Please read the following information carefully to understand how we treat your personal information when using artificial intelligence (AI). This privacy notice explains how we collect, use, store and protect personal data when using artificial intelligence systems as part of our services. It also tells you the security mechanisms we have put in place to protect your data and how to contact us if you have a complaint. We are committed to protecting user privacy and handling data responsibly.
This policy applies to all users who interact with our AI-powered tools, including but not limited to:
- Transcription
- Data analysis
- Content generation
Who are we?
CFG Law Limited trading as CFG is a limited liability company incorporated in England and Wales. We collect, use and are responsible for personal information about you. When we do this, we are the “controller” of this information for the purpose of the UK General Data Protection Regulation (UK GDPR) and other applicable data protection laws.
Our Data Protection Officer: Nicola Hughes
Telephone: 0161 437 9999
Email: nicola.hughes@cfglaw.co.uk
What do we do with your information?
When carrying out a personal injury claim, we collect the following personal information that you provide to us, which is defined as ‘personal data’:
- Personal details: full name, title, gender, date of birth.
- Family, lifestyle and social circumstances
- Financial details
- Business activities of the person whose details we are processing
- Education and Employment records
- Benefits Agency records
- Goods and services
- Contact details: email address, phone number, postal address
- Technical data: IP address etc.
- Marketing and Communications Data: Your preferences in receiving marketing and your communication preferences.
We may also collect information that is referred to as being in a ‘special category’. This could include:
- Physical or mental health records
- Racial or ethnic origin
- Sexual life
- Religious beliefs or other beliefs of a similar nature
- Political opinions
- Trade union membership
- Offences and alleged offences
- Criminal proceedings, outcomes and sentence
When using our AI systems, we may also collect the following types of data:
- User-provided data: Information you choose to submit such as text, feedback etc.
- Usage data: Interaction data such as timestamps, feature usage and system performance
- Technical data: Device type, operating system details.
How will we use your information?
We will mainly use your information for the provision of legal advice and this is necessary for the performance of the contract between us, for legitimate interests and protection of vital interests. We also process your data to comply with our legal and regulatory requirements. Processing special personal data is necessary for the establishment, exercise or defence of your legal claim or whenever courts are acting in their judicial capacity.
We may also use it for:
- Administering any accounts
- Processing your bank/credit card details in order to obtain payment
- The prevention and detection of fraud
- Market research
- Credit reference checks (where appropriate)
- Arranging treatment and rehabilitation
We use AI to:
- Improve service quality and accuracy
- Analyse usage patterns to enhance performance
- Support testing, research and development (using anonymized or aggregated data where possible)
Data collected may be used to:
- Operate and maintain AI features
- Detect misuse, fraud, or security issues
- Comply with legal obligations
If such personal data or sensitive data is obtained, it will be processed and used to enable us to provide the service which you have instructed us to provide to you. This may include the transfer of the data both within and outside the United Kingdom. By instructing us to act on your behalf you give your explicit consent to the storage, processing and use of the personal data and sensitive personal data and the possible transfer of the data within and outside the United Kingdom.
Legal Reasons we collect and use your personal data
We process your personal data on the following legal grounds:
- Contract: the processing of your data is necessary for us to fulfil our contractual obligations with you,
- Legal obligation: the processing is necessary for us to comply with our legal obligations and .
- Legitimate interests:
- To comply with our legal obligations and regulatory requirements.
Who will we share your information with?
Under the Solicitors Regulation Authority’s Code of Conduct there are very strict rules about who we can share your information with and this will normally be limited to other people who will assist with your case. This may include:
- Family, associates or representatives.
- Current, past of prospective employers
- Educators and examining bodies
- Business associates
- Trade associations and professional bodies
- Suppliers and service providers
- Ombudsman and regulatory authorities
- Barristers
- Medical Experts
- Private Investigators
- Liability Experts
- Healthcare professionals, social and welfare organisations
- Courts and tribunals
- Debt collection and tracing agencies
- Central government
- Claims/ Insurance/ Personal information databases
This data sharing enables us to pursue your claim and meet our contractual obligations to you.
We will share personal information with law enforcement agencies if required by applicable law.
We will not share your personal information with any other third parties without your consent.
International Data Transfers
It may be necessary to transfer your personal information to countries within the EEA. These countries are subject to the General Data Protection Regulation (GDPR) which provides effectively identical data protection as the UK GDPR. When we transfer data internationally, we ensure that the transfer is carried out in accordance with the UK GDPR, including by using standard contractual clauses to ensure adequate protection for your data.
If you would like any further information, please contact our Data Protection Officer.
Where will we store your personal data and how long for?
We will not collect more information than we need to fulfil our stated purposes and we will not retain it for longer than is necessary.
We will keep your information throughout the period of time that we do work for you and afterwards for a period of six years. If we require to hold your data for a longer period of time, you will be informed at the closure of your matter. We will then securely dispose of your information by deletion of the data from our IT systems and the secure shredding of any physical documentation.
What rights do you have?
Under the UK GDPR, you have a number of important rights that you can exercise free of charge. In summary these rights are:
- (Transparency over how we use your personal data and fair processing of your information;
- Access to your personal information and other supplementary information;
- Rectification - require us to correct any mistakes or complete missing information we hold on you;
- Erasure - require us to erase your personal information in certain circumstances;
- Receive a copy of the personal information you have provided to us or have this information be sent to a third party, this will be provided to you or the third party in a structured, commonly used and machine readable format;
- Object at any time to processing of your personal information for direct marketing;
- Object in certain other situations to the continued processing of your personal information;
- Restriction – request that we restrict our processing of your personal information in certain circumstances;
- Data portability – ask that we transfer the information you gave us to another organisation, or to you, in certain circumstances.
- Request not to be subject to automated decision making which produce legal effects that concern you or affect you in a significantly similar way.
If you want more information about your rights under the UK GDPR, please see the Guidance from the Information Commissioners Office on Individual's rights under the UK GDPR.
If you want to exercise any of these rights, please contact Nicola Hughes, Head of Legal Operations at:
CFG, Oakwater House
4 Oakwater Avenue
Cheadle Royal Business Park
Cheadle
SK8 3SR
Email: nicola.hughes@cfglaw.co.uk
Tel: 0161 498 1113
Who can you complain to if you are unhappy about what we have done with your information?
The UK GDPR also gives you the right to lodge a complaint with the Information Commissioner’s Office. Their contact details are:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint
Our security
We take the security of your data seriously and have implemented technical and organizational measures to protect it from unauthorized access, loss or misuse. We do this through the use of Mimecast Secure Messaging and SharePoint when sharing your data with authorized third parties.
Our datacentre and managed service providers are both ISO27001 and Cyber Essentials Plus accredited. We use a market leading product to provide additional security at server and end point level in addition to the use of various other security measures in place to protect your data.
Future processing
We do not intend to process your personal information for any reason other than stated within this privacy notice. If this changes, we will inform you in writing (by post or email).
Changes to this privacy notice
This privacy notice was published on 6th January 2025.
We constantly review our internal privacy practices to make sure they are up to date and may change this policy from time to time. When we do, we will inform you in writing (by post or email).
Get in touch
If you have any questions about this privacy notice or the information we hold about you, please contact Nicola Hughes, Head of Legal Operations at:
CFG, Oakwater House, 4 Oakwater Avenue, Cheadle Royal Business Park, Cheadle, SK8 3SR.
Email: nicola.hughes@cfglaw.co.uk
Tel: 0161 498 1113
Alternative formats
If it would be helpful to have this notice provided in another format (for example: in another language, audio) please contact us (see ‘Get in touch’ above).
