Privacy Notice


Hek Jones Limited (trading as Hek Jones Solicitors) is a company registered at Companies House under number 09134824 and regulated by the Solicitors Regulation Authority under number 619158. Its registered office is 2 nd Floor, 14 Cathedral Road, Cardiff, CF11 9LJ.

This Privacy Notice is intended to set out what data we collect as a firm, why it is collected and how we deal with that data whilst it is in our possession.

This privacy policy may change from time to time. Further information in respect of our data protection obligations may be found in our terms and conditions and letter of engagement.

What type of information will we collect from you?

The personal information we collect will depend on the nature of the services we are providing and what we are contracted to do for you. Typically this might include the following:

  • Contact details (including your name, address, date of birth, and email address)
  • Photographic identification and proof of address documents (to carry out due diligence)
  • Professional information (such as job title, previous positions, and professional experience)
  • Banking and financial details (to establish the source of funds where a transaction is involved)
  • Employment and job application details, e.g. date of birth, employment history, qualifications, equality monitoring information
  • The content of any enquiry submitted over our website

Where necessary to act in your best interests, and for the establishment, exercise, or defence of your legal matter, we may need to process information which is very sensitive in nature such as diversity and health related details. In some circumstances we may need to share this information with third parties, for example a court or tribunal. If you volunteer sensitive personal data, you allow us to process it as part of engaging our services.

On what basis can we process your information?

There are certain legal grounds on which we can process your personal data. We have to identify to you which of those grounds we rely on when processing your personal data. The legal grounds that we rely on are as follows:

Contract – in instructing Hek Jones Solicitors to act for you, then you enter into a contract with us for the provision of legal services. The terms of that contract are set out in our letter of engagement and terms of business. It is necessary for us to process personal data in the performance of that contract.

Legitimate Interests - It is necessary to process personal data for the furtherance of either your or our legitimate interests, except where our interests are overridden by the interests, rights or freedoms of affected individuals. These legitimate interests will include our interests in managing our relationship with our clients, administering visits to our offices and ascertaining achievement of proper standards/ compliance with policies, practices or procedures.

Legal Obligations – It may be necessary to process your personal data in order to comply with mandatory legal obligations to which we are subject under law, for example we may be required to share personal data with government agencies as part of our obligation to combat money laundering.

Consent – in certain circumstances you may give us your express consent to process your personal data. In such circumstances we will record how and when that consent was given and the extent of your consent. If you have given consent, you can withdraw this at any time by notifying us.

Information collected from you about other people

In commercial matters, in the course of providing our legal, financial and other professional services to you we will hold and use personal information about you, your officers and/or your employees. When you provide personal information to us relating to your officers or employees, you confirm that you are allowed to do so. You should ensure that those individuals understand how their data will be used by us.

In personal matters you may be providing other third party data to us, for example details about your family members, in which case we will use such data as a data controller in our own right and will comply with data protection legislation in relation to use of that data. You must have the authority to disclose personal data if it relates to someone else and all data disclosed should be complete, accurate and up to date.

What we are going to do with your information?

We will hold and use personal information about you in the following ways: 

  • To respond to any query that you may submit to us
  • To manage our relationship with you (and/or your business), including by maintaining our database of clients and other third parties for administration, and accounting and relationship management purpose
  • Verify your identity and establish the source of funding in any transaction.
  • Carry out appropriate anti-fraud checks (this may include conducting online searches using a third party identity provider).
  • To complete our contractual obligations to you, to carry out your instructions, or otherwise taking steps as described in our engagement terms and/or our Terms of Business (including any associated administration)
  • Carry out obligations arising from any contract entered into between you and third parties as part of your legal matter.
  • Refer you to another department within Hek Jones Solicitors about additional legal services which may benefit you.
  • Seek advice from third parties in connection with your matter, such as counsel.
  • Respond to any complaint or allegation of negligence against us.
  • Prevent money laundering or terrorist financing in accordance with financial crime regulations
  • To process any job application you have submitted
  • To comply with any other professional, legal and regulatory obligations

How long we keep your data for

We will only retain your information for as long as is necessary to: 

  • Carry out our obligations in respect of providing you with legal services
  • Establish or defend legal claims (for example negligence claims) that could be made against us.
  • Comply with legal obligations under EU/UK law (anti-money laundering regulations say your identification and source of funds information must be kept for a minimum period from conclusion of the matter).

