MARKETING

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising. We have established the following personal data control mechanisms.

PROMOTIONAL OFFERS FROM US

We may use your Identity, Contact, Technical, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you — this is how we decide which services and offers may be relevant to you (we call this marketing).

You will receive marketing communications from us if you have requested information from us, purchased services from us, or registered for a promotion, and, in each case, you have not opted out of receiving that marketing.

THIRD-PARTY MARKETING

We will get your express opt-in consent before we share your personal data with any company outside Cooke Painter Limited for marketing purposes.

OPTING OUT

You can ask us or third parties to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you, or by contacting us. See the contact details in Section 1.

Where you opt out of receiving marketing messages, this will not apply to personal data provided to us as a result of a service purchase or other transaction.

COOKIE POLICY

Our website uses cookies and similar technologies (together, "cookies") to distinguish you from other users. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site.

A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your device. Cookies contain information that is transferred to your device.

We currently use the following non-essential cookies and similar technologies, all of which require your consent before they are set:

• Google Analytics 4 — used to understand how visitors use our website (for example, page views and journeys through the site).
• Google Tag Manager — used to manage and deploy the other tags listed here.
• Google Ads / Floodlight remarketing tracking — used to measure the effectiveness of our advertising and to show relevant adverts to previous visitors on other websites.
• Microsoft Clarity — a session-recording and heatmap tool used to understand how visitors interact with pages on our site.
• Perfect Portal reviews widget — used to display client reviews on our website.

Cookies that are strictly necessary for the website to function (for example, to support basic security and navigation) do not require consent and are always active.

You can manage your cookie choices at any time using the “Cookie Settings” option available on our website, and you can withdraw or change your consent using the same tool. You can also block cookies by changing your browser settings, but if you block all cookies (including strictly necessary ones) you may not be able to access all or parts of our site.

If you would like to contact us regarding this Cookie Policy, have any queries, or would like a written copy, please contact our Data Privacy Manager: [email protected]

CHANGE OF PURPOSE

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider we need to use it for another reason that is compatible with the original purpose. If you would like an explanation of how the processing for the new purpose is compatible with the original purpose, please contact us — see the contact details in Section 1.

If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis that allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

5. DISCLOSURES OF YOUR PERSONAL DATA

We may have to share your personal data with the parties set out below for the purposes set out in the table in Section 4 above.

• External Third Parties, as set out in the Glossary.
• LexisNexis, our identity verification, sanctions and PEP screening provider, used for all matters.
• InfoTrack Limited, our electronic adverse media screening provider, used for most property transactions. We do not share your data with InfoTrack where we carry out adverse media screening manually instead.
• Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets, or with whom we may seek to merge. If a change happens to our business, the new owners may use your personal data in the same way as set out in this Privacy Notice.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes, and only permit them to process your personal data for specified purposes and in accordance with our instructions.

6. INTERNATIONAL TRANSFERS

Some of our external third parties, and some of the cloud and IT service providers we use, are based outside the United Kingdom, so their processing of your personal data will involve a restricted transfer of personal data outside the UK.

Whenever we make such a transfer, we ensure your personal data receives a standard of protection that is not materially lower than the standard it would receive in the UK, in line with the UK GDPR and the ICO’s guidance on international transfers. We do this using one of the following:

• Adequacy. We may transfer personal data to countries that the UK Secretary of State has determined, through UK adequacy regulations, provide an adequate level of protection for personal data. This currently includes all EU and EEA member states, together with a number of other countries recognised under the UK’s adequacy regulations. For further details, see the ICO’s guidance on adequacy at www.ico.org.uk.
• Appropriate safeguards. Where we use service providers in a country not covered by UK adequacy regulations, we put in place a recognised safeguard, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU’s Standard Contractual Clauses, and, where required, carry out a transfer risk assessment.
• The UK Extension to the EU-US Data Privacy Framework (the “UK-US Data Bridge”). Where we use service providers based in the United States, we may transfer personal data to them where they have self-certified to the UK Extension to the EU-US Data Privacy Framework. This is the current successor to the EU-US Privacy Shield, which was declared invalid by the Court of Justice of the European Union in July 2020 and can no longer be relied on for any transfer.

International transfer mechanisms involving the United States have a history of being successfully challenged in the courts (both the EU-US Safe Harbor and EU-US Privacy Shield frameworks were struck down), and further legal challenges to the current framework had been announced at the time this notice was last updated. We keep our approach to international transfers under review and will update our arrangements, and this notice, if any mechanism we rely on is invalidated or replaced.

Please contact us if you would like further information on the specific mechanism we use for a particular transfer. See the contact details in Section 1.

7. DATA SECURITY

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We also limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know it. They will only process your personal data on our instructions and are subject to a duty of confidentiality.

We have procedures in place to deal with any suspected personal data breach. Where required, we will notify the ICO of a qualifying breach without undue delay and, where feasible, within 72 hours of becoming aware of it, and we will notify you directly where the breach is likely to result in a high risk to your rights and freedoms.

8. DATA RETENTION

HOW LONG WILL YOU USE MY PERSONAL DATA FOR?

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, regulatory or reporting requirements. For example, where we hold data for anti-money laundering customer due diligence purposes, Regulation 40 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 sets a minimum retention period of five years; our own retention policy may set a longer period for certain files.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it and whether those purposes could be achieved by other means, and the applicable legal requirements.

Details of retention periods for different aspects of your personal data are available in our retention policy, which you can request from us — see the contact details in Section 1. Where Special Category or criminal offence data is retained under an Appropriate Policy Document, that document sets out our specific retention and erasure approach for that data.

