Privacy policy
How we handle personal information about visitors to this website and the people we act for.
Who we are
Thirsk Winton LLP (“we”, “our”, “us”) is a limited liability partnership registered in England and Wales (OC346094) with its registered office at Swan House, 9-12 Johnston Road, Woodford Green, Essex IG8 0XA. We are the data controller for the personal data described in this notice. Questions about this notice or about our use of your personal data should be sent to office@thirskwinton.co.uk or to the address above, marked for the attention of the Data Protection Lead.
This notice explains what personal data we collect when you use our website or when we provide legal services, why we collect it, who we share it with and the rights you have. We may update it from time to time; the date of the latest version is shown at the foot of the page. Clients also receive more detailed information about how we handle their data in our terms of business.
The personal data we collect
- Enquiries. If you use the contact form, email or telephone us, we collect your name, contact details and the information you give us about your enquiry.
- Clients and matters. When you instruct us we collect the information needed to act for you, which may include identity documents, financial information and information about other people involved in your matter. We are required by the Money Laundering Regulations to verify the identity of our clients and, where relevant, their beneficial owners.
- Website use. With your consent we use Google Analytics to understand how the website is used (see cookies, below). Our hosting provider records standard server logs, including IP addresses, for security purposes.
Why we use personal data and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Responding to your enquiry | Our legitimate interest in answering enquiries about our services |
| Providing legal services to you | Performance of our contract with you |
| Verifying identity and preventing money laundering | Compliance with our legal obligations |
| Complying with our professional and regulatory obligations | Compliance with our legal obligations and our legitimate interest in meeting SRA requirements |
| Sending occasional legal updates to existing clients and contacts | Our legitimate interest in keeping clients informed; you may opt out at any time |
| Understanding how the website is used | Your consent |
| Keeping our systems secure and preventing fraud | Our legitimate interest in protecting our business and clients |
Where we process special category data, for example health information relevant to a Court of Protection application, we do so because it is necessary for the establishment, exercise or defence of legal rights, or with your explicit consent.
Who we share personal data with
We share personal data only where necessary to act for you or to run our practice. Recipients may include: counsel, experts, other parties’ solicitors, courts and tribunals, HM Land Registry, HMRC, Companies House and other public bodies; our regulators, auditors and insurers; identity verification and anti-money-laundering screening providers; and the providers of the software and hosting services we use to run the firm. Our website is hosted on Microsoft Azure and enquiries submitted through the contact form are delivered to us by Twilio SendGrid. Where a provider processes personal data on our behalf, we have a written contract requiring them to protect it.
Some of our providers process data outside the United Kingdom. Where they do, we rely on UK adequacy regulations or on the International Data Transfer Agreement or Addendum, together with any additional safeguards needed.
How long we keep personal data
We keep client files for at least six years after a matter closes, and for longer where the nature of the matter requires it (for example wills, trusts and property transactions, where the file may be retained indefinitely). Enquiries that do not lead to an instruction are deleted after twelve months. Analytics data is retained by Google for 14 months.
Security
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or alteration, including access controls, encryption of data in transit, multi-factor authentication and staff training.
Your rights
You have the right to ask for a copy of the personal data we hold about you, to have inaccurate data corrected, to ask us to delete data or restrict how we use it, to object to processing based on our legitimate interests, to withdraw consent where we rely on it, and to receive data you have given us in a portable format. To exercise any of these rights, contact office@thirskwinton.co.uk. There is normally no charge and we will respond within one month.
If you are unhappy with how we have handled your personal data you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would welcome the chance to address your concerns first.
Cookies {#cookies}
This website sets no cookies until you make a choice on the banner shown on your first visit.
- Google Analytics (optional, only with your consent): cookies beginning
_gaare set by Google to distinguish visitors and measure how the site is used. IP addresses are anonymised. You can withdraw consent at any time by clearing your browser’s site data for this website, after which the banner will appear again. - Your consent choice is stored in your browser’s local storage under the name
tw-consentso that we do not ask you again. It contains only the word “accepted” or “declined”. - Google reCAPTCHA protects the enquiry form on the contact page from automated abuse. It loads only on that page and may set a
_GRECAPTCHAcookie and collect device and interaction data, which Google processes under its privacy policy. We rely on our legitimate interest in keeping the form secure; the strictly necessary exemption in the Privacy and Electronic Communications Regulations applies. - SRA digital badge: the badge in the footer is served by Yoshki on behalf of the Solicitors Regulation Authority and confirms that we are a regulated firm. It does not set cookies for tracking purposes.
Links to other websites
This website contains links to other sites, including those of regulators and public bodies. We are not responsible for the privacy practices of other websites and encourage you to read their privacy notices.
Last updated 23 September 2026.