Privacy Notice

Last updated: 2 February 2026

1. Who We Are 

Elephant Legal provides will-writing and estate-planning services for clients in the United Kingdom. We act as the data controller, which means we decide how and why your personal information is used.  

If you have any questions about this notice or how we handle your data, please contact our Data Protection Lead: 

Email: {{SUPPORT_EMAIL}} 
Address: {{POSTAL_ADDRESS}} 
Phone: {{PHONE_MAIN}} 
Data Protection Contact: {{DPO_CONTACT}} 

The Data Protection Lead and DPO contact are the same person 

 2. What Data We Collect 

We collect and process different kinds of information depending on how you interact with us: 

  • Clients and prospective clients: name, contact details, date of birth, family details, asset information, and instructions related to your will or estate plan. 

  • Website visitors: basic technical data such as IP address and cookie identifiers (see our Cookies Policy at {{PRIVACY_URL}}). 

  • General enquiries: name, email address, and the information you choose to share. 

We only collect information that is relevant to providing you with our services or responding to your enquiry. 

 3. Why We Use Your Information 

We use your personal information for the following purposes and under the legal bases shown below: 

4. Who We Share Information With 

We only share information when necessary for our work or where we are legally required to do so. 

Typical examples include: 

  • Secure IT and cloud storage providers who host our systems 

  • Professional advisers such as accountants, insurers, or compliance consultants 

  • Legal or regulatory bodies if required by law (for example, HMRC or the ICO) 

All third-party partners are carefully selected and bound by confidentiality and data-protection obligations. 

 5. International Transfers 

We do not transfer personal data outside the UK or EEA. If a transfer is ever required (for example, because a cloud backup server is located abroad), we will ensure that appropriate safeguards are in place to protect your information in line with UK data-protection law. 

 6. How Long We Keep Information 

We keep personal data only for as long as necessary to fulfil the purpose for which it was collected. 

  • Client files: normally retained for six years after the completion of our work (unless law requires longer). 

  • Enquiry records: usually deleted after 12 months if you do not become a client. 

  • Financial records: retained for at least six years in line with HMRC requirements. 

When information is no longer needed, it is securely deleted or anonymised. 

 7. How We Keep Your Information Secure 

We take appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, or misuse. This includes using secure storage, access controls, and professional safeguards appropriate to the nature of the information we hold. 

 8. Your Rights 

You have a range of rights under data-protection law, including to: 

  • Request a copy of the information we hold about you 

  • Ask us to correct or delete inaccurate information 

  • Restrict or object to certain uses of your data 

  • Withdraw consent (if you previously gave it) 

  • Move your data to another provider (where technically feasible) 

To exercise any of these rights, please contact us at {{SUPPORT_EMAIL}}. 

 9. Concerns or Complaints 

If you are concerned about how your information is handled, please contact us first at {{COMPLAINTS_EMAIL}} or see our Complaints Policy at {{COMPLAINTS_URL}}. 

You also have the right to raise a concern with the Information Commissioner’s Office (ICO), the UK’s data protection authority: 
www.ico.org.uk | 0303 123 1113 | ICO Registration No: ZC047142 

 10. How to Contact Us 

For questions about this notice or our approach to data protection: 

Email: {{SUPPORT_EMAIL}} 
Phone: {{PHONE_MAIN}} 
Address: {{POSTAL_ADDRESS}} 

Further information: 

  • Privacy Policy – {{PRIVACY_URL}} 

  • Terms of Service – {{TERMS_URL}}