Version: 2.0  |  Date of Publication: 29 March 2026  |  Review Date: 29 March 2027

Immigration Justice Solicitors Ltd, trading as Law and Justice Solicitors, takes its obligations under UK data protection law seriously. This Privacy Policy explains how we collect, use, store and share your personal data when you instruct us, enquire about our services, or interact with us in any other way. Please read it carefully.

1. Key Terms

Term Meaning
We / us / our Immigration Justice Solicitors Ltd t/a Law and Justice Solicitors.
Data Protection Representative The person responsible for data protection compliance at our firm. Currently: Samera Mohammed LL.B (Hons), LL.M, Solicitor and Director.
Personal data Any information relating to an identified or identifiable living individual.
Special category data Particularly sensitive personal data afforded additional protection under Article 9 UK GDPR. This includes health information, biometric data, racial or ethnic origin, religious or philosophical beliefs, sexual orientation, political opinions, and trade union membership.
Data Controller The entity that determines the purposes and means of processing personal data. That is us — Immigration Justice Solicitors Ltd t/a Law and Justice Solicitors.
Data Processor A third party that processes personal data on our behalf and on our instructions. We remain responsible for ensuring any processor provides sufficient guarantees about their data protection practices.

2. Who We Are

We are Immigration Justice Solicitors Ltd, trading as Law and Justice Solicitors. We are authorised and regulated by the Solicitors Regulation Authority (SRA No. 626650) and incorporated in England and Wales (company number 9796299).

We operate from two offices:

  • Wednesbury Office — serving clients across the West Midlands
  • Ilford Office — serving clients across Greater London and the South East

Full office addresses and contact details are available on our Contact Us page.

3. ICO Registration

We are registered with the Information Commissioner’s Office (ICO) as a Data Controller.

  • ICO Registration Reference: ZA200482
  • Registration Expiry: 29 August 2026

You can verify our registration on the ICO’s public register.

4. Contact Details for Data Protection Queries

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact our Data Protection Representative:

5. Personal Data We Collect

5a. Information We Always Collect

Whenever you contact us or use our services, we will collect:

  • Full name
  • Contact details (postal address, email address, telephone number)
  • Date of birth
  • Nationality and country of birth
  • Identity document details (e.g. passport, travel document, biometric residence permit)
  • Details of your immigration history and current status
  • Financial information necessary for billing and payment
  • Communications with us (letters, emails, call notes)

5b. Information We Collect Depending on Your Matter

Depending on the nature of your legal matter, we may also collect:

  • Employment history and qualifications
  • Family composition and relationship details
  • Details of criminal convictions or proceedings (where relevant to your matter)
  • Details about dependants and third parties connected to your case
  • Interpreter or language support requirements
  • Supporting documents such as birth certificates, marriage certificates, and photographs
  • Tribunal, court, or Home Office reference numbers and correspondence

5c. Special Category Data

Given the nature of immigration and asylum work, we frequently process special category data, including:

  • Health and medical information (for example, to support asylum claims or applications involving serious illness)
  • Racial or ethnic origin
  • Religious or philosophical beliefs
  • Sexual orientation or gender identity (in particular for LGBT+ asylum claims)
  • Political opinions (for example, in politically motivated persecution claims)

We process special category data under Article 9(2)(f) UK GDPR — processing necessary for the establishment, exercise, or defence of legal claims — as the applicable special category condition. Where we also rely on consent, we will make this clear at the point of collection.

6. How We Collect Personal Data

We collect personal data through the following means:

  • Direct contact — when you telephone, email, write to us, or visit our offices
  • Instruction and onboarding — when you sign a client care letter and complete our onboarding documentation
  • Calendly booking forms — when you book an appointment through our online scheduling system, operated by Calendly LLC
  • Home Office, tribunals, and third parties — when information is provided to us in the course of acting on your behalf
  • Publicly available sources — such as Companies House, the Home Office Employer Checking Service, or court and tribunal records, where relevant
  • Our website — through enquiry forms and analytics tools

7. Lawful Basis for Processing

We process your personal data under one or more of the following lawful bases, depending on the purpose:

Purpose of Processing Lawful Basis (UK GDPR)
Providing legal advice and representation Article 6(1)(b) — performance of a contract; Article 6(1)(c) — legal obligation
Processing special category data for legal claims Article 9(2)(f) — establishment, exercise, or defence of legal claims
Compliance with SRA regulatory and anti-money laundering obligations Article 6(1)(c) — compliance with a legal obligation
Financial administration, invoicing, and accounts Article 6(1)(b) — performance of a contract; Article 6(1)(c) — legal obligation
Sending promotional communications (where you have opted in) Article 6(1)(a) — consent
Improving our services and website analytics Article 6(1)(f) — legitimate interests
Responding to enquiries and complaints Article 6(1)(b) — performance of a contract; Article 6(1)(f) — legitimate interests

8. Promotional Communications

We may send you information about our services, legal updates, or events that may be of interest to you, but only where you have given us consent to do so. You may opt out of promotional communications at any time by contacting us at info@lawandjusticesolicitors.co.uk. Opting out will not affect the lawfulness of any processing carried out before your withdrawal of consent, and it will not affect the provision of legal services to you.

