Privacy Policy

1. Introduction

Sterling Lawyers Ltd, trading as Sterling Law, is committed to protecting your privacy and handling your personal data transparently and responsibly. This Privacy Policy explains what data we collect through this website, why we collect it, how it is processed, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy applies to all of the services offered through this website, including our settlement agreement review service, our wills, probate and estate administration service, and our frozen bank account service. Where a particular service involves data we do not collect for the others, that is identified in the relevant section below.

Please read this policy carefully.

2. Who we are

Sterling Lawyers Ltd, trading as Sterling Law (sterling-law.co.uk), is a firm of solicitors authorised and regulated by the Solicitors Regulation Authority (SRA No. 630147) and registered in England and Wales (Company No. 09711065). Sterling Lawyers Ltd is the data controller responsible for your personal data. We are registered with the Information Commissioner’s Office under registration number ZA205976.

Data Controller: Sterling Lawyers Ltd (trading as Sterling Law), Temple Chambers, 3-7 Temple Avenue, London, EC4Y 0DT
Contact: employment.sa@sterling-law.co.uk · +44 20 4524 4624

3. Data we collect

3a. Information you provide

When you submit an enquiry, book a call, or otherwise get in touch about any of our services, we collect:

• Identity and contact data: your name, email address, and phone number.
• Enquiry data: the service you are enquiring about and your answer to the short question that accompanies it — for example the type of matter you need help with (probate, a will, a lasting power of attorney), or what has happened to your account (a freeze with no explanation, an Account Freezing Order, funds withheld after closure).
• Appointment data: the date and time of your booking and any notes you provide when booking an onboarding call or solicitor consultation.
• Matter information: details of your situation and any documents you choose to share with us so that we can advise you. What this includes depends on the service:
  • Settlement agreement review — your settlement agreement, employment contract, correspondence with your employer, and identification.
  • Wills, probate and estate administration — information about the estate and its assets, the will, family and domestic circumstances, and information about other people such as executors, beneficiaries and family members (see section 3c), together with identification. It may also include information about a person who has died; UK data protection law applies to living individuals, but we treat information about the deceased with the same confidentiality.
  • Frozen bank accounts — bank correspondence and notices, any Account Freezing Order served on you, account statements, evidence of the source of the funds held, details of your outgoings, and identification. Because these matters arise out of suspected financial crime, this can include information about criminal allegations, investigations or proceedings involving you — see section 3d.

Providing your identity and contact data is necessary for us to respond to your enquiry; without it we cannot contact you. Providing identification documents and information about the source of funds is a legal requirement under the Money Laundering Regulations before we can act for you. If you do not provide it, we will be unable to take on your matter.

3b. Technical and usage data

Collected when you visit our website, subject to your cookie choices:

• IP address — collected server-side on form submission
• Browser user agent — device and browser type
• Google Analytics client ID — extracted from the _ga cookie to link your browsing session with GA4 reports (only where you have accepted analytics cookies)
• Google click ID (gclid) — stored in a first-party cookie by the Google Ads Conversion Linker tag when you arrive via a Google Ad, used to attribute confirmed bookings to the correct advertising campaign; set only after you accept marketing cookies
• Hashed contact details— if you have accepted marketing cookies and you then submit an enquiry or confirm an appointment booking, Google's tag takes contact details that appear on the page (such as your email address, phone number and name), creates a SHA-256 hash of each (not the details themselves) and sends them to Google Ads (Enhanced Conversions) to match the enquiry or booking to the Google Ad click that brought you to the site. Hashing is designed so that your details cannot readily be recovered from the values sent, and Google's terms restrict their use to matching. If you have not accepted marketing cookies, no hashed contact details are sent to Google
• Conversion IDs — unique identifiers used to deduplicate conversion events across our analytics platforms
• Page interaction events: scroll depth, CTA clicks, form start, link clicks — tracked via Google Analytics 4
• Anti-bot verification data — our enquiry forms are protected by Cloudflare Turnstile. When you submit a form, your IP address and a short-lived, single-use token generated in your browser are sent to Cloudflare so it can confirm the submission comes from a person rather than an automated script. This is a strictly necessary security measure, is not used for advertising or profiling, and operates whatever your cookie choices are.

