Privacy policy.

Who we are

Fernstone Law Limited is the data controller for the information described in this policy. We are a limited company registered in England and Wales, company number 08190708, and we are authorised and regulated by the Solicitors Regulation Authority under SRA number 591916.

Our registered office is Beech House, Park West, Sealand Road, Chester, CH1 4RJ. If you want to talk to us about your information, contact our Compliance Officer for Legal Practice at info@fernstonelaw.co.uk, or write to the address at the end of this policy.

We handle your information in accordance with the UK GDPR and the Data Protection Act 2018.

What information we collect

You can read this website without telling us anything about yourself. We collect information when you contact us, when you ask us to look at a claim, and while we run a claim for you. Depending on the claim, that can include:

• Your name, date of birth, address, phone number and email address
• What happened to you, including the date, place and circumstances of an accident
• Medical records, reports and details of your injuries and treatment
• Details of your earnings, expenses and other financial losses
• Details of finance or insurance agreements, for a motor finance or GAP claim
• Correspondence with insurers, employers, medical experts and other parties
• Records of our calls with you, which we record for training and quality purposes
• Information we receive about you from insurers, introducers and other third parties where they have passed your claim to us

Health and other special category information

Some of what we hold is what the law calls special category data, which is given extra protection. For a personal injury claim that is mainly information about your physical or mental health. It can also include information about racial or ethnic origin, religious or philosophical beliefs, sex life or sexual orientation, and information about criminal offences, where a claim happens to involve them.

Where we process special category data, we do so because it is necessary for the establishment, exercise or defence of legal claims, which is the condition in Article 9(2)(f) of the UK GDPR. Where we need your explicit consent for a particular use instead, we will ask for it and explain what it covers.

Why we use it, and our lawful basis

We have to have a lawful basis for each thing we do with your information. Ours are:

• To run your claim. Taking your instructions, gathering evidence, obtaining medical or expert reports, corresponding with the other side and settling or litigating your claim. Our basis is performance of our contract with you, or taking steps at your request before entering into one.
• To meet our legal and regulatory duties. Identity and anti money laundering checks, conflict checks, our obligations to the SRA and the courts, and our accounting and tax obligations. Our basis is compliance with a legal obligation.
• To run and improve the firm. Supervision and file review, training, quality monitoring of recorded calls, managing complaints, and protecting the firm against claims. Our basis is our legitimate interests in running a competent and properly supervised practice, weighed against your interests.
• To prevent and detect fraud. Checking information against validation and counter fraud databases. Our basis is our legitimate interests, and in some cases a legal obligation.
• To send you marketing. Only where you have asked us to, or where you are an existing client and the message is about a similar service. Our basis is consent, or our legitimate interests where the law allows. You can opt out at any time and every message tells you how.

We use software to analyse recorded calls for sentiment and quality. It supports how we supervise and train our people. No decision about your claim is made by automated means alone, and we do not carry out profiling that produces legal effects for you.

Who we share it with

We do not sell, rent or trade your information. We share it only where we need to in order to run your claim, meet a legal duty, or run the firm properly. That can mean:

• The other side in your claim, their solicitors and their insurers
• Medical experts, treatment providers and rehabilitation case managers
• Barristers, costs draftsmen, agents and the courts
• Our own insurers, auditors, accountants and professional advisers
• The SRA, the Legal Ombudsman and other regulators, where they require it
• The police and crime prevention agencies, where the law allows or requires it
• IT and case management suppliers who process information on our behalf under a written contract

Anyone processing your information on our behalf is bound by contract to keep it secure and to use it only for the purpose we have given them.

Everything you tell us is also covered by our professional duty of confidentiality, which is wider than data protection law. We disclose confidential information only where it is necessary to run your matter, where you have agreed, or where the law requires it.

Sending information outside the UK

We keep your information in the UK wherever we can. If a supplier we use stores or accesses it outside the UK, we make sure the transfer is covered by adequacy regulations, by the International Data Transfer Agreement or Addendum, or by another safeguard the law recognises. You can ask us which applies to your matter.

How long we keep it

We keep your file for at least six years after your matter closes. That period is not arbitrary. It is roughly the time during which a claim could still be brought about how we handled your case, and it is what our professional indemnity insurers require. Some records are kept longer, either because the law says so or because the matter involved a child, in which case time limits run from their eighteenth birthday.

Where we looked at a claim for you but did not go on to act, we keep what we hold for a shorter period, long enough to show why the decision was made. Our Data Retention and Archiving Policy sets the period for each category of record and is available on request.

Your rights

Under data protection law you have the right to:

• Ask for a copy of the personal information we hold about you
• Ask us to correct information that is wrong or incomplete
• Ask us to erase information, where there is no good reason for us to keep it
• Ask us to restrict how we use it while a question about it is resolved
• Object to us using it, including for direct marketing, which we will always stop
• Ask us to transfer it to you or another organisation in a portable format, where the processing is based on consent or contract and is automated
• Withdraw your consent at any time, where consent is what we relied on
• Complain to the Information Commissioner

These rights are not absolute. We may not be able to erase information we need to keep for a legal or regulatory reason, or that we need to defend a claim. If we cannot do what you have asked, we will tell you why.

Making a request, or complaining

You can make a request in any way that suits you: by email, by letter or by phone. You do not have to use a particular form, and there is no charge. Email info@fernstonelaw.co.uk or write to us at the address below. We will respond within one month, and will tell you if we need longer because the request is complex.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at any time:

Complaining to us first does not affect your right to go to the Information Commissioner. Complaints about our service rather than your data are dealt with under our complaints procedure.

Cookies

This website uses cookies. You can accept or refuse non-essential cookies when you first arrive, and change your mind at any time using the cookie control on the page. Our cookie policy explains what each cookie does.

Security

We are committed to keeping your information secure. We have physical, electronic and managerial measures in place to prevent unauthorised access, loss or disclosure, and we control access to your file within the firm to the people who need it. If a breach happens that is likely to result in a risk to your rights, we will report it to the Information Commissioner and, where the risk is high, tell you.

Links to other websites

We may link to other websites that are not within our control. Once you have left our website we cannot be responsible for the protection and privacy of any information you provide there. Please take care, and read the privacy statement that applies to the website in question.

Changes to this policy

We may change this policy from time to time. The date at the top of the page tells you when it was last reviewed. Where a change materially affects how we use information we already hold about you, we will tell you directly.

Our registered address

Fernstone Law Limited is authorised and regulated by the Solicitors Regulation Authority, SRA number 591916. Registered in England and Wales, company number 08190708.

Reviewed by Craig Bryan, Managing Director, Head of Personal Injury and COLPLast updated 2 September 2026