Privacy Policy

1. Who We Are

LawTools.io is a trading style of BRANDKRAFT LTD. We are a legal operations and technology agency that works with law firms to improve their intake, conversion, resourcing and operational efficiency. This Privacy Policy explains how we collect, use, store and protect personal data when you visit our website or engage with our services.

We are registered with the Information Commissioner's Office (ICO) as a data controller and are committed to handling personal data responsibly and in compliance with UK GDPR and the Data Protection Act 2018.

2. Information We Collect

We collect and process the following types of personal data:

2.1 Enquiry and Contact Information

• Full name and job title
• Business name and website
• Email address and telephone number
• Details of your enquiry or the challenges you are trying to solve
• Information submitted through our audit request, contact or intake forms

2.2 Technical and Usage Data

• IP address and browser type
• Device and operating system information
• Pages visited and time spent on the site
• Referral source (how you found us)
• Cookie and tracking data (see section 11)

2.3 Business Information

Where you are an existing or prospective client, we may also collect information about your firm's size, practice areas, technology stack and operational challenges in order to provide our services effectively.

3. How We Collect Your Information

We collect personal data through the following means:

• Contact and enquiry forms on this website
• Audit request and intake forms
• Direct communication by email, telephone or video call
• Meetings, consultations and discovery sessions
• Automated technologies including cookies and analytics tools
• Publicly available sources such as your firm's website or professional directories, where relevant to a prospective engagement

4. How We Use Your Information

4.1 Delivering Our Services

• Responding to enquiries and audit requests
• Scoping, proposing and delivering engagements
• Configuring and implementing legal technology on your behalf
• Coordinating resourcing placements and managed services
• Communicating with you throughout an engagement

4.2 Business Operations

• Invoicing and account management
• Maintaining accurate client and prospect records
• Improving our website and service offering
• Internal reporting and quality assurance

4.3 Marketing Communications (with your consent)

• Sending relevant updates, insights and service information about LawTools.io
• Notifying you of new services, events or resources that may be of interest

You can opt out of marketing communications at any time (see section 12).

5. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contractual Necessity: Processing is required to fulfil or prepare to enter into a contract with you or your firm
• Legitimate Interests: Processing is necessary for our legitimate business interests — such as responding to enquiries, maintaining records and improving our services — where these interests are not overridden by your rights
• Legal Obligation: Processing is required to comply with applicable law or regulatory requirements
• Consent: Where you have given explicit consent for a specific purpose, such as receiving marketing communications

6. Sharing Your Information

We do not sell your personal data. We may share it only with:

• Service Providers: Trusted third-party suppliers who support our operations (e.g. CRM platforms, email tools, cloud hosting, analytics) who are contractually bound to handle data securely and only on our instruction
• Resourcing Partners: Where your engagement involves placing staff or contractors, relevant information may be shared with those individuals to facilitate the placement
• Technology Partners: Where we configure or implement third-party legal software on your behalf, relevant information may be shared with that software provider as part of the setup process
• Legal or Regulatory Authorities: Where we are required to disclose information by law, court order or regulatory obligation

7. International Transfers

We primarily store and process your data within the United Kingdom and the European Economic Area. Where we use third-party tools that process data outside the UK (for example, US-based SaaS platforms), we ensure appropriate safeguards are in place — such as standard contractual clauses or adequacy decisions — in accordance with UK GDPR requirements.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration or loss. These include:

• Encrypted data storage and transmission (TLS/SSL)
• Access controls and role-based permissions
• Regular review of our systems and security practices
• Data minimisation — we only collect what we need
• Confidentiality obligations for all staff and contractors

9. Data Retention

We retain personal data for as long as necessary to fulfil the purpose for which it was collected:

• Enquiry and prospect data: up to 24 months from last contact, unless a client relationship is established
• Client data: for the duration of the engagement and a minimum of 6 years thereafter to meet legal and accounting obligations
• Marketing data: until you withdraw consent or opt out
• Technical and analytics data: in line with the retention settings of the relevant analytics platform (typically 14–26 months)

After the applicable retention period, data is securely deleted or anonymised.

10. Your Rights

Under UK GDPR, you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Ask us to correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data where there is no legitimate reason for us to continue holding it
• Right to Restriction: Ask us to limit processing of your data in certain circumstances
• Right to Data Portability: Request your data in a portable, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, please contact us at hello@lawtools.io. We will respond within one calendar month.

11. Cookies and Website Analytics

Our website uses cookies and similar technologies to improve your experience and help us understand how visitors use the site.

• Essential Cookies: Necessary for the website to function correctly — these cannot be disabled
• Analytics Cookies: Help us understand traffic patterns and improve content — only set with your consent
• Functional Cookies: Remember your preferences and settings across visits

You can manage or withdraw cookie consent at any time via your browser settings or our cookie preference centre.

12. Marketing Communications

We will only send you marketing communications where you have consented or where we have a legitimate interest in doing so as a business contact. You can opt out at any time by:

• Clicking the "unsubscribe" link in any email we send
• Emailing us at hello@lawtools.io with the subject line "Unsubscribe"

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post any updated policy on this page with a revised date. Where changes are significant, we will notify active clients by email.

14. Complaints

If you have concerns about how we handle your personal data, please contact us first and we will do our best to resolve the matter. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office: