Effective Date: August 2026
Pure Legacy Ltd (“we”, “our”, or “us”) is committed to protecting your privacy and handling your personal information fairly, lawfully and transparently.
This Privacy Notice explains how we collect, use, store and protect your personal information when you use our services or contact us.
1. Who We Are
Address: Pure Legacy Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
Telephone: 0208 150 4615
Email: admin@purelegacy.co.uk
Website: www.purelegacy.co.uk
We are a provider of will writing, estate planning and probate services and are regulated by the Society of Will Writers.
We are registered with the Information Commissioner’s Office (ICO) under registration number ZC117472.
For the purposes of data protection law, we are the Data Controller of the personal information you provide to us.
We are not required to appoint a Data Protection Officer given the nature and scale of our processing activities. If you have any questions about this Privacy Notice or how we handle your personal information, please contact us using the details above.
2. The Information We Collect
Depending on the services you request, we may collect:
Personal Information
- Full name
- Date of birth
- Address
- Telephone number
- Email address
- Marital or civil partnership status
- Nationality (where relevant)
Identity Information
To comply with legal obligations, we may collect:
- Passport details
- Driving licence details
- Utility bills
- Bank statements
- Other proof of identity or address
If you do not provide identification where required by law, we may be unable to provide our services.
Estate Planning Information
This may include:
- Details of your family members and beneficiaries
- Information about executors, trustees and attorneys
- Details of your assets and liabilities
- Property ownership
- Business interests
- Pension information
- Insurance policies
- Funeral wishes
- Digital assets (where applicable)
We may receive personal information about individuals connected with you, including beneficiaries, executors, trustees, attorneys, family members and the deceased. We process this information only where necessary for providing our services or complying with legal obligations.
Where you provide us with personal information about another individual (such as a beneficiary, executor or attorney), you should ensure that you have authority to provide that information or have made them aware that you have done so, where appropriate. Where we correspond directly with such individuals in the course of providing our services, we will make this Privacy Notice available to them, or otherwise provide them with information about how we use their personal information at that time.
Probate Information
Where we administer an estate, we may collect information relating to:
- The deceased
- Executors
- Beneficiaries
- Assets and liabilities
- Financial institutions
- Tax affairs
- Estate accounts
Special Category Data
In limited circumstances we may process information relating to:
- Physical or mental health
- Capacity assessments
- Disability
We only process Special Category Data where necessary and where an appropriate lawful condition under UK GDPR and the Data Protection Act 2018 applies, including where you have given your explicit consent, where necessary to establish, exercise or defend legal claims, or where necessary to assess mental capacity.
Criminal Offence Data
In limited circumstances, we may process information relating to criminal convictions or offences where this is necessary to comply with our legal and regulatory obligations, including applicable anti-money laundering requirements.
We may also carry out sanctions and politically exposed persons (PEP) screening as part of our identity verification and compliance procedures. PEP and sanctions information will only be processed where necessary for these purposes and in accordance with applicable data protection law.
3. How We Collect Information
We may obtain personal information:
- Directly from you
- From your representatives
- From executors or attorneys
- From family members (where appropriate)
- From financial institutions
- From government departments
- From HM Revenue & Customs
- From HM Courts & Tribunals Service
- Through electronic identity verification providers
- From publicly available sources where appropriate
- Through our website, including when you submit an enquiry or contact form
4. How We Use Your Information and Our Lawful Bases for Processing
We use your personal information for the purposes set out below. Data protection law requires us to identify a lawful basis for each purpose; the table shows the basis or bases we normally rely on.
| Purpose | Lawful Basis |
| Preparing legal documents, drafting Wills, preparing Lasting Powers of Attorney, and providing estate planning advice | Performance of a contract; legitimate interests where necessary to respond to enquiries and establish a potential client relationship |
| Administering estates | Performance of a contract; compliance with a legal obligation |
| Verifying your identity | Compliance with a legal obligation; legitimate interests (preventing fraud) |
| Preventing fraud and money laundering | Compliance with a legal obligation; legitimate interests |
| Communicating with you | Performance of a contract; legitimate interests |
| Processing payments | Performance of a contract |
| Complying with legal and regulatory obligations | Compliance with a legal obligation |
| Responding to complaints | Legitimate interests; compliance with a legal or regulatory obligation where applicable |
| Maintaining our business records | Compliance with a legal obligation; legitimate interests |
| Sending marketing communications | Consent, or the “soft opt-in” exception for existing clients, where applicable |
Where we rely on legitimate interests, these include: preventing and detecting fraud; maintaining the security of our systems, staff and premises; managing and defending legal claims; and improving our services to clients. We only rely on legitimate interests where these are not overridden by your rights and freedoms, and you can ask us about the balancing assessments we carry out.
Where we process Special Category Data or Criminal Offence Data, we will only do so where an additional condition under UK data protection law applies.
