Privacy Notice

Last updated: 9 October 2026

1. Introduction

Alastair Purdy LLP (“we”, “us” or “our”) is a solicitors’ practice. In most cases, we are the controller of the personal data described in this notice. This notice applies to clients, prospective clients and other individuals whose personal data we process in connection with legal services and the operation of our business, including witnesses, counterparties, professional contacts, suppliers and website or event users.

Personal data means information relating to an identified or identifiable living individual. It does not include information that has been irreversibly anonymised. We process personal data in accordance with Regulation (EU) 2016/679 (the GDPR), the Data Protection Act 2018 and other applicable data protection and electronic-communications law.

This notice explains what personal data we collect, where it comes from, why and how we use it, who receives it, international transfers, retention, security and individual rights. We generally act as an independent controller because of our professional and legal obligations. In limited circumstances, we may act as a processor where this is expressly agreed.

2. Collection and use of your data

We collect personal data directly from you when you instruct us, enquire about our services, communicate with us, make a payment, attend an event, use our website or otherwise interact with the firm. We may also collect data from your representatives, personnel, group companies or persons authorised by you.

We may receive personal data from other solicitors, barristers, experts, witnesses, counterparties, courts, tribunals, regulators, public authorities, financial institutions, verification and sanctions providers, insurers, professional advisers, service providers, public registers and other publicly available sources.

Information provided in connection with legal services may be confidential and protected by legal professional privilege. Do not send confidential information until we have confirmed in writing that we act for you. An unsolicited communication does not create a solicitor-client relationship and may not be privileged.

For questions, requests or concerns about our use of personal data, contact our Data Protection Contact:

Email: DPO@purdys.ie
Post: Data Protection Contact, Alastair Purdy LLP, Corrib Castle, 1 Waterside, Woodquay, Galway, H91 DK58

What personal data do we collect?

Depending on the person, matter and service, we may collect, use, store and transfer the following categories of personal data:

Identity and Contact Data: name, title, date of birth, address, email, telephone number, signature, client or matter identifier, employer or organisation, role, and identity numbers such as PPS number where relevant and lawful.
Matter and Communications Data: instructions, correspondence, attendance notes, documents, evidence, opinions, professional information, relationship information and other personal data relevant to an enquiry, transaction, dispute or legal service.
Financial and Transaction Data: bank and payment details, invoices, payments, client-account transactions, asset or property information, tax information, source of funds and source of wealth.
Compliance and Due Diligence Data: identity documents, proof of address, beneficial ownership, authority, business activities, politically exposed person and sanctions checks, electronic-verification results, conflict data and fraud-prevention information.
Special Category and Criminal-Offence Data: health, disability, racial or ethnic origin, political opinions, beliefs, trade-union membership, genetic or biometric data, sex life or sexual orientation, and allegations, convictions, offences or related security measures, where relevant and lawful.
Technical, Security and Marketing Data: IP address, device and log data, account and access information, website and cookie data, cyber-security events, event attendance, marketing preferences and limited account, diagnostic, security or usage data generated by approved technology and AI services.

We may create aggregated or anonymised information for statistics, service planning, quality, risk and business analysis. Properly anonymised information is not personal data and may be used for any lawful purpose. We do not attempt to re-identify it.

3. How we use your personal data

We use personal data only where we have a lawful basis and only for specified, explicit and legitimate purposes. The principal lawful bases are:

Contract and pre-contract steps: where processing is necessary to take steps at your request before an engagement or to perform our contract for legal services.
Legal and regulatory obligations: where processing is necessary to comply with obligations applying to us, including professional, court, tax, anti-money laundering, sanctions, accounts, complaints and record-keeping duties.
Legitimate interests: where processing is necessary for our or a third party’s legitimate interests and those interests are not overridden by your rights and freedoms.
Other lawful bases: consent where appropriate and freely given; protection of vital interests; performance of a task in the public interest; and the establishment, exercise or defence of legal claims. Consent is not generally the basis on which we provide legal services.

More than one lawful basis may apply to a processing activity. We will explain the specific basis on request. Where personal data is required by law, regulation or contract, failure to provide it may prevent us from accepting instructions, continuing to act, handling money or completing a transaction.

