Privacy Policy

1. About this Privacy Notice

This Privacy Notice explains how Patricia White Litigation & Advocacy Ltd, trading as PW-LA (“PW-LA” or “the firm”), collects, uses, stores, shares and protects personal data.

It applies to personal data processed when an individual:

• visits or interacts with the firm’s website at https://www.pw-la.com;
• contacts the firm with an enquiry;
• asks the firm to provide legal services;
• becomes or has previously been a client;
• is involved in a client’s matter as a witness, opponent, adviser, expert, representative or other relevant person;
• supplies services to the firm;
• receives communications or marketing from the firm; or
• otherwise interacts with the firm.

Additional information about the firm’s services and its relationship with clients may be contained in the relevant client care letter, terms of business and client information sheets. Those documents should be read together with this Privacy Notice.

The firm’s contractual documents do not override rights under applicable data protection law.

2. Who is responsible for personal data?

Patricia White Litigation & Advocacy Ltd is the controller of the personal data described in this Privacy Notice, unless stated otherwise.

The firm’s details are:

Patricia White Litigation & Advocacy Ltd
Suite 10b, Tower House Business Centre
Fishergate
York
YO10 4UA
United Kingdom
Telephone: 01904 217184
Email: enquiries@pw-la.co.uk

The firm is regulated by CILEx Regulation Limited under registration number 2163508.

Questions concerning this Privacy Notice or the firm’s handling of personal data should be directed to:

Patricia Mary White
Compliance Manager
Patricia White Litigation & Advocacy Ltd
Suite 10b, Tower House Business Centre
Fishergate
York
YO10 4UA
United Kingdom
Telephone: 01904 217184
Email: patriciaw@pw-la.co.uk

3. Data protection principles

The firm processes personal data in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and other applicable data protection legislation.

Personal data must be:

• processed lawfully, fairly and transparently;
• collected for specified, explicit and legitimate purposes;
• adequate, relevant and limited to what is necessary;
• accurate and, where necessary, kept up to date;
• retained for no longer than is necessary;
• protected by appropriate technical and organisational measures; and
• processed in a manner that enables the firm to demonstrate compliance.

4. How personal data is collected

The firm may obtain personal data:

• directly from an individual;
• through the firm’s website, enquiry forms and onboarding forms;
• during telephone calls, video calls and face-to-face meetings;
• through emails, letters and other communications;
• from a client or a person acting on the client’s behalf;
• from an opponent, witness, expert, barrister, solicitor or other professional adviser;
• from courts, tribunals, government bodies and regulators;
• from employers, former employers, employees and colleagues;
• from publicly available sources, including Companies House, court records, professional registers and social media;
• from identity verification, fraud prevention and anti-money laundering providers;
• from insurers, litigation funders and claims management organisations;
• from the firm’s legal research, case management and technology providers; and
• from cookies and similar technologies used on the firm’s website.

Where a client supplies personal data about another person, the client should provide that person with this Privacy Notice where it is lawful and appropriate to do so. There may be circumstances in which providing the notice would be impossible, involve disproportionate effort, prejudice legal proceedings or conflict with duties of confidentiality or legal professional privilege.

5. Personal data the firm may process

The personal data processed will depend on the nature of the relationship and the legal matter. It may include:

5.1 Identity and contact information

• name, title and former names;
• postal and email addresses;
• telephone numbers;
• date of birth;
• National Insurance number;
• passport, driving licence and other identification details;
• photographs and copies of identity documents;
• immigration or nationality information; and
• signatures.

5.2 Matter and professional information

• instructions and information about a legal matter;
• correspondence, attendance notes and recordings;
• employment and professional information;
• information contained in pleadings, statements, evidence and other case documents;
• court and tribunal information;
• information about disputes, complaints and settlement discussions;
• the identity of witnesses, opponents and professional advisers; and
• information relating to legal costs and funding arrangements.

