Privacy Policy

Last updated: 11 July 2026

1. Who We Are

Garfield.Law Limited ("Garfield", "we", "us") is the data controller responsible for the personal information described in this policy. Garfield is a law firm authorised and regulated by the Solicitors Regulation Authority (SRA). Our contact details are set out at the end of this policy.

2. Information We Collect and Process

We currently collect and process the following information:

  • Personal identifiers, contacts and characteristics (for example, name and contact details)
  • Customer financial information
  • Employee data
  • Details of the customer's business and its debtors
  • Information about the customer's debtors including their names, contact details, financial information and other related information
  • Identity verification information, including identity document images and the results of biometric liveness checks (see section 4)
  • Information contained in documents and correspondence you upload or that we generate in the course of your claim

Some of this information may include special category data (for example, information that happens to appear in evidence or correspondence relating to a claim, or the biometric data used for identity verification). Where we process special category data we do so under an additional condition permitted by data protection law, including the establishment, exercise or defence of legal claims, and, for identity verification, a substantial public interest condition (see section 4).

2a. Website Analytics and Cookies

We use analytics and marketing technologies on our website to understand how it is used and to measure our marketing. These include Google Analytics 4 (GA4), Mixpanel (hosted in the EU), Google Ads and the LinkedIn Insight Tag. Non-essential cookies and similar technologies are only used with your consent, which you can manage at any time through our Cookie Settings page or the cookie banner shown when you first visit our site. Full details are set out in our Cookie Policy.

Where we use advertising or conversion-measurement features (such as Google signals, or sharing hashed identifiers like your email address with advertising providers), we rely on your consent. You can manage Google Ads personalisation at https://adssettings.google.com. Separately, we analyse how signed-in users interact with the product itself in order to improve and secure our services; this in-app analytics relies on our legitimate interest and does not use advertising cookies.

3. How We Get Personal Information and Why We Have It

Most of the personal information we process is provided to us directly by you for one of the following reasons:

  • To enable our app to work, to assist you in bringing the small claims that you wish to bring.

We also receive personal information indirectly, from the following sources in the following scenarios:

  • From HM Courts & Tribunals Service
  • From Companies House
  • From your debtors when they send documents to us relating to your small claims
  • From approved integration partners who submit claims to us on your behalf

We use the information that you have given us in order to help you progress your small claims and in order that we can provide you with a better user experience.

Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing this information are:

  1. Consent (Article 6(1)(a)) for non-essential cookies and marketing. You can withdraw your consent at any time by contacting us or through our cookie settings.
  2. Contract (Article 6(1)(b)) to provide our services to you.
  3. Legal obligation (Article 6(1)(c)) for identity verification, accounting records, and other regulatory requirements.
  4. Legitimate interests (Article 6(1)(f)), including pursuing legal claims against your debtors on your behalf, keeping our platform secure and reliable, and understanding how our website is used. Where we rely on legitimate interests we have assessed that our interests are not overridden by your rights, and you have the right to object (see section 9).

4. Identity Verification (KYC)

To meet our regulatory obligations as a law firm (including anti-money laundering and SRA customer due diligence requirements), we verify the identity of our clients. We use a specialist identity verification provider to do this, which involves checking identity documents and a biometric liveness check that matches your face against your identity document.

The biometric element is special category data. We process it under a substantial public interest condition in data protection law, on the basis that identity verification is a regulatory precondition to us acting for you. Where we are required to maintain a policy document governing this processing, we do so and it is available on request.

5. How We Use Artificial Intelligence

Our platform uses artificial intelligence to help draft legal documents, extract information from documents you upload, and power the in-app assistant. All AI processing of your claim data takes place server-side within our secure Google Cloud environment, in UK and EU data centres, under contractual terms that provide for a zero-data-retention configuration and that prohibit the use of your data to train AI models.

Identity verification (see section 4) and certain other checks may be carried out by automated means.

Separately, our engineering team uses AI-assisted development tools when investigating and fixing technical issues. Where these tools process client data, that processing runs on the same zero-data-retention Google Cloud AI configuration described above, so your data is not retained beyond processing or used to train AI models.

6. Who We Share Your Information With

We use trusted third-party providers ("sub-processors") to deliver our services. They act on our instructions under data processing agreements that require them to keep your information secure and confidential. The categories of recipient include:

  • Cloud infrastructure, hosting and AI processing (Google Cloud, Vercel)
  • Email and postal correspondence providers (Mailgun, Stannp)
  • Identity verification (Sumsub)
  • Payment processing and accounting (Stripe, Xero)
  • Error monitoring and internal operational tooling

In the course of conducting litigation we also disclose claim information to HM Courts & Tribunals Service (for court filings) and carry out lookups against Companies House. These are UK government bodies acting in their own right, not on our instructions. We may also share information with other government agencies where required. A current list of our sub-processors is available on request.

7. International Data Transfers

The core information relating to your claims and account is stored in the United Kingdom. Some of our sub-processors store or process personal data outside the UK (for example in the European Economic Area or the United States). Where personal data is transferred outside the UK, we ensure an appropriate safeguard is in place, such as the UK Extension to the EU-US Data Privacy Framework, or the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, so that your information continues to be protected to UK standards.

8. How We Store Your Personal Information

Your information is stored securely on appropriately secured systems.

We retain client and case information for the duration of the claim plus six years, in line with the Limitation Act 1980 and our professional record-keeping obligations. Accounting and payment records are retained for seven years to meet HMRC requirements. Where you ask us to delete your account, we retain limited account information for up to twelve months afterwards before permanent deletion. When information is no longer required, we dispose of it securely by permanent deletion.

9. Your Data Protection Rights

Under data protection law, you have rights including:

  • Your right of access - You have the right to ask us for copies of your personal information.
  • Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
  • Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
  • Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.
  • Your right to object to processing - You have the right to object to the processing of your personal information in certain circumstances, including where we rely on legitimate interests.
  • Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. Some rights are subject to legal exemptions, including where information is protected by legal professional privilege, and where for regulatory or insurance reasons we are required to retain information for a specified period of time, which can be six years in some circumstances and twelve in others.

Please contact us at our details below if you wish to make a request.

10. How to Complain

If you have any concerns about our use of your personal information, you can make a complaint to us at our contact details below.

You can also complain to the ICO if you are unhappy with how we have used your data.

11. Our Contact Details

Garfield.Law Limited
Address: Pantiles Chambers, 85 High Street, Tunbridge Wells, Kent TN1 1XP
E-mail: enquiries@garfield.law

12. ICO's Contact Details

Information Commissioner's Office:
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113
ICO website: https://ico.org.uk