Privacy Policy

MATRIX LAW SOLICITORS

PRIVACY POLICY

Version 3.0  ·  Last updated 20/09/2026· 

This Privacy Policy explains how Matrix Law Solicitors (“Matrix Law Solicitors”, “we”, “us” or “our”) collects, uses, shares and protects personal data, and the rights you have in relation to it. It applies to everyone whose personal data we handle, including prospective clients and enquirers, clients and the people who represent them, individuals whose personal data appears in the matters we handle, website visitors, job applicants, suppliers and other professional contacts.

We are the controller of the personal data described in this policy, including the personal data contained in our client files. Please read this policy together with our Cookie Policy and any additional privacy information we give you when we collect your personal data.

1.  Who we are

Matrix Law Solicitors is a trading name of Ravinder Merhas. For data protection purposes, the controller of the personal data described in this policy is Ravinder Merhas, trading as Matrix Law Solicitors.

We are authorised and regulated by the Solicitors Regulation Authority (SRA number 8014467). We are bound by the SRA Standards and Regulations, including the duty of confidentiality owed to every client, which sits alongside this policy and is not reduced by it. We are registered with the Information Commissioner’s Office (ICO) and pay the data protection fee.

Our principal office is at 1st Floor, 239 Kensington High Street, London W8 6SN.

We handle personal data in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (“PECR”).

How to contact us

You can contact us about this policy or any data protection matter by email at contact@matrixlawsolicitors.co.uk, or by post to our principal office above.

Our processing does not require us to appoint a Data Protection Officer under Article 37 UK GDPR, and we have not appointed one. Responsibility for data protection rests with Ravinder Merhas, who is your point of contact for any data protection query.

2.  What we mean by “personal data”

Personal data means any information relating to an identified or identifiable individual. It includes obvious identifiers such as a name, email address or telephone number, and less obvious information that can be linked to a person, such as an IP address or account identifier.

A controller decides why and how personal data is processed and is responsible for it under data protection law. A processor handles personal data only on a controller’s instructions. We are the controller of the personal data described in this policy; the service providers we use act as our processors unless we tell you otherwise.

Special-category data is a more sensitive subset of personal data — information about health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify a person, and sex life or sexual orientation. Criminal-offence data means information about criminal convictions, offences and related matters. We handle both only in the limited circumstances set out in section 6.

3.  The personal data we collect

What we collect depends on your relationship with us and the matters we handle. Our work spans commercial, litigation, private client (including wills, probate, trusts and family matters) and immigration, so the personal data involved varies from matter to matter. The categories below describe the main types of personal data we collect and the people they relate to.

3.1  Prospective clients and enquirers

When you enquire about our services — for example through our website contact form — we may collect your name and contact details, your country, information about the service you are interested in and the legal need or matter you describe, how you heard about us, records of our communications with you, and your marketing preferences and any consents you have given.

3.2  Clients and the people who represent them

When you become a client, or you are connected with a client (for example as a director, officer, employee or family member), we may collect your name, role and contact details; identity and verification information collected for anti-money laundering and know-your-client checks, including identity documents, proof of address and the results of sanctions and politically-exposed-persons screening; billing and payment information; documents and information provided in connection with a matter; and records of our communications and meetings (including recordings or transcripts where you have consented).

3.3  Individuals connected with a matter

A matter will often involve personal data about people who are not our client — for example an opposing party and their advisers, family members, witnesses, counterparties, employees, or others connected with the matter. The data we hold depends on the matter and may include names and contact details, the contents of documents and correspondence, financial or employment information, and information about disputes, complaints or claims. We usually receive this information from our client, but may also obtain it from public sources or other parties to the matter.

If you provide us with personal data about another person, please make sure you are entitled to do so and, where appropriate, that they have been given the information in this policy.

3.4  Website visitors

When you visit our website we may collect technical information such as your IP address, browser and device type; usage information such as pages viewed and referring sources; and any information you submit through our web forms or when you subscribe to our newsletter. We explain our use of cookies in our Cookie Policy.

3.5  Job applicants

When you apply for a role we may collect your CV, covering letter, employment history, references, right-to-work documentation and contact details, together with any information obtained through reference or background checks. Successful applicants receive a separate staff privacy notice.

3.6  Suppliers and professional contacts

When we engage suppliers, advisers or other contacts we collect the business contact details of the relevant individuals, their role, and the information needed to manage the relationship and any payments.

3.7  Information you need to give us

Some of the information we ask for is required by law or under our contract with you. In particular, to accept or continue acting we carry out identity checks and, where legally required, anti-money-laundering checks, and we need enough information to take and act on your instructions. If you do not provide this information, we may be unable to accept your instructions, complete the checks we are required to carry out, or continue to act for you.

