucker, who can be contacted at sam@keith.com.
When you instruct us, we collect the information we need to carry out your conveyancing transaction and meet our legal obligations. This typically includes:
Some of this information is required by law (for example, identity documents for anti-money laundering checks). Other information is necessary for us to perform our contract with you. If you do not provide the information we need, we may not be able to act for you or complete your transaction.
In the course of your transaction we may also receive personal information about you from third parties, including: the solicitor or conveyancer acting for the other party; your mortgage lender or broker; your estate agent; HM Land Registry; property search providers; credit reference and identity verification agencies; and other professionals involved in the transaction. Where we receive your information from a third party, we process it for the same purposes and on the same lawful bases described in this policy.
Some information needs extra protection under data protection law - for example health information and biometric data (such as facial images captured during electronic identity verification). We only process this kind of information where it is necessary for your matter, and we keep it to the minimum necessary.
During onboarding, some of this data may be processed by our AI systems as a first step before a qualified member of our team reviews it. No decision affecting you is made by AI.
Data protection law requires us to have a lawful reason for processing your personal information. The bases we rely on are:
Where we process sensitive personal information (such as health or biometric data), we rely on the substantial public interest conditions for preventing unlawful acts and safeguarding individuals at risk (Article 9(2)(g) UK GDPR, with Schedule 1, Part 2, Data Protection Act 2018), or your consent where you have volunteered the information. We do not rely solely on consent for sensitive data connected to your matter, because records held for legal or regulatory reasons (such as identity verification under anti-money laundering law) cannot always be deleted when consent is withdrawn.
We use AI-assisted tools to help our licensed conveyancers work efficiently and accurately - assisting with document analysis, risk identification, anti-money laundering screening, transaction management and quality checking of correspondence.
Human oversight. No legally significant decision about your matter is ever made solely by an AI system. AI outputs are always reviewed and approved by a licensed conveyancer before any action is taken. The AI assists; it does not replace human judgement.
Your rights around AI. Because all legally significant AI outputs on your matter are reviewed and approved by a licensed conveyancer, our use of AI involves meaningful human involvement and does not constitute solely automated decision-making under Article 22 UK GDPR. You may nevertheless request a human review of any AI-assisted output on your matter at any time by contacting our Data Protection Officer, and if you would like to object to our use of AI on your matter, please get in touch.
AI vendors and your data. Our AI platform providers act as data processors under written agreements. They process your data only on our instructions, maintain appropriate security measures and are contractually prohibited from using your personal data to train their own AI models. Wherever possible, data is processed within the United Kingdom. Onfido (part of the Entrust group), our electronic identity verification provider, processes identity and biometric data within the UK and EEA. Where any provider processes data outside the UK, appropriate transfer safeguards are in place.
We use product analytics tools to understand how our website and case management system are used, to identify issues and to improve our service. Our analytics platform provider, PostHog, acts as a data processor under a written data processing agreement and hosts data within the European Union. Analytics data is collected under our legitimate interests and is limited to usage and interaction data - it does not involve automated decision-making about you. We minimise the personal data captured, including anonymising IP addresses and excluding sensitive content.
On our public website, analytics run without cookies or any other storage on your device. To tell one visit from another on the same day, a one-way hash is made of your IP address, browser type and a value that changes daily, so that it cannot be reversed and does not identify you or follow you across days. You have the right to object to analytics processing: email sam@keith.com and we will stop.
| Type of information | How long we keep it |
|---|---|
| General personal data | 7 years after your matter ends (15 years for purchase files) |
| Client due diligence (ID, bank statements, AML records) | 7 years after your matter ends (15 years for purchase files) |
| Sensitive personal data | 7 years after your matter ends |
| Call recordings | 1 year |
| AI processing logs and sign-off records | Same as the underlying matter file (minimum 7 years) |
| Product analytics and usage data | Maximum 2 years |
We only share your information where it is necessary or required. This may include regulatory authorities; credit reference agencies; property search companies; insurers; other parties to your transaction (estate agents, brokers, lenders, the other side's solicitors); government departments (HMRC, Companies House, Probate Registry, HM Land Registry); experts and barristers; our auditors and assessment bodies; and our AI, technology and analytics providers acting as data processors under written agreements.
Your data is held within a secure, matter-level environment that is isolated from all other client files. Our systems - including our AI systems - are designed so that your information cannot be accessed from, or shared with, any other client's matter. All data stored on our systems is encrypted at rest, and all data transmitted between our systems is encrypted in transit.
Some of these rights are not absolute - for example, we may need to keep information to comply with anti-money laundering obligations even if you ask us to delete it.
Our website does not set any cookies, and does not store anything on your device. The website analytics described above run in cookieless mode: we count visits and page views without placing a cookie or using local storage, and without building a profile of you across visits. What the Keith app stores once you are a client, and the analytics choice it gives you, is set out on our cookies page.
We review this policy regularly and update it as our practices, technology or the law change. Updates are posted on this page and we will tell you directly about any material changes.
If you are unhappy with how we have handled your personal information, contact our Data Protection Officer, Sam Tucker, at sam@keith.com. We will acknowledge your complaint within 30 days, investigate it without undue delay, and inform you of the outcome. Full details are in our complaints procedure. You also have the right to complain to the Information Commissioner's Office at www.ico.org.uk, although we would appreciate the opportunity to address your concerns first.