Zavri Legal ("Zavri", "we", "us", "our") is the data controller in respect of personal data collected through this website and through our legal introduction services. As data controller, we are responsible for deciding how and why your personal data is processed.

If you have any questions about how we handle your personal data, or if you wish to exercise any of your rights under UK GDPR, please contact us using the details above.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. We would, however, appreciate the opportunity to address your concerns before you contact the ICO.

We collect and process the following categories of personal data about you, depending on how you interact with us:

We do not intentionally collect personal data about children under the age of 16. If you believe we have collected data about a child, please contact us immediately using the details in PP1.

We collect personal data through the following means:

Direct interactions

You provide personal data directly when you: submit an enquiry through our website; create an account; email, call, or otherwise contact us; respond to a quote or instruction; or submit a review or feedback.

Automated technologies

When you visit our website, we automatically collect technical and usage data using cookies, server logs, and similar technologies. Please see our Cookie section (PP9) for further details.

Third parties

We may receive personal data about you from: identity verification providers; analytics providers (such as Google Analytics); advertising platforms (such as Google Ads); and publicly available sources where relevant to verifying the information you provide.

We are required by UK GDPR to have a lawful basis for processing your personal data. The table below sets out the purposes for which we process your data and the lawful basis we rely on in each case.

Where we rely on legitimate interests as our lawful basis, we have carried out a balancing test to ensure our interests do not override your fundamental rights and freedoms. You have the right to object to processing based on legitimate interests — see PP7 for details.

Special category data

Where you voluntarily provide special category data (such as health information) in your legal enquiry, we process this on the basis of explicit consent (UK GDPR Article 9(2)(a)) for the purpose of referring your matter to an appropriate solicitor. You may withdraw this consent at any time, though doing so may affect our ability to refer your matter appropriately.

We may share your personal data with the following categories of recipients:

Network Firms

When you submit a legal enquiry, we share your personal data with the Network Firm we consider best placed to assist you. Currently our primary Network Firm is Londonium Chambers Limited (SRA: 620622). We may also refer to other SRA-authorised firms with whom we have a written referral agreement. Each Network Firm is an independent data controller and processes your data under its own privacy policy and SRA obligations from the point of referral onwards.

Service providers

We use third-party service providers to operate our business and website. These include:

• Website hosting and infrastructure providers (currently Hostinger)
• Analytics providers (currently Google Analytics — data processed in accordance with Google's privacy policy and our data processing agreement)
• Email service providers
• Identity verification and AML/KYC providers
• Customer relationship management (CRM) software providers

All service providers are required to process your data only on our documented instructions and in accordance with applicable data protection law. We carry out due diligence on all significant data processors before engaging them.

Legal and regulatory authorities

We may disclose your personal data to law enforcement agencies, regulatory bodies (including the SRA and ICO), courts, or other authorities where required or permitted by law.

Business transfers

If Zavri Legal is acquired, merged with another business, or transfers all or part of its assets, your personal data may be transferred to the acquirer as part of that transaction. We will notify you by email or prominent website notice before your data is transferred and becomes subject to a different privacy policy.

We do not sell your personal data to third parties. We do not share your personal data with any third party for their own marketing purposes.

Zavri Legal is based in England and Wales. Some of our service providers may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place in accordance with UK GDPR, including:

• Transfers to countries with an adequacy decision from the UK Secretary of State;
• Use of the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses; or
• Other lawful transfer mechanisms as approved by the ICO.

You may request details of the safeguards in place for any specific transfer by contacting us using the details in PP1.

If you are unsatisfied with our response to any request, you have the right to lodge a complaint with the ICO at ico.org.uk.

We retain personal data only for as long as is necessary for the purposes set out in this policy, having regard to our legal, regulatory, and contractual obligations. The following retention periods apply:

Where data is no longer required, we delete or anonymise it securely. Where deletion is not immediately possible (for example because data is stored in backup systems), we will isolate the data from further processing until deletion is possible.

Our website uses cookies — small text files placed on your device — to enable core functionality, analyse usage, and improve your experience. We use the following categories of cookies:

You can manage your cookie preferences at any time via the cookie consent banner shown when you first visit our website, or by adjusting your browser settings. Note that disabling strictly necessary cookies may affect how the website functions.

We have implemented appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, alteration, or disclosure. These measures include:

• SSL/TLS encryption for all data transmitted to and from our website (HTTPS)
• Access controls limiting data access to authorised personnel only
• Regular software and security updates
• Secure password policies and multi-factor authentication where available
• Regular backups and disaster recovery procedures

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it and will notify you without undue delay where the breach is likely to result in a high risk to you.

We may update this Privacy Policy from time to time to reflect changes in the law, our services, or our data processing activities. The date at the top of this page shows when it was last updated.

Where changes are material, we will notify registered users by email. Your continued use of our website after any changes constitutes acceptance of the updated policy. We recommend checking this page periodically.