Privacy Policy

Your privacy is important to us. This Privacy Policy provides important information about how Hughes Paddison Limited handles your personal information.

Hughes Paddison Limited is a data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). This Policy applies to personal information which we process through the company’s website and the services we provide. Please read this policy carefully and contact us if you have any questions about our privacy practices or your information choices.

How we collect and use your data

For clients and prospective clients (including our employees or personal representatives of our clients) we will collect, process and store personal information so that we can provide our services to you. We may also collect, store and process special category data that you give to us (we will only request this type of data where it is necessary to provide services to you.)

For non-clients and other third parties, we will only collect, process and store information given to us where we are satisfied we have identified a lawful process to do so. For example, we may have been given your details because you are in a dispute with a client of this firm. We may also collect, store and process special category data relating to you, but we will only do so where we have identified a lawful basis to do so.

We will only process personal data (including special category data) where it is necessary:

• for the performance of a contract with you;
• in order to take steps before we enter into a contract with you;
• where it is in the legitimate interest of our business;
• for the establishment, exercise or defence of legal claims;
• to comply with our legal or regulatory obligations; or
• where we have the consent of the data subject.

How and why we use your personal data

Under data protection law, we can only use your personal data if we have a proper reason, e.g,:

• where you have given consent
• to comply with our legal and regulatory obligations
• for the performance of a contract with you or to take steps at your request before entering into a contract
• for the purpose of a recognised legitimate interest
• for our legitimate interest or those of a third party

A legitimate interest is when we have a business or commercial reason to use your personal data, so long as this is not overridden by your own rights and interests. We will carry out an assessment when relying on legitimate interest, to balance our interests against your own.

Others who may see or have access to your data

The company shares or discloses personal information when necessary to provide services or conduct our business operations as described below. We do not sell any personal information to third parties. Below are the parties with whom we may share personal information and why.

• Within the company: Our business is supported by a variety of people who are part of the company’s teams and functions, and personal information will be made available to them if necessary for the provision of services, account administration, sales and marketing, customer and technical support, and business development, for instance. All of our employees and contractors are required to follow our data privacy and security policies when handling personal information.  

• Other professional advisers and intermediaries: In the course of giving legal advice we may be required to work with other solicitors, tax advisers, accountants, barristers, estate agents, surveyors and other professional advisers and intermediaries.  Subject always to our professional duty of confidentiality, we may share your personal information with these professional advisers and intermediaries in order to provide our services to you. 

• Our business partners: We occasionally partner with other organisations to deliver services, provide content, or to host events, conferences, and seminars. As part of these arrangements, you may be a client of both the company and our partners, and we and our partners may collect and share information about you. The company will handle personal information in accordance with this policy, and we encourage you to review the privacy policies of our partners to learn more about how they collect, use, and share personal information. 

• Our third-party service providers: We partner with and are supported by service providers in the UK and European Union. Personal information will be made available to these parties only when necessary to fulfil the services they provide to us, including (without limitation):

• software, system and platform support;
• direct marketing services; document management and dictation services, cloud hosting services; advertising; data analytics;
• anti-money laundering checks; accountancy; insurance; and order fulfilment and delivery.

Our third-party service providers are not permitted to share or use personal information we make available to them for any other purpose than to provide services to us. 

• For legal reasons: We will share personal information when we believe it is required, such as (without limitation): 

• to comply with legal and regulatory obligations and respond to requests from government agencies, regulators, law enforcement and other public authorities;
• in the event of a merger, sale, restructure, acquisition, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings);
• to protect our rights, users, systems, and services.

How long we will keep your personal data

We will not keep your personal data for longer than we need it for the purpose for which it is used. Different retention periods apply for different types of personal data.

Personal data will usually be retained for 15 years after conclusion of the matter.

Where we are advising clients on their Will, holding title deeds to property or some other personal matters, we may retain the file for up to 99 years.

