Privacy Notice

Last updated: September 2026.

Data controller

Filippi Legal Consultancy Ltd, registered in England and Wales, company number 17365550.

Email: compliance@filippilegalconsultancy.com

1. Who we are

Filippi Legal Consultancy provides unregulated legal services in England and Wales. For the purposes of UK data protection law, namely the UK GDPR and the Data Protection Act 2018, it is the controller of the personal data described in this notice.

Data protection enquiries: compliance@filippilegalconsultancy.com

2. What data is collected

• Enquiry data: name, email address, preferred language, and any information provided about the situation when contact is made.
• Client file data: where an engagement proceeds, identity documents collected for client due diligence, correspondence, documents relating to the matter, and billing records.
• Special category and criminal offence data: some matters involve sensitive information, such as health, ethnic origin or allegations of criminal conduct. This is processed only where necessary for the matter and only where a condition under Articles 9 or 10 of the UK GDPR applies, most often the establishment, exercise or defence of legal claims.
• Third-party data: documents provided by clients often contain personal data relating to other people. This is processed as part of the matter and handled on the same basis as client file data.
• Website data: this website sets no analytics or advertising cookies and stores no form entries on a server. The contact form composes a message in the sender's own email application.

3. Why data is used, and the lawful bases

• To respond to enquiries and provide services: performance of a contract, or steps taken at the individual's request before entering a contract.
• To carry out conflict-of-interest and identity checks: legitimate interests in operating the consultancy properly, and compliance with legal obligations where anti-money laundering law applies.
• To keep records and accounts: compliance with legal obligations relating to tax, accounting and limitation periods.
• To establish, exercise or defend legal claims: legitimate interests.

Personal data is not sold, and is not used for automated decision-making or profiling.

4. Who data is shared with

Personal data is shared only where necessary for the matter or required by law:

• Service providers supporting the practice, including email, document storage and accounting software, under appropriate contractual safeguards;
• Other professionals involved with the client's agreement, such as a regulated firm to which a referral is made, or a lawyer in Brazil assisting with a Brazilian matter;
• Insurers, auditors, regulators or public authorities where required by law.

5. International transfers

Where a matter involves Brazil or another country outside the UK, personal data may be transferred there in order to progress the matter. Such transfers are made either under an appropriate safeguard, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, or because the transfer is necessary for the performance of the contract with the client or for the establishment, exercise or defence of legal claims. Some service providers supporting the practice are also located outside the UK. Where this is the case, transfers are protected by the safeguards described above.

6. How long data is kept

• Enquiries that do not lead to an engagement: up to 12 months, then deleted.
• Client files: six years from the close of the matter, reflecting relevant limitation periods, then securely destroyed. Some files are kept longer where the nature of the matter makes a longer limitation period possible.
• Identity verification records: five years from the end of the business relationship, in line with anti-money laundering requirements where they apply.
• Accounting records: six years, as required by tax and company law.

7. Your rights

Under UK data protection law you may request:

• A copy of your personal data (subject access);
• Correction of inaccurate data, or completion of incomplete data;
• Erasure of data, restriction of processing, or objection to processing based on legitimate interests;
• Transfer of data in a portable format, where applicable;
• Withdrawal of consent, where processing is based on consent.

These rights are not absolute. Some data must be retained to comply with legal obligations, or to establish, exercise or defend legal claims, and a request may be refused in whole or in part on that basis. Where a request is refused, the reasons are given.

To exercise a right, email compliance@filippilegalconsultancy.com. A response is provided within one month, which may be extended by up to two further months for complex or numerous requests, in which case notice of the extension is given within the first month.

A complaint may also be made to the Information Commissioner's Office at ico.org.uk.

8. Security

Client information is held in access-controlled, encrypted systems. Physical documents are stored securely and destroyed confidentially. Security arrangements are reviewed periodically.

9. Changes

This notice is updated as the practice develops, and the date of the latest version appears at the top of this page. Where a change materially affects how personal data is used, clients and enquirers are notified directly.