Privacy Policy

Of Counsel Limited

1. Introduction

Of Counsel Limited (“Of Counsel“, “we“, “us“, “our“) is a match-making platform that connects senior lawyers (“Counsel“) with businesses seeking legal support (“Client Businesses“). This Privacy Policy explains how we collect, use, share and protect personal data when you visit our website, register as Counsel, engage with us as a Client Business, or otherwise interact with us.

We are committed to processing personal data lawfully, fairly and transparently, in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025 (DUAA), which amends both. Where we process personal data of individuals located in the European Economic Area (EEA) — including Counsels resident in EU member states — we also apply, and where legally required comply with, the EU General Data Protection Regulation (EU GDPR).

2. Who we are

Of Counsel Limited is a company registered in England and Wales (company number: 16791993), with its registered office at C/O Solid Ltd, Eagle House, 163 City Road, London, United Kingdom, EC1V 1NR. For the purposes of UK GDPR and EU GDPR, Of Counsel is the data controller in respect of the personal data described in this Policy, unless stated otherwise.

Of Counsel Limited is registered with the Information Commissioner’s Office (ICO) registration reference ZC097012. 

Contact for privacy matters: Email: hello@ofcounsel.co.uk.   

3. Scope

This Policy applies to personal data we process in connection with:

• our website and any related sub-domains, portals or booking tools (the “Site“);
• the onboarding, vetting, profiling and matching of Counsel with Client Businesses;
• the administration of engagements, invoicing, and (where applicable) payroll for Counsel providing services through Of Counsel;
• our own recruitment, marketing, and business administration.

It does not cover the privacy practices of Client Businesses once personal data has been lawfully shared with them and they act as an independent controller (see Section 9).

4. The personal data we collect

4.1 Counsel (contracting/fractional lawyers)

• Identity and contact details (name, title, address, email, phone number, date of birth)
• Professional details (qualifications, jurisdictions of practice, SRA/Law Society or equivalent regulatory registration number, CV, referees, areas of expertise, rates)
• Right-to-work and compliance information (nationality, passport/ID, immigration status, professional indemnity insurance details, conflicts and AML/sanctions screening results)
• Financial information (bank account details, VAT/tax status, invoicing history) for the purpose of paying fees or, where Counsel is engaged on a payroll basis, for payroll administration
• Health and disability information, where voluntarily provided to enable reasonable adjustments
• Family or personal circumstances, where relevant to engagement terms, next-of-kin/emergency contact details, or payroll and statutory obligations (for example, statutory parental leave or pension auto-enrolment status)
• Communications with us and platform usage data

We do not intentionally collect information about racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic data, or biometric data (such as fingerprints), and Counsels should not include such information in any documents or profiles submitted to us. If such information is provided unsolicited, we will delete it unless we are required to retain it by law.

4.2 Client Businesses and their representatives

• Business contact details (name, job title, company, email, phone number)
• Instruction details, matter requirements, and correspondence
• Billing and payment details

4.3 Website visitors and prospects

• Contact details submitted via enquiry or newsletter forms
• Technical data (IP address, browser/device type, pages visited) collected via cookies and similar technologies (see Section 13)

5. Special category data

Some of the data described in Section 4.1 (health/disability information) is “special category data” under Article 9 UK/EU GDPR, requiring an additional legal basis on top of a standard Article 6 basis. We rely on one or more of the following, as applicable:

• Explicit consent (Article 9(2)(a)) — for example, where Counsel voluntarily discloses a disability to request reasonable adjustments;
• Employment, social security and social protection law (Article 9(2)(b)) — where Counsel is engaged on payroll and statutory obligations apply;
• Establishment, exercise or defence of legal claims (Article 9(2)(f)) — where relevant to a dispute or regulatory matter.

Banking/financial details and family circumstance data referenced in Section 4.1 are not, of themselves, “special category data” under Article 9, but we treat them as confidential and commercially sensitive and apply enhanced security measures accordingly (see Section 11).

6. How we collect personal data

We collect personal data:

• directly from you, when you register on the Site, submit an enquiry, apply to join Of Counsel, or instruct us as a Client Business;
• from third parties, including referees, regulatory bodies (for verification of professional standing), AML/sanctions and credit-reference agencies, and publicly available professional sources (for example, LinkedIn or the Law Society/SRA register);
• automatically, through cookies and analytics tools when you use the Site (see Section 13).

7. Purposes of processing and legal bases

Purpose	Categories of data	Legal basis (Art. 6 UK/EU GDPR)
Registering and verifying Counsel; conflicts, AML and right-to-work checks	Identity, professional, compliance	Necessary for steps prior to entering a contract; legal obligation
Matching Counsel to Client Business instructions	Identity, professional	Legitimate interests (operating our core matching service)
Managing engagements, invoicing and payments	Identity, financial	Performance of a contract
Payroll administration (where applicable)	Identity, financial, family circumstance	Legal obligation; performance of a contract
Reasonable adjustments for disability	Health data	Explicit consent / employment law obligation (Art. 9)
Marketing communications	Identity, contact	Consent (or legitimate interests for existing professional contacts, with an opt-out)
Website analytics and improvement	Technical/usage	Consent (non-essential cookies) or legitimate interests
Complying with legal, regulatory and tax obligations	As relevant	Legal obligation
Establishing, exercising or defending legal claims	As relevant	Legitimate interests; legal obligation

Following the DUAA reforms to Article 6 UK GDPR, certain limited categories of processing (for example, sharing data with law enforcement or regulators, or for safeguarding purposes) may also be carried out on the basis of a “recognised legitimate interest“, which does not require a balancing test. We will identify any such processing separately if it applies.

