Privacy Policy
How we collect, use, share and protect personal data, and the rights available to you under the UK GDPR.
01Data controller
Sea&Mew IP Ltd is the data controller responsible for the personal data described in this policy. Our registered office is 17 College Court Road, Enfield, EN3 4FQ, United Kingdom. We are registered with the UK Information Commissioner's Office (ICO) as a data controller.
02Data we collect
We collect and process the following categories of personal data:
a. Information you provide through forms
When you submit our enquiry or contact form we collect your name, email address, optional telephone number, and the content of your message. If you engage us, we also collect identification, matter and billing information necessary to act for you.
b. Information from communications
We keep records of correspondence with you — including emails, letters and call notes — in order to handle your matter, maintain an accurate file, and comply with our professional and legal obligations.
c. Technical and log data
When you visit the website, our hosting infrastructure may automatically record limited technical data such as IP address, browser type and version, device type, referring page, and pages visited. This data is used to keep the site secure and functioning.
d. Cookies and similar technologies
We use a minimal set of cookies. Details of the categories, purposes and how to manage them are set out in our Cookie Policy.
03Purposes and lawful bases
Under the UK GDPR we must have a lawful basis for each processing activity. The table below sets out our purposes, the data involved and the lawful basis relied on (referencing Article 6).
| Purpose | Data used | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Responding to enquiries and providing quotations | Enquiry form, email and correspondence | Legitimate interests (Art. 6(1)(f)); steps prior to entering a contract (Art. 6(1)(b)) |
| Taking instructions and performing professional services | Identity, contact, matter and billing details | Performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Client due diligence and conflict checks (AML/KYC) | Identity documents and screening results | Legal obligation (Art. 6(1)(c)); substantial public interest (Art. 9(2)(g)) |
| Billing, payments and accounting records | Invoice and payment data | Performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Operating, securing and improving the website | Technical and log data | Legitimate interests (Art. 6(1)(f)) |
| Analytics and site performance measurement | Aggregated/anonymised usage data | Consent (Art. 6(1)(a)) where required — see Cookie Policy |
| Direct marketing to prospective clients | Contact details | Consent (Art. 6(1)(a)) or legitimate interests (Art. 6(1)(f)) with an opt-out |
| Establishing, exercising or defending legal claims | Relevant records | Legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have carried out a balancing assessment to confirm that our interests are not overridden by your rights. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Where processing is necessary to comply with a legal obligation, providing the data is required by law.
04How we share data
We share personal data only where necessary and with appropriate safeguards. Recipients may include professional advisers and agents instructed on your matter (for example associate attorneys, counsel or foreign agents in other jurisdictions), IT, hosting and communications providers acting as our processors, our accountants and auditors, and official registries and authorities where required to file or prosecute your rights.
We may also disclose data where required by law, by a regulator or court order, or to establish, exercise or defend legal claims.
05International transfers
Some of our service providers and correspondent agents are located outside the United Kingdom. Where personal data is transferred outside the UK, we ensure a lawful transfer mechanism is in place — for example the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or a transfer to a jurisdiction covered by UK adequacy regulations — together with any additional safeguards required following a transfer risk assessment.
You may request further information about the safeguards we rely on by contacting us at sandy@sea-mew.uk.
06Retention periods
We retain personal data only for as long as necessary for the purposes set out above, including to satisfy legal, accounting and regulatory requirements. Indicative retention periods are:
- Unsuccessful enquiries: up to 12 months, unless you ask us to keep them for longer;
- Client matter files: generally 6 years after the matter closes, reflecting limitation and professional-indemnity requirements;
- Identity and AML records: 5 years after the end of the business relationship, as required by anti-money-laundering law;
- Accounting and tax records: 6 years from the end of the relevant accounting period;
- Website technical/log data: short rolling periods determined by our hosting provider.
Where a longer period is required (for example where a claim is pending), we may retain data for longer. When data is no longer needed it is securely deleted or anonymised.
07Security
We maintain appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These include access controls and least-privilege permissions, encryption of data in transit, secure storage of physical and electronic files, staff confidentiality obligations, and supplier due diligence. No method of transmission or storage is entirely secure, but we review our safeguards regularly and will notify the ICO and affected individuals of a notifiable personal data breach without undue delay.
08Your rights
Under the UK GDPR you have the following rights in relation to your personal data:
- Access — to obtain confirmation of whether we process your data and a copy of it;
- Rectification — to have inaccurate or incomplete data corrected;
- Erasure — to have your data deleted where there is no overriding lawful reason for us to keep it;
- Restriction — to limit the way we use your data in certain circumstances;
- Objection — to object to processing based on legitimate interests or to direct marketing at any time;
- Portability — to receive data you provided in a structured, commonly used, machine-readable format, or to have it transmitted to another controller;
- Withdraw consent — to withdraw consent at any time where processing is based on consent.
To exercise any of these rights, email sandy@sea-mew.uk. We may need to verify your identity before acting. These rights are not absolute and may be subject to exemptions.
09Cookies
Our website uses a small number of cookies and similar technologies. Full details — including the categories we use, what is strictly necessary, and how to manage or delete cookies in your browser — are set out in our Cookie Policy.
10Contact and complaints
Questions, requests and complaints about our processing of personal data should be directed to sandy@sea-mew.uk. We take concerns seriously and will investigate promptly. If you remain dissatisfied you have the right to complain to the ICO using the details above.