5.3 Financial information

• bank account details;
• payment card and transaction details;
• income, expenditure, assets and liabilities;
• tax and accounting information;
• information concerning legal costs; and
• information required to process payments or transfer funds.

Payment card details may be collected directly by the firm’s payment service provider. The firm does not necessarily retain the complete card information.

5.4 Technical and website information

• internet protocol address;
• browser type and version;
• device and operating system information;
• website usage and navigation information;
• cookie identifiers;
• referring website information; and
• date, time and duration of website interactions.

Some technical information may constitute personal data even where it does not identify an individual by name.

5.5 Special category personal data

Where relevant to a matter, the firm may process personal data revealing or concerning:

• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade union membership;
• genetic or biometric information;
• physical or mental health;
• sex life; or
• sexual orientation.

5.6 Criminal offence information

Where relevant and lawful, the firm may process information about:

• criminal allegations;
• investigations;
• cautions and convictions;
• offences;
• criminal proceedings; and
• related security measures.

5.7 Information generated using technology

The firm’s systems may generate or assist in generating information from existing matter data, including:

• summaries;
• chronologies;
• suggested classifications;
• extracted dates and key terms;
• document comparisons;
• legal research notes;
• draft correspondence or documents; and
• other assessments or inferences requiring human review.

Such information may itself constitute personal data.

6. Purposes for which personal data is used

The firm may process personal data to:

• respond to enquiries;
• decide whether the firm can accept instructions;
• carry out conflict and client identity checks;
• comply with anti-money laundering and fraud prevention requirements;
• open, administer and manage client matters;
• provide legal advice and representation;
• communicate with clients and others involved in a matter;
• prepare, review and file documents;
• conduct legal research;
• instruct barristers, experts and other professionals;
• communicate with courts, tribunals, opponents and their representatives;
• receive, process and transfer money where appropriate;
• issue invoices and maintain accounting records;
• manage complaints and resolve disputes;
• establish, exercise or defend legal claims;
• maintain the security and integrity of the firm’s systems;
• monitor and improve the quality of the firm’s services;
• provide legal updates and marketing where permitted;
• comply with legal, regulatory, professional and insurance obligations;
• maintain business continuity and records; and
• manage or restructure the firm’s business.

7. Lawful bases for processing

The lawful basis depends on the purpose and circumstances of the processing. The firm may rely on one or more of the following bases.

7.1 Contract

Processing may be necessary:

• to take steps at an individual’s request before entering into a contract;
• to provide legal services under a retainer; or
• to perform another contract with the individual.

7.2 Legal obligation

Processing may be necessary to comply with legal or regulatory obligations, including obligations relating to:

• professional regulation;
• accounting and taxation;
• anti-money laundering;
• fraud prevention;
• court and tribunal requirements;
• complaints;
• insurance; and
• data protection.

7.3 Legitimate interests

The firm may process personal data where necessary for its legitimate interests or those of another person, provided that those interests are not overridden by an individual’s rights and interests.

Relevant legitimate interests may include:

• operating and administering a legal practice;
• managing client matters efficiently;
• protecting confidential information;
• maintaining information and system security;
• preventing and detecting fraud;
• maintaining accurate business records;
• managing risks and professional obligations;
• recovering fees;
• establishing, exercising or defending legal claims;
• improving the firm’s services; and
• using appropriate technology to support the delivery of legal services.

7.4 Consent

Consent may be relied upon where it is appropriate to do so, including for certain forms of electronic marketing.

Where processing is based on consent, consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing undertaken before withdrawal.

The firm does not rely on consent merely because legal technology or an AI-assisted tool is involved. Another lawful basis will normally apply where the processing is necessary to provide legal services or pursue a legitimate interest.

7.5 Vital interests and public interest

In limited circumstances, processing may be necessary to protect a person’s vital interests or to perform a task in the public interest.

