We are committed to respecting your privacy and take our responsibility under data protection regulations seriously. This Privacy Notice (“Notice”) – together with any other privacy information we may provide on specific occasions – applies to the processing of personal data by KP Law in the course of providing legal services and carrying out its business operations. The Notice sets out the types of personal data KP Law collects, explains how KP Law collects and processes that data, who it shares it with and certain rights and options that you have in this respect. Please read this notice carefully.
Where we refer to data protection legislation, we mean the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy & Electronic Communications Regulation, the Data (Use and Access) Act 2025 and any other relevant legislation.
We recognise that information privacy is an ongoing responsibility, and so we will from time to time update this Privacy Notice as we undertake new personal data practices or adopt new privacy policies.
When we refer to “KP Law” “us” or “we” in this Notice we mean KP Law Limited, a company incorporated in England & Wales with registered number 11937792 and registered address 75 High Holborn London England WC1V 6LS. We are registered with the Information Commissioner’s Office under registration number ZA653311. KP Law is a 100% subsidiary of Legatus Holdings Limited.
We collect and process personal data for following categories of data subjects:
All of the information you provide during the application process will only be used for the purpose of progressing your application, or to fulfil legal or regulatory requirements if necessary.
We will not share any of the information you provide during the recruitment process with any third parties for marketing purposes or store any of your information outside of the United Kingdom or the European Union unless we have appropriate safeguards in place with the entity with whom we share such information. We verify that any data transfer outside of the UK or EEA is subject to UK or EU adequacy re, the International Data Transfer Agreement (IDTA), the International Data Transfer Addendum to the EU Standard Contractual Clauses or other appropriate tools which comply with data protection legislation. The information you provide will be held securely by us whether the information is in electronic or physical format.
We will use the contact details you provide to us to contact you to progress your application. We will use the other information you provide to assess your suitability for the role you have applied for.
We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary.
4.1.1 Application Stage
At the application stage, we ask you for:
You may also be asked to provide equal opportunities information. This is not mandatory information – if you don’t provide it, it will not affect your application. This information will not be made available to any staff outside of our recruitment and HR team in a way which can identify you. Any information you do provide, will be used only to produce and monitor equal opportunities statistics.
4.1.2 Selection Stage
Our hiring managers shortlist applications for interview. They will not be provided with your equal opportunities information if you have provided it.
We might ask you to attend an interview or take a written test. Information will be generated by you and by us. For example, you might complete a written test, or we might take interview notes. This information is held by us.
At this stage we will ask you to provide contact details of previous employers/colleagues, their details and their answers and/ or opinions will be retained by us. We will also conduct an ID verification and check your right to work in the UK if appropriate.
4.1.3 How long is the information retained?
If you are unsuccessful at any stage of the process, the information you have provided until that point will be retained for 6 months from the data of such decision. Information generated throughout the assessment process, for example interview notes, is retained by us for 6 months following the closure of the campaign.
If you are successful in your application, we will retain your information in accordance with our Privacy Notice for Employees, Workers and Contractors. A copy of this Notice will be provided to you with your offer letter.
Our lawful bases for processing your personal data are Article 6(1)(b) of the UK GDPR, which relates to processing necessary to perform a contract or to take steps at your request, before entering a contract, and Article 6(1)(f) for the purpose of our legitimate interests. In the event that we collect any special category data our additional condition for processing would be Article 9 (2) (b) of the UK GDPR, which relates to processing for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment.
4.2 Clients including potential clients, litigants and counterparties
If you are a client or potential client, we will collect personal information about you in the course of our services, including the provision of legal advice and representation of our clients in legal matters.
We may collect the following information about you:
We may also receive personal information from third parties including lead generators, other law firms or business contacts. Any such information provided to us is used solely for providing our services and is handled strictly as per our data protection procedures.
Only information that is relevant to the case is collected. As a counterparty or litigant, information about you may be provided to us by our clients or other third parties because you are the subject of, or otherwise included in, legal advice or representation we have been asked to provide to such clients.
