Privacy policy of W-V Law Firm LLP, a limited liability partnership registered in England and Wales under company number OC418986, with its registered address at Suite 29, 58 Acacia Road, London, England, NW8 6AG.
In this privacy policy we refer to ourselves as “we”, “us” or “our”.
You can contact us as follows:
- by email at info@w-v.co.uk; or
- by post at Suite 29, 58 Acacia Road, London, England, NW8 6AG.
We take data protection, including the security of the personal information we hold about you, very seriously. This privacy policy explains how we collect and use personal information about you. Please read it carefully so that you know and understand why and how we use the personal information we collect and hold.
We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. As our services are also directed at people in the European Union, we additionally comply with the EU General Data Protection Regulation (GDPR, Art. 3(2)). Article references in this policy refer to the GDPR; the UK GDPR contains equivalent provisions.
This privacy policy may be updated from time to time. This version was last updated on 26 October 2026.
1. Key definitions
- Data controller: under data protection law, the organisation or person who decides how personal data is collected, stored and used.
- Data processor: a data controller may appoint another organisation or person to carry out certain tasks involving personal data on its behalf and in accordance with its written instructions.
- Personal information: any information from which a living individual can be identified.
- Special category information: certain highly sensitive personal data that requires special protection under data protection law.
2. Personal information we collect and hold about you
| General category | Types of personal data in this category | Retention periods |
|---|---|---|
| Identity information | Information about your identity such as your name, gender, marital status and date of birth | Until deleted at the user’s request |
| Contact information | Information about your contact details such as email address, postal addresses and telephone numbers | Until deleted at the user’s request |
| Website, device and technical information | Information about your use of our website and technical data we collect, including the IP address when a contact form is submitted | Until deleted at the user’s request |
3. Special category information
3.1 Special category information is explained in section 1 above. We do not collect or hold any special category information about you.
3.2 We do not collect any information about you relating to criminal offences or proceedings.
4. How we use personal information
4.1 We may only use your personal data for certain legal reasons set out in data protection law. As a rule, these include:
- Contract (Art. 6(1)(b) GDPR): the processing is necessary to perform a contract we have entered into with you or to take steps at your request before entering into a contract.
- Legitimate interests (Art. 6(1)(f) GDPR): the processing is necessary for our legitimate interests or those of a third party, provided these interests are not overridden by your fundamental rights and freedoms.
- Legal obligation (Art. 6(1)(c) GDPR): we need to use your personal data to comply with a legal obligation.
- Consent (Art. 6(1)(a) GDPR): you have given us your explicit consent to use your personal data for specific purposes.
4.2 As explained in section 3, more sensitive types of personal data require a higher level of protection. Such processing normally takes place where (a) we have your explicit consent, (b) it is necessary in connection with legal claims, or (c) you have made the data public yourself.
4.3 We need your personal information in order to provide our services. If you do not provide the personal information we require, we may be unable to provide the services to you.
4.4 It is important that you keep your personal information up to date. Please contact us as soon as possible if your personal information changes.
4.5 You have the right to withdraw your consent at any time. Please contact us using the details above. When we receive a request to withdraw your consent for a specific purpose, we will stop processing your personal data for that purpose unless we have another legal reason for doing so, in which case we will confirm that reason to you.
4.6 Where we rely on legitimate interests as the legal reason for using your personal data, we also explain what that legitimate interest is. For some purposes we may rely on more than one legal reason, as the legal reason may differ depending on the circumstances.
4.7 We sometimes anonymise personal information so that you can no longer be identified from it, and use it for our own purposes.
4.8 Under data protection law we may only use your personal data for the purposes we have told you about, unless we consider the new purpose to be compatible with the original one. If we wish to use your personal data for a purpose we consider incompatible, we will contact you to explain this and the legal basis that applies.
5. How we collect personal information
5.1 We usually collect identity, contact, payment, transaction, survey, marketing and special category information directly from you when you complete a form, survey or questionnaire, use our services or contact us by email, telephone, in writing or otherwise.
