Privacy

Last updated: 17 February 2026

Grant Smith Law Practice Limited ("we", "us", "GSLP") is committed to protecting your privacy and handling your personal data responsibly. This notice explains what personal data we collect, why we collect it, how we use it, and what rights you have.

We are the data controller for the personal data described in this notice. We are a limited company registered in Scotland (company number SC 145875) with our principal office at 252 Union Street, Aberdeen, AB10 1TN. 

We are regulated by the Law Society of Scotland.

If you have any questions about this notice or how we handle your personal data, please contact our Data Protection Officer (DPO) at: 

Data Protection Officer
Grant Smith Law Practice Limited
252 Union Street
Aberdeen
AB10 1TN

Email: info@grantsmithlaw.co.uk

Who this notice applies to

This notice applies to everyone whose personal data we process. That includes:

• Visitors to our website
• People who contact us by telephone, email, or through our website
• Our clients and former clients
• People who are not our clients but whose personal data we receive during the course of legal matters (for example, the other party in a property transaction, a family law case, or a personal injury claim)
• People whose data we receive from other law firms who instruct us to act on their behalf (for example, as local agents in court proceedings)
• Job applicants
• Our suppliers, contractors, and professional contacts
• People who receive marketing communications from us
• People who visit our offices
• People who make complaints about our services

What personal data we collect

Your name, address, email address, telephone number, and date of birth. Your occupation, employer details, and financial information (such as income, assets, and liabilities). Identification documents such as your passport, driving licence, or utility bills (for anti-money laundering checks). Details of your legal matter, including correspondence, file notes, court documents, and records of meetings and telephone calls. Information about other parties involved in your matter. Payment information and billing records. Financial information such as bank statements, account details, and income information disclosed or obtained during the course of legal proceedings.

How we obtain your data

We obtain personal data in several ways. We collect data directly from you when you instruct us, contact us, or use our website. We also receive data from other sources, including other solicitors, courts and tribunals, government agencies, financial institutions, medical professionals, insurers, and other third parties involved in legal matters. Where we receive your data from a source other than you, we will tell you within one month or at the point of our first contact with you, unless an exemption applies.

Special category data

Some legal matters require us to process more sensitive types of personal data, known as special category data under the UK General Data Protection Regulation. This may include:

 Information about your physical or mental health (for example, in personal injury, family law, or power of attorney matters). Information about criminal convictions or offences (for example, in criminal defence work). Information about your racial or ethnic origin, religious beliefs, political opinions, or sexual orientation (where relevant to your legal matter).

We will only process special category data where we have a lawful basis to do so. In most cases, this will be because processing is necessary for the establishment, exercise, or defence of legal claims (Article 9(2)(f) of the UK GDPR). We maintain an Appropriate Policy Document as required by the Data Protection Act 2018.

Why we collect your data and our legal basis for processing

We process your personal data for different reasons depending on the circumstances. The list below sets out the main purposes and the lawful basis we rely on in each case.

If you are a client or prospective client:

We process your data to provide you with legal services and advice. Our lawful basis is that processing is necessary for the performance of our contract with you, or to take steps at your request before entering into a contract. 

We process your data to carry out anti-money laundering and identity verification checks. Our lawful basis is that processing is necessary to comply with a legal obligation.

We process your data to manage our relationship with you, including billing and administration. Our lawful basis is that processing is necessary for the performance of our contract with you and for our legitimate interests in running our business.

We process your data to defend or pursue legal claims. Our lawful basis is that processing is necessary for our legitimate interests or for the establishment, exercise, or defence of legal claims.

If you are a third party involved in a legal matter:

We may receive your personal data during the course of acting for our client. Our lawful basis is that processing is necessary for our legitimate interests in providing legal services to our client, or for the establishment, exercise, or defence of legal claims. We may obtain your personal data from court documents, from the other party or their solicitor, from third parties such as banks or financial institutions in response to court orders or statutory powers, or from publicly available sources.

If we receive your data from another law firm:

We sometimes act as local agents for other law firms, for example by representing their clients at procedural hearings in local Sheriff Courts. In these circumstances, we receive personal data from the instructing firm and process it in accordance with their instructions and the terms of any data processing agreement in place. Our lawful basis is that processing is necessary for the performance of our contract with the instructing firm and for the establishment, exercise, or defence of legal claims.

If you are a website visitor:

We process data collected through cookies and similar technologies to improve your experience on our website. Please see our Cookie Policy for more information.

If you contact us through our website or by email or telephone:

We process your data to respond to your enquiry. Our lawful basis is that processing is necessary for our legitimate interests in responding to enquiries and providing information about our services.

If you are a job applicant:

We process your data to assess your suitability for the role. Our lawful basis is that processing is necessary to take steps at your request before entering into a contract, and for our legitimate interests in recruiting suitable staff. 

If you receive marketing communications from us:

We process your data to send you information about our services, legal updates, or events. Our lawful basis is consent (where you have opted in) or our legitimate interests in promoting our services to existing and former clients and professional contacts. You can withdraw your consent or opt out at any time by contacting us or using the unsubscribe link in any email.

If you are a supplier, contractor, or professional contact:

We process your data to manage our business relationships with you, including placing and administering orders, processing invoices and payments, and communicating with you about the services you provide to us. Our lawful basis is that processing is necessary for the performance or our contract with you or for our legitimate interests in managing our business operations and professional relationships.

If you visit our offices:

We may collect you name and the name of the person you are visiting when you attend on of our offices. Please note that some of our offices are located in buildings managed by third parties who may operate their own CCTV and security systems. These are not controlled by us, and any queries about building security should be directed to the relevant building management.