8. Special category and criminal offence data

Where the firm processes special category personal data, it will identify both an Article 6 lawful basis and an applicable condition under Article 9 UK GDPR and the Data Protection Act 2018.

Depending on the circumstances, this may include processing:

• necessary for the establishment, exercise or defence of legal claims;
• necessary for the provision of legal advice;
• necessary for reasons of substantial public interest on the basis of law;
• necessary to protect vital interests;
• concerning information manifestly made public by the individual; or
• based on explicit consent, where that is appropriate.

Criminal offence data will be processed only where permitted under Article 10 UK GDPR and the Data Protection Act 2018.

Where required, the firm will maintain an appropriate policy document covering its processing of special category or criminal offence data.

9. Use of legal technology and AI-assisted tools

9.1 How the firm uses technology

The firm uses approved legal technology and artificial intelligence-assisted tools to support the provision and administration of legal services.

Depending on the matter, these tools may assist authorised personnel with:

• matter and document management;
• locating information within an authorised matter file;
• reviewing and summarising documents;
• extracting dates, facts and key terms;
• preparing chronologies;
• comparing documents and identifying possible inconsistencies;
• undertaking legal research;
• locating legislation, cases, forms and precedents;
• preparing initial drafts of correspondence and legal documents;
• completing forms and precedents;
• checking the consistency and presentation of documents; and
• carrying out administrative tasks.

The tools support the firm’s work. They do not replace professional legal judgement or transfer responsibility for the firm’s services to a technology provider.

9.2 Approved systems

The firm’s approved systems currently include:

• LEAP case management software;
• LEAP Matter AI;
• LawY;
• LEAP Generator;
• By Lawyers;
• LexisNexis legal research services;
• LexisNexis Protégé;
• Otter AI; and
• Zoom

The functions enabled by the firm and the list of approved systems may change over time. Any additional or replacement system used for client work will be subject to the firm’s approval, confidentiality, data protection and information-security procedures.

The firm does not enter client-confidential information into unapproved consumer or publicly available AI services.

9.3 Personal data processed by approved technology

Depending on the nature of the matter, approved systems may process:

• client identity and contact information;
• instructions and correspondence;
• documents and evidence;
• financial information;
• matter notes and calendar information;
• information concerning witnesses, opponents and other third parties;
• special category personal data;
• criminal offence or allegation data; and
• summaries, chronologies, classifications, draft text and other information generated from the underlying matter data.

The firm seeks to limit the personal data processed through these systems to what is reasonably necessary and proportionate for the relevant task.

9.4 Lawful basis for technology-assisted processing

The lawful basis for processing does not change merely because an AI-assisted tool is used.

Depending on the relevant purpose, the firm may rely on:

• performance of its contract to provide legal services;
• compliance with legal and regulatory obligations;
• the firm’s legitimate interests in delivering, administering, securing and improving its services;
• the establishment, exercise or defence of legal claims; or
• another lawful basis or condition described in this Privacy Notice.

9.5 Human review and accuracy

AI-assisted tools can produce incomplete, inaccurate or misleading material. They may generate incorrect citations, overlook relevant information or produce content affected by limitations in the underlying technology.

The firm applies an appropriate level of human review before AI-assisted output is materially relied upon or communicated externally. The nature and extent of the review will reflect the purpose of the output, the risks involved and its significance to the matter.

Depending on the task, the firm’s review may include:

• checking factual information against the client’s instructions and matter file;
• checking quotations against the original document;
• checking legislation against an up-to-date legislative source;
• checking authorities and citations against appropriate legal sources;
• comparing research against more than one recognised legal resource; and
• reviewing draft documents for accuracy, relevance and legal effect.

Material legal propositions, authorities and citations produced with AI assistance will be checked against appropriate legal sources before being relied upon.

The firm remains responsible for the legal services it provides.

9.6 Witness evidence

Where AI-assisted tools are used in connection with witness evidence, they may assist with organisation, document review, chronology preparation, formatting or the preparation of an initial draft from the witness’s instructions.

