Pacific Legal close

Our Policies

Privacy Policy

Free Assessment

PRIVACY POLICY (PACIFIC LEGAL)

Effective date: 02/03/2026

Pacific Legal is a trading style of Levy & McRae Solicitors LLP (“we”, “us”, “our”). We are committed to safeguarding the privacy of personal information collected and processed during the course of our business, including personal information we receive from clients, prospective clients, job applicants, event attendees and visitors to our websites.

This Privacy Policy explains how we collect, use, store, share and protect personal information, and the rights you have under UK data protection law (including the UK GDPR and the Data Protection Act 2018).

1) WHO WE ARE

Data Controller

For the purposes of UK data protection law, the data controller is:

Levy & McRae Solicitors LLP (trading as Pacific Legal)
Pacific House, 70 Wellington Street, Glasgow, G2 6UA
Email: compliance@pacificlegal.co.uk / info@lemac.co.uk

If you have questions about this policy or how we handle personal information, please contact us using the details above.

2) INFORMATION WE COLLECT

We may collect and process personal information about you, including (where relevant):

  • Identity and contact details (e.g., name, address, email, telephone number)

  • Date of birth and nationality (where required)

  • Employment information (e.g., employer, role, work history)

  • Financial information relevant to your matter (e.g., financial status, transactions, losses, fees, charges) including information relating to investments, pensions, and other financial arrangements where relevant

  • Information you provide in correspondence, forms, or during calls

  • Technical data from website usage (e.g., IP address, browser/device details, cookies)

  • Marketing preferences and communication history

  • Recruitment information (e.g., CV, references, right-to-work information)

Special category data

Depending on the nature of a legal matter, we may also process special category data (e.g., health information) and/or information relating to criminal convictions/offences, but only where lawful and necessary (see Section 5).

3) HOW WE COLLECT INFORMATION

We collect personal information in various ways, including:

  • When we provide or discuss providing legal services to you or an organisation you represent

  • When you request information from us or otherwise correspond with us

  • When you apply for a role or work experience

  • When you visit our website or interact with our content

  • When you attend our seminars, webinars, or events

  • When you are a counterparty (or connected to a counterparty) to one or more of our clients

  • When you complete forms (including online forms)

We may collect personal information directly from you and also from other sources where appropriate, such as:

  • Our clients and their authorised representatives

  • Employers, professional advisers, and other organisations you deal with

  • Courts, regulators, government agencies, and law enforcement bodies

  • Credit reference agencies and publicly available sources

  • Electronic verification providers for identity/AML and compliance checks

  • Recruitment agencies

  • Service providers who process data on our behalf (e.g., IT and communications providers)

4) HOW WE USE YOUR INFORMATION

We will only use your personal information where permitted by law. Purposes include:

A) Providing legal services and managing matters

  • Taking instructions, advising, corresponding, progressing and managing your matter (including claims and disputes relating to investments, pensions and other financial products/services where relevant)

  • Conducting due diligence and case acceptance checks

  • Identifying and communicating with clients, representatives and relevant parties

  • Billing, payment processing and accounting

  • Handling complaints and quality assurance

  • Managing conflicts checks

B) Compliance and regulatory obligations

  • Identity verification, anti-money laundering (AML), sanctions and fraud prevention checks

  • Responding to regulatory requests and legal obligations

  • Maintaining required records

C) Business administration, security and improvement

  • IT systems administration and information security

  • Audits, internal reporting and service improvement

  • Training and supervision

  • Website analytics and performance

D) Communications, service updates and marketing (see Section 8)

  • Providing service updates and information you request

  • Sharing updates about our services where permitted

  • Partner “opportunity” introductions only with your explicit agreement (see Section 7C)

5) OUR LAWFUL BASES FOR PROCESSING

We rely on one or more of the following lawful bases under the UK GDPR:

  • Contract: where processing is necessary to provide legal services under a contract with you or your organisation

  • Legal obligation: where we must process data to comply with the law (e.g., AML obligations)

  • Legitimate interests: where necessary for our legitimate business interests (e.g., delivering legal services, running our business, ensuring security, preventing fraud), provided those interests are not overridden by your rights

  • Consent: where we need or choose to rely on consent (e.g., certain marketing activities, and any transfer of your data to a third party for an opportunity, as described in Section 7C)

Special category data

We will only process special category data where a lawful condition applies, including (as relevant):

  • Explicit consent; and/or

  • It is necessary for the establishment, exercise or defence of legal claims, or where courts act in their judicial capacity; and/or

  • Substantial public interest conditions under applicable law (where relevant and lawful).

Criminal convictions/offences data

Where relevant to a matter, we will only process this type of data where lawful and necessary, including for legal claims, compliance, or as otherwise permitted by law.

6) HOW WE KEEP YOUR INFORMATION SAFE

We use appropriate technical and organisational measures designed to protect personal information from loss, misuse, unauthorised access, disclosure, alteration, or destruction. Your information may be stored in secure systems including internal case management systems and secure servers.

Please note that transmission of information via the internet is not completely secure. While we take steps to protect your information, any transmission is at your own risk.