4.  How we obtain personal data

We collect personal data directly from you; from our client, where you are connected with a matter we are handling; from your colleagues, family members or representatives; from third parties we engage, such as identity-verification providers; from publicly available sources such as Companies House, HM Land Registry, court records and professional registers, particularly for client due diligence; from people who refer you to us; and automatically through our website, email and security systems.

5.  How and why we use personal data, and our lawful bases

We use personal data only where we have a lawful basis under Article 6 UK GDPR. The bases we rely on are: performance of a contract with you, or steps taken at your request before entering into a contract; compliance with a legal or regulatory obligation, including our anti-money laundering, SRA, accounting and tax obligations; our legitimate interests (and those of our clients), where they are not overridden by your rights and freedoms; and your consent, where we ask for it — for example for certain marketing, for meeting recordings, or for particular special-category data such as biometric identity verification.

5.1  Enquiries and prospective clients

We use personal data to respond to enquiries, understand the assistance requested and decide whether we can act. Where you are the prospective client, our basis is taking steps at your request before entering into a contract; where an enquiry is made by someone else or contains information about other people, our basis is our legitimate interests in responding to and assessing enquiries.

5.2  Advising and acting for our clients

We use personal data to complete onboarding and compliance checks, take instructions, give legal advice, prepare and negotiate documents, correspond with other parties, and manage billing and payment. The lawful basis depends on whose personal data it is:

• Individual clients. Where our client is an individual, our bases are performance of our contract with you (taking instructions, doing the legal work and billing) and compliance with our legal and professional obligations (including anti-money-laundering and identity checks where legally required). Where identity checks are not legally required, we rely on our legitimate interests in verifying identity and preventing fraud.
• Representatives of organisations. Where our client is an organisation, the people who represent it — such as directors, officers or employees — are not usually party to our retainer, so contract is not our basis for their personal data. Our basis is our legitimate interests, and those of our client, in advising the client and managing the matter, together with compliance with our legal obligations for particular checks.
• Others connected with a matter. For other people connected with a matter, our bases are our legitimate interests and those of our client in giving legal advice and in establishing, exercising or defending legal rights, together with compliance with our legal and professional obligations.

We process only what the matter requires, under our professional duty of confidentiality.

5.3  Running and developing our business

We use personal data to administer our accounts, manage suppliers, protect our systems and information, prevent fraud and misuse, train and supervise our team, keep the records our regulator requires, and exercise or defend legal claims. Our basis is our legitimate interests in operating a well-run and secure practice and, where applicable, compliance with legal obligations.

5.4  Communicating with you

We use personal data to respond to you and to send service-related messages about your matter. Our basis is performance of a contract or our legitimate interests in responding to you, and your consent where required.

5.5  Marketing

We use limited personal data to tell you about services that may interest you, including through our newsletter. We rely on:

• your consent, where we have asked for it (for example, when you subscribe to our newsletter); or
• our legitimate interests, where the PECR “soft opt-in” permits us to market to you. The soft opt-in applies only where we obtained your details in the course of discussing or providing our services to you, we are marketing our own similar legal services, and we gave you an easy way to opt out both when we collected your details and in every message since.

Being a prospective client, or having been referred to us, does not by itself bring you within the soft opt-in. Where we rely on legitimate interests we carry out the assessment that requires. You can opt out of marketing at any time. How we handle referrals is explained in section 9.

5.6  Legal and regulatory compliance

We use personal data to meet our obligations under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, the SRA Standards and Regulations, tax and accounting law, data protection law, and any court or regulatory order that applies to us. Our basis is compliance with a legal obligation and, where relevant, our legitimate interests.

6.  Special-category and criminal-offence data

Depending on the matter — particularly in family, private client, immigration and dispute work — we may need to process special-category data (for example health, racial or ethnic origin, or religious or philosophical beliefs) and information about criminal allegations, proceedings, convictions or offences. We do this only where it is necessary and where an appropriate additional condition applies.

For special-category data we rely on a condition under Article 9 UK GDPR — most often that the processing is necessary for the establishment, exercise or defence of legal claims or for obtaining or giving legal advice; that you have given explicit consent; or that it is necessary for reasons of substantial public interest recognised by law, such as preventing or detecting unlawful acts. For criminal-offence data we rely on a condition in Schedule 1 to the Data Protection Act 2018, most often in connection with legal claims and legal advice or the prevention or detection of unlawful acts.