The witness’s evidence must remain their own account. AI-assisted tools will not be used to invent, alter or embellish evidence. Applicable procedural rules, practice directions and court or tribunal guidance will be followed.

9.7 Confidentiality and privilege

The firm’s professional duties of confidentiality continue to apply when approved technology is used. The firm also takes appropriate steps to protect information subject to legal professional privilege.

Access to matter data is subject to user permissions, confidentiality controls and matter-access restrictions. Information from another client’s matter will not be used for a client’s matter unless that use is lawful, appropriate and consistent with the firm’s professional obligations.

9.8 Providers, subprocessors and model training

Approved technology providers may process personal data on the firm’s behalf under applicable contractual, confidentiality and data-processing arrangements. Providers may use subprocessors, including cloud-hosting, technical-support and underlying technology providers.

The firm undertakes proportionate due diligence concerning approved providers. This may include reviewing:

• contractual confidentiality provisions;
• data processing terms;
• security controls;
• access restrictions;
• data hosting locations;
• subprocessors;
• data retention and deletion arrangements;
• international transfers;
• security incident procedures; and
• the use of customer information to train or improve AI models.

The firm does not authorise client-confidential information to be used to train publicly available AI models. Where an external AI provider is involved, relevant contractual terms, account settings and safeguards must be approved before client-confidential information is processed.

Further information about the firm’s use of approved legal technology is contained in the firm’s Client Information Sheet: Use of Approved Legal Technology and AI-Assisted Tools, available from the firm upon request.

10. Automated decision-making

The firm does not ordinarily use solely automated processing to make decisions producing legal or similarly significant effects on individuals without meaningful human involvement.

AI-assisted tools may support research, document preparation and matter administration, but final legal and strategic decisions remain subject to appropriate human consideration.

If the firm proposes to undertake solely automated decision-making producing legal or similarly significant effects, the affected individuals will be provided with the additional information and safeguards required by applicable law.

11. Who may receive personal data?

The firm does not sell or rent personal data.

Where necessary and lawful, personal data may be disclosed to:

• employees, consultants and authorised personnel working for the firm;
• barristers and other legal professionals;
• experts, mediators and other professional advisers;
• courts, tribunals and dispute resolution bodies;
• opponents and their legal representatives;
• insurers and litigation funders;
• regulators, including CILEx Regulation Limited;
• the Legal Ombudsman and other complaint-handling bodies;
• law enforcement agencies, tax authorities and government bodies;
• banks and payment service providers;
• auditors, accountants and insurers;
• identity verification, anti-money laundering and fraud prevention providers;
• IT, cloud-hosting, communications and information-security providers;
• website, analytics and marketing service providers;
• legal research, case management and document automation providers;
• storage, archiving and confidential destruction providers;
• prospective purchasers, investors or professional advisers in connection with a proposed business sale or restructuring; and
• other persons where disclosure is authorised or required by law.

A disclosure will be limited to what is reasonably necessary for the relevant purpose and will remain subject to applicable duties of confidentiality and legal professional privilege.

Consent is not always required before personal data is shared. The firm may share information where another lawful basis applies, including where sharing is necessary to provide legal services, comply with a legal obligation or establish, exercise or defend a legal claim.

12. Principal service providers

The firm’s service providers currently include the following, subject to change.

12.1 LEAP

LEAP provides the firm’s cloud-based case management system, document management facilities, client communication facilities through LawConnect and approved AI-assisted functions.

12.2 By Lawyers, LawY and LEAP Generator

These services provide or assist with legal content, research, document preparation, matter management and document-generation functions.

12.3 LexisNexis and LexisNexis Protégé

LexisNexis provides legal research materials and AI-assisted research and drafting services. These services may process information submitted by authorised users to support research, analysis and document preparation.

