Menu

Privacy Policy

This privacy policy sets out how United Legal Access CIC uses and protects any information that you give.

Data Privacy Policy

Effective Date: 22nd June 2026, Version 1.0

1. Introduction

United Legal Access CIC ‘ULA’ (referred to as “we” “our” or “us”) is committed to protecting your personal data in accordance with applicable UK data protection law; The UK GDPR, Data Protection Act 2018, Privacy and Electronic Communications Regulations 2003 (‘PECR’) and the Data (Use and Access) Act 2025. This also includes (and is not limited to) other applicable laws such as the EU GDPR and e-Privacy Directive.

This privacy notice has been designed with an individuals (‘data subjects’) right to be informed to how we collect and process personal data, how we use it, secure it and what rights individuals have.

We are registered with the Information Commissioners Office (the ICO) under registration number ZB330451.

2. Contact Information

Our head office contact details are as follows:

7 Bell Yard
London
WC2A 2JR
United Kingdom

Email: info@unitedlegalaccess.com

The Data Protection Officer (DPO) for ULA is as follows:

Name: RA Data Protection Ltd

Email: ravi@radataprotection.com

Website: https://radataprotection.com

3. Legal Basis

The legal basis for which we will process personal data are:

  • Consent
  • Contractual obligation
  • Legal obligation
  • Vital interests
  • Our legitimate interests

Also due to the nature of our organisation we may need to process special category personal data. Where we process special category personal data we ensure the relevant special condition is identified as required.

4. Data Subjects

Due to our business activities, we may process personal data of the following individuals (“data subjects”):

  • Enquirers
  • Claimants
  • Employees (including job applicants)
  • Volunteers
  • Social media users
  • Suppliers/Vendors

The above is representative and non-exhaustive.

5. Personal Data We Collect

The personal data we process consists of the below:

  • Name
  • Postal address (including country)
  • Email address
  • Telephone number
  • Recruitment data (e.g. CVs)
  • Photographic ID (e.g. passports)
  • Health information
  • Information related to legal claims

The above list is non-exhaustive and representative.

6. How We Collect Personal Data

We collect personal data through different ways. Examples include:

  • Through our websites
  • Through calls, emails, letters
  • Social media interactions

The above list is non-exhaustive and representative.

7. How We Use Personal Data

We will only use your personal data for the below processing activities:

  • To communicate with you regarding our services
  • To process claims and carry out enquiries
  • For our internal records
  • To update and improve our website
  • For any legal disputes and defend legal claims
  • Marketing news and communications
  • Handle any enquiries or complaints

The above list is non-exhaustive and representative.

8. Third-Parties Who We May Share Personal Data With

We do not rent, sell or purchase personal data to and from other organisations. In order to ensure we can complete various activities we may need to share personal data to other third parties we contract. Below are examples of who we may share personal data with:

  • Legal and compliance advisers (e.g. HR and legal advisers)
  • External IT and website support services
  • Third party law firms for Windrush Compensation Scheme support services

The above list is non-exhaustive and representative. Where we are required to share data with third parties, we will work with them to ensure the correct agreement is put into place.

Please note there may also be instances where we may need to share personal data with a competent law enforcement body, regulatory body, government agency, court, or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation or (ii) to exercise, establish or defend our legal rights.

9. Children’s Data

We do not specifically market to children however we understand some enquiries may involve personal data of children under the age of 18 years old, and those under 18 may also seek our services directly.

Where we receive enquiries from those under 18 we will ensure we gain consent from a parent/legal guardian and/or if they have capacity to fully understand our services they are requesting, including requests for data (i.e. a Data Subject Access Request).

For further information you can contact us using our details above.

10. Pro-Bono Legal Advice Services

We offer a free online legal advisory service to help with certain legal matters you may have. Those in need of the legal advisory services will need to submit a ticket via our website and any accompanying documents if needed. This also includes any enquiries into the validity of a potential legal matter sent to us. We will issue to the requestor a client care letter to also onboard clients as well, so it is important we receive accurate personal data at all times otherwise this may affect any legal claims raised to us.

Those requiring our legal advisory services should be aware the use of the services is at their own risk and we are not responsible or liable for any information (including documentation) they may share with us.

We will retain any information and documentation in line with our insurance and retention periods so any requests for deletion may not be possible. For further information you can contact us using our details above.

11. Windrush Compensation Services

Those looking to make use of our Windrush Compensation Services will need to complete a Client Information Agreement as part of our client onboarding process. We cannot assist with Windrush Compensation Services without this agreement in place.

As part of the Windrush Compensation Services we will ask for a “Consent and Authority Form” to be complete so we can carry out certain activities on a clients behalf. This also enables us to contact approved third party law firms (as mentioned in section 8 above) as and when required.

Once a claim has ended we will send out a “Closure Letter” and will retain data in line with our retention practices.

For further information you can contact us using our details above.

12. Will Writing Services

We can help with will writing services with an approved will writing software. We do not execute or carry out wills should someone using our will writing services passes away. We keep wills in our software for up to 12 years in which they are automatically removed from our software system.

