This notice explains how I collect and use personal information when you visit sadikbugra.com, send me an enquiry, become a client, or are otherwise involved in a matter I am handling. It describes how my systems actually work. I will update it if that changes.
Who I am
The controller of your personal information is Sadik Bugra Isler, a solicitor practising as a freelance solicitor in his own name. I am an individual, not a company or firm, and I do not employ staff.
- Address: 2 Victoria Square, St Albans, AL1 3TF, United Kingdom
- Email: info@sadikbugra.com
I have not appointed a data protection officer and I am not required to do so. Please send any question about this notice or your personal information to the email address above.
Information I collect
When you visit the website
The public website does not set cookies and does not use analytics, advertising, tracking pixels, embedded third-party content or third-party fonts. The map on the website is an ordinary link to a mapping service, not an embedded map; if you follow it, the mapping service's own privacy terms apply.
Like any website, the servers that host it receive technical information such as your IP address, browser type and the pages requested. This information is kept in server logs for 14 days for security and to keep the site working. See Cookies for more detail.
When you send an enquiry
Enquiries are made by email to info@sadikbugra.com. The website itself has no form and does not collect or store anything you type. Your email will contain whatever you choose to send, usually your name, email address and a short description of your matter.
Please keep your first email brief and do not send documents or sensitive information, such as health details or information about criminal allegations, until I have confirmed that I can help.
Sending an enquiry does not sign you up to any marketing. I do not operate a mailing list or newsletter, and I will only use your details to deal with your enquiry.
When you become a client, or are involved in a matter
Depending on the matter, I may hold:
- identity and contact details, and identity documents used to verify who you are
- details of your business, your role in it and the people who own or control it
- the facts of your matter, correspondence, documents, evidence and my advice
- financial information relevant to the matter, such as invoices, debts, payments, and my fees
- in some matters, information about employment, tenancy or property arrangements
- in some matters, special category information (for example health information in an employment or housing dispute) or information about criminal allegations, offences or convictions.
Where the information comes from
Most information comes from you. Information may also come from:
- the other party to your matter and their representatives
- courts, tribunals and other public bodies
- witnesses, experts, barristers and other professionals involved in the matter
- public sources such as Companies House, the Land Registry, the Insolvency Service and the SRA register
- people who refer you to me or who contact me on your behalf.
If you are not my client but are involved in a matter (for example as the other party or a witness), I will usually have received your information from my client or from the documents in the matter.
How I use information and my lawful bases
| Activity | Purpose | Lawful basis |
|---|---|---|
| Responding to enquiries | Replying to you, assessing whether I can help, arranging an initial discussion | Steps you ask me to take before entering into a contract; otherwise my legitimate interests in responding to enquiries |
| Conflict checks | Making sure I can act without a conflict of interest, as my professional rules require | My legitimate interests in complying with my professional obligations |
| Identity and client due diligence | Verifying identity, preventing fraud and, where the Money Laundering Regulations 2017 apply to the work, carrying out the checks they require | Legal obligation where those Regulations apply; otherwise my legitimate interests in preventing fraud and meeting professional standards |
| Acting for clients | Advising, corresponding, negotiating, preparing documents, conducting proceedings and enforcing judgments | Performance of my contract with my client; for other people involved in the matter, the legitimate interests of my client and me in the matter being handled properly |
| Billing and accounts | Invoicing, recording payments, keeping tax and accounting records | Contract and legal obligation |
| Regulatory and legal obligations | Responding to my regulator, the Legal Ombudsman, my insurer, courts and lawful requests | Legal obligation; otherwise my legitimate interests in meeting my professional and insurance obligations |
| Complaints and claims | Handling complaints, and establishing or defending legal claims | My legitimate interests |
| Website and system security | Keeping the website and my email secure | My legitimate interests |
Special category and criminal offence information
Where I process special category information (such as health information) or information about criminal allegations, offences or convictions, I do so only where it is necessary to establish, exercise or defend legal rights, for legal proceedings (including prospective proceedings), or for obtaining or giving legal advice. These are the conditions in Article 9(2)(f) of the UK GDPR and Schedule 1 to the Data Protection Act 2018, including paragraph 33 (legal claims). In some cases another condition in Schedule 1 may apply, for example where processing is necessary for preventing fraud or for complying with regulatory requirements.