12.4 Leigh Lacy Website Design & Marketing Ltd

Leigh Lacy Website Design & Marketing Ltd provides website design, maintenance and related services, including facilities used for online enquiries, onboarding and appointments.

12.5 TakePayments Ltd

TakePayments Ltd processes debit and credit card payments. Payment information is processed in accordance with TakePayments Ltd’s own privacy and security arrangements.

12.6 LawTap

LawTap provides an online appointment booking system and may process names, contact details and appointment information.

12.7 Google Analytics

Google Analytics may collect website and device information to help the firm understand how visitors use its website. Non-essential analytics cookies will be used only in accordance with applicable cookie and electronic communications requirements.

12.8 Jotform

Jotform provides online forms used for enquiries and onboarding. Information submitted through a Jotform form may be transmitted to the firm and, where instructions are accepted, added to the firm’s LEAP case management system.

Jotform may retain submitted information in accordance with the firm’s account settings and Jotform’s applicable terms. Further information is available at https://www.jotform.com/privacy/.

12.9 Mailchimp

Mailchimp may be used to send and manage newsletters and other marketing communications. Marketing communications will be sent only where permitted by applicable law.

12.10 Social media and review platforms

The firm may use platforms including Facebook, X, LinkedIn, YouTube and Trustpilot. Those providers process information under their own terms and privacy notices. Information posted publicly on those services may be visible to other users.

An up-to-date list of material service providers may be obtained by contacting the firm. The firm may withhold information where disclosure would prejudice security, confidentiality or the rights of another person.

13. International transfers

Some service providers or their subprocessors may store or access personal data outside the United Kingdom.

Where personal data is transferred to a country outside the United Kingdom, the firm will ensure that an applicable transfer mechanism is used. Depending on the destination and circumstances, this may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to the European Commission’s standard contractual clauses; or
• another transfer mechanism permitted by UK data protection law.

Where appropriate, the firm will consider whether supplementary contractual, technical or organisational safeguards are required.

Information about the applicable safeguard may be requested using the contact details in section 2. Certain information may be redacted where necessary to protect confidential or security-sensitive material.

14. Direct marketing

The firm may occasionally send clients and other contacts information about its services, legal developments or events.

Electronic marketing will be sent only where:

• the recipient has provided consent;
• the firm is permitted to rely on the existing client relationship under applicable electronic marketing rules; or
• another lawful basis applies.

Marketing preferences may be changed at any time by:

• using the unsubscribe facility in the relevant communication;
• emailing enquiries@pw-la.co.uk; or
• contacting the firm using the details in section 2.

Withdrawing from marketing will not affect communications necessary to provide legal services, administer a matter or comply with legal obligations.

The firm does not sell personal data to third parties for marketing purposes.

15. Website information and cookies

The firm’s website may collect technical information such as:

• IP address;
• browser and device details;
• operating system;
• referring website;
• pages visited;
• date and time of access; and
• interaction with website content.

The firm may use cookies and similar technologies that are:

• strictly necessary for the website to operate;
• used for security and fraud prevention;
• used to remember preferences; or
• used for analytics or other non-essential purposes.

Non-essential cookies will not be placed unless any consent required by law has been obtained. Cookie preferences can be managed through the firm’s cookie banner or browser settings.

Further details should be provided in the firm’s separate Cookie Notice at [link].

16. Links to other websites

The firm’s website may contain links to websites operated by other organisations. This Privacy Notice applies only to processing for which PW-LA is the controller.

Third-party websites have their own privacy notices and terms. The firm is not responsible for the privacy practices of third-party websites merely because they can be accessed through a link on the firm’s website.

17. Children’s personal data

The firm’s website and services are not directed specifically at children. However, the firm may process children’s personal data where this is necessary in connection with a legal matter.

Where a child’s personal data is processed, the firm will take account of the child’s age, understanding and circumstances and will provide age-appropriate information where required.

A child or parent or guardian with questions about the firm’s use of a child’s personal data should contact the firm using the details in section 2.

