Privacy Policy & Cookies

PRIVACY POLICY
Last updated: June 2026

1. Who We Are
Dudman Shaw Limited, a company incorporated in England and Wales (Company No. 05094816), trading as Rundlewalker Solicitors, is the data controller responsible for the personal data we collect and process.

We are authorised and regulated by the Solicitors Regulation Authority (SRA No. OC402197) and registered with the Financial Conduct Authority (FCA). We are the data controller for the personal data we collect and process.

Our contact details are:
Roger Henderson, Data Protection Manager, Rundlewalker Solicitors, King’s Wharf, The Quay, Exeter.
Email: roger.henderson@rundlewalker.com
Telephone: 01392 209218

2. What This Policy Covers
This Privacy Policy explains:
• What personal data we collect
• How and why we use it
• Our lawful bases for processing
• Who we share it with
• How long we keep it
• Your rights under UK GDPR
• How to contact us or the ICO

This policy applies to:
• Visitors to our website
• Individuals who submit enquiries
• Clients and prospective clients
• Third parties involved in legal matters
• Social media users who interact with us
• Suppliers and professional partners

3. Personal Data We Collect
We collect and process the following categories of personal data:
3.1 Website and enquiry data
• Name
• Email address
• Telephone number
• Details of your enquiry
• IP address
• Device and browser information
• Cookie and analytics data (See Cookie Policy)

3.2 Client and matter data
• Identity information
• Contact details
• Case related information
• Financial information (where relevant)
• Information relating to legal claims
• Information provided by third parties (e.g., experts, counsel)

3.3 Special category data
Where necessary for legal services, we may process:
• Health information
• Criminal offence data
• Information relating to children
• Other sensitive information relevant to a legal claim

3.4 Social media interactions
If you respond to or engage with our posts on platforms such as Facebook, we may receive your public profile information and any content you choose to share.

4. How We Collect Personal Data
We collect data:
• Directly from you (forms, email, telephone, meetings)
• Through our website (analytics, cookies, enquiry forms)
• From third parties (barristers, experts, insurers, witnesses)
• From publicly available sources
• Through social media interactions initiated by you

5. How We Use Your Personal Data
We use personal data for the following purposes:

5.1 Providing legal services
• Assessing your enquiry
• Managing your matter
• Communicating with you
• Instructing counsel or experts
• Complying with court or regulatory requirements

5.2 Regulatory and legal obligations
• SRA compliance
• FCA compliance
• Anti money laundering (AML) checks
• Fraud prevention
• Record keeping and auditing

5.3 Website operation and analytics
• Monitoring website performance
• Improving user experience
• Measuring Google Ads conversion activity
• Ensuring website security

5.4 Business operations
• Managing suppliers
• Internal administration
• Quality assurance
• Professional indemnity insurance requirements
We do not use your data for unsolicited marketing emails or newsletters.

6. Lawful Basis for Processing
We rely on the following lawful basis under UK GDPR:

6.1 Contract
To provide legal services and respond to enquiries.

6.2 Legal obligation
For AML checks, regulatory compliance, accounting, and statutory duties.

6.3 Legitimate interests
For:
• Website analytics
• Google Ads conversion tracking
• Internal administration
• Network and information security
We balance these interests against your rights and freedoms.

6.4 Consent
For:
• Non essential cookies
• Analytics and tracking technologies (See Cookie Policy)

6.5 Special category data
Processed under:
• Article 9(2)(f) — legal claims
• Article 9(2)(g) — substantial public interest
• Schedule 1, DPA 2018 (legal claims; safeguarding; regulatory requirements)

7. Who We Share Personal Data With
We may share data with:
• Barristers, experts, and professional advisers
• Courts, tribunals, and regulatory bodies
• Insurers and indemnity providers
• Medical experts
• Private Investigators
• Healthcare professionals, social and welfare organisations
• Legal Expenses Insurers
• Otherside legal advisors.
• Estate Agents and Financial Advisors
• IT and system providers (including Advanced / One Advanced Legal)
• Secure cloud hosting providers
• Law enforcement where required
We do not sell personal data.
All third party processors are bound by UK GDPR compliant contracts.

8. International Transfers
Some analytics and tracking data processed by Google may involve transfers outside the UK.
Where this occurs, we ensure appropriate safeguards are in place, including:
• UK International Data Transfer Agreement (IDTA)
• UK Addendum to EU Standard Contractual Clauses (SCCs)
• Additional technical and organisational measures

9. Data Retention
We retain data only as long as necessary:
• Enquiry data: 6–24 months
• Client matter files: 6–15 years, depending on matter type
• AML records: 5 years (minimum statutory requirement)
• Analytics data: up to 26 months
• Complaints records: 6 years
Retention periods may vary based on legal, regulatory, or insurance requirements.

10. Your Rights
You have the following rights under UK GDPR:
• Right of access
• Right to rectification
• Right to erasure
• Right to restrict processing
• Right to object
• Right to data portability
• Right to withdraw consent (for cookies and analytics)
Legal professional privilege
Some rights may be limited where disclosure would breach legal professional privilege.

11. How to Exercise Your Rights
Contact:
Roger Henderson, Data Protection Manager, Rundlewalker Solicitors, King’s Wharf, The Quay, Exeter.
Email: roger.henderson@rundlewalker.com
Telephone: 01392 209218
We may need to verify your identity before responding.

12. Complaints
You may complain to:
Information Commissioner’s Office (ICO)
www.ico.org.uk Telephone: 0303 123 1113
Solicitors Regulation Authority (SRA)
www.sra.org.uk For concerns relating to professional conduct.

13. Updates to This Policy
We may update this policy periodically.