Not every service on this website is covered by analytics. Where analytics is not enabled for a particular service, no analytics or advertising tags load on that service's pages at all and none of the analytics data described above is collected there, regardless of your cookie choices.

3c. Information about other people

Some matters, particularly probate and estate administration, require information about people other than you. That can include executors, administrators, beneficiaries, family members, and people with an interest in a will or an estate. Frozen account matters can similarly involve a joint account holder or a business partner.

Where you give us personal data about someone else, we ask you to make sure you are entitled to share it with us. We use that information only to advise on and progress the matter you have instructed us about, and we hold it under the same confidentiality and security arrangements as your own data. We do not use it to market to those people.

If we hold your personal data because someone else provided it to us in connection with a matter, you have the same rights set out in section 13, and you can contact us using the details in section 16. In some cases we may be unable to disclose information to you, or unable to contact you directly, where doing so would breach our professional duty of confidentiality or legal professional privilege owed to our client, or would prejudice a matter — these are recognised exemptions under the Data Protection Act 2018.

3d. Criminal offence data

If you enquire about a frozen bank account, the information you give us may relate to criminal allegations, investigations or proceedings — for example a Suspicious Activity Report made about your account, an Account Freezing Order obtained by an enforcement authority, or a wider financial crime investigation. Information of this kind is treated as criminal offence data under Article 10 UK GDPR and receives additional protection.

Enquiring about this service does not imply any wrongdoing on your part, and accounts are frequently frozen where the funds are entirely legitimate. We process this information only to advise and act for you, we restrict access to it to the personnel working on your matter, and we process it in reliance on a condition in Schedule 1 to the Data Protection Act 2018 — principally the condition permitting processing that is necessary for the purpose of, or in connection with, legal proceedings, obtaining legal advice, or otherwise establishing, exercising or defending legal rights. See section 8 for the corresponding legal bases.

Separately, the identity, anti-money-laundering and sanctions checks we carry out for every client may reveal information about criminal convictions or offences, for example through sanctions, politically exposed person or adverse media screening. We process that information under Article 10 UK GDPR in reliance on the conditions in paragraphs 10 and 12 of Schedule 1 to the Data Protection Act 2018 (preventing or detecting unlawful acts, and complying with regulatory requirements), and we maintain an appropriate policy document as required by Part 4 of that Schedule, which is available on request.

4. How we use your data

• Responding to your enquiry and arranging and conducting your call.
• Providing the legal service you have enquired about, and related legal advice, if you proceed.
• Carrying out the identity, anti-money-laundering, conflict and source-of-funds checks we are required to complete before we can act for you.
• Creating and maintaining a record of your enquiry and matter in our case records.
• Attributing conversions to the correct advertising campaigns, where you have consented.
• Notifying our team internally that a new enquiry or booking has been received.
• Sending you service-related emails (for example, document requests and booking details).
• Measuring website performance and, where you consent, advertising effectiveness.
• Preventing misuse of our website and ensuring its security.
• Complying with our legal, regulatory, and professional obligations.

5. Analytics and tracking technologies

Analytics and advertising technologies are only initialised after you consent via our cookie banner. Until then, Google Consent Mode keeps analytics and advertising storage denied, so no analytics or advertising cookies are set.

5a. Google Analytics 4 (GA4)

Provider: Google LLC (USA).
GA4 collects data about how visitors use our website, including pages visited, events triggered (e.g. CTA clicks, scroll depth, form interactions), and session durations. Data is associated with a persistent _ga cookie containing a randomly generated client ID. UTM campaign parameters are attached to every event to enable source attribution in reports. Client-side GA4 tracking is only active after you accept analytics cookies via our consent banner.

Our server also sends Google Analytics a simple count each time an enquiry is submitted, an onboarding call is booked or a solicitor booking link is followed, including for visitors who declined cookies. These counts include no email address, name, cookie or device identifier, or reference to your case record.

Google's privacy policy: policies.google.com/privacy

5b. Advertising and conversion attribution

Where we run advertising campaigns, and only after you accept marketing cookies, we may use advertising cookies and tags (for example, Google Ads) to measure campaign performance and for remarketing. These are governed by the marketing option in our cookie banner via Google Consent Mode v2. No advertising cookies are set unless campaigns are active and you have consented.

