Privacy policy.

Who we are

Fernstone Law Limited is the data controller for the information described in this policy. We are a limited company registered in England and Wales, company number 08190708, and we are authorised and regulated by the Solicitors Regulation Authority under SRA number 591916.

Our registered office is Beech House, Park West, Sealand Road, Chester, CH1 4RJ. If you want to talk to us about your information, contact our Compliance Officer for Legal Practice at info@fernstonelaw.co.uk, or write to the address at the end of this policy.

We handle your information in accordance with the UK GDPR and the Data Protection Act 2018.

What information we collect

You can read this website without telling us anything about yourself. We collect information when you contact us, when you ask us to look at a claim, and while we run a claim for you. Depending on the claim, that can include:

• Your name, date of birth, address, phone number and email address
• What happened to you, including the date, place and circumstances of an accident
• Medical records, reports and details of your injuries and treatment
• Details of your earnings, expenses and other financial losses
• Details of finance or insurance agreements, for a motor finance or GAP claim
• Correspondence with insurers, employers, medical experts and other parties
• Records of our calls with you, which we record for training and quality purposes
• When you send us an enquiry through this website, what you type into the form, together with the date and time, your IP address, the approximate place that address connects from, the page you sent it from, and where you came from before that: the website that sent you to us (for example Google), and any campaign tag in the link. If you accept analytics cookies, we also note the first page you opened on your visit, and if you accept marketing cookies and came from one of our adverts, the advert's click reference, so that we can tell which advertising led to the enquiry. We keep the first-page note only until you close the tab. If you accept marketing cookies, we also pass your email address and phone number to Google Ads, which encrypts them, so that we can measure whether our advertising led to your enquiry. We never send your name or what you write in the form
• Information we receive about you from insurers, introducers and other third parties where they have passed your claim to us

Health and other special category information

Some of what we hold is what the law calls special category data, which is given extra protection. For a personal injury claim that is mainly information about your physical or mental health. It can also include information about racial or ethnic origin, religious or philosophical beliefs, sex life or sexual orientation, and information about criminal offences, where a claim happens to involve them.

Where we process special category data, we do so because it is necessary for the establishment, exercise or defence of legal claims, which is the condition in Article 9(2)(f) of the UK GDPR. Where we need your explicit consent for a particular use instead, we will ask for it and explain what it covers.

Why we use it, and our lawful basis

We have to have a lawful basis for each thing we do with your information. Ours are:

• To answer your enquiry. Reading what you send through the website, ringing or writing back, and routing it to the right team. Our basis is taking steps at your request before entering into a contract.
• To keep the website secure and see where enquiries come from. We record the IP address and approximate location of each enquiry to spot spam and fraud and to understand which areas we serve, and we note where each enquiry came from so that we know which of our pages and listings people find us through. Our basis is our legitimate interests, weighed against your interests. We do not use the location to make decisions about you.
• To run your claim. Taking your instructions, gathering evidence, obtaining medical or expert reports, corresponding with the other side and settling or litigating your claim. Our basis is performance of our contract with you, or taking steps at your request before entering into one.
• To meet our legal and regulatory duties. Identity and anti money laundering checks, conflict checks, our obligations to the SRA and the courts, and our accounting and tax obligations. Our basis is compliance with a legal obligation.
• To run and improve the firm. Supervision and file review, training, quality monitoring of recorded calls, managing complaints, and protecting the firm against claims. Our basis is our legitimate interests in running a competent and properly supervised practice, weighed against your interests.
• To prevent and detect fraud. Checking information against validation and counter fraud databases. Our basis is our legitimate interests, and in some cases a legal obligation.
• To send you marketing. Only where you have asked us to, or where you are an existing client and the message is about a similar service. Our basis is consent, or our legitimate interests where the law allows. You can opt out at any time and every message tells you how.

We use software to analyse recorded calls for sentiment and quality. It supports how we supervise and train our people. No decision about your claim is made by automated means alone, and we do not carry out profiling that produces legal effects for you.