9. Third Party Sharing

We share personal data with third parties only where necessary and appropriate. Recipients may include:

  • The Home Office and UK Visas and Immigration (UKVI) — as required in the course of representing you in immigration matters
  • His Majesty’s Courts and Tribunals Service (HMCTS) — including the First-tier Tribunal (Immigration and Asylum Chamber) and the Upper Tribunal
  • Barristers, expert witnesses, and instructed agents — where necessary for your matter
  • Interpreters and translators — under confidentiality obligations
  • Our professional regulators — the Solicitors Regulation Authority, where required
  • Calendly LLC — our appointment scheduling provider, acting as a data processor on our behalf
  • Apptivo Inc — our CRM and business management software provider, acting as a data processor on our behalf
  • Our IT infrastructure and cloud storage providers — under appropriate data processing agreements

We do not sell your personal data to any third party and will not share it for commercial purposes without your explicit consent.

10. How Long We Keep Your Data

We retain personal data for as long as necessary to fulfil the purposes set out in this policy and to comply with our legal and regulatory obligations. Our standard retention periods are:

  • Active client files: For the duration of your matter and for a minimum of 6 years after the matter concludes, in accordance with the Limitation Act 1980 and SRA record-keeping requirements.
  • Enquiry and prospective client records: Up to 12 months from the date of the initial enquiry, unless you become a client.
  • Financial and accounting records: 6 years from the end of the relevant financial year, as required by HMRC.
  • Anti-money laundering identity verification records: 5 years from the end of the business relationship, as required under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.
  • Marketing consent records: Until you withdraw your consent or for as long as the consent remains active.

When data is no longer required, we dispose of it securely in accordance with our data retention and destruction policy.

11. International Data Transfers

Some of our data processors are based outside the United Kingdom, specifically in the United States of America. We transfer personal data to these processors only where adequate safeguards are in place:

  • Calendly LLC (USA) — appointment scheduling. Calendly participates in the UK Extension to the EU-US Data Privacy Framework and we rely on Standard Contractual Clauses (SCCs) with the UK Addendum as a supplementary safeguard for UK data transfers.
  • Apptivo Inc (USA) — CRM and business management. Apptivo participates in the UK Extension to the EU-US Data Privacy Framework and we rely on Standard Contractual Clauses (SCCs) with the UK Addendum as a supplementary safeguard for UK data transfers.

You may request a copy of the relevant safeguards by contacting us at info@lawandjusticesolicitors.co.uk.

12. Data Security

We implement appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These measures include:

  • Encryption of data in transit and at rest
  • Access controls limiting data access to authorised personnel only
  • Secure password management and multi-factor authentication
  • Regular staff training on data protection obligations
  • Secure disposal of paper and electronic records
  • Ongoing review of our technical and organisational security measures

No method of transmission over the internet or electronic storage is completely secure. While we take your data security seriously, we cannot guarantee absolute security.

13. Data Breaches

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the Information Commissioner’s Office within 72 hours of becoming aware of the breach, as required by Article 33 UK GDPR. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay. We maintain an internal data breach register and follow our documented incident response procedure in all cases.

14. Your Rights

Under UK data protection law, you have the following rights in relation to your personal data:

Right What It Means
Right of access (Article 15) You may request a copy of the personal data we hold about you (a Subject Access Request). We will respond within one month.
Right to rectification (Article 16) You may ask us to correct inaccurate or incomplete personal data.
Right to erasure (Article 17) You may ask us to delete your personal data in certain circumstances, for example where it is no longer necessary for the purpose for which it was collected. Note that this right may be limited where we are required to retain data by law or for the defence of legal claims.
Right to restriction (Article 18) You may ask us to restrict processing of your personal data in certain circumstances, for example while accuracy is contested.
Right to data portability (Article 20) Where we process your data by automated means and on the basis of your consent or a contract, you may request that we provide your data in a structured, commonly used and machine-readable format.
Right to object (Article 21) You may object to processing based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will always comply.
Rights re: automated decision-making (Article 22) You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects. We do not carry out solely automated decision-making in our legal practice.

To exercise any of these rights, please contact us at info@lawandjusticesolicitors.co.uk or 0121 792 1703. We may need to verify your identity before processing your request. We will respond within one calendar month of receipt of a valid request.

15. How to Complain

If you are unhappy with how we have handled your personal data, please contact us in the first instance. You may also lodge a complaint directly with the Information Commissioner’s Office (ICO):

  • Website: ico.org.uk
  • Telephone: 0303 123 1113
  • Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our processing activities, changes in the law, or for other operational reasons. Where we make material changes, we will update the version number and date of publication at the top of this page. We encourage you to review this policy periodically.

17. Accessibility

This Privacy Policy is written in plain English to ensure it is as clear and accessible as possible. If you require this policy in an alternative format (for example, large print or a different language), please contact us at info@lawandjusticesolicitors.co.uk or 0121 792 1703.

This Privacy Policy was last reviewed on 29 March 2026.
Approved by: Samera Mohammed LL.B (Hons), LL.M, Solicitor and Director, Law and Justice Solicitors.