18. Security

The firm uses proportionate technical and organisational measures intended to protect personal data against:

• unauthorised or unlawful access;
• accidental loss;
• alteration;
• unauthorised disclosure;
• destruction; and
• other misuse.

Measures may include:

• access controls and user permissions;
• password and authentication requirements;
• encryption where appropriate;
• secure cloud services;
• system monitoring;
• data backup;
• staff confidentiality obligations;
• information-security training;
• supplier due diligence; and
• incident response procedures.

No internet transmission or information system can be guaranteed to be completely secure. Individuals should take reasonable care when sending information electronically and should promptly notify the firm of any suspected unauthorised access or disclosure.

Clients using LawConnect or another client portal must keep passwords and access credentials confidential and must notify the firm promptly if they believe their account has been compromised.

19. Telephone, email and electronic communications

The firm may retain emails, attendance notes and other electronic communications as part of a matter file or business record.

Telephone or video communications will not be recorded routinely unless the individual is informed and an appropriate lawful basis applies. The firm may record details of communications in attendance notes for evidential, quality, training or matter-management purposes.

Email transmitted over the internet carries inherent security risks. The firm may provide secure portal facilities where appropriate, particularly for sensitive information.

20. Retention

Personal data will be retained only for as long as reasonably necessary for the purpose for which it was collected, including compliance with legal, regulatory, accounting, insurance and reporting obligations and the establishment, exercise or defence of legal claims.

Unless a different period is required or justified:

• client matter files will generally be retained for six years after the matter is closed;
• financial and accounting records will generally be retained for six years after the end of the relevant accounting period;
• anti-money laundering records will be retained for the period required by applicable law;
• enquiry information where no retainer is entered into will generally be retained for up to 12 months after the enquiry is closed;
• complaint records may be retained for six years after the complaint is concluded;
• marketing information will be retained until the individual opts out or the firm determines that it is no longer required; and
• website analytics and cookie information will be retained in accordance with the settings and periods stated in the firm’s Cookie Notice.

Information may be retained for longer where:

• a longer statutory or regulatory period applies;
• the matter involves a child or a person lacking capacity;
• litigation, a complaint or an insurance claim is pending or reasonably anticipated;
• the information is required to establish, exercise or defend a legal claim;
• a court, tribunal or regulator requires retention; or
• deletion would conflict with the firm’s professional obligations.

Prompts, outputs and drafts created through approved AI-assisted systems may form part of the client file where they are materially relevant to the work undertaken. Temporary prompts, draft outputs and technical logs may be retained for shorter periods in accordance with the firm’s settings and the relevant provider arrangements.

At the end of the applicable retention period, personal data will be securely deleted, anonymised or otherwise placed beyond use, unless continued retention is required or permitted by law.

21. Individual rights

Subject to legal limitations and exemptions, individuals may have the following rights.

21.1 Right of access

An individual may request confirmation of whether the firm processes their personal data and obtain a copy of that data together with other relevant information.

The firm may withhold or redact information where required or permitted by law, including where disclosure would adversely affect another person’s rights or reveal information protected by legal professional privilege.

21.2 Right to rectification

An individual may request correction of inaccurate personal data or completion of incomplete personal data.

21.3 Right to erasure

An individual may request deletion of personal data in certain circumstances. The right is not absolute. The firm may continue to retain information where necessary to:

• comply with a legal obligation;
• establish, exercise or defend legal claims;
• protect another person’s rights;
• comply with professional or regulatory obligations; or
• pursue another lawful purpose for which retention is permitted.

21.4 Right to restriction

An individual may request restriction of processing where:

• the accuracy of the data is disputed;
• processing is unlawful but deletion is not requested;
• the firm no longer needs the data but it is required for a legal claim; or
• an objection is being considered.

21.5 Right to object

An individual may object to processing based on legitimate interests. The firm will stop the processing unless it demonstrates compelling legitimate grounds that override the individual’s interests, rights and freedoms or the processing is required for legal claims.

