The policy we give every client, in full.
In this Privacy Policy the terms, 'we' or 'us' is Keith.
Your privacy is important to us and we are committed to keeping your information secure and managing it in accordance with our legal responsibilities under applicable data protection laws. We are registered with the UK Information Commission Office (ICO) as a data controller under registration number ZC164714.
Please read this Privacy Statement carefully as it contains important information to help you understand how and why we process any personal information that you give to us.
We process personal information which you give us, or which we obtain from others:
This includes:
Special categories of personal data include information about an individual's health, biometric data (such as facial images and liveness data collected during electronic identity verification) and other categories of personal information which are closely protected.
We do not generally process such information unless you have voluntarily provided this to us, or it is relevant to the legal service you have asked us to provide you with. For example, where you have advised us of an issue, such as your health, which could mean that you may be classed as a "vulnerable client" i.e. due to your personal circumstances or personal characteristics you are particularly vulnerable to financial detriment. During onboarding, certain personal data you provide - which may include special category data such as biometric data from identity verification, or information about your health or ethnicity - will be processed by our AI systems as a first step before being reviewed by a qualified member of our team. This initial AI processing is used to check your information, flag any matters requiring attention, and prepare your file for human review. No decision affecting you is made by the AI alone. We will process sensitive information where you have provided this information to us and have agreed that we can use this information to deliver products and services to you or it is necessary for reasons of substantial public interest (such as anti-money laundering requirements or safeguarding individuals at risk) or where we need to comply with a legal obligation. Where possible we shall seek to minimise the collection and use of such special categories of personal data.
Identity verification: Anti-money laundering law requires us to verify your identity, and we do this to comply with that legal obligation. Our standard method is an electronic check that includes a biometric element (a facial image and liveness check). We only process your biometric data with your explicit consent. We cannot complete an electronic check to the standard we need without the biometric element. If you do not wish to give consent, you will need to verify your identity manually instead, by visiting another regulated lawyer in person to have your identity documents certified and sent to us. You can withdraw your consent at any time before your check is complete, in which case we will move to the manual route. Withdrawing consent does not affect the lawfulness of any processing carried out before you withdrew it.
Our AI tools are not used to infer or generate special category data. Where special category data appears in documents processed by our AI tools, access is restricted to qualified staff and is subject to additional security controls.
We use your information to:
We will process your information on one or more of the following lawful bases: performance of a contract; compliance with a legal obligation; legitimate interests where not overridden by your rights; or your consent. The Data (Use and Access) Act 2025 (DUAA2025) also introduces 'recognised legitimate interests' (including crime prevention and network security) for which no balancing test is required.
We use artificial intelligence (AI) tools to assist our licensed conveyancers in processing your matter. AI may assist with document analysis, risk flagging, AML screening and quality checking. No legally significant decision about your matter is made solely by an AI system - such AI outputs are reviewed and approved by a licensed conveyancer before any action is taken.
What AI tools we use: We use AI-assisted tools to support our licensed conveyancers. These tools may assist with document analysis and review, risk identification and flagging, AML and fraud screening, transaction management, quality checking of correspondence and legal documents, and transcribing recorded calls.
Human oversight: No legally significant decision about your matter is made solely by an AI system. Such outputs are reviewed and approved by a licensed conveyancer before any action is taken. The AI tools we use are assistive - they support but do not replace qualified human judgement.
Automated decision-making and your rights (Article 22 UK GDPR, as amended by DUAA 2025): The UK GDPR gives you the right not to be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you. As AI outputs are reviewed by a qualified human, our use of AI does not constitute 'solely automated decision-making' under Article 22. However, in any case where this might apply, we ensure: (i) a lawful basis exists; (ii) you are informed of the processing and its logic; (iii) you have the right to request human review; (iv) you can express your point of view and contest any outcome; and (v) a data protection impact assessment has been conducted.
AI vendors and international transfers: We use third-party AI platform providers as data processors under written data processing agreements. These require providers to process your data only on our instructions, maintain appropriate security measures, and not use your personal data to train their own AI models without our written consent. Wherever possible, the AI and technology providers we use process your data within the United Kingdom or the European Economic Area. Onfido (part of the Entrust group), which we use for electronic identity verification, processes identity and biometric data within the UK and EEA. Where any provider processes data outside the UK, we ensure appropriate transfer safeguards are in place (UK International Data Transfer Addendum or equivalent), and you can ask us for details of these safeguards. An up-to-date list of our service providers (sub-processors) is available on request.
Your right to an explanation: You have the right to request a meaningful explanation of how any AI tool contributed to an output in your matter, including the logic involved and its significance for you. You also have the right to request that any AI-assisted decision that affects you be reviewed by a human professional. Please use the contact details in section 14.