4.2.1 How do we process this data?
We use this data for following purposes:
*When we process special category data such as health information our additional condition for processing would be Article 9 2. (f) of the GDPR “processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity”. *When we process personal data relating to criminal convictions and offences, we do so in accordance with Article 10 of the UK GDPR and section 10(5) of the Data Protection Act 2018. We rely on paragraph 33 of Schedule 1 to the Data Protection Act 2018 (legal claims) and, where we carry out anti-money laundering and fraud prevention checks, paragraph 10 of Schedule 1 (preventing or detecting unlawful acts), as applied by paragraph 36 of Schedule 1.
We may share your personal data in following circumstances:
There may be occasions where we will need to share your data with entities in third countries, such as when we are using cloud software providers or outsourced contractors which enable us to provide you with the services. We verify that any data transfer outside of the UK or EEA is subject to UK adequacy regulations, the International Data Transfer Agreement (IDTA), the International Data Transfer Addendum to the EU Standard Contractual Clauses or other appropriate safeguards which comply with data protection legislation.
We do not use automated decision-making in relation to your personal data.
We, and third parties engaged by us, may use artificial intelligence (AI) tools to obtain information from you and to review and consider the personal data you provide to us and in order to assist with verifying your identity and carrying out related checks, such as anti-money laundering, sanctions screening and fraud prevention checks. Any third parties providing AI-enabled services to us are bound by contractual obligations to process your personal data only on our instructions, to keep it secure and to comply with data protection legislation. Our lawful bases for this processing are Article 6(1)(c) of the UK GDPR, which relates to processing necessary to comply with our legal obligations (including under anti-money laundering regulations), and Article 6(1)(f), for the purpose of our legitimate interests in verifying identity and preventing fraud.
Where AI tools are used to compare your live image with your photographic identification, this involves the processing of biometric data, which is special category data. Our additional condition for this processing is Article 9(2)(a) of the UK GDPR, your explicit consent, which we will ask for before the check is carried out. You may withdraw your consent at any time, and if you do not wish to consent you may ask us to verify your identity by an alternative method which does not involve biometric data.
To help protect the privacy of data and personally identifiable information you provide to us, we maintain physical, technical and organisational controls. We update and test our security technology and controls on an ongoing basis. We restrict access to your personal data to those employees who need to know that information to provide benefits or services to you. In addition, we train our employees about the importance of confidentiality and maintaining the privacy and security of your information. We commit to taking appropriate disciplinary measures to enforce our employees’ privacy responsibilities.
We are certified to IASME Cyber Essentials Plus governance standard which demonstrates our commitment to security and privacy of your personal information.
Your personal data is stored by KP Law on the servers of the cloud-based services and IT service providers we engage, as well as in physical forms in our office and at backup and archive facilities.
We will continue to keep your personal data for as long as this is necessary to fulfil the purposes for which we collect and use it, as these are explained in this Notice, including for complying with our legal and regulatory obligations (for example auditing, reporting and accounting requirements), for the provision of legal services and for the establishment or defence of legal claims.
Where data is stored on basis of consent, we provide such information at the time consent is taken.
For more information on where and how long your personal data is stored, and for more information on your rights of erasure and portability, please contact us at dataprotection@kpl.co.uk.
We have appointed a Data Protection Lead for you to contact if you have any questions or concerns about our personal data policies or practices. If you are concerned about an alleged breach of privacy law or any other regulation by us, please contact our Data Protection Lead at dataprotection@kpl.co.uk who will ensure that your complaint is investigated.
Under data protection legislation you have the following rights:
If you wish to exercise any of your rights please contact us at dataprotection@kpl.co.uk
If you are concerned about how we handle your personal data, you can contact us in the first instance at dataprotection@kpl.co.uk. If after our review you are still not satisfied you have a right to complain to the Information Commissioner’s Office (ICO). The ICO can be contacted here:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Last Updated: October 2026