Our Privacy Notice

Who we are 

This Privacy Notice provides information about the way we hold, collect and use your personal information (data) in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data Use and Access Act 2025. We are committed to maintaining the trust and confidence of visitors to our website, and the protection of your personal information is very important to us. 

JLH Legal Limited (trading as Thrive Law) is a company registered in England and Wales under company number 10737027, registered office Third Floor, 10 South Parade, Leeds, LS1 5QS. Our head office is Second Floor, 5 Park Place, Leeds, LS1 2RU. JLH Legal Limited is a data controller and is registered with the Information Commissioner’s Office. 

Our Data Protection contact is Rebecca Shah. Email: data@thrivelaw.co.uk. Telephone: 0113 869 8101. 

Types of data we collect 

Most pages on our website can be accessed without giving us your personal information. However, you may choose to provide us with your personal information, such as your name, address and email details, so that we can contact you with further information about us and our services. This may be through an enquiry form, requesting marketing literature, telephoning us, calling into our office with an enquiry, or expressing an interest at a seminar or event. We may also contact you to follow up about enquiries you have made with us.  

Cookies, Google Analytics and IP addresses 

A cookie is a small piece of data that a website can store on your device. We use cookies to understand how our website is used, to remember your preferences, and to give you a better experience when you return. 

Some cookies are essential for our website to work and do not require your consent. Certain other low-risk cookies, such as those used solely to collect statistical information about how our website is used so that we can improve it, and those used solely to remember your viewing preferences, also do not require your consent under current rules. Where we use these cookies, we will tell you about them and you can opt out of them at any time, free of charge. 

We will ask for your consent before using any non-essential cookies that fall outside those categories, including any cookies used for advertising or that share information with third parties for advertising purposes. Where consent is required, non-essential cookies are not set until you have given it, and you can withdraw your consent at any time. 

Please note that any cookies connected via our social media channels, such as X (formerly Twitter) and Facebook, are not within our control. Please refer to their respective privacy policies for information about how their cookies work. 

Google Analytics may be used to collect standard internet log information and details of visitor behaviour patterns, such as the number of visitors to various pages of our website. This information is processed in a way which does not identify any individual. We do not make, or allow Google to make, any attempt to identify those individuals visiting our website. 

When you visit our website, we may collect information about your device and IP address for fraud prevention and to gather statistical data about browsing patterns. This does not identify any individual. 

Legal basis for processing your personal information 

We will only use your personal information where the law allows us to. Generally this will be for one or more of the following reasons: 

• to perform the contract you have engaged us for; 

• to comply with a legal or regulatory obligation we are subject to; 

• where you have provided your consent; or 

• for our legitimate interests, such as facilitating the provision of services to you, responding to and following up on enquiries you make, carrying out business analysis to help improve the management of our practice, governance and good practice, and notifying you about changes to our services. 

Where we rely on legitimate interests, we will have considered whether those interests are overridden by your interests or fundamental rights and freedoms. 

Sharing your information 

Personal information you provide when contacting us about our services will be disclosed to our personnel to facilitate any enquiries you have, or to provide services to you. It may also be disclosed to organisations we work with who support us in providing those services, such as IT hosting and software providers. Where we use external organisations to process your personal information, we require them to comply strictly with our instructions and with data protection law, and we make sure that appropriate controls are in place. We enter into contracts with all of our data processors and monitor their activities to ensure they comply with our policies and procedures. 

Transfer of your data to other countries 

Some of the providers we use to deliver our services store personal information outside the United Kingdom. In particular, some of our email, case management and website form providers store data within the European Union (for example in Germany and Ireland). 

Transfers of personal information from the United Kingdom to the European Economic Area are permitted under the UK’s adequacy regulations, which recognise that the EEA provides an adequate level of protection for personal data. Where we transfer personal information to any country that is not covered by UK adequacy regulations, we will take steps to ensure that it is adequately protected in accordance with UK legal requirements, such as by putting an International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses in place. 

How long we keep your information 

We keep personal information only for as long as we need it, taking account of our legal and regulatory obligations and our legitimate business needs. 

It is the firm’s policy to retain files electronically for seven years after the conclusion of a matter, after which time the files will usually be destroyed.  

Marketing and mailing list data is reviewed regularly, and at least every 12 months, and is removed where there is no continued engagement. A copy our data retention schedule is available on request. 

Updating, deleting and restricting use of your personal information 

It is important that the information we hold about you is accurate and up to date. Please keep us informed if there are changes to the personal information we hold about you. 

By law you have the right to: 

• request access to your personal data (a “data subject access request”), which allows you to receive a copy of the personal data we hold about you and to check that we are processing it lawfully; 

• request the correction of personal data we hold about you, so that you can have any incomplete or inaccurate information corrected; 

• request erasure of your personal data where there is no good reason for us to continue processing it. Please note that we may be unable to erase personal data where we have an ongoing legal obligation to process it. Where we do erase your personal data, we will retain a record of your name, the date of your request and the date the data was erased; 

• object to the processing of your personal data where we rely on legitimate interests (or those of a third party) and there is a particular reason relating to your situation. Where we process your personal data for direct marketing, you also have a right to object at any time; 

• request a restriction of the processing of your personal data, which allows you to ask us to suspend processing; and 

• request the transfer of your personal information to another party. 

If you wish to inform us of any changes, object, withdraw consent for us processing your personal data, or access the information we hold about you, please contact Rebecca Shah at data@thrivelaw.co.uk or on 0113 869 8101. Please note that in some cases we may not be able to delete, correct, restrict or grant an objection to processing if we have a legal obligation, legitimate interest or contractual reason to continue. If we refuse such a request, we will explain why, together with your right to complain. 

If you are requesting access to personal information, we may ask you for enough information to confirm your identity. We will only ask for what we reasonably need to be satisfied as to your identity, and we will not request more information than is necessary. You should also let us know the information to which your request relates, including any matter or reference numbers if you have them. There is no charge for making a request, unless it is manifestly unfounded or excessive. 

Your right to complain 

We hope that we can resolve any query or concern you raise about our use of your personal information. If you have a concern, you can raise it with us directly by contacting our Data Protection contact, Rebecca Shah, at data@thrivelaw.co.uk or on 0113 869 8101. We will acknowledge your complaint within 30 days, keep you informed of progress, and give you a written outcome in plain language. Our data protection complaints procedure explains how this works and is available on our website. 

You also have the right to complain to the Information Commissioner’s Office (the ICO), which is the supervisory authority for data protection in the UK. We would normally ask that you give us the chance to resolve your complaint first, but you are entitled to contact the ICO at any time. The ICO can be contacted at www.ico.org.uk or on 0303 123 1113. Further information about your rights can also be found on the ICO’s website. 

Website forms 

Any forms available on our website are powered by Jotform. When you fill out a form, the data you submit will be forwarded to Jotform and collated into an email which is sent to us. The data you submit via the form is not stored within this website’s own database or in any of our internal computer systems. Your data remains within Jotform’s secure database in the European Union for as long as we continue to use Jotform’s services, or until you request its removal by emailing us. We consider Jotform to be a third party data processor. For more information, please see https://www.jotform.com/privacy/. 

Children aged 16 or under 

We are concerned to protect the privacy of children aged 16 or under. If you are aged 16 or under, please get your parent or guardian’s permission beforehand whenever you provide us with personal information. 

Changes to this Privacy Notice 

We may change this Privacy Notice from time to time. If you use our website regularly, please visit this page from time to time to check this notice.