Calls with us: When you speak to us by telephone, your call may be handled by Keith, our AI assistant, or by a member of our team. We record all calls. If you are not yet a client, we will tell you at the start of the call that it is being recorded and, where relevant, that you are speaking to an AI assistant. Once you have instructed us, we will not repeat these messages on every call, so please treat this policy and your client care letter as notice that all calls with us are recorded and may be handled by Keith. If you ask, Keith will always confirm that it is an AI assistant. Recordings are transcribed using automated speech-to-text tools so that an accurate record of the call is kept on your file, and are held in our own secure storage in the UK or European Economic Area. We do not use recordings of your voice to identify you or to create a voice profile.
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Providing a service and internal processing | |
| To assess your needs and provide you with suitable products and services | Performance of contract (Article 6(1)(b)) Where special category data is processed: necessary for reasons of substantial public interest (Article 9(2)(g), read with Schedule 1, Part 2 DPA 2018) - specifically, preventing and detecting unlawful acts (paragraph 10) for anti-money laundering and fraud checks, and safeguarding individuals at risk (paragraph 18) for vulnerability and health information. Explicit consent (Article 9(2)(a)) for biometric data used in electronic identity verification. Consent (Article 9(2)(a)) may also be relied upon where the individual has voluntarily provided health or vulnerability information. |
| To service and administer your matter including billing | Legitimate interests to provide and manage the service (Article 6(1)(f)) |
| To verify the identity of our clients | Legal obligation under the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 (Article 6(1)(c)). Where biometric data is processed for electronic identity verification: your explicit consent (Article 9(2)(a)). If you do not consent, we verify your identity manually instead |
| To confirm, update and improve our client records | Legal obligation under UK GDPR / DPA 2018 (Article 6(1)(c)) |
| To provide you with any information on the services that you have requested | Performance of contract (Article 6(1)(b)) |
| Communicating with you by telephone, SMS and email, including checking that your phone number is valid before we contact you | Performance of contract (Article 6(1)(b)); legitimate interests in making sure our communications reach the right person securely (Article 6(1)(f)) |
| Recording and transcribing calls, and keeping recordings and transcripts on your file | Legitimate interests in keeping an accurate record of instructions and advice, checking quality, training our staff, preventing fraud and resolving complaints or disputes (Article 6(1)(f)); legal obligation where we are required to keep records (Article 6(1)(c)) |
| Relationship Management | |
| To manage and develop our relationship with you | Legitimate interests to service your matter and improve our service (Article 6(1)(f)) |
| To inform you of products and services that may be of interest to you, where you have chosen to be made aware of this. | With your consent |
| Product analytics and system improvement | |
| Collecting and analysing usage data from our case management system to understand how it is used, identify issues, improve performance and report on system usage | Legitimate interests to improve the case management system and monitor its performance (Article 6(1)(f)). |
| Measuring the effectiveness of our online advertising, including sharing a hashed version of your email address with Google Ads | With your consent. |
| Training and development | |
| For training purposes and to improve our service to you | Legitimate interests to improve our services and develop our employees (Article 6(1)(f)) |
| Complying with Legal Obligations | |
| To prevent, investigate and prosecute crime, fraud and money laundering | Legal obligation for prevention of financial crime and money laundering (Article 6(1)(c)) |
| For auditing purposes | Legitimate interests / legal obligation where required by regulation (Articles 6(1)(c) and 6(1)(f)) |
| If we are obliged to disclose information by reason of any law, regulation or court order | To comply with legal obligations |
| Use of AI-assisted tools in service delivery | |
| Processing matter details through AI-assisted tools (document analysis, risk flagging, transaction management and quality checking) - outputs reviewed by a licensed conveyancer before action is taken | Legitimate interests to deliver an efficient and accurate legal service (Article 6(1)(f)). AI outputs subject to mandatory human review. Where special category data is involved: necessary for reasons of substantial public interest (Article 9(2)(g), read with Schedule 1, Part 2 DPA 2018) - specifically, preventing and detecting unlawful acts (paragraph 10) for anti-money laundering and fraud checks, and safeguarding individuals at risk (paragraph 18) for vulnerability and health information. Explicit consent (Article 9(2)(a)) for biometric data used in electronic identity verification. Consent (Article 9(2)(a)) may also be relied upon where the individual has voluntarily provided health or vulnerability information. |
| Using AI tools to assist in anti-money laundering screening and fraud detection | Legal obligation (Article 6(1)(c)); legitimate interests in preventing financial crime (Article 6(1)(f)). Where special category data is involved: substantial public interest (Article 9(2)(g)). |
| Other | |
| To transfer information to any entity which may acquire rights in us | Legitimate interests for commercial purposes, subject to appropriate data protections (Article 6(1)(f)) |
| For any other purpose to which you agree. | With your consent |
We will retain your personal information in accordance with applicable laws. We will take reasonable steps to destroy or anonymise personal information we no longer need for the purposes we have set out above.