Where your data is stored

Your data is stored within the UK or the EEA. In some cases, we may need to disclose or transfer your personal information within the company or to third parties in areas outside of your home country, but we will not transfer your data outside of the European Union unless there is an adequacy decision in place or we have your consent.  

How we keep your data secure

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality. The company holds Cyber Essentials Plus accreditation which is a government-backed certification scheme that helps keep personal data safe from cyber-attacks.

We have put in place procedures to deal with any suspected personal data breaches and will notify you and any applicable regulator of a breach where we are legally required to do so.  

Cookies

A cookie is a small text file which is placed onto your device (e.g., computer, smartphone or other electronic device) when you use our website. We use cookies on our website.

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. For more information about the cookies we use, please see our Cookie Policy.

Marketing

We will use your personal data to send you updates (by email, text message, telephone or post) about our products and services, including exclusive offers, promotions or new services.

We have a legitimate interest in using your personal data for marketing purposes. This means we do not need your consent to send you marketing information.

You have the right to opt out of receiving marketing communications at any time by contacting us.

We may ask you to confirm or update your marketing preferences if you ask us to provide further services in the future, or if there are changes in the law, regulation, or the structure of the business.

We will always treat your personal data with the utmost respect and never sell or share it with other organisations for marketing purposes.

Your data privacy rights

We respect your right to access and control your information and we will respond to requests for information and, where applicable, will correct, amend, or delete your personal information. In some cases, exemptions apply to the following rights. If for any reason, we are unable to fulfil your request we will explain the reason to you:

• Access to personal information: You have the right to request access to your personal data (known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it. If you request access to your personal information, we will gladly comply, subject to our obligations not to disclose information which is subject to legal professional privilege and any other relevant legal requirements and exemptions. Before providing data to you, we may ask for proof of identity and sufficient information about your interaction with us so that we can locate any relevant data. 

• Object to processing: of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes.

• Request erasure: of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see above), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law.

• Request restriction of processing: of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the accuracy of the data; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it. 

• Request the transfer: of your personal data to you or to a third party. We will provide to you, or a third party chosen by you, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

• Correction of your data: You have the right to request that we correct your personal information if it is inaccurate or requires updating or complete your personal information if the information we hold is incomplete.

• Rights in respect of automated decision-making: Where significant decisions (those which produce a legal or similarly significant effect on you) are made using your personal data and based on solely automated processing with no meaningful human involvement, you have the right to certain safeguards in place to protect your data subject rights, freedoms and legitimate interests. These safeguards include giving your information about the decision and enabling you to make representations, obtain human intervention, and contest the decision.

In addition to also requiring the above safeguards, significant decisions made using special category personal data and based on solely automated processing are only permissible in certain specified scenarios (e.g. when you have given your explicit consent for the decision to be made using such data).

We do not make any such decisions based on data collected by our website.

• Withdrawal of consent: If we are processing your personal information on the basis that you have given your consent to us processing that personal information, you have a right to withdraw your consent at any time by using the “Contact Us” option on our website or let us know in writing, by email or by telephone.

• Marketing preferences: To opt out of email marketing, you can use the unsubscribe link found in the email communication you receive from us or you can use the “Contact Us” option on our website or let us know by telephone. 

Making a complaint

Please contact us if you have any queries or concerns about our use of your personal data. Full details are contained in the firm’s Complaints Procedure.

You also have the right to lodge a complaint with the Information Commissioner. They may be contacted using the details at https://ico.org.uk/make-a-complaint or by telephone: 0303 123 1113.

Changes to this policy

It is important that you check back often for updates to this Policy. If we make changes, we consider to be important, we will let you know by placing a notice on our website and/or contacting you using other methods such as email. 

This Policy was last updated on 18 August 2026.

Contact us

If you have any queries about this policy, or wish to exercise any of your data privacy rights, please contact us in one of the following ways:

By Email: info@hughes-paddison.co.uk  

By Post: 

Attn: Compliance Manager
Hughes Paddison Solicitors
9-10 Royal Crescent
Cheltenham
Gloucestershire 
GL50 3DA  

or 

By Telephone:

01242 574244