1. Introduction
This Privacy Policy explains how Covrig Counsel Ltd (“Covrig Counsel”, “we”, “us” or “our”) collects, uses and protects personal data when you visit our website, contact us or engage us to provide legal services.
We are committed to handling personal data in a transparent and proportionate way. Given the nature of our services, we aim to limit the amount of personal data processed to what is necessary for the provision of legal services.
This policy is drafted in accordance with applicable UK data protection law, including the UK GDPR and the Data Protection Act 2018.
2. Who We Are
Covrig Counsel is a legal consultancy providing commercial, corporate and regulatory legal services to businesses. Covrig Counsel Ltd is a company registered in England and Wales (company number 17025515) with its registered office at 167-169 Great Portland Street, 5th Floor, London W1W 5PF. Our legal services are provided by solicitors regulated by the Solicitors Regulation Authority (SRA); Covrig Counsel Ltd itself is not regulated by the SRA. We are registered with the Information Commissioner’s Office (ICO) under registration number ZC236455.
For the purposes of applicable data protection law, Covrig Counsel acts as the data controller in relation to personal data processed in connection with our website, communications and the provision of our services.
If you have any questions about how we handle your personal data, you can contact us using the details in section 13.
3. Personal Data We Collect
We collect limited personal data. This typically includes:
Contact details such as your name, email address and any information you provide when contacting us or submitting an enquiry
Booking details if you schedule a call through our online booking page (provided by Cal.com), such as your name, email address, the time you choose and anything you write in the booking form
Technical information when you visit our website, such as your IP address, browser type and the pages you request, which our hosting provider (Vercel) records in server logs to keep the website secure and working
Information necessary to deliver our legal services where you engage us, including details relevant to the matter on which we are advising
For the purposes of client onboarding and compliance, details of directors and ultimate beneficial owners of corporate clients, obtained from public registries such as Companies House or provided directly by the client
We do not intentionally collect special category data through our website.
Cookies and third-party sites. Our website does not use analytics or advertising cookies and does not track you across other websites. If we introduce analytics or other non-essential cookies, we will update this policy and ask for your consent where the law requires it. Our website links to third-party websites, including our booking page (cal.com) and LinkedIn. Those websites have their own privacy policies and may use their own cookies, and we are not responsible for them.
4. How We Use Your Personal Data
We use personal data for the following purposes:
Responding to enquiries and communicating with prospective clients
Managing meeting bookings and keeping our website secure and working properly
Assessing whether we are able to provide legal services
Carrying out and delivering our legal services, including advising clients, managing engagements and maintaining appropriate records
Conducting client due diligence and sanctions screening as part of our onboarding process, including screening directors and beneficial owners against the UK consolidated sanctions list administered by the Office of Financial Sanctions Implementation (OFSI)
Complying with our legal obligations, including under UK financial sanctions law
Sending marketing communications to those who have opted in to receive them (see section 7)
We do not use personal data for automated decision-making or profiling.
We may use artificial intelligence tools to help us review documents and prepare advice. These tools process personal data on our behalf and under our instructions, a solicitor reviews their outputs, and we do not use them to make decisions about you that have legal or similarly significant effects.
5. Legal Basis for Processing
We process personal data on the following legal bases under UK GDPR:
Legitimate interests: responding to enquiries, managing meeting bookings, keeping our website secure, operating and developing our business, and conducting proportionate due diligence on prospective clients
Performance of a contract: processing necessary to deliver our legal services where you engage us, including steps taken prior to entering into a contract
Legal obligation: processing necessary to comply with applicable law, including UK financial sanctions obligations administered by OFSI. This includes screening clients, directors and beneficial owners against the UK consolidated sanctions list
Consent: where you have opted in to receive marketing communications from us via our order form
6. Personal Data Relating to Third Parties
As part of our client onboarding and compliance process, we may process personal data about individuals who are not directly engaging with us, in particular, directors and ultimate beneficial owners of our corporate clients. This data is typically obtained from public registries such as Companies House, or provided to us by the client.
