Legal Client Privacy Notice

Last updated: 29 August 2026

This notice applies only where Ryan has agreed to undertake legal work and the engagement has been confirmed separately and in writing.

Who this notice applies to

This notice covers personal information used in Ryan's own legal client work. This includes legal matter administration, correspondence, legal case files, documents and evidence, Clio Manage and Clio for Clients, and relevant information about other people contained within a legal matter.

Merely making an enquiry does not make you a legal client. Access to the client portal is not a route for instructing Ryan on a new matter. Any engagement must be agreed separately and in writing.

This notice should be read with your engagement information and any matter specific privacy information provided to you.

Who is the controller?

Ryan Jarvis is the controller for personal information where he determines why and how it is used in connection with his own legal client work.

Ryan is registered with the Information Commissioner's Office under registration ZB338223 (opens in a new tab).

Data protection contact: ryan@ryanjarvis.uk

Information that may be used

The information depends on the nature of the matter. Ryan may use:

• name, address, email address, telephone number and date of birth where relevant;
• identity information where it is reasonably necessary;
• client and matter identifiers;
• instructions, correspondence and documents supplied or uploaded;
• court and tribunal documents, evidence and witness information;
• information about complainants, defendants, opponents and other parties;
• information obtained from public bodies, official records and public registers;
• financial, billing and payment information where applicable;
• details of professional advisers and representatives;
• case management and client portal records;
• information about legal rights, claims, allegations or proceedings;
• special category information and criminal offence information where relevant and lawful.

Ryan does not collect every category for every matter. Information should be limited to what is relevant and reasonably necessary.

Where information may come from

Depending on the matter, information may come from:

• you and anyone authorised to act for you;
• previous or other advisers where appropriate;
• family members or other people authorised by you or reasonably relevant to the matter;
• witnesses, complainants, opponents and other parties;
• courts and tribunals;
• police, prisons, probation and other public authorities;
• healthcare or social care organisations where relevant and lawful;
• experts and other professionals;
• official records, public registers and freedom of information material;
• publicly accessible information;
• documents or evidence supplied in connection with the matter;
• messages and documents supplied through Clio for Clients.

Why information is used and the lawful bases

The lawful basis is selected for the particular purpose. Ordinary legal work is not treated as a legal obligation merely because it concerns law, and consent is not used as the routine basis for providing legal services.

Article 6(1)(b) does not automatically apply to witnesses, opponents, complainants or other third parties because they are not parties to the client engagement.

Special category information

A legal matter may contain health information, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, information about sex life or sexual orientation, or genetic or biometric information where relevant.

Using special category information requires both an Article 6 lawful basis and an Article 9 condition. Where the processing is necessary for obtaining legal advice or for establishing, exercising or defending legal rights, Article 9(2)(f) may apply. It is not treated as applying to every item merely because it appears in a legal file. The condition must match the purpose and circumstances.

Criminal offence information

Legal matters may involve criminal allegations, convictions, proceedings, sentences or related information. This information is subject to Article 10 of the UK GDPR.

Ryan does not process criminal offence information under official authority merely because he undertakes legal work. An Article 6 lawful basis and authority under domestic law must both be identified.

Where processing is necessary for legal proceedings, including prospective proceedings, obtaining legal advice, or establishing, exercising or defending legal rights, the condition in the Data Protection Act 2018, Schedule 1, Part 3, paragraph 33 may apply. It does not apply automatically to every use of criminal offence information.

If a different Schedule 1 condition is required, it must be identified and documented before the processing takes place. Where that condition requires an Appropriate Policy Document, one must be in place. This notice does not claim that an Appropriate Policy Document exists where that has not been confirmed.

Legal professional privilege and confidentiality

Some information may be subject to legal professional privilege or another duty of confidentiality where the legal requirements for that protection are met. This notice does not suggest that every communication or document is automatically privileged.

Who may receive information?

Information is only shared where there is a proper reason connected with the matter, the client's instructions, the operation of necessary services, a legal requirement, or the establishment, exercise or defence of legal rights.

Clio

Themis Solutions (Ireland) Limited, trading as Clio, provides Ryan's legal case management system, document storage and sharing, client portal, matter communications, and service operation and support.

For personal information Ryan places in Clio in connection with a client matter, Ryan remains the controller. Under Clio's published Data Protection Addendum (opens in a new tab), the subscriber is the controller and Themis is the processor for Subscriber Personal Data.

The information placed into or generated within a matter may include client identification and contact details, matter details, correspondence, documents, evidence, billing information and sensitive information where relevant to the legal matter. This does not mean every Clio subprocessor receives every category of information.

Clio may separately act as controller for limited information it uses for its own account administration, service, billing or other purposes described in the Clio Privacy Policy (opens in a new tab).