Our retention periods are:
| Type of personal Information | Retention Period |
|---|---|
| General personal data which includes your normal personal data, personal identity and personal financial data | 7 years after the end of our business relationship with you, or the end of your matter whichever comes later Conveyancing Purchase and remortgage Files will be retained for 15 years |
| Client Due Diligence Material which includes copies of your Passport, Drivers Licence, Bank Statements and any associated documents and explanations you have given to us to prevent fraud, financial crime and money laundering | 7 years after the end of our business relationship with you, or the end of your matter whichever comes later Conveyancing Purchase and remortgage Files will be retained for 15 years |
| Special categories of personal data | 7 years after the end of our relationship with you Conveyancing Purchase and remortgage Files will be retained for 15 years |
| Call recordings (audio) | 1 year |
| Call transcripts and records of calls and messages | Same period as the underlying matter file |
| CCTV - digital images if you visit our offices | 30 days |
| AI system processing logs and conveyancer sign-off records | Same period as the underlying matter file (minimum 7 years), to enable the Firm to demonstrate human oversight and respond to complaints or regulatory enquiries |
| Product analytics and usage data | Maximum 2 years |
Where necessary or required we share information with:
When we call or message you, our communications platform provider processes certain communications data as an independent controller, rather than on our instructions. This includes phone numbers, call and message logs, the date, time, duration and delivery status of a call or message, and technical information about devices and networks, and in limited circumstances may include the content of a communication. The provider uses this information for its own purposes as a communications provider: to operate, maintain, secure and improve its services; to prevent and investigate fraud, spam and misuse; and to meet its legal and regulatory obligations, including assisting telecommunications providers, regulators and law enforcement. Some of this processing may take place outside the UK, including in the United States, under recognised transfer safeguards. The provider's own privacy notice explains how it handles this information and how you can exercise your rights with it. Please contact us if you would like further details.
We invest appropriate resources to protect your personal information, from loss, misuse, unauthorised access, modification or disclosure. Your data is held within a secure, matter-level environment that is isolated from all other client files. Our systems, including our AI systems, are designed so that your information cannot be accessed from, or shared with, any other client's matter. All data stored on our systems and devices is encrypted at rest, and all data transmitted between our systems (including to and from our AI platforms) is encrypted in transit. However, no internet-based site can be 100% secure and we cannot be held responsible for unauthorised or unintended access that is beyond our control.
We will keep this Privacy Policy under regular review and update it as our practices, technology and applicable law change. Any updates will be posted on our website and we will communicate any material changes to you directly.
Our website and client portal show a cookie banner. Analytics and advertising cookies are off unless you choose to turn them on, and you can change your choice at any time through the Cookie Settings link at the bottom of each page.
Strictly necessary cookies, which keep you signed in and your session secure, are always set, because the service cannot work without them.
Analytics cookies are set by PostHog, our product analytics provider, and help us understand how our website and portal are used, including how visitors find us. Session recordings mask passwords, security codes, card and bank details, and other sensitive information. Analytics data is held within the European Union.
Advertising cookies let us measure which of our adverts lead to new clients, as described in section 8.
Without your consent, we count visits anonymously and store nothing on your device for analytics or advertising. Whatever your choice, we record key steps in your matter against your account so that we can provide and improve our service.
You have the right to request copies of your personal information and where we have requested your permission to process your personal information, or you have provided us with information for the purposes of entering into a contract with us, to receive the personal information you provided to us in a portable format, if technically feasible. If you think any of the personal information we hold about you is inaccurate, you may also request it is corrected or erased. You also have a right, in certain circumstances, to object to our processing of your personal information, to require us to stop processing your personal information and/or to withdraw your agreement to processing based on 'consent', but this does not apply where we have other legal justifications to continue processing your data or an overriding legitimate interest. If you wish to object to, or ask us to restrict, our use of AI in processing your personal data, please contact us using the details at the end of this policy or speak to your fee earner. We will consider any such request carefully on its merits and in accordance with applicable data protection law. AI assistance is integral to the way we deliver our services - it supports the speed, consistency and value we are able to offer - so a change to how we use it on your matter may affect the scope or timescales for your transaction. We will discuss any such change openly with you before it takes effect and will work with you to agree a way forward.
In relation to all of these rights, please write to us at the address below.
If you have a complaint about how we have handled your personal information you may contact us using the details below and we will investigate your complaint. You also have the right to complain to the Information Commission Office - (www.ico.org.uk).
For anything about your personal information - to exercise a right, to object to our use of AI, or to complain - write to us at team@keith.com.
For anything else, email keith@keith.com or telephone 020 3870 2730.