5. Automated Decision-Making
We do not use your personal information to make solely automated decisions that produce legal effects concerning you, or that similarly significantly affect you. If this changes, we will update this Privacy Notice and provide you with information about the logic involved and the likely consequences of that processing.
6. Who We Share Information With
We will never sell your personal information.
Where necessary, we may share information with:
- HM Revenue & Customs
- HM Courts & Tribunals Service
- The Probate Registry
- The Office of the Public Guardian
- Banks and building societies
- Investment providers
- Insurance companies
- Financial advisers
- Solicitors
- Barristers
- Accountants
- Medical professionals (where appropriate)
- Identity verification providers
- IT service providers
- Cloud storage providers
- Professional indemnity insurers
- Our professional regulator, the Society of Will Writers
- Other organisations where required by law
Information is only shared where necessary to provide our services or comply with legal obligations.
7. International Transfers
We normally store and process your information within the United Kingdom. We use the following providers, which may involve your information being processed outside the UK:
- Microsoft 365: used for our administrative systems, including email and document storage. Microsoft generally provides UK data residency for applicable Microsoft 365 services. Certain processing, including technical support, security, diagnostics and other service operations, may involve the processing of personal information outside the UK. Where an international transfer takes place, Microsoft provides appropriate contractual safeguards in accordance with applicable data protection law.
- HubSpot: our customer relationship management (CRM) system, in which client data is stored. HubSpot is a US-based company and personal information may be transferred to and processed in the United States. HubSpot uses appropriate safeguards for international transfers, including the UK Extension to the EU-US Data Privacy Framework and, where applicable, the UK Addendum to the Standard Contractual Clauses.
Other IT, cloud storage or software providers we use may also process information outside the UK from time to time.
Where information is transferred outside the UK, whether by us or by our service providers, we ensure appropriate safeguards are in place, which may include:
- the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses;
- reliance on the UK extension to the EU-US Data Privacy Framework, where the receiving organisation is certified; or
- another safeguard approved under UK data protection law.
You can request further information about the safeguards we use by contacting us using the details below.
8. Business Transfers
If our business is sold, merged or restructured, your personal information may be transferred to the new owner, who will continue to protect it in accordance with this Privacy Notice.
9. Keeping Your Information Secure
We take appropriate technical and organisational measures to protect your information, including:
- secure electronic systems;
- password protection;
- encryption where appropriate;
- restricted staff access;
- secure storage of paper records;
- regular security monitoring.
Although we take reasonable steps to protect your information, no method of electronic transmission or storage is completely secure.
10. How Long We Keep Your Information
We retain personal information only for as long as necessary to:
- provide our services;
- comply with legal obligations;
- deal with complaints;
- defend legal claims; and
- meet regulatory requirements.
The length of time we retain information depends on the type of service provided.
We normally retain client files for a minimum of seven years after completion of our work, although longer retention periods may apply where required by law, regulatory obligations or where necessary to establish, exercise or defend legal claims.
Where the Money Laundering Regulations 2017 apply to our services, records used for customer due diligence and identity verification are retained for a minimum of five years from the end of our business relationship with you, in line with our obligations under those Regulations.
11. Your Rights
You have the right to:
- access your personal information;
- request correction of inaccurate information;
- request deletion of your information where appropriate;
- request restriction of processing;
- object to certain processing;
- request transfer of your information where applicable;
- withdraw consent where processing is based on consent.
You have the right to object to processing where we rely on legitimate interests as our lawful basis.
These rights are subject to certain legal exceptions.
Requests should be made in writing using the contact details below.
12. Marketing
We will only send marketing communications where you have asked us to do so or where we are legally permitted.
You may unsubscribe from marketing communications at any time.
We do not sell your personal information to third parties.
13. Website & Cookies
Our website does not currently use cookies or similar tracking technologies to collect information about visitors or to track how you use our website.
If this changes in the future and we introduce cookies or similar technologies, we will update this Privacy Notice and, where required, provide appropriate information and obtain your consent before using any non-essential cookies.
14. Complaints
We aim to resolve any concerns about how we handle your personal information quickly and fairly.
If you have a concern, please contact us using the details below, providing as much detail as possible.
We will acknowledge your complaint within 5 working days and aim to provide a full response within 28 days. If we need longer, we will explain why and keep you updated.
If you remain dissatisfied with our response, or if we have not resolved your complaint within a reasonable time, you have the right to complain to the Information Commissioner’s Office (ICO).
The ICO can be contacted through its website at ico.org.uk or by telephone on 0303 123 1113.
15. Contact Us
If you have any questions about this Privacy Notice or your personal information, please contact:
Pure Legacy Ltd
Registered office: Pure Legacy Ltd, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ
Correspondence address: Pure Legacy Ltd, PO Box 6308, Windsor, SL4 9JF
Telephone: 0208 150 4615
Email: admin@purelegacy.co.uk
16. Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in the law or the way we operate.
The latest version will always be available on our website and copies are available on request.