Purpose / Activity	Type of Data	Lawful Basis
Establishing and managing our relationship; taking instructions; providing legal services; communicating and maintaining the file.	Identity and contact; matter and communications; financial and transaction; special category and criminal-offence data where relevant.	Contract and pre-contract steps; legitimate interests in providing and managing legal services; legal claims; legal obligations where applicable.
Conflicts, client due diligence, AML, sanctions, fraud prevention, professional obligations, regulatory reporting and responding to courts or public authorities.	Identity and contact; matter and communications; financial and transaction; compliance and due diligence; special category and criminal-offence data where relevant.	Legal and regulatory obligations; substantial public interest where authorised; legal claims; legitimate interests in protecting the firm, clients and the legal system.
Managing fees, billing, client money, accounting, payment and debt recovery.	Identity and contact; financial and transaction; matter and communications; compliance data where required.	Contract; legal and regulatory obligations; legitimate interests in financial administration and recovering amounts due.
Operating and securing the firm; service providers; quality, audit, insurance, risk, business continuity, service improvement and approved technology including controlled AI support.	Identity and contact; matter and communications where permitted; technical, security and usage; other data strictly necessary for the activity.	Legitimate interests in secure and effective operations; contract; legal and regulatory obligations.
Website use, events, professional relationships and permitted legal updates or marketing.	Identity and contact; technical, security and marketing data.	Consent where required; legitimate interests in developing relationships and services; Irish electronic-marketing law.

4. Legal basis

Legitimate interests means the interests of the firm or a third party in conducting and managing activities in a proportionate, secure and effective way. We identify the interest, assess necessity and balance it against the impact on individuals. We do not rely on legitimate interests where individual rights and freedoms override the interest.

Our legitimate interests may include providing, managing and improving legal services and client relationships; responding to enquiries, feedback, complaints and service requests; conflict checks and professional-risk management; protecting systems, premises, communications, clients and funds; fraud and cybercrime prevention; quality assurance, audits, insurance and regulatory readiness; managing suppliers and advisers; improving workflows, templates, know-how and approved technology, including controlled use of artificial intelligence tools; business continuity and recovering amounts due; establishing, exercising or defending legal rights; business planning, restructuring, succession, merger or transfer; developing professional and business relationships; sending permitted legal updates and event information; maintaining suppression lists; and creating anonymised or aggregated analysis.

Performance of a contract means processing necessary to take steps at your request before an engagement or to perform our legal-services contract with you.

Compliance with a legal or regulatory obligation means processing necessary to meet an obligation imposed on the firm by law, a court, a regulator or professional rules.

Consent means a freely given, specific, informed and unambiguous indication of agreement. Where we rely on consent, you may withdraw it at any time without affecting processing already carried out lawfully.

5. Special category and criminal-offence data

Special category data includes information about health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric identifiers, and sex life or sexual orientation. Criminal-offence data is regulated separately. We process these data only where relevant, necessary and lawful.

Legal claims: we commonly process special category data where necessary to establish, exercise or defend legal claims or for related judicial purposes, in accordance with Article 9(2)(f) GDPR and section 47 of the Data Protection Act 2018.
Explicit consent: we may rely on explicit consent for a specific use where that basis is appropriate.
Vital interests or manifestly public data: in limited cases, processing may be necessary to protect vital interests, or may concern data that the individual has clearly made public.
Substantial public interest and criminal-offence data: we may process data where authorised by Irish or EU law for a substantial public interest, including prevention or detection of unlawful acts. Criminal-offence data is processed under Article 10 GDPR and section 55 of the Data Protection Act 2018 or other applicable law.

6. Disclosures of personal data

We share personal data only where necessary for a stated purpose, permitted by law and consistent with confidentiality and legal professional privilege.

Access within the firm is limited to partners, employees, consultants and authorised support personnel who need the information for their role. The firm is generally the controller; individuals working for us process data under our authority and confidentiality duties.

Some service providers and sub-processors may process personal data outside the European Economic Area (EEA), including where Anthropic Claude models are accessed through Microsoft Copilot. Anthropic acts as Microsoft’s sub-processor, and Microsoft states that this model processing is outside its EU Data Boundary. Where a transfer occurs, we rely, as applicable, on a European Commission adequacy decision, including Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 for certified US organisations participating in the EU-US Data Privacy Framework. Where an adequacy decision does not apply, we rely on the European Commission’s 2021 Standard Contractual Clauses or another lawful transfer mechanism under the relevant data processing agreement, together with supplementary safeguards where required.

Recipients may include:

service providers supporting practice management, communications, cloud hosting, e-signature, document production, cybersecurity and approved enterprise or business artificial intelligence;
Keyhouse, DocuSign and BundleDocs;
Microsoft 365 and Microsoft Copilot under enterprise subscriptions;
OpenAI Business and Enterprise services supplied under OpenAI’s business terms and Data Processing Addendum;
Anthropic Claude models accessed only through Microsoft Copilot;
other approved IT, cloud, cybersecurity, verification, archiving and support providers;
barristers, experts, foreign lawyers, mediators, arbitrators, other solicitors, professional advisers, witnesses, counterparties and persons involved in a matter;
courts, tribunals, the Law Society of Ireland, the LSRA, the Revenue Commissioners, An Garda Síochána, regulators and public authorities, banks, auditors, insurers and funders where lawful and necessary; and
a prospective or actual successor, merger party or buyer of all or part of our practice under appropriate safeguards.

