Privacy Notice and Processing Notice
Part 1. Privacy Notice (website and intake form)
Who we are. Factum is operated by Factum Probatum Limited (company in formation) ([registered address], company number [•]) ("we"). We are the controller of the personal data described in this notice. Contact: [privacy email]. ICO registration: [•]. [EU/UK representative, if required: •]
What this notice covers. Data about people who visit this site, use the free analysis, make an enquiry, or instruct us. It does not cover the content of message exports a client gives us for a matter: for that, the client is the controller and we are its processor under a data processing agreement. If you are a person named in such messages, see Part 2.
The free analysis runs in your browser. When you use the free analysis, your file is read on your own device. It is not uploaded to us and we do not see its contents. We see only that the page was used and, if you choose to proceed to a paid package, the file's hash (a fingerprint, not the content).
What we collect, why, and on what basis
| Data | Why | Lawful basis |
|---|---|---|
| Name, email, phone, firm, role, short description of the matter type, from the enquiry or intake form | To reply, quote and, if you proceed, set up the engagement | Legitimate interests (answering enquiries); contract, if you instruct us |
| Billing and contract records | To invoice, account and meet legal duties | Contract; legal obligation |
| Basic site logs (IP address, browser, time) and strictly necessary cookies | Security and operating the site | Legitimate interests |
| Optional analytics, if switched on [we do not currently use advertising cookies] | To see how the site is used | Consent, where required |
| Correspondence | To keep a record of what was agreed | Legitimate interests; contract |
Please do not put case details or special category data in the free-text enquiry box. Tell us only the type of matter and the number of messages; we will arrange a secure route for the files.
Who receives it
Our hosting provider (Cloudflare), our email provider [Fastmail], our payment and accounting providers [•], and professional advisers and insurers where needed. We do not sell personal data. We do not use enquiry data to train any AI model.
Transfers
Where a provider processes data outside the UK, the EEA or Switzerland, we use an adequacy decision or the standard contractual clauses / UK addendum. Ask us for details.
How long we keep it
Unsuccessful enquiries: [12] months. Clients' contract and billing records: [6] years after the engagement ends (tax and limitation). Site logs: [•] days.
Your rights
Under UK GDPR, EU GDPR and the Swiss FADP, you may ask for access, correction, erasure, restriction, portability, and to object to processing based on legitimate interests; and, where we rely on consent, to withdraw it. Write to [privacy email]. You may complain to the Information Commissioner's Office (ico.org.uk), your EU supervisory authority, or the Swiss FDPIC (edoeb.admin.ch).
Automated decisions
We make no decisions about individuals solely by automated means that have legal or similarly significant effects.
Last updated: [date].
Part 2. Processing notice (for a client to forward to a counterparty or third party, if it chooses)
Short form, one paragraph. The client decides whether, when and to whom to send it. It does not replace the client's own notices or any duty it has.
Notice about processing of messages in connection with legal proceedings. [Client name] ("the Client") is a party to, or advising on, [a dispute / proceedings] in which messages that include your personal data may be relevant. The Client has engaged Factum (a operated by Factum Probatum Limited (company in formation)) as its processor, to organise those messages into a table and counts so that the Client and its advisers can prepare and conduct the proceedings. Factum acts only on the Client's instructions, keeps the data confidential, uses sub-processors only under written contract with no training on the data, and deletes it when the matter ends. The data is processed to establish, exercise or defend legal claims. The Client is the controller and is your contact for your data-protection rights, including access and objection, subject to any exemption available in law, including legal professional privilege and the exemption for legal proceedings. Contact: [Client's data-protection contact]. You may complain to your data-protection authority.