Privacy Policy

Scissero Law Ltd is the data controller for personal data described in this policy. We are a company registered in England and Wales (Company No. 14955310) with our registered office at 25 Cabot Square, London E14 4QZ.

Scissero Law Ltd is authorised and regulated by the Solicitors Regulation Authority (SRA No. 8006186) as a licensed body for the provision of legal services.

Questions about this policy or about how we handle your personal data should be addressed to privacy@scissero.com.

We collect personal data in the following categories:

• Identity & contact data — name, business email address, employer, job title and country, provided when you request a demo, subscribe to insights, or otherwise contact us.
• Correspondence — the content of messages you send us through our forms, by email, or via other channels, including any attachments.
• Engagement data — once you become a client, information necessary to provide legal services and operate the platform, including matter-related documents and platform usage records.
• Technical data — IP address, browser type, device information and basic page-view information, collected automatically when you visit our website. See our Cookie Policy for detail.

We do not knowingly collect personal data from children. Our services are directed exclusively at businesses and the professionals who work for them.

We process personal data for the following purposes, and on the legal bases shown:

• To respond to enquiries and provide demos — on the basis of your consent (when you tick the consent box on our forms) and our legitimate interest in operating and growing our business.
• To provide legal services and operate the platform — on the basis of performance of a contract with you or your organisation.
• To comply with our regulatory and legal obligations — including obligations under SRA rules, anti-money-laundering law, and applicable tax and accounting law — on the basis of a legal obligation.
• To send insights and marketing communications — on the basis of your consent, which you may withdraw at any time by using the unsubscribe link in any email or by contacting us.
• To keep our website and services secure — on the basis of our legitimate interest in preventing fraud and abuse.

We do not use any client data — documents, queries, outputs, or matter information — to train artificial intelligence models, ours or anyone else's.

We share personal data only as needed to operate our business and provide our services. Recipients fall into these categories:

• Service providers (processors) who help us run the business — for example, our customer relationship management platform, email delivery providers, cloud infrastructure providers, and professional advisers. Each is bound by a written data processing agreement that requires them to protect your data and use it only on our instructions.
• Regulators, courts and law enforcement where we are legally required to disclose information.
• Professional advisers — auditors, accountants, insurers and lawyers — in the ordinary course of business.
• Successors in interest in the event of a corporate transaction such as a merger, acquisition or reorganisation, in which case any recipient will be bound by terms at least as protective as those in this policy.

We do not sell personal data, and we do not share personal data with third parties for their own marketing purposes.

All client data within our platform is stored exclusively within the European Economic Area (EEA). Operational systems supporting our business — such as our customer relationship management platform and email systems — may store personal data in the United Kingdom or the EEA.

Where any transfer of personal data outside the UK or EEA is necessary, we rely on the UK's adequacy regulations, the European Commission's adequacy decisions, or appropriate safeguards such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses.

We operate to the ISO/IEC 27001 standard for information security management and the ISO/IEC 42001 standard for AI management, both of which are independently audited.

We retain personal data only for as long as we have a lawful basis to do so:

• Enquiry and marketing data — until you withdraw your consent or ask us to delete it, and in any event no longer than three years after our last meaningful interaction with you.
• Client matter data — for the duration of the engagement and, after closure, for the period required by the SRA, our professional indemnity insurers, and applicable tax and limitation law (typically seven years).
• Website technical data — for the period set out in our Cookie Policy.

At the end of the applicable retention period, personal data is securely deleted or anonymised.

Under UK and EU data protection law, you have the right to:

• access the personal data we hold about you;
• have inaccurate personal data corrected;
• have your personal data erased in certain circumstances;
• restrict or object to the processing of your personal data;
• receive your personal data in a portable format;
• withdraw consent, where we rely on consent, at any time; and
• lodge a complaint with the UK Information Commissioner's Office or your local supervisory authority in the EEA.

To exercise any of these rights, please email privacy@scissero.com. We will respond within one month of receiving a valid request.

The UK supervisory authority is the Information Commissioner's Office: ico.org.uk.

We protect personal data using appropriate technical and organisational measures. All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Access is restricted on a role-based, need-to-know basis and is logged for audit. Our security posture is described in more detail at scissero.com/security.

If we ever experience a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, notify you directly without undue delay.

Our use of cookies and similar technologies is described in our Cookie Policy.

We may update this Privacy Policy from time to time. When we do, we will revise the "last updated" date at the top of the page. Material changes will be brought to your attention through our website or, where appropriate, by email.

For any questions or requests relating to this Privacy Policy or to your personal data, please contact:

Scissero Law Ltd
25 Cabot Square
London E14 4QZ
United Kingdom
privacy@scissero.com