Waterstone Legal is committed to protecting your privacy. This statement describes how we collect and use your personal data. It also describes the rights you have and control you can exercise in relation to it.
It is important that you read this privacy notice together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy notice supplements the other notices and is not intended to override them.
Who we are?
Waterstone Legal is a forward-thinking legal practice providing legal services.
If you have any questions about our use of your personal data, please use the following contact:
Address: Waterstone Legal, 2nd Floor, 2–5 Minories, London EC3N 1BJ
Telephone: 020 7063 9040
Fax: 020 7063 9041
Email: enquiries@wslegal.co.uk
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.
What personal information do we collect about you?
We may collect personal information from you in the course of our business, including through your use of our website, when you contact or request information from us, when you engage our legal or other services or as a result of your relationship with one or more of our staff and clients.
The personal information that we process includes:
- Contact information: your name, position, role, company or organisation, telephone (including mobile phone number where provided) as well as email and postal address Contact information, such as your postal address, email address and phone number(s)
- Business information: data identifying you in relation to matters on which you instruct us or in which you are involved
- Technical information: such as information from your visits to our website or applications or in relation to materials and communications we send to you electronically
- Information in connection with investigations or proceedings: where this is necessary to conduct the investigation or proceedings
- Personal information provided to us: such as Identification and background information provided by you or collected as part of our business acceptance
- processes or on behalf of our clients or generated by us in the course or providing services to them, which may include special categories of data
- Online data: [when you access this website and our technology services, information about your visit including URL clickstream to, through and from our website (including date and time), information about your network as such as information about devices, nodes, configurations, connection speeds and network application performance; pages viewed or searched for, page response times, download errors, length of visits and interaction information (such as scrolling, clicks, mouse-overs) and whether you click on particular links or open our emails]
- Any other information relating to you which you may provide to us
- How we obtain your personal information?
- We collect information from you: as part of our business acceptance processes and about you and others as necessary in the course of providing legal services or while monitoring our technology tools and services, including our websites and email communications sent to and from Waterstone Legal or when you provide it to us, or interact with us directly, for instance engaging with our staff or registering on one of our digital platforms or applications.
- We may collect or receive information about you: from other sources, such as keeping the contact details we already hold for you accurate and up to date using publicly available sources
- Please do not send us confidential information: until we have confirmed in writing that we represent or act for you or your company or organisation.
- Unsolicited emails: from non-clients do not establish a lawyer-client relationship. They may not be privileged and, therefore, may be disclosed to others.
How we use your personal information
We use your personal data for the following purposes:
- Business relationship: managing and administering our relationship with you, your company or organisation including keeping records about business contacts, services and payments so we can customise our offering for you, develop our relationship and target our marketing and promotional campaigns;
- Communication: sending emails, newsletters and other messages to keep you informed of legal developments, market insights and of our services;
- Events: running legal briefings, roundtables and other events;
- Client surveys and feedback: including events feedback and client listening exercises as well as answering issues and concerns which may arise;
- Client legal compliance: client due diligence (under anti-money laundering, sanctions screening and other crime prevention and detection laws and regulatory requirements) which may involve automated screening checks to ensure that clients and contacts are genuine and to prevent fraud or crime and we may not be able to take instructions if you do not provide the information we need to do these checks;
- Website monitoring: to check the website and our other technology services are being used appropriately and to optimise their functionality;
- Site security: to provide security to our offices and other premises (normally collecting your name and contact details on entry to our buildings);
- Online security: protecting our information assets and technology platforms from unauthorised access or usage and to monitor for malware and other security threats;
- Regulatory: compliance with our legal and regulatory obligations as a law firm including auditing and reporting requirements;
- Managing suppliers: who deliver services to us;
- Legitimate interest: to pursue the legitimate business interests listed in the “Legitimate Interests section of this policy below.
On what basis we use your personal information
We use your personal information on the following basis:
- To perform a contract: such as engaging with an individual to provide legal or other services
- Necessary to deal with legal claims: for example, involving court proceedings
- Compliance: To comply with legal and regulatory obligations
- Consent: we have your explicit consent for the processing
Cookies and similar technologies
This section was last updated on 9 October 2026.
A cookie is a small file that a website asks your browser to keep. The rules that govern them — the Privacy and Electronic Communications Regulations 2003 (PECR) — cover any storing of information on your device, or reading of information already stored there, so they also cover a browser's local and session storage. Everything of that kind that this site uses is listed below. Nothing is left out.