We use AI tools only for limited support tasks such as drafting assistance, review, research, summarisation and administration. We do not use these tools to process client personal data or confidential matter content. Limited account, authentication, diagnostic, security and usage data may be processed to provide and secure the services. Approved AI services are supplied under enterprise or business subscriptions and are subject to privacy, security, contractual and configuration review. We do not use personal data or client content to train AI models, and our prompts and outputs are not used to train foundation models under our approved arrangements. Relevant outputs are subject to human review, and we do not use these tools to make solely automated decisions with legal or similarly significant effects.

7. Data security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, destruction, unauthorised access or disclosure. Measures include role-based access, confidentiality obligations, secure configuration, encryption at rest and in transit where appropriate, multi-factor authentication, tenant isolation, identity and permission controls, sensitivity labels, retention and audit controls where available, backups, logging, vendor and configuration due diligence, staff training, data minimisation and incident-response procedures. No system can be guaranteed completely secure.

We have procedures to assess and respond to suspected personal data breaches. We will notify the Data Protection Commission and affected individuals where and within the time required by law.

8. Data retention

We keep personal data only for as long as needed for the relevant purpose and to meet legal, professional, insurance, accounting and reporting requirements. Client files are generally retained for at least seven years after the final bill or closure of the matter. Longer periods may apply, including for conveyancing, probate, wills, trusts, minors, title documents, undertakings, ongoing rights or liabilities, litigation holds and safe-custody documents.

We determine retention by considering the amount, nature and sensitivity of the data, the risk of harm, the purpose and whether it can be achieved another way, limitation periods, legal professional privilege, regulatory duties and the need to establish, exercise or defend legal claims. More detail is available from our Data Protection Contact.

You may ask us to erase personal data in certain circumstances. We may retain it where necessary for legal or professional obligations, privilege, confidentiality, court processes, record keeping or legal claims.

We may irreversibly anonymise personal data for statistical, research, quality or business-analysis purposes. Once data is properly anonymised, it may be retained and used indefinitely without further notice.

9. Children

We do not direct our website or marketing to children. We may, however, process personal data about a child where relevant to legal services, for example in employment, family, litigation, probate, property or capacity matters. The data may be provided by a parent or guardian, a client, a court, a public body or another participant. We apply appropriate safeguards and rely on the lawful basis relevant to the matter; parental consent is used only where legally required and appropriate.

10. Data protection rights

Subject to conditions and exemptions, you may exercise the rights below. Rights may be restricted where necessary to protect legal professional privilege, another person’s rights, confidentiality, court or tribunal processes, anti-money laundering duties or other legal obligations, including restrictions under section 162 of the Data Protection Act 2018.

Request access to your personal data and information about how it is processed.
Request correction of inaccurate data and completion of incomplete data.
Request erasure of personal data where there is no lawful reason to continue processing it.
Object to processing based on legitimate interests because of your particular situation, and object at any time to direct marketing.
Request restriction of processing in applicable circumstances.
Request data portability for certain personal data you provided to us where processing is automated and based on consent or contract.
Withdraw consent at any time where consent is the lawful basis, without affecting earlier lawful processing.

You also have rights concerning solely automated decisions. We do not currently make decisions about individuals solely by automated means that produce legal or similarly significant effects.

To exercise a right, contact us using the details above. We may request proportionate evidence of identity or authority. Requests are normally free, but we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive. We normally respond within one month and will tell you if a lawful extension is required.

You may also complain to the Data Protection Commission through its online form or at info@dataprotection.ie. We ask that you first give us an opportunity to address the concern.

11. Inquiry form

When you contact Alastair Purdy LLP using our website enquiry form, we collect the information you provide, which may include your name, organisation (if supplied), email address, telephone number (if supplied), the service category selected, your preferred solicitor (or an indication of no preference), and the details of your enquiry.

We use this information to consider the nature and scope of your enquiry, assess whether we may be able to assist, carry out any necessary preliminary conflict or eligibility checks, identify the appropriate solicitor or team, respond to you, and arrange an initial consultation where appropriate. If the firm subsequently agrees to act, relevant information may be used as part of our client intake and onboarding process.

We may retain enquiry information for appropriate follow-up, administrative and record-keeping purposes, subject to the lawful bases and retention principles set out in this notice. Depending on the circumstances, processing may be necessary for steps requested before entering into a contract, for our legitimate interests in managing enquiries, or to comply with legal and professional obligations. Information is not used for unrelated marketing without an appropriate lawful basis.

Please do not include confidential or highly sensitive material in your initial enquiry. Sending a form does not establish a solicitor–client relationship or mean that the firm has accepted instructions. If a matter is urgent, please contact us directly rather than relying solely on the enquiry form.