This website does not build, copy or embed the Clio login system and does not collect your Clio username, password or other authentication information.

Access legal client portal (opens in a new tab)

Email

Proton AG provides Ryan's email service for professional communications. Email correspondence may therefore be processed through Proton's systems. Proton does not create legal professional privilege, and ordinary email from another provider should not be assumed to be end to end encrypted.

Other recipients

Depending on what is necessary for a particular matter, recipients may include:

• banks or payment providers for invoices and payments;
• professional advisers, insurers or brokers where applicable;
• counsel, another lawyer, experts, translators or interpreters where authorised or necessary;
• courts, tribunals, police, prisons, probation, regulators and other public authorities;
• counterparties and their representatives;
• people from whom information or comment is properly sought;
• other people authorised by the client or where disclosure is required by law.

These categories do not mean information will be sent to every type of recipient in every matter.

International transfers

Some service providers operate internationally. The use of an address containing eu does not guarantee that all legal client information remains solely in the United Kingdom or European Union.

Clio's published Data Protection Addendum provides for the European Commission Standard Contractual Clauses and the UK Addendum where they are required for restricted transfers of Subscriber Personal Data. The destinations that may be involved depend on the Clio products and features used and the current Clio subprocessor information (opens in a new tab).

Where UK data protection law requires safeguards for a restricted transfer, Ryan uses services subject to applicable transfer arrangements and keeps those arrangements under review.

How long information is kept

Legal matter files

Legal matter files are normally retained for six years after the matter closes, unless a shorter period is appropriate or a longer period is reasonably necessary.

A longer period may be justified by ongoing or prospective proceedings, limitation periods, the need to establish, exercise or defend legal rights, complaints or claims, court or tribunal requirements, safeguarding, professional liability or insurance requirements, statutory duties, an ongoing connected matter, or the particular nature of the case.

At the end of the retention period, the file should be deleted, anonymised or reviewed, and any decision to keep it for longer should be documented.

Financial and tax records

Financial and tax records are kept for the applicable statutory accounting and tax period.

Conflict and matter history

A minimal record may be kept for longer than the full file where reasonably necessary to identify conflicts, demonstrate a previous engagement or protect legal rights.

Security

Ryan uses proportionate measures intended to protect legal client information. These include controlled access, appropriate account security, secure case management, encrypted services where appropriate, data minimisation, separation from journalism, secure document sharing through Clio where appropriate, and review of suppliers and access.

No online service can guarantee absolute security. The Legal Client Portal must not be used for journalism, story tips or journalistic source material. The separate Secure Tips page explains the available journalistic contact routes.

Legal work and journalism

Information obtained through a legal client relationship is not used for Ryan's journalism merely because Ryan also works as a journalist.

Any materially different use of client information would require its own lawful basis and consideration of confidentiality, contractual duties, professional obligations and applicable law.

The Legal Client Portal must not be used for journalism, story tips or journalistic source material.

Marketing

Legal client information is not sold or used for unrelated direct marketing. Legal clients are not automatically added to the journalism newsletter.

Any direct marketing must have its own basis under data protection law and the Privacy and Electronic Communications Regulations, together with an appropriate consent or opt out process where required.

Your data protection rights

Depending on the purpose and lawful basis, you may have rights to:

• access your personal information;
• correct inaccurate information;
• ask for information to be erased;
• restrict the use of information;
• object to certain processing;
• receive information in a portable format where portability applies;
• withdraw consent where consent is actually relied upon.

These rights are not absolute. Third party information may need to be protected, statutory exemptions may apply, and legally privileged information may be protected where privilege actually exists. Any exemption must be considered case by case.

A subject access request does not automatically provide an unrestricted copy of the complete legal case file. For requests about Ryan's legal case file, contact Ryan rather than Clio. Clio may separately deal with rights relating to information it processes as controller for its own purposes.

Automated decisions

Ryan does not use solely automated processing, without meaningful human involvement, to make decisions about legal clients that have legal or similarly significant effects. This does not mean that ordinary software automation is never used to administer a matter.

Data protection complaints

This section concerns complaints about how personal information is handled. A complaint about the substantive legal service may instead be dealt with under the applicable engagement and complaints arrangements.

Email ryan@ryanjarvis.uk and use the subject Data protection complaint.

Ryan aims to acknowledge a data protection complaint within five working days. He will take appropriate steps to investigate it, keep you informed where necessary and communicate the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office (opens in a new tab).

Changes to this notice

This notice will be reviewed when legal client processing, relevant law or important provider arrangements change. The date at the top shows when it was last substantively updated.

Significant changes will be brought to affected people's attention where appropriate.

Other privacy information

The main Privacy Notice covers this website, ordinary professional correspondence and Ryan's journalism. Separate organisations, including Conviction and Criminal Justice Hub, retain responsibility for their own work and systems.