7) DATA SHARING AND TRANSFERS TO THIRD PARTIES

We may share personal information with third parties in the following circumstances:

A) Service providers acting on our instructions (processors)

We may share your personal information with trusted suppliers who provide services to us, such as:

  • IT and hosting providers, case management and document management systems

  • Email, telephony and communications providers

  • Payment processors and banking partners

  • Identity verification / AML / fraud prevention providers

  • Professional advisers (e.g., auditors, insurers) where necessary

These suppliers act as data processors and may process personal information only on our documented instructions, subject to appropriate contractual protections, confidentiality obligations and security requirements.

Outsourced contact centre: We use an outsourced contact-centre provider to support client communications and administration. This provider processes personal information on our behalf as a processor and only on our instructions. Where the provider (or any of its sub-processors) is located outside the UK, this may involve an international transfer; in such cases we ensure appropriate safeguards are in place (see Section 10).

B) Courts, regulators and law enforcement

We may share personal information where necessary to comply with legal obligations, respond to lawful requests, or to establish, exercise or defend legal claims.

C) Third-party opportunities / introductions (consent-based transfers)

Sometimes we may identify an opportunity that could benefit you (for example, a service, product, or support offered by a third party). We will only transfer or share your personal information with a third party for this purpose where you have expressly agreed to the transfer (or your authorised representative has confirmed your agreement).

Before any such transfer (where appropriate), we will explain:

  • the identity of the third party (or the category of third party),

  • what information will be shared, and

  • the purpose of the sharing.

Withdrawing consent: You can withdraw your consent at any time before the transfer takes place by contacting us at compliance@pacificlegal.co.uk. Withdrawal will not affect processing that occurred before consent was withdrawn.

D) Group and business changes

If our business structure changes (e.g., reorganisation, merger, acquisition, or a transfer of assets), we may share personal information as part of that process where lawful, necessary, and subject to appropriate safeguards.

8) SERVICE UPDATES AND MARKETING

We may contact you by telephone, SMS, post, or email where permitted.

Our communications fall into two categories:

A) Service communications (non-marketing)

We may contact you about your matter, account, requests, or service updates. You cannot opt out of essential service communications.

B) Marketing communications

We may send information about our services where permitted by law. Where required, we will obtain your consent, and you can opt out at any time.

Partner opportunities: We may tell you about partner opportunities. However, we will not transfer your personal information to any third party for their own marketing, outreach, or opportunity unless you have expressly agreed to that transfer (see Section 7C).

Opt-out: You can opt out at any time by using unsubscribe links in emails (where provided) or emailing compliance@pacificlegal.co.uk.

9) COOKIES

Our website uses cookies and similar technologies to distinguish you from other users and help improve your experience. Please refer to our Cookie Policy for details of the cookies we use, and how you can manage them.

10) INTERNATIONAL TRANSFERS

Your personal information is generally processed in the UK. Where we (or our service providers) transfer, store, or permit access to personal information outside the UK, we will ensure appropriate safeguards are in place in accordance with UK data protection law. These safeguards may include:

  • transfers to countries recognised as providing adequate protection; and/or

  • approved contractual protections (including the UK International Data Transfer Agreement (IDTA) and/or the UK Addendum to the EU Standard Contractual Clauses); and/or

  • other lawful mechanisms permitted by applicable law.

Some of our suppliers (including our outsourced contact-centre provider) are located outside the UK and may access or process personal information from outside the UK, including in South Africa. Where this involves a restricted international transfer, we implement appropriate safeguards (such as the UK IDTA and related contractual, technical and organisational measures) to protect your personal information.

You can contact us if you would like further information about the safeguards we use.

11) HOW LONG WE KEEP YOUR INFORMATION

We retain personal information only for as long as necessary for the purpose for which it was collected, including for legal, regulatory, accounting, insurance and reporting requirements.

Personal information processed in connection with business acceptance and/or the provision of legal services will be retained in accordance with our Retention and Destruction Policy, unless otherwise agreed with you in writing.

If you want more information about our retention periods, please contact info@lemac.co.uk.

12) CREDIT AND DEBIT CARD PAYMENTS

We may take payments via credit or debit card (online or by telephone). Our processes are designed to be compliant with the Payment Card Industry Data Security Standard (PCI DSS). We do not store full card details.

13) YOUR DATA PROTECTION RIGHTS

You have rights under UK data protection law, including:

  • Access: request a copy of your personal information

  • Rectification: request correction of inaccurate or incomplete information

  • Erasure: request deletion of personal information in certain circumstances

  • Restriction: request we limit processing in certain circumstances

  • Portability: request transfer of information to another provider (where applicable)

  • Object: object to processing based on legitimate interests, and object to direct marketing at any time

  • Withdraw consent: where processing is based on consent

  • Complain: lodge a complaint with the ICO (see Section 15)

To exercise your rights, contact the Data Protection Leader at info@lemac.co.uk or write to:

Data Protection Leader
Levy & McRae Solicitors LLP
Pacific House, 70 Wellington Street
Glasgow, G2 6UA

We may need to verify your identity before responding.

14) CONTACT PREFERENCES

If you do not wish to be contacted by telephone, SMS, post, or email, please let us know by emailing compliance@pacificlegal.co.uk.

15) COMPLAINTS

If you have concerns about how we handle your personal information, please contact us first using the details in Section 1.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. The ICO can be contacted via its website or by telephone on 0303 123 1113.

16) CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. The latest version will be published on our website, and the “Effective date” at the top will be updated.