An individual may object to direct marketing at any time.

21.6 Right to data portability

In applicable circumstances, an individual may request personal data they provided to the firm in a structured, commonly used and machine-readable format or request that it be transmitted to another controller.

21.7 Right to withdraw consent

Where processing is based on consent, consent may be withdrawn at any time. Withdrawal does not affect processing undertaken before withdrawal or processing based on another lawful basis.

21.8 Rights concerning automated decisions

Individuals have rights in relation to certain decisions made solely by automated means that produce legal or similarly significant effects. The firm does not ordinarily undertake such decision-making.

21.9 Right to complain

An individual may complain to the firm or to the Information Commissioner’s Office as explained in section 24.

The exercise of a data protection right will not normally involve a fee. The firm may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive, particularly where it is repetitive, as permitted by law.

22. How to exercise data protection rights

Requests should be sent to:

Patricia Mary White
Compliance Manager
Patricia White Litigation & Advocacy Ltd
Suite 10b, Tower House Business Centre
Fishergate
York
YO10 4UA
United Kingdom
Telephone: 01904 217184
Email: patriciaw@pw-la.co.uk

The firm may request information reasonably necessary to confirm the requester’s identity and locate the relevant information.

The firm will respond without undue delay and ordinarily within one month. That period may be extended by up to two further months where permitted by law, taking account of the complexity and number of requests. The requester will be informed if an extension is required.

23. Personal data breaches

The firm maintains procedures for identifying, assessing, managing and recording personal data breaches.

Where a breach is likely to result in a risk to individuals’ rights and freedoms, the firm will notify the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

Where a breach is likely to result in a high risk to an affected individual’s rights and freedoms, the firm will also notify that individual without undue delay unless an applicable exception applies.

Not every security incident is legally required to be reported to the Information Commissioner’s Office or to affected individuals.

24. Complaints

Concerns about the firm’s handling of personal data should initially be directed to:

Patricia Mary White
Compliance Manager
Patricia White Litigation & Advocacy Ltd
Suite 10b, Tower House Business Centre
Fishergate
York
YO10 4UA
United Kingdom
Telephone: 01904 217184
Email: patriciaw@pw-la.co.uk

An individual also has the right to complain to the Information Commissioner’s Office.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
United Kingdom
Telephone: 0303 123 1113
Website: https://ico.org.uk

The Information Commissioner’s Office generally expects a complaint to be raised within three months of the individual’s last meaningful contact with the organisation concerned.

25. Changes to this Privacy Notice

The firm may update this Privacy Notice to reflect:

• changes to the firm’s services;
• changes in law or regulatory requirements;
• changes to service providers;
• the introduction or amendment of technology, including AI-assisted tools;
• changes to how personal data is processed; or
• improvements to the clarity of the notice.

The current version will be published on the firm’s website. Where a change materially affects how the personal data of existing clients is processed, the firm will take reasonable steps to bring the change to their attention before the materially different processing begins, where required.

26. Contact details

Questions about the collection, use, disclosure, transfer or protection of personal data should be directed to:

Patricia White Litigation & Advocacy Ltd
Suite 10b, Tower House Business Centre
Fishergate
York
YO10 4UA
United Kingdom
Telephone: 01904 217184
Email: enquiries@pw-la.co.uk

Compliance contact: Patricia Mary White
Compliance email: patriciaw@pw-la.co.uk

27. Review history

2 February 2026: Updated following the change of name from Patricia White Lawyers & Advocates Ltd to Patricia White Litigation & Advocacy Ltd, the change of office address and the appointment of a revised debit and credit card payment provider.

1 September 2026: Updated following changes to the firm’s website provider.

27 October 2026: Updated to explain the firm’s use of approved legal technology and AI-assisted tools and to revise the information concerning lawful bases, recipients, international transfers, retention, individual rights and personal data breaches.