Automated decisions
I do not make decisions about you using solely automated processing.
Generative AI tools
I do not routinely transfer client files, privileged material or confidential matter information to generative artificial intelligence tools.
How information is stored and who can access it
I alone have access to my practice email and records. I use the following:
- Website: hosted by Akamai Technologies (Linode) on a server in its London, United Kingdom data centre. The website stores no personal information; the server keeps standard access logs for 14 days.
- Email: my practice mailbox, info@sadikbugra.com, is provided by an email service provider acting as my processor. I will name the provider here once the mailbox is in use.
- Documents: if you send me documents, please do so only after I have confirmed I can act; they are kept in my practice records with access limited to me.
These providers act as my processors. They may only use the information on my instructions and must keep it secure.
Who I share information with
I share information only where necessary, which may include:
- my IT, hosting, email and storage providers, acting as processors
- the other party to your matter and their representatives, courts and tribunals, where needed to progress your matter
- barristers, experts, process servers, enforcement agents, tracing agents and other professionals instructed in your matter, with your agreement
- my professional indemnity insurer and broker, if needed to notify or deal with a claim
- the provider of my accounting software, hosted on servers in London, for my financial records
- the Solicitors Regulation Authority, the Legal Ombudsman, HM Revenue and Customs, law enforcement and other bodies where the law or my professional obligations require it.
I do not sell personal information.
International transfers
My website is hosted on a server in London. My hosting provider is part of the Akamai group, which is headquartered in the United States; any access to data from outside the UK (for example for technical support) is governed by its data processing terms and the UK international transfer safeguards it relies on. Where my email provider stores or accesses data outside the UK, I will rely on an appropriate safeguard recognised under UK data protection law and describe it here.
How long I keep information
I keep information only for as long as I need it. My proposed retention periods are:
- Enquiries that do not lead to instruction: 12 months from when the enquiry is closed, then deleted, except a minimal conflict-check record (the names of the parties and the type of matter) kept for six years
- Client matter files: six years from the end of the matter, longer where there is a specific reason, such as an ongoing obligation, a continuing trust or a potential claim
- Anti-money laundering records: five years from the end of the business relationship, where the Money Laundering Regulations 2017 apply to the work
- Security and audit logs: 12 months
- Rate-limiting data (keyed hash of IP address): deleted within 24 hours.
At the end of the relevant period, information is securely deleted or anonymised.
Your rights
You have rights under data protection law, including the right to:
- ask for a copy of your personal information
- ask me to correct inaccurate or incomplete information
- ask me to delete your information
- ask me to restrict how I use your information
- object to my use of your information where I rely on legitimate interests
- ask for information you provided to me to be transferred to you or someone else, in some circumstances.
Some rights do not apply in every case. For example, I may not be able to disclose information that is protected by legal professional privilege, or that belongs to another client, or delete information I must keep for legal or regulatory reasons. If I cannot do what you ask, I will explain why.
To exercise any of these rights, email info@sadikbugra.com. I may need to confirm your identity before responding. I will normally respond within one month.
Complaints about how I use your information
If you are unhappy with how I have handled your personal information, please tell me first by email to info@sadikbugra.com or by post to the address above. I will acknowledge your complaint within 30 days and respond without undue delay.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection:
- Website: ico.org.uk/make-a-complaint
- Telephone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
The ICO will usually expect you to have raised your complaint with me first.
Changes to this notice
I will update this notice when my practice or systems change. The date of the latest review is shown on this page.