8. Automated decision-making

We pride ourselves on having a human touch to what we do. Whilst we may use software tools to assist in shortlisting Counsel against a Client Business’s stated requirements (for example, matching by jurisdiction, sector expertise, or availability), any such matching is reviewed by a member of our team before a match is proposed or an engagement is confirmed. We do not currently make decisions based solely on automated processing that produce legal or similarly significant effects on individuals without human involvement. If this changes, we will update this Policy and provide the safeguards required by Article 22 UK/EU GDPR.

9. Who we share your data with

We may share personal data with:

• Client Businesses, to enable matching and engagement (limited to relevant professional and compliance information; financial and health data are shared only where necessary, for example for invoicing or agreed adjustments);
• Counsel, where relevant to a specific instruction;
• Service providers acting as our processors, including cloud hosting and IT providers, payroll and accountancy providers, AML/KYC and right-to-work verification providers, and professional indemnity insurers — all bound by written data processing agreements;
• Regulators and professional bodies (e.g. the SRA, ICO/Information Commission, HMRC), where required by law;
• Professional advisers (lawyers, auditors) in connection with our own business needs;
• A buyer or successor entity, in the event of a sale, merger or restructuring of Of Counsel’s business, subject to appropriate confidentiality protections.

We do not sell personal data to third parties.

10. International data transfers

Of Counsel is based in the United Kingdom. Some Counsels are resident in EU member states, and we may engage service providers based in the UK or EEA. Our current policy is to store and process personal data only within the UK and the EEA, and we do not currently transfer personal data outside these territories.

We reserve the right to transfer personal data outside the UK and EEA in future — for example, if we engage a service provider located elsewhere, or if Counsel or Client Business is based outside these territories. If we do so, we will ensure the transfer is lawful by using an appropriate safeguard, which may include:

• a UK adequacy regulation or EU adequacy decision in respect of the destination country;
• the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses;
• the EU Standard Contractual Clauses (SCCs), together with a transfer risk/impact assessment as required by certain case law in force;
• another lawful transfer mechanism recognised under UK/EU GDPR.

We will update this Policy before making any such transfer and, where required, will provide further information on request.

11. Data security

We apply appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls on a need-to-know basis, staff confidentiality obligations, and regular review of our processors’ security arrangements. Financial and health data are subject to enhanced access restrictions. We maintain a personal data breach response procedure and will notify the ICO/Information Commission and affected individuals where required by law.

12. Data retention

We retain personal data only for as long as necessary for the purposes described in this Policy, including to satisfy legal, accounting, tax, AML and professional indemnity requirements. As a general approach:

• Counsel profile and compliance data: retained for the duration of the relationship and for 6 years afterwards, reflecting limitation periods and AML record-keeping obligations;
• Financial/payroll records: retained in accordance with HMRC requirements (currently at least 6 years);
• Client Business contact data: retained for the duration of the relationship and for 6 years afterwards;
• Website enquiry data or applications to join Of Counsel: retained for 12 months if no relationship results.

13. Cookies

The Site uses cookies and similar technologies to operate core functions and, where you consent, to analyse usage and improve our services. Full details of the cookies we use and how to manage your preferences are set out in our separate Cookie Policy. Following the DUAA’s changes to the Privacy and Electronic Communications Regulations (PECR), certain low-risk analytics cookies may be used without consent where permitted, but we will always allow you to manage your preferences via our cookie settings tool.

14. Children

The Site and our services are directed at professionals and businesses. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

15. Your rights

Subject to applicable law, you have the right to:

• be informed about how your data is used;
• access a copy of your personal data;
• request rectification of inaccurate data;
• request erasure of your data (“right to be forgotten”), in certain circumstances;
• request restriction of processing;
• object to processing based on legitimate interests or for direct marketing;
• request data portability, where technically feasible;
• withdraw consent at any time, where processing is based on consent;
• not be subject to solely automated decision-making producing legal or similarly significant effects (see Section 8).

To exercise any of these rights, contact us using the details in Section 2. We will respond within the statutory timeframe (generally one month), conducting a reasonable and proportionate search for your data as required under the DUAA reforms.

16. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at hello@ofcounsel.co.uk so we can try to resolve the issue. In accordance with the DUAA’s new statutory complaints-handling requirements, we will acknowledge your complaint within 30 days and respond substantively without undue delay.

You also have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner’s Office (transitioning to the Information Commission) Website: ico.org.uk Telephone: 0303 123 1113

If you are resident in the EEA, you may also have the right to complain to your local data protection supervisory authority.

17. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated version on the Site with a revised “Last updated” date, and, where changes are material, we will take reasonable steps to notify affected individuals.

18. Contact us

If you have any questions about this Policy or how we handle personal data, please contact:

Of Counsel Limited via the website or Email: hello@ofcounsel.co.uk. 

Last updated: 23 July 2026