5.2 Hosting and server logs: when you visit our website, the web server automatically records technical access data (server log files): IP address, date and time of access, page requested, referring page, browser type and version, and operating system. We need this data to deliver the website, ensure its stability and security, and defend against attacks. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). The data is not combined with other data sources and is deleted as soon as it is no longer required for these purposes, unless a specific security incident requires longer retention. The website is operated by a hosting provider that processes the data solely on our behalf and in accordance with our instructions (Art. 28 GDPR).
5.3 Contact form: if you write to us using a form on this website, we process the details you enter (salutation, name, email address, telephone number and your message). We also store the IP address from which the form was submitted, together with the date, time, page used and browser type. Your enquiry is sent by email to our main office (info@w-v.co.uk) and to our key account team (st@gruendungskanzlei.eu). You will then receive an automatic confirmation of receipt at the email address you provided. We use Google Workspace, provided by Google Ireland Limited, Dublin, as our processor for sending and storing emails (Art. 28 GDPR). We use this data to deal with your enquiry, to be able to demonstrate your consent and to prevent misuse of the form. The legal bases are Art. 6(1)(b) GDPR (handling your enquiry), Art. 6(1)(f) GDPR (evidence and abuse prevention) and your consent under Art. 6(1)(a) GDPR, which you may withdraw at any time with effect for the future. We delete your details once your enquiry has been fully dealt with and no statutory retention obligations apply; if an engagement follows, the retention periods applicable to it apply.
5.4 SSL/TLS encryption: for security reasons this website uses SSL/TLS encryption, recognisable by “https://” in the address bar and the padlock symbol in your browser. Data you submit via our forms cannot be read by third parties in transit.
5.5 Cookies and access to your device: our website does not use cookies or similar technologies for analytics, tracking or advertising. Only information that is strictly necessary to provide the website is stored on or read from your device. A cookie banner is therefore not required. In particular, we do not use Google Analytics or any advertising or retargeting services.
5.6 Fonts (Google Fonts): we use fonts from the Google Fonts service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you open a page, your browser loads the fonts directly from Google’s servers, which means your IP address is transmitted to Google. A transfer to Google LLC in the USA cannot be ruled out; Google LLC is certified under the EU-US Data Privacy Framework. The legal basis is our legitimate interest in a consistent and legible presentation of our website (Art. 6(1)(f) GDPR). Further information is available at developers.google.com/fonts/faq/privacy and in Google’s privacy policy at policies.google.com/privacy.
5.7 Paintings from Wikimedia Commons: the public-domain paintings on our practice-area pages are loaded from the servers of Wikimedia Commons (Wikimedia Foundation, Inc., San Francisco, USA), which means your IP address is transmitted to the Wikimedia Foundation. The legal basis is our legitimate interest in an attractive website design (Art. 6(1)(f) GDPR). Information on the Wikimedia Foundation’s data protection is available at foundation.wikimedia.org.
6. Who we may share personal information with
6.1 We may need to share your personal information with other organisations or individuals, including:
- other companies and brands in our group (which may act as joint controllers or as processors on our behalf), where this is necessary to deal with your enquiry or provide our services, and for IT, hosting and administrative services;
- any organisation that intends to acquire our business and assets, in which case we may disclose your personal information to the prospective buyer.
6.2 Depending on the circumstances, the organisations or individuals with whom we share your personal information will act either as processors or as controllers. Where we share your personal information with a processor, we ensure that contracts are in place setting out our respective responsibilities and obligations, including in relation to the security of the personal information.
6.3 We do not sell or trade the personal information you have provided to us.
7. Transfers outside the EEA or the United Kingdom
We are based in the United Kingdom. The European Commission has adopted an adequacy decision for the United Kingdom under Art. 45 GDPR, renewed in December 2025 until the end of 2031, so data from the EU may be transferred to us without further authorisation.
Transfers to service providers in the USA are based on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified under it, and otherwise on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).
Where a transfer of personal information by us results in your personal information being transferred outside the United Kingdom or the EEA, we ensure that safeguards are in place to give your personal information a similar level of protection as in the United Kingdom or the EEA, and that the transfer complies with data protection law.
