The policy we give every client, in full.
In this Privacy Policy the terms, 'we' or 'us' is Keith.
Your privacy is important to us and we are committed to keeping your information secure and managing it in accordance with our legal responsibilities under applicable data protection laws. We are registered with the UK Information Commissioner's Office (ICO) as a data controller.
Please read this Privacy Statement carefully as it contains important information to help you understand how and why we process any personal information that you give to us.
We process personal information which you give us:
This includes:
Special categories of personal data include information about an individual's health, biometric data (such as facial images and liveness data collected during electronic identity verification) and other categories of personal information which are closely protected.
We do not generally process such information unless you have voluntarily provided this to us, or it is relevant to the legal service you have asked us to provide you with. For example, where you have advised us of an issue, such as your health, which could mean that you may be classed as a "vulnerable client" i.e. due to your personal circumstances or personal characteristics you are particularly vulnerable to financial detriment. During onboarding, certain personal data you provide - which may include special category data such as biometric data from identity verification, or information about your health or ethnicity - will be processed by our AI systems as a first step before being reviewed by a qualified member of our team. This initial AI processing is used to check your information, flag any matters requiring attention, and prepare your file for human review. No decision affecting you is made by the AI alone. We will process sensitive information where you have provided this information to us and have agreed that we can use this information to deliver products and services to you or it is necessary for reasons of substantial public interest (such as anti-money laundering requirements or safeguarding individuals at risk) or where we need to comply with a legal obligation. Where possible we shall seek to minimise the collection and use of such special categories of personal data.
Our AI tools are not used to infer or generate special category data. Where special category data appears in documents processed by our AI tools, access is restricted to qualified staff and is subject to additional security controls.
We use your information to:
We will process your information on one or more of the following lawful bases: performance of a contract; compliance with a legal obligation; legitimate interests where not overridden by your rights; or your consent. The Data (Use and Access) Act 2025 (DUAA2025) also introduces 'recognised legitimate interests' (including crime prevention and network security) for which no balancing test is required.
We use artificial intelligence (AI) tools to assist our licensed conveyancers in processing your matter. AI may assist with document analysis, risk flagging, AML screening and quality checking. No legally significant decision about your matter is made solely by an AI system - such AI outputs are reviewed and approved by a licensed conveyancer before any action is taken.
What AI tools we use: We use AI-assisted tools to support our licensed conveyancers. These tools may assist with document analysis and review, risk identification and flagging, AML and fraud screening, transaction management, and quality checking of correspondence and legal documents.
Human oversight: No legally significant decision about your matter is made solely by an AI system. Such outputs are reviewed and approved by a licensed conveyancer before any action is taken. The AI tools we use are assistive - they support but do not replace qualified human judgement.
Automated decision-making and your rights (Article 22 UK GDPR, as amended by DUAA 2025): The UK GDPR gives you the right not to be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you. As AI outputs are reviewed by a qualified human, our use of AI does not constitute 'solely automated decision-making' under Article 22. However, in any case where this might apply, we ensure: (i) a lawful basis exists; (ii) you are informed of the processing and its logic; (iii) you have the right to request human review; (iv) you can express your point of view and contest any outcome; and (v) a data protection impact assessment has been conducted.
AI vendors and international transfers: We use third-party AI platform providers as data processors under written data processing agreements. These require providers to process your data only on our instructions, maintain appropriate security measures, and not use your personal data to train their own AI models without our written consent. Wherever possible, the AI platform providers we use process your data within the United Kingdom. Onfido (part of the Entrust group), which we use for electronic identity verification, processes identity and biometric data within the UK and EEA. Where any provider processes data outside the UK, we ensure appropriate transfer safeguards are in place (UK International Data Transfer Addendum or equivalent). An up-to-date list of AI providers, including sub-processors, is available on request.
Your right to an explanation: You have the right to request a meaningful explanation of how any AI tool contributed to an output in your matter, including the logic involved and its significance for you. You also have the right to request that any AI-assisted decision that affects you be reviewed by a human professional. Please use the contact details in section 14.
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Providing a service and internal processing | |
| To assess your needs and provide you with suitable products and services | Performance of contract (Article 6(1)(b)) Where special category data is processed: necessary for reasons of substantial public interest (Article 9(2)(g), read with Schedule 1, Part 2 DPA 2018) - specifically, preventing and detecting unlawful acts (paragraph 6) for identity verification and biometric data, and safeguarding individuals at risk (paragraph 18) for vulnerability and health information. Consent (Article 9(2)(a)) may also be relied upon where the individual has voluntarily provided the information. |
| To service and administer your matter including billing | Legitimate interests to provide and manage the service (Article 6(1)(f)) |
| To verify the identity of our clients | Legal obligation under the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 (Article 6(1)(c)) |
| To confirm, update and improve our client records | Legal obligation under UK GDPR / DPA 2018 (Article 6(1)(c)) |
| To provide you with any information on the services that you have requested | Performance of contract (Article 6(1)(b)) |
| Relationship management | |
| To manage and develop our relationship with you | Legitimate interests to service your matter and improve our service (Article 6(1)(f)) |
| To inform you of products and services that may be of interest to you, where you have chosen to be made aware of this. | With your consent |
| Product analytics and system improvement | |
| Collecting and analysing usage data from our case management system to understand how it is used, identify issues, improve performance and report on system usage | Legitimate interests to improve the case management system and monitor its performance (Article 6(1)(f)). |
| Training and development | |
| For training purposes and to improve our service to you | Legitimate interests to improve our services and develop our employees (Article 6(1)(f)) |
| Complying with legal obligations | |
| To prevent, investigate and prosecute crime, fraud and money laundering | Legal obligation for prevention of financial crime and money laundering (Article 6(1)(c)) |
| For auditing purposes | Legitimate interests / legal obligation where required by regulation (Articles 6(1)(c) and 6(1)(f)) |
| If we are obliged to disclose information by reason of any law, regulation or court order | To comply with legal obligations |
| Use of AI-assisted tools in service delivery | |
| Processing matter details through AI-assisted tools (document analysis, risk flagging, transaction management and quality checking) - outputs reviewed by a licensed conveyancer before action is taken | Legitimate interests to deliver an efficient and accurate legal service (Article 6(1)(f)). AI outputs subject to mandatory human review. Where special category data is involved: necessary for reasons of substantial public interest (Article 9(2)(g), read with Schedule 1, Part 2 DPA 2018) - specifically, preventing and detecting unlawful acts (paragraph 6) for identity verification and biometric data, and safeguarding individuals at risk (paragraph 18) for vulnerability and health information. Consent (Article 9(2)(a)) may also be relied upon where the individual has voluntarily provided the information. |
| Using AI tools to assist in anti-money laundering screening and fraud detection | Legal obligation (Article 6(1)(c)); legitimate interests in preventing financial crime (Article 6(1)(f)). Where special category data is involved: substantial public interest (Article 9(2)(g)). |
| Other | |
| To transfer information to any entity which may acquire rights in us | Legitimate interests for commercial purposes, subject to appropriate data protections (Article 6(1)(f)) |
| For any other purpose to which you agree. | With your consent |
We will retain your personal information in accordance with applicable laws. We will take reasonable steps to destroy or anonymise personal information we no longer need for the purposes we have set out above.