If you make a complaint about our services:

We process your data to investigate and respond to your complaint. This may include sharing your personal data with our professional indemnity insurers, the Scottish Legal Complaints Commission, the Law Society of Scotland, or other regulatory bodies as required. Our lawful basis is that processing is necessary for our legitimate interests in handling complaints and improving our services and to comply with our legal and regulatory obligations. We retain complaint records for a minimum of 10 years from the date the complaint is resolved.

Whether you have to provide your data

In some cases, providing your personal data is a contractual or legal requirement. For example, we are required by law to verify the identity of our clients under anti-money laundering regulations. If you do not provide the information we need, we may not be able to act for you. Where we obtain data about third parties during the course of legal proceedings, this is typically required or authorised by law or by court order.

Who we share your data with

We may share your personal data with:

• Other parties and their legal representatives as required for your matter.
• Courts, tribunals, and regulatory bodies as required by law or for the administration of justice.
• The Law Society of Scotland and other professional regulatory bodies.
• The Scottish Legal Aid Board (where your matter is funded by Legal Aid).
• HM Revenue and Customs, the National Crime Agency, and other government agencies where required by law.
• Our professional indemnity insurers.
• Third-party service providers who support our business operations, such as our IT and case management system providers, secure email providers, and cloud storage providers.
• Other law firms who instruct us, where we act as their local agent.
• Credit reference agencies and identity verification services for anti-money laundering purposes.
• Banks and financial institutions, where required by court order or in the exercise of statutory powers
• Any prospective buyer, investor, or successor in the event of a sale, merger, or restructuring of all or part of our business, to the extent necessary for that purpose.

We require all third parties who process personal data on our behalf to have appropriate security measures in place and to process data only in accordance with our instructions.

International transfers

We process and store all personal data within the United Kingdom. We do not transfer personal data outside the United Kingdom. If this changes in the future, we will update this notice and ensure that appropriate safeguards are in place in accordance with the UK GDPR.

How long we keep your data

We keep your personal data for as long as necessary to fulfil the purposes for which it was collected, to comply with our legal and regulatory obligations, and to protect our legitimate interests. 

For client files, we follow the Law Society of Scotland's recommended retention periods. As a general guide:

• Conveyancing and property files: we retain title deeds and related documents indefinitely, and other conveyancing papers for a minimum of 10 years from the date of the transaction.
• Wills: we retain the original will indefinitely (or until the testator requests its return or we are notified of their death and the will has been registered).
• Executry files: a minimum of 10 years from the date the estate is wound up.
• Family law files: a minimum of 10 years from the closure of the file, with certain documents relating to children retained until the youngest child reaches the age of 25.
• Criminal defence files: a minimum of 5 years from the closure of the file.
• Personal injury files: a minimum of 10 years from the closure of the file.
• Corporate and commercial files: a minimum of 10 years from the closure of the file.
• Powers of Attorney: retained indefinitely while the power is in force.
• For visitor records, we retain your details for 12 months from the date of your visit.
• For complaint records, we retain your details for a minimum of 10 years from the date the complaint is resolved.

For data received from other law firms in our capacity as local agents, we retain paper records only for the duration of the specific court appearance and destroy them securely afterwards. Electronic records are retained for no longer than is necessary to complete our reporting and invoicing obligations.

For job applicant data, we retain unsuccessful applications for 6 months after the recruitment process has concluded, unless you give us permission to hold your details for longer.

Anti-money laundering records are retained for a minimum of 5 years from the end of the business relationship, as required by the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.

Where we hold personal data about individuals who are not our clients (for example, the other party in a legal matter), we retain this data for the same period as the client file to which it relates, as it forms part of the legal record. 

Your rights

Under the UK General Data Protection Regulation, you have the following rights in relation to your personal data:

Right of access. You can ask us for a copy of the personal data we hold about you (known as a subject access request).

Right to rectification. You can ask us to correct any personal data that is inaccurate or incomplete.

Right to erasure. You can ask us to delete your personal data in certain circumstances, for example where the data is no longer necessary for the purpose for which it was collected. Please note that we may be unable to delete data where we are required to keep it for legal, regulatory, or professional reasons.

Right to restrict processing. You can ask us to limit how we use your personal data in certain circumstances.

Right to data portability. In certain circumstances, you can ask us to transfer your personal data to you or to another organisation in a commonly used, machine-readable format.

Right to object. You can object to our processing of your personal data where we are relying on legitimate interests as our lawful basis. You also have an absolute right to object to your data being used for direct marketing.

Right to withdraw consent. Where we are processing your data based on your consent, you can withdraw that consent at any time. This will not affect the lawfulness of any processing we carried out before you withdrew your consent.

Rights relating to automated decision-making. We do not use automated decision-making or profiling in a way that produces legal effects or similarly significant effects on you.

Please note that some of these rights are not absolute. In particular, where your personal data forms part of a legal file relating to ongoing or potential legal proceedings, we may be unable to comply with a request for access, erasure, or restriction to the extent that doing so would be likely to prejudice those proceedings or would require the disclosure of information that is subject to legal professional privilege (Data Protection Act 2018, Schedule 2, Part 1, Paragraph 5). We will always tell you if we are relying on an exemption and explain our reasons.

To exercise any of these rights, please contact our Data Protection Officer using the details at the top of this notice. We will respond to your request within one month. In some cases, we may need to verify your identity before we can act on your request.

How to complain

If you are unhappy with how we have handled your personal data, we would like to hear from you. Please contact our Data Protection Officer in the first instance.

If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: www.ico.org.uk

Changes to this notice

We may update this notice from time to time. Any changes will be posted on this page with an updated date. We encourage you to check this page periodically.