Typically we will store the information for fifteen years from the date of conclusions of your matter.

Who your information will be shared with

We may share your details with carefully selected third parties. These may include service providers, support services and organisations that help us to market our services and third parties instructed to enable us to fulfil our contractual obligations to you and/or our clients in the course of business.

We may pass your information to any third parties where required to do so in the course of providing legal services, or where we are obliged by law. This will include, but is not limited to:

  • A court or tribunal where we are acting for you in a dispute or litigation Government bodies (such as HM Land Registry or HM Revenue and Customs for property related work).

  • The solicitors acting on the other side of your matter.

  • Counsel or other experts to obtain advice or assistance on your matter.

  • Other professionals and service providers (such as insurance brokers, where you wish to take out an insurance policy as part of a transaction).

  • Organisations involved in any merger or business reorganisation we are dealing with.

  • Any disclosures to law enforcement agencies where required by law (in particular the prevention of financial crime and terrorism).

  • Our regulators in connection with any ongoing regulatory investigation.

  • Our professional indemnity insurer in the event a claim is made against us in order to defend ourselves.

  • The bank or building society or other lender providing finance in the transaction.

  • Our own bank or other financial instruction to enable us to comply with your instructions or our contractual obligations.

  • External auditors who may carry out independent checks of your file as part of our accreditations or professional obligations.

At the outset of your matter we may not be aware of all the other parties involved as this will depend on the specific nature of the work.

Security of your data

We follow strict security procedures as to how your personal information is stored and used, and who sees it, to help stop any unauthorised person getting hold of it. All personal information you register on our website will be located behind a firewall. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access

Measures when transferring your data to others

Some organisations may be located in countries outside of Europe where data protection laws are not as strict as they are in the UK. Where your personal data is being transferred outside the EU, we will undertake an assessment of the level of protection in light of the circumstances surrounding the transfer. We will make sure that any transfers are not repetitive and only limited to the minimum amount of information possible. In certain circumstances we may need to seek your consent unless there is an overriding legal need to transfer the information.

How you can access and update your information

You have a right to request a copy of the personal information we hold about you, known as a subject access request. You also have the right to request that information we hold about you which may be incorrect, or which has been changed since you first told us, is updated. You can ask that we erase all personal information that we hold about you. Where it is appropriate that we comply, your request will be fully actioned within 30 days. These requests are free of charge (except in exceptional circumstances) and can be sent to the Managing Director, Hek Jones Solicitors, 104 Whitchurch Road, Cardiff, CF14 3LY

How you can object to us using your data

You can ask us to limit the way in which we are using your information or object to certain types of processing. We will do our best to comply with your request unless we have to use the information for legitimate business or legal purposes.

Please note that if you want us to restrict or stop processing your data this may impact on our ability to provide our services. Depending on the extent of your request we may be unable to continue acting for you and be forced to immediately cease acting. In these situations you would remain liable for the fees and disbursements incurred to date.

Any queries or concerns about the way in which your data is being used can be sent to

Moving your information to another organisation

You have the right to request that we send a copy of the personal data we hold about you to another organisation for your own purposes, for example when you are dealing with a different service provider. If you would like us to move, copy, or transfer your information to another organisation please let us know. We will respond to you within one month after assessing whether or not this is possible, taking into account the technical compatibility with the other organisation in question.

Complaints about the use of your personal data

If you wish to raise a complaint on how we have handled your personal data, you can contact us to have the matter investigated by writing to the Managing Director, Hek Jones Solicitors, 104 Whitchurch Road, Cardiff, Cf14 3LY.

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the UK data protection regulator, the Information Commissioner’s Office. Further details can be found at or 0303 123 1113.

If you are not our client

If you are not our client your personal data may be processed to enable us to provide legal advice to our client and may also be used in legal proceedings on behalf of our client. We are allowed to use your information because it is in the legitimate interests of our client (for example under the terms and conditions of a loan agreement) to do so. We may also have to use your personal data to comply with our own legal and regulatory obligations.

We may also retain and use your personal data when responding to enquiries by you if you are considering becoming a client or an employee of the firm, for example when you contact us asking for a quotation or applying for a job. This privacy notice will apply to such information even though you are not, and may not become, a client of the firm.