We ask before we set anything for analytics, and we ask before it is set rather than afterwards. Until you say yes, the site tells Google Tag Manager that analytics storage is denied — and it does so before the Tag Manager container loads, so no analytics tag runs and no analytics cookie is written. The two things this site keeps in your browser for its own purposes wait for the same answer. If you say no, or ignore the question altogether, every page and every feature on this site works exactly the same way.
Strictly necessary — no consent needed
We do not ask permission for these, because each one exists only to carry out something you have just told the site to do. PECR exempts storage for that reason. There are three of our own, and none is a cookie:
- ws-consent — browser local storage. It records the choice you made about cookies, the version of this section you were shown when you made it, and the date and time. It is how we avoid asking you again on every page, and how we can show what you agreed to if we are ever asked. It contains nothing that identifies you and it is never sent to us or to anyone else — it stays in your browser. It is written only at the moment you answer, so if you never answer, nothing is written. It stays until you clear your browsing data, and we treat it as out of date after 6 months and ask you again.
- ws-offer-closed — browser session storage, written only if you close the promotional bar at the top of the page. It holds the single character 1, and it is the only way we can honour your having closed the bar when you open the next page. Not keeping it would mean showing you again something you had just dismissed. It disappears when you close the tab.
- ws-promo-seen — browser session storage, written only when you close the offer pop-up or follow its link. It holds the single character 1 and identifies nobody; it stops the pop-up opening again while the tab is open. It disappears when you close the tab.
Analytics and site measurement — only if you say yes
One switch covers everything below. Until you turn it on, none of it is written to your device and none of it is read from it — including the checks that would tell us whether it was already there.
If you turn it on, Google Analytics 4 is loaded through Google Tag Manager and sets two cookies on this website's own domain:
- _ga — tells one browser apart from another, so that somebody coming back for a second look is not counted as a second person. Google's default lifetime for it is two years.
- _ga_ followed by our Google Analytics measurement ID, for example _ga_ABCDE12345 — keeps track of the visit you are currently making. Google's default lifetime for it is two years.
The same switch also loads PostHog, a second analytics tool, provided by PostHog Inc. and hosted in its European Union cloud. We use it for the same purpose as Google Analytics, and to count the enquiries sent through the forms on this site. For an enquiry it is told only which form was used, the option you picked from that form's list, the page, and the campaign tags in the link you arrived by — never your name, your contact details or anything you type. It stores:
- ph_ followed by our PostHog project key and _posthog — a cookie, with a copy in browser local storage, holding a random identifier for your browser and the current visit. The cookie lasts one year from your last visit. It is set on waterstonelegal.co.uk as a whole, including its subdomains.
- Further keys beginning ph_ in browser session storage, which keep track of the current visit and tell one open tab from another. They go when you close the tab.
- __ph_opt_in_out_ followed by our PostHog project key — browser local storage, written when you turn this switch off while PostHog is running on the page. It records whether PostHog has been switched off or back on, and holds no identifier. It stays until you clear your browsing data.
PostHog is set to discard your IP address, so it is not kept with the records. PostHog keeps the records it receives for up to seven years, the retention period on our plan, and then deletes them.
Google Tag Manager itself sets no cookies. It is the container these tags are loaded from, and on its own it measures nothing.
We use analytics to see which pages and which services people read, how they found the site, and where they give up — so that we can make it more useful. We do not use it to advertise to you, we do not sell it, and we do not try to work out who you are from it. Google states that Google Analytics 4 does not log or store the IP address your browser connects from; it uses it to work out an approximate location and then discards it.
Two other things are kept in your browser under the same switch. Neither is a cookie, neither identifies you, and neither leaves your browser — but both are storage on your device, so they belong in this list and they wait for the same yes:
- ws-offer-deadline — local storage. Holds a single date and time: three days from your first visit, which is when the countdown on the promotional bar runs out for you. Keeping it is what stops the same offer restarting every time you open a page. It stays until you clear your browsing data, or until you turn this switch off, whichever comes first. If you have not turned the switch on, the bar still appears and still counts down — the countdown simply starts afresh on each page instead of being remembered.
- ws-read: followed by an article's reference — session storage, on blog articles only. It is set once you have spent fifteen seconds on an article, and it stops that article being counted twice in the internal tally we use to decide which piece to feature. It counts reads, not readers, and it goes when you close the tab. With the switch off, nothing is stored and nothing is counted — your reading is not recorded at all.
Turning the switch off again deletes both of these from your browser straight away, along with the Google Analytics and PostHog cookies and storage, except the PostHog note of your choice described above.