We process this data on the basis of our legitimate interests in conducting proportionate due diligence and our legal obligation to comply with UK financial sanctions law. We retain this data for the duration of the client relationship and for five years thereafter, in line with our record-keeping obligations.
7. Marketing
We do not currently send marketing communications as a matter of course. Where we do so in future, we will only send electronic marketing communications to individuals who have given their prior consent by opting in via our order form. You are not required to opt in to receive our services.
If you have opted in and later change your mind, you can withdraw your consent at any time by contacting us using the details in section 13, or by following the unsubscribe link in any marketing email we send.
We do not share personal data with third parties for marketing purposes.
8. Data Sharing
We do not sell, rent or otherwise disclose personal data to third parties for marketing purposes.
Personal data may be processed by third-party service providers that support the operation of our business, such as email, document management or hosting providers. These providers are required to process personal data in accordance with appropriate confidentiality and security obligations and are not permitted to use it for their own purposes.
These providers include our website host (Vercel), our online booking provider (Cal.com), our email, document storage and productivity provider (Microsoft), artificial intelligence tools that we use to help deliver our services (under terms that do not permit the provider to use your data to train its models) and our IT and security providers. We may also share personal data with our professional advisers, our professional indemnity insurers and brokers, our regulator (the SRA), and law enforcement agencies, courts or other authorities where we are required by law to do so.
9. International Transfers
In the course of providing our legal services, personal data may be accessed by us from outside the United Kingdom, including from Hong Kong, where members of our team are working. We implement appropriate technical and organisational measures to protect personal data during such access, including secure systems, encryption and access controls.
Where personal data is transferred or accessed outside the United Kingdom, we will ensure that appropriate safeguards are in place in accordance with applicable UK data protection law, including where required by the use of approved transfer mechanisms and supplementary measures. Some of our service providers, including our website hosting, booking and email providers, may process personal data in other countries, including the United States and the European Union. You can contact us for more information about the safeguards we rely on.
10. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Our standard retention periods are:
Client matter records and associated personal data: six years from the end of the client relationship
Client due diligence and sanctions screening records: five years from the end of the client relationship, in line with our compliance obligations
Enquiries that do not result in an engagement: up to twelve months from the date of the enquiry, after which personal data will be deleted unless there is an ongoing reason to retain it
Website server logs: kept by our hosting provider for a short period in line with its standard log retention (no more than 30 days)
Where retention beyond these periods is required by law or necessary to defend or pursue a legal claim, data will be retained for as long as necessary for that purpose.
11. Your Rights
Under applicable UK data protection law, you have the following rights in relation to your personal data:
The right to request access to personal data we hold about you
The right to request correction of inaccurate or incomplete data
The right to request erasure of your data in certain circumstances
The right to object to or restrict processing in certain circumstances
The right to withdraw consent at any time where processing is based on consent
The right to data portability in certain circumstances
To exercise any of these rights, please contact us using the details in section 13. We will respond within one month of receiving your request.
Some rights may not apply in particular cases. For example, we may not be able to disclose information that is subject to legal professional privilege or to our duty of confidentiality to a client (Data Protection Act 2018, Schedule 2, paragraph 19).
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you are unhappy with how we have handled your personal data. The ICO can be contacted at ico.org.uk or by calling 0303 123 1113.
12. Data Security
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration. These measures include, where appropriate, encryption, multi-factor authentication, secure cloud-based systems, access controls and other safeguards proportionate to the nature of the personal data we process. While no system can be completely secure, we take reasonable steps to safeguard the information we receive.
13. Contact
If you have any questions about this Privacy Policy or how your personal data is handled, or if you wish to exercise any of your rights, you can contact us at:
14. Updates
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The latest version will always be available on our website.
Last updated: October 2026