Data Privacy Policy

We are committed to protecting the privacy and security of your personal information. This Privacy Notice (“Notice”) sets out how we collect and use personal information about you during and after your relationship with us, in accordance with the Data Protection Act 2018 (‘the Act’), UK General Data Protection Act (GDPR) and Data (Use and Access) Act 2025 (“UK GDPR). This includes whether you become one of our clients or contact us in another way and gives details of what to expect when you interact with us online and how and what happens if we collect personal information through these interactions.

It is important that you read this Notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information. Please note this Notice does not form part of any contract to provide services you may have with us from time to time.

We reserve the right to amend this Notice at any time without notice to you so, if required, please check to ensure that you are referring to the latest version of this Notice. We may also notify you in other ways from time to time about the processing of your personal data.

1.       Data Controller

Ibrahim Mustafa (IM) LLP is a “data controller” (ICO Registration No. ZB387669) for the purposes of the UK GDPR. This means that we are responsible for deciding how we hold and use personal information about you.

If you have any questions or concerns about this Notice or how we handle your personal information, please contact the “Data Protection Officer” at the above address, or alternatively, by email at info@imsolicitors.com

You have the right to make a complaint at any time to the ICO at https://ico.org.uk/.  We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance. You do also have the right to make a complaint directly to us as your data controller. Please contact the “Data Protection Officer” at the above address, or alternatively, by email at info@imsolicitors.com. If you remain dissatisfied after raising a complaint with us, you have the right to complain to the ICO. This can be done by using their complaints tool at https://ico.org.uk/ or by contacting them on 0303 123 1113

2.      How we will use information about you

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

• Where we need to carry out the contract we have entered into with you.
• Where we need to comply with a legal obligation.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

We may also use your personal information in the following situations, which are likely to be rare:

• Where we need to protect your interests (or someone else’s interests).
• Where it is needed for official purposes.

Generally, we do not rely on consent as a legal basis for processing your personal data and we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law, subject to the processing of records where there is a “recognised legitimate interest” to which the balancing test under Article 6(1)(f) does not apply. If it becomes necessary to obtain your consent, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of any contract with us that you agree to any request for consent from us and you will be able to withdraw your consent at any time.

3.      People who make a complaint to us

When we receive a complaint from a person we create a file which will contain the details of the person complaining and other relevant details (including details of other people) that are relevant to the complaint. We only use this information for the purposes of investigating and responding to the complaint.

We will keep personal information contained in complaint files in line with our retention policy for client files. This means that information relating to a complaint will be retained for six years from closure within our case management system, unless advised otherwise.

4.      Disclosure of personal information

We will only disclose personal data to third parties where permitted to do so by law and in the normal course of our business. For example, when acting for you in defending a criminal allegation against you, we might share your personal information with the Crown Prosecution Service if it is in the best interests of you in order to advance your defence, or if you are an employee, we might share your personal information with HMRC in the context of ensuring that your payroll records are correct.

There are times where it will not be realistic to get your express permission in connection with each and every disclosure of this nature. If you have any concerns that any of your data has been incorrectly shared, then this should be raised with us through our standard procedures (i.e.; the Complaints Procedure in respect of clients and the Grievance Procedure in respect of employees etc).

5.      Disclosure of Personal Information

The data we collect from you may be transferred to, and stored at, a destination outside the United Kingdom (UK) or to a destination outside the UK. It may also be processed by staff operating outside the UK who work for us or for one of our suppliers. Data Protection Act 2018 (‘the Act’), UK General Data Protection Act (GDPR) and Data (Use and Access) Act 2025 restrict international data transfers in order to ensure that the level of data protection afforded to individuals is not undermined.  

We will only transfer data outside the UK or to a destination outside the UK where permitted to do so by law, and only where appropriate safeguards are in place. As a UK-regulated firm, our international data transfers are governed by Data Protection Act 2018 (‘the Act’), UK General Data Protection Act (GDPR) and Data (Use and Access) Act 2025. The safeguards we may rely upon include: an adequacy regulation made by the UK Secretary of State confirming that the destination country ensures an adequate level of protection; a UK International Data Transfer Agreement (IDTA) or UK Addendum to EU Standard Contractual Clauses, as approved by the UK Information Commissioner’s Office (ICO); or another transfer mechanism permitted under UK data protection law. If you have any questions about the transfer of data outside the UK, please contact us for further information.

6.      Use of Artificial Intelligence

We may use Artificial Intelligence (AI) tools to support the delivery of legal services. Any use of AI is governed by our firm’s Artificial Intelligence (AI) Policy and is subject to manager authorisation and oversight. AI is used as a support tool and does not replace the professional judgement, expertise or responsibility of the fee earner handling your matter.

We are committed to ensuring that all work produced with the assistance of AI is reviewed, verified and approved by a qualified member of staff before being relied upon or shared with you. No client data, personal data or privileged information is uploaded to any AI tool that has not been assessed and approved by our IT department and risk assessed by senior management in accordance with our data protection compliance processes and UK GDPR requirements.

Where AI has made a substantial contribution to work produced for you, we will consider whether disclosure to you is appropriate, in accordance with our obligations under the SRA Standards and Regulations and our duty to act in your best interests at all times.

If you have any questions about our use of AI, or wish to discuss this further, please speak to the fee earner handling your matter or contact our Data Protection Officer.

7.      Your rights

You have a right to access the personal data we hold about you. You may ask us to rectify or erase the personal data we hold about you or to restrict the processing we carry out. You can also object to the way we are processing your personal data or request that we transfer it to a third party.

For a full list of your rights and how these can be exercised, please visit www.ico.org.uk/your-data-matters for further details. You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact us at info@imsolicitors.com

8.      Our Website

Any data that you submit using a form on our website or by email (i.e.; your name, email address) will only be held by us for the purpose for which it is needed and for the shortest amount of time required.

For example, if you make an enquiry that we are unable to assist you with, your contact form will be deleted. If your enquiry results in you becoming a client of the firm, then your data will be stored as part of your client record and kept in accordance with the requirements relating to client records (in respect of which you will be advised separately on entering a retainer).

We do not currently have a mailing list for you to subscribe to. In any event, your data will not be disclosed to any third parties without your consent or as otherwise allowed by the relevant data protection legislation and will only be used for responding to your query (or purposes associated with that purpose).