13. WhatsApp enquiries and Call Recordings

We use the Business version of WhatsApp to help with claimant enquiries and their cases, specifically for Windrush Compensation Scheme. The use of WhatsApp helps ensure more specific and timely responses and helps with sharing of documentation from claimants if they chose to do so. Our use of WhatsApp is dedicated to our internal team members only and no external third parties, but also note we may share messages received with approved law firms as and when required to help with support services.

We are not responsible for any documents and contents shared via WhatsApp and these are the responsibility of those making use of WhatsApp as a communications tool.

Any data and documentation sent to us via WhatsApp will only be kept for a certain period of time in line with our retention settings, so any information requests related to WhatsApp (e.g. Data Subject Access Requests) may not be available.

Any calls made to us via WhatsApp are not recorded either. For more information you can contact us using our details above.

14. Job Applicants and Volunteer Recruitment

From time to time we may advertise job vacancies on our website or on third party websites such as Indeed, and we do the same when we are able to recruit for volunteers. When we advertise for job vacancies or volunteers we will process personal data which can include (and is not limited to):

  • Names
  • CV information
  • Social media profiles (e.g. LinkedIn profiles)
  • References

We use the above personal data to help with shortlisting and background checks to assess suitability of both job applicants and volunteers. Volunteers will need to specify what they are applying for so we are able to ensure they are allocated to the relevant function, legal advisory or Windrush Compensation Scheme. Also note we may be able to review information on your LinkedIn profile that may not be on your CV which can affect your application.

Any job applicants who may provide legal advice as part of their roles, and legal advisory volunteers will need to provide a valid certificate in the last 2 years of an enhanced DBS check. We do not have official authority to conduct such checks and we will only keep a copy for our records, and we will issue a Solicitors Agreement as part of the onboarding process. This does not apply to Windrush Compensation Scheme volunteers.

For further information towards job applicants and volunteer recruitment please contact us using our information above.

15. Marketing and Social Media

We currently do not carry out any email marketing communications, and we will update our notices if this was to change.

We use social media sites such as Facebook and Instagram to share news, updates and for promotional activities as a few examples. Our use of social media enables us to interact with customers (including potential customers), reach new audiences and showcase our products and services as a few examples. When you interact with us on social media through means such as “likes”, “shares” or leaving comments this enables us to see certain social media details (e.g. names, social media handles and photos). We don’t record or copy any social media profiles or details, but you should be aware when interacting with us on social media, other users or viewers can view your profile and any comments/feedback and it is your responsibility to ensure you have set up suitable and appropriate privacy settings for your use of social media.

16. Data Transfers Outside The UK

As with many companies based in the UK there may be instances of where your personal data may need to be transferred to other countries. These countries may be in the European Economic Area (EEA; The EU member states, Norway, Iceland and Liechtenstein), in an adequate listed country or in other third countries who may not have strict and similar data protection laws to the UK. Where we have identified personal data needs to be transferred outside the UK we will ensure there is a legitimate purpose for the data transfer, it is documented where needed and the correct data transfer mechanism under data protection law is relied on. For more information you can contact us using our details above.

17. Cookies

For details on the cookies we use on this website and how you can change your consent, please see our cookie notice on our website.

18. Links To Other Websites

This website contains links to other third party websites. We have no control or are liable of these sites, the content on these sites and how these sites protect your personal data. Please refer to their own privacy notices within them.

19. Data Retention

As a data controller we will retain personal data to provide our services and for a reasonable period thereafter to enable us to meet our contractual, insurance and legal obligations.

We will retain personal data for as long as necessary in line with various requirements, such as for example, best practice recommendations (e.g. ICO recommendations), relevant guidelines (e.g. ACAS guidance) or for as long as mandated under specific legislation (e.g. HMRC requirements). We will also determine appropriate retention periods based on our legitimate interests where identified.

At the end of the retention period personal data will be securely deleted or anonymised.

20. Data Security

We have put in place appropriate security measures to prevent personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality. If we become aware of any loss, misuse, alteration of personal data we will investigate the incident at hand and report (when needed to relevant parties) such instances.

21. Data Subject Rights

Under data protection law individuals have the following rights:

  1. Right to be informed
  2. Right to access personal data
  3. Right to rectify personal data
  4. Right to erase personal data
  5. Right to object to personal data
  6. Right to have data ported
  7. Right to restrict personal data
  8. Right to not have personal data processed by automated means and profiled

If you would like to exercise any of the above Rights you can do so by sending a written request using details above. Please note we may ask for ID (e.g. passport scan, drivers license etc) to verify identity where needed. Upon successful verification we will delete and remove all copies of ID received.

Should we also require extension of time to help fulfil any Right requests, we will be sure to contact requestors as soon as possible with reason(s) why an extension is needed and when Right requests can be fully carried out and completed.

22. Concerns and Complaints

If you have any concerns and/or complaints to this privacy notice and/or to how we process personal data please contact us using our details above.

You can make a complaint to the ICO (or other supervisory authority) at any time however, we hope that you would consider raising any issue or complaint you have with us first. You can submit a complaint to the ICO via https://ico.org.uk/make-a-complaint/.

23. Privacy Notice Updates

We will review this notice and make changes to it from time to time. We recommend that you check this notice to see where changes have been made and to ensure you are able to review updated information at all times.