8. How long we keep your personal information
8.1 We keep your personal data only for as long as necessary. How long that is depends on the purposes for which we collected the personal information (see section 4) and on whether we are legally required to keep it.
9. Automated decision-making
9.1 “Automated decision-making” means decisions made automatically without human involvement. Under data protection law this includes profiling.
9.2 Data protection law restricts automated decision-making (including profiling) that has a legal or similarly significant effect on you.
9.3 If we decide to carry out automated decision-making that has a legal or similarly significant effect on you, we will notify you and tell you the legal basis for it.
10. Your rights under data protection law
10.1 Under data protection law you have the following rights in relation to your personal data:
- Right of access (Art. 15 GDPR, often called a “subject access request”): the right to receive a copy of the personal information we hold about you, together with certain further information to help you understand how it is used.
- Right to rectification (Art. 16 GDPR): the right to have inaccurate personal data corrected and incomplete personal data completed.
- Right to erasure (Art. 17 GDPR, often called the “right to be forgotten”): applies only in certain cases; where it applies, you may ask us to delete all your personal information.
- Right to restriction of processing (Art. 18 GDPR): applies only in certain cases; where it applies, you may ask us to restrict the processing of your personal information.
- Right to data portability (Art. 20 GDPR): allows you to ask us to transfer your personal information to someone else.
- Right to object (Art. 21 GDPR): you may object to the processing of your personal information for direct marketing. You may also object to processing based on legitimate interests (see section 4) where something about your particular situation makes you want to object. In certain circumstances you may object to processing that consists of profiling (including profiling for direct marketing).
Your right to object: where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. You may object to processing for direct marketing at any time without giving reasons. An informal message to info@w-v.co.uk is sufficient.
10.2 In addition to the rights in section 10.1, you have the right to withdraw your consent at any time with effect for the future (Art. 7(3) GDPR) where we rely on consent as the legal basis for using your personal data. See section 4.5 for details.
11. Marketing
11.1 You may receive marketing from us about similar services, either because you have consented or because we have another legal reason to contact you for marketing purposes.
11.2 We will, however, give you the opportunity to control whether and how we contact you for marketing. Every email we send includes a link to unsubscribe or change your marketing preferences. You can also contact us at any time using the details at the start of this policy.
11.3 If you ask us to stop marketing, we may still send you non-marketing communications (for example about services you have used).
11.4 We do not pass your personal information to third parties for marketing purposes.
12. Complaints
If you are unhappy with how we have handled or used your personal information, you have the right to complain to the UK data protection supervisory authority, the Information Commissioner’s Office (ICO, ico.org.uk). If you live in the European Union, you may also complain to a data protection supervisory authority in the member state of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR). We would, however, ask you to contact us first so that we have the opportunity to discuss your concern and resolve it.
13. Third-party websites and services
Our website contains links to third-party websites. When you click on these links, the third-party website opens in a new window. These websites may collect personal information about you; their own privacy policies apply. These include in particular:
- Calendly (booking the initial consultation): if you book an appointment via the link, Calendly LLC, Atlanta, USA, processes your details (e.g. name, email address, chosen time). Calendly is certified under the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(b) GDPR.
- WhatsApp: if you message us via WhatsApp, your messages and telephone number are processed by WhatsApp Ireland Limited, Dublin; data may be transferred to Meta Platforms, Inc., USA, which is certified under the EU-US Data Privacy Framework. Please do not send us particularly confidential documents via WhatsApp.
- Google Maps: the “Get directions” links lead to Google Maps, a service of Google Ireland Limited, Dublin. Data is transmitted to Google only when you click such a link; no map is embedded on our website itself.
- ProvenExpert (client reviews): our website contains a link to our review profile on ProvenExpert, a service of Expert Systems AG, Berlin. Data is transmitted to ProvenExpert only when you click this link.
14. Obligation to provide data
You are under no legal or contractual obligation to provide us with personal data. Without the details marked as required in the contact form, however, we cannot deal with your enquiry.