Our retention periods are:
| Type of personal information | Retention period |
|---|---|
| General personal data which includes your normal personal data, personal identity and personal financial data | 7 years after the end of our business relationship with you, or the end of your matter whichever comes later Conveyancing purchase and remortgage files will be retained for 15 years |
| Client due diligence material which includes copies of your passport, driving licence, bank statements and any associated documents and explanations you have given to us to prevent fraud, financial crime and money laundering | 7 years after the end of our business relationship with you, or the end of your matter whichever comes later Conveyancing purchase and remortgage files will be retained for 15 years |
| Special categories of personal data | 7 years after the end of our relationship with you Conveyancing purchase and remortgage files will be retained for 15 years |
| Call recordings | 1 year |
| CCTV - digital images if you visit our offices | 30 days |
| AI system processing logs and conveyancer sign-off records | Same period as the underlying matter file (minimum 7 years), to enable the firm to demonstrate human oversight and respond to complaints or regulatory enquiries |
| Product analytics and usage data | Maximum 2 years |
Where necessary or required we share information with:
We invest appropriate resources to protect your personal information, from loss, misuse, unauthorised access, modification or disclosure. Your data is held within a secure, matter-level environment that is isolated from all other client files. Our systems, including our AI systems, are designed so that your information cannot be accessed from, or shared with, any other client's matter. All data stored on our systems and devices is encrypted at rest, and all data transmitted between our systems (including to and from our AI platforms) is encrypted in transit. However, no internet-based site can be 100% secure and we cannot be held responsible for unauthorised or unintended access that is beyond our control.
We will keep this Privacy Policy under regular review and update it as our practices, technology and applicable law change. Any updates will be posted on our website and we will communicate any material changes to you directly.
Our website sets no cookies and stores nothing on your device. We count visits and page views in cookieless mode: a one-way hash is made of your IP address, browser type and a value that changes daily, so it cannot be reversed, does not identify you, and does not follow you from one day to the next.
Our client portal does use cookies. The cookies that sign you in and keep your session secure are set whenever you use the service, because the service cannot work without them.
We also use analytics cookies in the portal, set by PostHog, our product analytics provider, to understand how the service is used so that we can improve it. These record the pages you visit and the features you use, and they allow us to replay your session in the portal. Recordings mask what you type into forms, and the document, signing and payment screens, so that content is not captured. Analytics data is held within the European Union.
Analytics cookies are set only if you agree to them. We ask when you open your matter, by a box that is not ticked for you, and until you agree we store nothing on your device for analytics and cannot identify you. You can change your answer at any time under Privacy in your account, which stops the session recording and clears the cookie. Our cookies page lists what the portal sets.
You have the right to request copies of your personal information and where we have requested your permission to process your personal information, or you have provided us with information for the purposes of entering into a contract with us, to receive the personal information you provided to us in a portable format, if technically feasible. If you think any of the personal information we hold about you is inaccurate, you may also request it is corrected or erased. You also have a right, in certain circumstances, to object to our processing of your personal information, to require us to stop processing your personal information and/or to withdraw your agreement to processing based on 'consent', but this does not apply where we have other legal justifications to continue processing your data or an overriding legitimate interest. If you wish to object to, or ask us to restrict, our use of AI in processing your personal data, please contact us using the details at the end of this policy or speak to your fee earner. We will consider any such request carefully on its merits and in accordance with applicable data protection law. AI assistance is integral to the way we deliver our services - it supports the speed, consistency and value we are able to offer - so a change to how we use it on your matter may affect the scope or timescales for your transaction. We will discuss any such change openly with you before it takes effect and will work with you to agree a way forward.
In relation to all of these rights, please use the contact details in section 14.
If you have a complaint about how we have handled your personal information you may contact us using the details in section 14 and we will investigate your complaint. You also have the right to complain to the Information Commissioner's Office - (www.ico.org.uk).
For anything about your personal information - to exercise a right, to object to our use of AI, or to complain - write to us at team@keith.com.
For anything else, email keith@keith.com or telephone 020 3870 2730.