We also use Google Ads Enhanced Conversions. When you submit an enquiry or confirm a booking having accepted marketing cookies, the hashed contact details described in section 3b are sent to Google Ads to match the enquiry or booking to the Google Ad click that brought you to the site, improving the accuracy of our campaign reporting. They are sent only where you have accepted marketing cookies, and do not involve sharing your contact details in readable form.

6. Lead and matter management

Enquiries and bookings are recorded in our own case-management records, hosted on our secure infrastructure, and our team is notified internally (via Slack) when a new enquiry is received. Records may include your name, email, phone number, appointment details, matter notes, workflow status, and timestamps. Document collection for your matter is handled through a separate agreed channel and is not uploaded through this website.

We do not use automated decision-making or profiling to decide whether to respond to your enquiry or whether to act for you. Those decisions are made by our staff.

7. Third-party processors and data sharing

We only share your information with third parties when necessary to deliver our service or where legally required. Our current processors are:

• Google LLC — online appointment scheduling and calendar, and GA4 website analytics (USA; certified under the UK Extension to the EU-US Data Privacy Framework — see section 10).
• Slack Technologies (Salesforce, Inc.) — internal notifications to our team (USA; certified under the UK Extension to the EU-US Data Privacy Framework — see section 10).
• Cloudflare, Inc. — anti-bot verification on our enquiry forms (Cloudflare Turnstile) and network-level protection for this website. It processes your IP address and the verification token described in section 3b (USA; certified under the UK Extension to the EU-US Data Privacy Framework — see section 10).
• Resend (Resend, Inc.) — our transactional email provider, used to send you service-related emails (such as document requests and booking details); it processes your email address and the email content. Email is sent from Resend's EU region (Ireland).
• DigitalOcean — provides the virtual private server, located in London, United Kingdom, on which we self-host our application and database (managed with Coolify). Your case records are stored here, in the UK.
• Regulators, professional bodies, or authorities — where we are legally required to disclose.

We never sell your personal data to third parties.

8. Legal bases for processing (UK GDPR)

• Enquiry and booking data — Steps prior to a contract and contractual necessity (Article 6(1)(b)): to respond to your enquiry, arrange and conduct your call, and provide the service if you proceed.
• Maintaining our case records and internal notifications — Legitimate interests (Article 6(1)(f)): keeping accurate records of enquiries and managing client relationships, where not overridden by your rights.
• Analytics and advertising cookies, and the hashed contact details sent for Google Ads Enhanced Conversions (sections 3b and 5b) — Consent (Article 6(1)(a)): only activated after you accept cookies via our banner.
• Security, anti-bot verification and prevention of misuse — Legitimate interests (Article 6(1)(f)): protecting our website, staff, and clients, and keeping our enquiry forms usable by preventing automated abuse.
• Identity, anti-money-laundering and source-of-funds checks — Legal obligation (Article 6(1)(c)): compliance with the Money Laundering Regulations and our obligations as a regulated firm.
• Regulatory and professional obligations — Legal obligation (Article 6(1)(c)) and our professional duties as solicitors.
• Information about other people provided to us in connection with a matter (see section 3c) — Legitimate interests (Article 6(1)(f)): advising our client and progressing the matter we have been instructed on, where not overridden by the rights of the individuals concerned.
• Special category data (for example, health, or details of family or domestic circumstances relevant to your matter) — processed only where an Article 9 UK GDPR condition applies, such as the establishment, exercise, or defence of legal claims, or with your explicit consent.
• Criminal offence data (see section 3d) — processed under Article 10 UK GDPR together with a condition in Schedule 1 to the Data Protection Act 2018, principally the condition for legal proceedings, obtaining legal advice, and establishing, exercising or defending legal rights (paragraph 33) and, for anti-money-laundering and sanctions screening, the conditions for preventing or detecting unlawful acts and complying with regulatory requirements (paragraphs 10 and 12), supported by our appropriate policy document. Access is restricted to the personnel acting on the matter.

9. Cookies

We use a consent banner for non-essential cookies. If you decline, only strictly necessary functionality remains active and no analytics or advertising cookies are set. You can change your choice at any time using the "Cookie settings" link in the footer.