Identity verification. Our anti-money-laundering checks may involve electronic identity verification. Where that verification uses biometric technology (for example comparing a photograph or short video of you with your identity document), it involves biometric special-category data and we ask for your explicit consent before it is carried out. You can decline the biometric check and we will offer a reasonable alternative way to verify your identity; if you withdraw consent we will cease any further checks and date will be destroyed; the check is carried out by our identity-verification provider, and the photograph, video or biometric template is retained for 1 year and then deleted. 

Additional safeguards. Where we process special-category or criminal-offence data we apply additional safeguards, including stricter access controls, and we maintain the appropriate policy document required by the Data Protection Act 2018 where a Schedule 1 condition calls for one. We will make that document available to the ICO on request.

7.  Children’s personal data

Our website and marketing are not directed at children. However, some of our work — particularly family and private client matters — requires us to process personal data about children. Where it does, we normally receive that information from a parent, guardian, adult client or representative, and we use it only where it is necessary, lawful and relevant to the matter, with appropriate care given to its sensitivity.

8.  Cookies and website tracking

We use cookies and similar technologies on our website. Strictly necessary cookies make the site work and keep it secure and are set automatically. We use non-essential cookies and similar technologies, including analytics and advertising technologies, only where you have given the relevant consent through our cookie banner, in line with PECR. Our separate Cookie Policy explains the technologies we use, their purpose and how to manage your preferences, which you can change at any time.

9.  Marketing, communications and referrals

We send marketing only where you have consented or where the PECR soft opt-in applies (see section 5.5). Every marketing message includes an unsubscribe link, and you can opt out at any time by using it or by contacting us. Opting out of marketing does not affect the service-related messages we need to send about your matter.

Referrals and introductions. We accept referrals and introductions from clients and professional contacts. How we deal with them depends on the circumstances:

• where you have asked the referrer to put us in touch, or have otherwise agreed to be contacted, we will contact you about the assistance you are seeking; and
• where a person’s details are passed to us without that agreement, we contact them only where we are lawfully permitted to do so and in line with the professional rules that apply to us as solicitors.

Where required, we provide this policy to a person who has been referred to us and tell them the source of their details within the applicable legal time limits, subject to any relevant exception. You have the right to object to direct marketing at any time, and we will stop.

10.  Who we share personal data with

We share personal data only with recipients that need it for the purposes in this policy, and only under appropriate contractual and security safeguards. Our duty of confidentiality to clients applies to every disclosure. We may share personal data with:

• our staff, consultants and agents working within the practice;
• service providers who act as our processors under written contracts meeting Article 28 UK GDPR and may not use personal data for their own purposes — for example our Microsoft 365 email and document platform, our case-management and document-hosting provider (Legal Workspace), our AI provider (Anthropic), and our compliance and finance tools;

• providers that act as controllers in their own right for certain data, such as our card-payment provider world pay and our identity-verification / anti-money-laundering provider Thirdford whose own privacy notices apply to that processing;
• barristers, experts, agents and other advisers instructed on a matter;

• courts, tribunals, registries (including the Home Office and UK Visas and Immigration on immigration matters) and other parties to a matter and their advisers, where the matter requires it;
• regulators and authorities where we are required or permitted to disclose, including the SRA, the ICO, HM Revenue & Customs and law-enforcement bodies;
• our professional indemnity insurers and brokers, accountants and auditors, and compliance consultants, under duties of confidentiality; and
• a purchaser or their advisers in connection with a genuine sale, restructuring or succession of the practice, subject to appropriate safeguards.

A provider can be our processor for one activity and a controller for another. Where a provider processes personal data on our behalf, we require it to act only on our instructions and to protect the data appropriately. We do not sell personal data.

11.  International transfers

We aim to keep the processing of your personal data within the United Kingdom. Where any personal data is transferred outside the UK, we will make sure it is protected by an appropriate safeguard recognised under UK data protection law before the transfer takes place. You can ask us for more information about the safeguards that apply to a particular transfer.

12.  How long we keep personal data

We keep personal data only for as long as we need it for the purposes in this policy and to meet our legal, regulatory, professional, insurance and accounting requirements. Our retention schedule sets the periods. As a general guide:

• general client matter files (including data about others connected with a matter) are kept for six years after the matter closes, or longer where the matter carries extended limitation exposure;
• for wills, probate, trusts and estate work we distinguish between an original will and other enduring records — which we may keep for as long as they may be needed — and routine correspondence and supporting documents on the file, which we keep for seven years after the matter closes;
• family and children matters are kept for a period set by reference to the type of matter — for a period of 6 years from the child turning 18.
• client due-diligence and identity-verification records are kept for five years after the end of the business relationship, as anti-money-laundering law requires, and are then deleted unless we are required or permitted to keep them for another specified purpose;

• accounting and client-account records are kept for at least six years, in line with tax law and the SRA Accounts Rules;
• enquiries that do not become matters are kept for up to 24 months after the last substantive contact;
• marketing data is kept until you opt out or for up to two years from your last meaningful interaction with us, whichever is sooner; where you opt out, we keep a minimal record of your objection so that we do not contact you again — this is kept to respect your choice, not to continue marketing;

• unsuccessful job applications are kept for up to six months after the recruitment decision, unless you agree to longer; and
• website and security logs are kept for 12 months after which they are deleted or aggregated.

