How Harbour & Lane LLP uses your personal data

This notice explains what personal data we hold, why, and your rights. It covers our clients, people who ask us for a fee estimate, and people we hold details about because they're involved in a client's transaction.

Who we are

Harbour & Lane LLP is responsible for your personal data (the "controller"). Our address: 1 Harbour Street, Leeds, LS1 4AB. [Our ICO registration number: add it in Settings.] For anything about your personal data, or to use your rights, contact us at hello@harbourandlane.example or on 0113 496 0000, or write to us at the address above.

What we hold, and why

Enquiries and fee estimates. To answer your enquiry, and to work out and send you a fee estimate. The law lets us do this because: taking steps at your request before entering into a contract; for enquiries that go no further, our legitimate interests in answering and following up enquiries.

Taking you on as a client. To agree the terms of our work for you, collect what we need to act for you, and keep your client record. The law lets us do this because: performing the contract with you; for the information the law requires us to collect and keep, our legal obligations.

Checking who you are. To check who you are before we act for you, and where your money comes from, as the Money Laundering Regulations 2017 require, and to check for conflicts of interest. This can include an online ID check and checks against sanctions and other official lists. The law lets us do this because: legal obligation: the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, and the SRA's rules on conflicts.

Your conveyancing matter. To carry out your transaction: the contract, title and searches, enquiries, reports, exchange and completion, Stamp Duty and registration, and to keep the matter file. The law lets us do this because: performing the contract with you; our legal obligations, for example to Land Registry and HMRC and to keep our records; and, for the other people involved (the other side, agents, lenders and others), our legitimate interests in acting for our clients.

Payments. To ask for and record the money you pay us, including by card or bank payment. The law lets us do this because: performing the contract with you, and our legal obligations under the SRA Accounts Rules.

Signing documents. To let you sign documents electronically, and keep the evidence of who signed and when. The law lets us do this because: performing the contract with you, and our legitimate interests in being able to prove what was signed.

Emails, texts and your portal. To keep you up to date, send you sign-in and signing codes, and run your client portal. The law lets us do this because: performing the contract with you, and our legitimate interests in communicating about our work.

Help from an AI service. An AI service reads documents and emails on your matter and suggests findings and replies. Our staff check everything it suggests. The law lets us do this because: our legitimate interests in working efficiently for our clients, with our own checks on everything the AI suggests.

Requests about your data. To log and answer requests people make about their personal data. The law lets us do this because: legal obligation: the rights in UK GDPR Chapter III.

Signing in, and keeping our systems secure. To let you sign in to our client portal, and to keep a record of what happened in our systems, which keeps information secure. The law lets us do this because: our legitimate interests in running and securing our systems, and our legal obligation to keep personal data secure.

If you do our online ID check, it compares your face with the photo in your ID (biometric data). We use that only to confirm who you are, as the law allows for preventing fraud and money laundering, or with your consent in the check. Checks against official lists can show whether someone is subject to sanctions or holds a public position.

Where it comes from

• You, for example on a form, in our portal or by email
• Our staff
• Our AI service, as suggestions our staff check
• Our systems, as they work: dates, references and records of what happened
• Our ID check provider
• Other people and organisations involved: the other side and their solicitor, estate agents, lenders, HMRC and Homes England
• HM Land Registry
• Search providers (local authority, water and drainage, environmental and others)
• Companies House (the public register of companies)
• Ordnance Survey (Great Britain's national mapping service)
• The government's register of energy performance certificates (England and Wales)
• Our card payment provider

Who we share it with

As your matter needs: the other side and their solicitor, estate agents, lenders and their solicitors, HM Land Registry, HMRC (Stamp Duty Land Tax), search providers, managing agents and landlords, Homes England (Help to Buy). The organisations that provide our services and handle data for us: Cloudflare (running the website and the app); Neon (Databricks) (the database); Amazon Web Services (AWS) (storing documents (Amazon S3), turning Word documents into PDFs, the connection to HM Land Registry, and text messages); Email provider (sending our emails); ComplyCube (online ID checks, including the face match); Stripe (card and Pay by Bank payments).

Outside the UK

Some of the organisations that provide our services handle data outside the UK. It's protected there by: Cloudflare, the UK Extension to the EU-US Data Privacy Framework; otherwise the EU standard contractual clauses with the ICO's UK Addendum; Stripe, the UK Extension to the EU-US Data Privacy Framework; otherwise the ICO's international data transfer addendum. [Email provider: say where it handles data and what protects it.]

How long we keep it

• Enquiries and fee estimates that don't go ahead: usually for 2 years after we were last in touch
• Azenteq's own sales record: removed 24 months after the last contact if nothing came of it
• Fee estimates: with the matter file if a matter was opened; otherwise as for enquiries
• ID and anti-money-laundering records: for 5 years after our relationship with you ends, as the Money Laundering Regulations 2017 require
• Matter files: for our retention period after the matter is closed (at least 6 years), as our regulators and lenders require and in case of a claim
• Technical records such as sign-in attempts: for a short time only
• Requests about your data: for 6 years after they're closed, then your name is removed
• Your portal sign-in: while you can sign in to our portal
• Staff records: under our staff policy
• Our record of what happened in our systems: as our evidence; your details in it are anonymised if your data is erased

When we delete your personal data, it is permanently erased from all our systems, including secure backups, within 90 days.

Decisions about you

We don't make decisions about you by automated means alone. Where we use an AI service to help with our work, a member of our staff checks everything it suggests.

If you're not our client

We may hold your details because you're involved in a client's transaction: for example as the other side or their solicitor, a lender, an estate agent, someone giving money as a gift, the owner of a company client, or someone signing a document. We get them from our client, from you, or from the other side's solicitor, use them only for that transaction, and keep them with our client's file for as long as we keep it.

Your rights

You can ask us for a copy of your personal data, to correct anything that's wrong, to erase it where we no longer need to keep it, to restrict or object to how we use it, and for a copy you can take to another organisation. We can't erase or restrict what the law requires us to keep. There's no charge, and we reply within a month.

If you're unhappy with how we've dealt with your request, please tell us. You can also complain to the Information Commissioner's Office (ico.org.uk/make-a-complaint, or 0303 123 1113).

Cookies

We only store what's needed for our portal to work and to keep it secure, so we don't ask for your consent. We don't use cookies for advertising, tracking or analytics.

• Keeps you signed in to the portal (cookie; until you sign out, or 12 hours after you last used the portal)
• Cloudflare's check that you're a person and not an automated program, which protects the form from abuse (browser storage; while you use the form)

Changes to this notice

We update this notice when how we use personal data changes. Last updated: 2 November 2026.