Essential (always active)

• sl_cookie_consent — stores your cookie consent choice (browser localStorage; retained until you clear it or the policy version changes).
• Security and session cookies for our internal admin area, used only by authorised staff.

Analytics (consent required)

• _ga and _ga_<id> — Google Analytics 4 client and session identifiers, used to distinguish users and sessions (up to 2 years). Set only after you accept analytics cookies.

Advertising (consent required)

• Advertising cookies (for example, Google Ads and the Conversion Linker gclid cookie) for conversion measurement and remarketing. Set only where campaigns are active and you accept marketing cookies.

10. International data transfers

Your case records are stored on our server in the United Kingdom. Service-related email is processed within the EU/EEA (Ireland), which is covered by the UK's adequacy regulations. Some processors — including Google, Slack and Cloudflare — are based in the United States. Each is certified under the UK Extension to the EU-US Data Privacy Framework (the "UK-US Data Bridge"), which the UK government has recognised under the Data Protection (Adequacy) (United States of America) Regulations 2023 as providing adequate protection. Where a transfer is not covered by that certification, we rely on the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK Addendum, in accordance with Article 46 UK GDPR.

11. Data retention

• Enquiries that do not become matters: retained for 12 months from your last contact with us, after which they are deleted or anonymised.
• Enquiry and matter records: retained for 6 years from the conclusion of the matter, in line with our legal, regulatory, and professional obligations.
• Documents you share: retained for 6 years from the conclusion of your engagement, in line with applicable regulatory requirements.
• Wills, probate and estate files: retained for at least 12 years from the conclusion of the matter, reflecting the longer periods over which an estate, a trust, or a claim against an estate can be revisited.
• Original wills, codicils and deeds left with us for safe custody: retained indefinitely for as long as they remain in our custody, because the original document must still be available when it is needed. You can ask us to release an original document to you or to another firm at any time.
• GA4 analytics data: up to 14 months (Google's default retention setting).
• Server logs (IP address, user agent): 90 days.
• Anti-bot verification data: the Turnstile token is single-use and short-lived; Cloudflare retains verification data in line with its own retention policy and we do not keep a separate record of it beyond our server logs above.

12. Data security

• All data is transmitted over HTTPS (TLS encryption).
• Access to our case records and admin area is restricted to authorised personnel.
• We apply appropriate technical and organisational measures to protect your data.
• We conduct regular reviews of our data processing practices and third-party processor agreements.

13. Your rights under UK GDPR

You have the following rights regarding your personal data:

• Right of access (Article 15): request a copy of the personal data we hold about you.
• Right to rectification (Article 16): request correction of inaccurate or incomplete data.
• Right to erasure (Article 17): request deletion where there is no lawful basis for continued processing.
• Right to restrict processing (Article 18): ask us to limit how we use your data while a dispute is resolved.
• Right to data portability (Article 20): receive your data in a structured, machine-readable format.
• Right to object (Article 21): object to processing based on legitimate interests.
• Right to withdraw consent: withdraw analytics/advertising consent at any time via "Cookie settings" — this does not affect the lawfulness of prior processing.
• Rights in relation to automated decision-making (Article 22): as explained in section 6, we do not make decisions about you based solely on automated processing.

To exercise any of these rights, contact us at employment.sa@sterling-law.co.uk. We will respond within one month of receiving your request. Where a request is complex, or you have made several requests, we may extend that period by up to two further months; if so, we will tell you within the first month and explain why. We may also ask you to verify your identity before we respond.

Some of your rights are subject to exemptions under the Data Protection Act 2018. In particular, we may be unable to disclose information that is subject to legal professional privilege or that we hold in confidence for another client (see section 3c).

14. Complaints

If you are unhappy with how we handle your data, please contact us first so we can try to resolve it. You also have the right to complain to the UK Information Commissioner's Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113

15. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be indicated by an updated "Last updated" date at the top of this page. We encourage you to review this policy periodically.

16. Contact us

For any questions about this Privacy Policy or your personal data:

• Email: employment.sa@sterling-law.co.uk
• Post: Sterling Law, Temple Chambers, 3-7 Temple Avenue, London, EC4Y 0DT