Who we share it with

We do not sell, rent or trade your information. We share it only where we need to in order to run your claim, meet a legal duty, or run the firm properly. That can mean:

• The other side in your claim, their solicitors and their insurers
• Medical experts, treatment providers and rehabilitation case managers
• Barristers, costs draftsmen, agents and the courts
• Our own insurers, auditors, accountants and professional advisers
• The SRA, the Legal Ombudsman and other regulators, where they require it
• The police and crime prevention agencies, where the law allows or requires it
• IT and case management suppliers who process information on our behalf under a written contract
• For enquiries sent through this website, Mailgun, which delivers the enquiry to our team by email, and ipapi.co, which turns the IP address into an approximate location. ipapi.co receives the IP address and nothing else about you. Our website is hosted by Vercel. Google, through Google Tag Manager, receives limited information whenever you visit the site, even before you choose cookies: your IP address, browser type and the page you are on, so that we can measure our advertising without cookies (our legitimate interest). If you accept analytics or marketing cookies, Google and any advertising services we use also receive cookie identifiers and information about how you use the site, as the cookies policy explains

Anyone processing your information on our behalf is bound by contract to keep it secure and to use it only for the purpose we have given them.

Everything you tell us is also covered by our professional duty of confidentiality, which is wider than data protection law. We disclose confidential information only where it is necessary to run your matter, where you have agreed, or where the law requires it.

Sending information outside the UK

We keep your information in the UK wherever we can. If a supplier we use stores or accesses it outside the UK, we make sure the transfer is covered by adequacy regulations, by the International Data Transfer Agreement or Addendum, or by another safeguard the law recognises. You can ask us which applies to your matter. Some of the suppliers that handle website enquiries, for example our email delivery and location lookup providers, may process information outside the UK in this way.

How long we keep it

We keep your file for at least six years after your matter closes. That period is not arbitrary. It is roughly the time during which a claim could still be brought about how we handled your case, and it is what our professional indemnity insurers require. Some records are kept longer, either because the law says so or because the matter involved a child, in which case time limits run from their eighteenth birthday.

Where we looked at a claim for you but did not go on to act, we keep what we hold for a shorter period, long enough to show why the decision was made. Our Data Retention and Archiving Policy sets the period for each category of record and is available on request.

Your rights

Under data protection law you have the right to:

• Ask for a copy of the personal information we hold about you
• Ask us to correct information that is wrong or incomplete
• Ask us to erase information, where there is no good reason for us to keep it
• Ask us to restrict how we use it while a question about it is resolved
• Object to us using it, including for direct marketing, which we will always stop
• Ask us to transfer it to you or another organisation in a portable format, where the processing is based on consent or contract and is automated
• Withdraw your consent at any time, where consent is what we relied on
• Complain to the Information Commissioner

These rights are not absolute. We may not be able to erase information we need to keep for a legal or regulatory reason, or that we need to defend a claim. If we cannot do what you have asked, we will tell you why.

Making a request, or complaining

You can make a request in any way that suits you: by email, by letter or by phone. You do not have to use a particular form, and there is no charge. Email info@fernstonelaw.co.uk or write to us at the address below. We will respond within one month, and will tell you if we need longer because the request is complex.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at any time:

Complaining to us first does not affect your right to go to the Information Commissioner. Complaints about our service rather than your data are dealt with under our complaints procedure.

Cookies

This website uses cookies. You can accept or refuse non-essential cookies when you first arrive, and change your mind at any time using the cookie control on the page. If you accept analytics cookies, we use Google Analytics to count visits and see which pages are used; it is switched off until you do. Our cookie policy explains what each cookie does.

Security

We are committed to keeping your information secure. We have physical, electronic and managerial measures in place to prevent unauthorised access, loss or disclosure, and we control access to your file within the firm to the people who need it. If a breach happens that is likely to result in a risk to your rights, we will report it to the Information Commissioner and, where the risk is high, tell you.

Links to other websites

We may link to other websites that are not within our control. Once you have left our website we cannot be responsible for the protection and privacy of any information you provide there. Please take care, and read the privacy statement that applies to the website in question.

That includes The Legal Claim Company, our own motor finance brand, which runs a separate website where you start a new motor finance claim. That website has its own privacy notice, which explains what it collects.

Changes to this policy

We may change this policy from time to time. The date at the top of the page tells you when it was last reviewed. Where a change materially affects how we use information we already hold about you, we will tell you directly.

Our registered address

Fernstone Law Limited is authorised and regulated by the Solicitors Regulation Authority, SRA number 591916. Registered in England and Wales, company number 08190708.

Reviewed by Craig Bryan, Legal Services Director, COLP/COFALast updated 12 October 2026