Things other people load on this site
Three features on this site are served by somebody else. Each one makes a request to that third party when a page loads, which tells them the address of the page you are on and the IP address your browser connects from:
- The ReviewSolicitors reviews panel, at the right-hand edge of the page. We have checked what it does: it sets no cookies and stores nothing in your browser.
- Our Solicitors Regulation Authority digital badge in the footer, which is served by the SRA's badge provider.
- The Trustpilot reviews box, which shows our Trustpilot rating and is loaded from Trustpilot. It is shown in a frame on the page, and anything Trustpilot stores in that frame is covered by Trustpilot's own privacy and cookie policies, not this notice.
Google Tag Manager is loaded on every page in the same way. Loading it does not set a cookie and it collects nothing until you have agreed to analytics.
The lawful basis
Storing anything on your device, or reading anything already stored there, needs your consent under regulation 6 of PECR unless it is strictly necessary for a service you have asked for. Where we rely on consent, the personal data that follows is processed on the basis of that same consent, under Article 6(1)(a) of the UK GDPR. Consent is a real choice: refusing costs you nothing, and nothing about this site is withheld if you say no.
Changing or withdrawing your choice
You can change your mind at any moment, and it is exactly as easy as saying yes was: use the "Cookie settings" link at the foot of every page on this site. Turning the switch off deletes the Google Analytics and PostHog cookies, the offer countdown and any article read notes from your browser straight away, and stops anything further being written for analytics, apart from a note of your refusal (listed above).
You can also refuse or delete cookies in your browser's own settings, and set it to tell you whenever one is offered. If you do that, this site will still work.
If you think we have got any of this wrong, please tell us at enquiries@wslegal.co.uk — and you can complain to the Information Commissioner's Office, whose details are at the top of this notice.
How long do we keep your data?
We generally keep your information as needed to provide our legal services and to deal with claims. This will depend on a number of factors such as whether you or your company or organisation are an existing client or have interacted with recent client mailings or bulletins or attended recent events. We will retain your information as necessary to comply with legal, accounting or regulatory requirements. Typical retention periods will range from 3 to 15 years.
Who we share your personal information with?
We share your information as with others as follows:
We may share your personal information with certain trusted third parties in accordance with contractual arrangements in place with them, including:
- Suppliers: to whom we outsource certain support services such as word processing, translation, photocopying and document review
- Third parties engaged during the services: we provide to clients and with their prior consent, such as barristers, local counsel and technology service providers like data room and case management services
- Regulatory authorities: such as courts, tribunals, government agencies and law enforcement agencies where necessary, or for the reasons set out in this policy.
- Others: Our professional advisers and auditors and our IT service providers and third parties involved in hosting or organising events or seminars
We will use reasonable endeavours to notify you and protect your personal information. We do not sell, rent or otherwise make personal information commercially available to any third party, except with your prior permission.
How we protect your personal information
We will hold your information securely in line with physical, technical and administrative security measures to help protect your personal information from unauthorised access, use, disclosure, alteration or destruction consistent with applicable data protection laws.
However, the transmission of information via the internet is not completely secure. Although we will take reasonable measures to protect your personal information, we cannot guarantee the security of your information transmitted and any transmission is at your own risk.
Your rights regarding your personal information
The UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection laws provide certain rights for data subjects. The availability of these rights and the ways in which you can use them are set out below in more detail.
- Access: you are entitled to ask us if we are processing your data and, if we are, you can request access to your personal data. This enables you to receive a copy of the personal data we hold about you and certain other information about it;
- Correction: you are entitled to request that any incomplete or inaccurate personal data we hold about you is corrected;
- Erasure: you are entitled to ask us to delete or remove personal data in certain circumstances. There are also certain exceptions where we may refuse a request for erasure, for example, where the personal data is required for compliance with law or in connection with claims;
- Restriction: you are entitled to ask us to suspend the processing of certain of your personal data about you, for example if you want us to establish its accuracy or the reason for processing it;
- Transfer: you may ask us to help you transfer certain of your personal data to another party;
- Objection: where we are processing your personal data based on a legitimate interests (or those of a third party) and you may challenge this. However, we may be entitled to continue processing your information. You also have the right to object where we are processing your personal information for direct marketing purposes;
- Automated decisions: you may contest any automated decision made about you where this has a legal or similar significant effect and ask for it to be reconsidered.
- Consent: where we are processing personal data with consent, you can withdraw your consent.
Some of these rights will only apply in certain circumstances. If you would like to exercise, or discuss, any of these rights, please contact one of the Data Privacy contacts set out in this Policy above, in writing at the relevant email address.
We must ensure that your personal information is accurate and up to date. Therefore, please advise us of any changes to your information by email to enquiries@wslegal.co.uk.