In some circumstances you can ask us to delete your data — see Request erasure below.

In some circumstances we may anonymise your personal data (so it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

9. YOUR LEGAL RIGHTS

Under certain circumstances, you have rights under Data Protection Legislation in relation to your personal data. These rights include the right to:

• be informed;
• request access to your personal data;
• request correction of your personal data;
• request erasure of your personal data;
• object to processing of your personal data;
• request restriction of processing of your personal data;
• request transfer of your personal data;
• withdraw consent;
• not be subject to a decision based solely on automated processing (including profiling) which produces legal or similarly significant effects, and to object to profiling for direct marketing purposes; and
• complain to us and/or to a supervisory authority.

For more detail on the rights listed above, please see the Glossary section below.

If you wish to exercise any of the rights set out above, please contact us — see the contact details in Section 1.

NO FEE USUALLY REQUIRED

You will not have to pay a fee to access your personal data (or to exercise any of your other rights). However, we may charge a reasonable fee, or refuse to comply, if your request is clearly unfounded, repetitive or excessive.

WHAT WE MAY NEED FROM YOU

We may need to request specific information from you to confirm your identity and ensure your right to access your personal data (or exercise any other right). This is a security measure to ensure personal data is not disclosed to anyone who has no right to receive it. We may also contact you for further information to speed up our response.

TIME LIMIT TO RESPOND

We try to respond to all legitimate requests within one month. Occasionally it may take us longer if your request is particularly complex or you have made a number of requests, in which case we will notify you and keep you updated. Where your request is broad or unclear and we hold a large amount of information about you, we may ask you to clarify or narrow it before we proceed; where we do this, the one-month response period is paused until you provide that clarification.

10. GLOSSARY

LAWFUL BASIS

• Legitimate Interest means the interest of our business in conducting and managing our business to give you the best service and the best and most secure experience. We balance any potential impact on you (positive and negative) and your rights before we process your personal data for our legitimate interests, and we do not do so where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted by law to proceed). You can obtain further information about how we assess this by contacting us — see the contact details in Section 1.
• Recognised Legitimate Interest means one of a limited set of purposes specified by Parliament — for example, safeguarding, and the prevention or detection of crime — introduced by the Data (Use and Access) Act 2025, for which we are not required to carry out the normal legitimate interests balancing test.
• Consent means any freely given, specific and informed indication of your formal agreement to the processing of your personal data for one or more specific purposes.
• Performance of Contract means processing your data where necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into such a contract.
• Comply with a legal or regulatory obligation means processing your personal data where necessary for compliance with a legal or regulatory obligation to which we are subject.
• Vital Interests means processing necessary to protect the vital interests of the data subject (you) or of another natural person.

THIRD PARTIES

EXTERNAL THIRD PARTIES

• Service providers acting as processors, based in the United Kingdom, who provide website, application service provider, IT and system administration services.
• Professional advisers acting as processors or joint controllers — including lawyers, bankers, auditors, brokers and insurers — based in the United Kingdom, who provide consultancy, banking, legal, insurance and accounting services.
• HM Revenue & Customs, regulators and other authorities acting as processors or joint controllers, based in the United Kingdom, who require reporting of processing activities in certain circumstances.

YOUR LEGAL RIGHTS

Be informed about the collection and use of your personal data. This Privacy Notice and our Cookie Policy explain and inform you about the way we use your personal data, and fulfil our obligation to you.

Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

Request correction of the personal data we hold about you. This enables you to have any incomplete or inaccurate data corrected, though we may need to verify the accuracy of the new data you provide.

Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us to continue processing it, where you have successfully exercised your right to object (see below), where we may have processed your data unlawfully, or where we are required to erase it to comply with local law. We may not always be able to comply with an erasure request for specific legal reasons, which we will explain to you at the time, if applicable.

Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation that makes you want to object on this ground. You also have the right to object where we process your personal data for direct marketing purposes. In some cases we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

Request restriction of processing of your personal data. This enables you to ask us to suspend processing in certain scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even though we no longer require it, because you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

Request the transfer of your personal data to you or to a third party. We will provide your personal data to you, or a third party you have chosen, in a structured, commonly used, machine-readable format. This right applies only to automated information that you provided based on consent, or that we used to perform a contract with you.

Withdraw consent at any time, where we are relying on consent to process your personal data. This will not affect the lawfulness of processing carried out before you withdraw consent. If you withdraw consent, we may not be able to provide certain services to you — we will tell you if this is the case at the time.

Right relating to automated decision-making and profiling. Where we make a decision about you based solely on automated processing (including profiling) which produces legal effects concerning you or similarly significantly affects you, you have the right not to be subject to that decision, except in limited circumstances permitted by law — for example, where it is necessary for entering into or performing a contract with you, is authorised by law, or is based on your explicit consent. Where such decision-making applies to you, you also have the right to obtain human intervention, to express your point of view, and to contest the decision. Separately, you have the right to object to profiling carried out for direct marketing purposes at any time.

Right to complain. You can complain to us directly (see Section 1) and/or to the Information Commissioner’s Office — or its successor body, the Information Commission — at any time if you think your personal data has not been processed correctly by Cooke Painter. See Section 1 for more information.

GENERAL

Questions, comments or requests about this Privacy Notice are welcomed and should be addressed to the Data Privacy Manager at [email protected]

Alternatively, you can write to the Data Privacy Manager at:

Data Privacy Manager

Cooke Painter Solicitors

314 Wells Road

Knowle

Bristol

BS4 2QG