Where personal data is held in backups, it is overwritten in the ordinary course of our backup cycle monthly. Where a legal hold applies, retention is extended for as long as the hold requires. When information is no longer needed it is securely deleted, destroyed or anonymised.

13.  How we protect personal data

We apply appropriate technical and organisational measures to protect personal data against unauthorised or unlawful access, loss, alteration, disclosure and destruction. These may include encryption in transit and at rest, role-based access controls and multi-factor authentication, secure hosting with tested backups, staff training and policies, due diligence and written contracts with our providers, and monitoring, logging and incident-response procedures (including notifying the ICO and affected individuals where the law requires). No system is completely secure; please do not send us highly sensitive information through a general website form, and contact us promptly if you become aware of a possible security incident affecting your personal data.

14.  Your rights

You have a number of rights over your personal data. Most are not absolute, and we may need to balance them against our legal, regulatory and professional obligations. Subject to those limits, you may:

• ask for access to your personal data and information about how we use it;
• ask us to correct inaccurate or incomplete data;
• ask us to erase data in certain circumstances (we may be unable to comply where we must keep it by law or regulation, or for legal claims);
• ask us to restrict our processing in certain circumstances;
• object to processing based on our legitimate interests, and object to direct marketing at any time (which we will always honour);
• ask us to transfer certain data you provided to you or another controller, where we process it by automated means on the basis of consent or contract; and
• withdraw your consent where we rely on it, without affecting processing already carried out.

Automated decision-making

Having reviewed our processes including AML and identity-verification screening and recruitment, we do not make decisions about you that produce legal or similarly significant effects based solely on automated processing; there is always meaningful human involvement in decisions of that kind. Our use of AI is explained in section 15.

Legal professional privilege and information about non-clients

Because we are a law firm, some of the personal data we hold is subject to legal professional privilege or to the duty of confidentiality we owe our clients. Data protection law recognises this: exemptions apply to privileged information and to information covered by a legal adviser’s duty of confidentiality (including under Article 14(5)(d) UK GDPR and Schedule 2 to the Data Protection Act 2018), and there are further exceptions to what we must tell people whose data we obtain from someone other than them. We rely on an exemption or exception only so far as its conditions are met.

If you are not our client but your personal data appears in a matter we handle, we may not always be able to tell you about that processing directly, and this policy is one of the ways in which we provide that information. Where you ask for information that would reveal another person’s personal data, we will consider whether it is reasonable to disclose it without their consent, balancing your rights against theirs; the absence of their agreement is not by itself decisive.

How to exercise your rights

Please contact us at contact@matrixlawsolicitors.co.uk. We will respond within one month, though we may extend this by up to two further months for complex or numerous requests, and will tell you if we do. We may need to verify your identity first, and we may charge a reasonable fee or decline to act on a request that is manifestly unfounded or excessive.

15.  Automated decision-making and AI

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects (see section 14).

We use AI-assisted tools in the course of our work — for example for research, drafting, summarising and document review. We currently use Anthropic’s Claude, through Anthropic’s business services and underwritten terms that prohibit the use of our data to train its models. Our solicitors review and remain responsible for all legal advice and work product, we assess each AI provider before adoption, and because our AI provider is based in the United States the transfer safeguards in section 11 apply.

16.  Complaints and the ICO

If you are unhappy with how we have handled your personal data, please contact Ravinder Merhas first so that we can try to put things right. We operate a data protection complaints process: you can make a complaint by email to ravi@matrixlawsolicitors.co.uk we will acknowledge your complaint within 30 days; and we will investigate it, keep you informed of progress, and give you an outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection, at: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; helpline 0303 123 1113; ico.org.uk.

Complaints about our legal services are handled under our separate complaint’s procedure (and, where it applies, by the Legal Ombudsman). That is different from the data protection complaints process described above, and we will give you details when relevant.

17.  Changes to this policy

We may update this policy to reflect changes to our services, systems, or legal and regulatory requirements. The version number and effective date are shown at the top. Where a change is material, we will take reasonable steps to notify you, including by posting a notice on our website or contacting you directly.

18.  Contact us

For any questions about this policy, please contact us at contact@matrixlawsolicitors.co.uk or at the address in section 1.