Legal · Document I of III
Privacy Policy
What personal data we hold, why we hold it, who we share it with, and how to make us stop. Written to be read rather than skimmed past.
Effective 1 January 2026 Version 1.0 Bright Hills Partners Ltd. England & Wales
In short: we collect the contact details you give us, the analytics of how this site is used, and — when a law firm engages us — the inquiry data flowing through the systems we build for them. We do not sell any of it.
1 · Who we are
Naelar is a trading name of Bright Hills Partners Ltd., a company registered in England and Wales under company number 16414218. For the personal data described in this policy we are the data controller, except where section 4 says otherwise. You can reach us any time at info@naelar.com.
2 · What we collect
3 · Why we use it, and on what basis
| Purpose | Lawful basis |
|---|---|
| Replying to an inquiry and running an intro call | Legitimate interests — responding to a request you made |
| Delivering the services in an engagement | Performance of a contract |
| Invoicing, accounting and statutory records | Legal obligation |
| Improving this site and measuring which channels work | Consent, through cookie preferences |
| Sending occasional email about our work | Consent, withdrawable in one click from any email |
| Preventing fraud and keeping systems secure | Legitimate interests |
We do not sell personal data, and we do not use it for automated decision-making that has a legal effect on you.
4 · Data we handle for client firms
When we build and run lead generation, landing pages, CRM and intake systems for a law firm, inquiry data from that firm's prospective clients passes through those systems. For that data the firm is the controller and we act as its processor: we handle it only on the firm's written instructions, only for the purposes of the engagement, and under a data processing agreement that forms part of our contract.
If you are a member of the public who contacted a law firm through a page or form we built, your privacy rights sit with that firm. Contact the firm directly, or write to us and we will pass your request on and tell you who to contact.
5 · Who we share it with
Only the service providers we need to run the business, each under contract and each limited to what the job requires: hosting and email providers, CRM and marketing platforms, scheduling and video-call tools, analytics providers, payment processors and our accountants. We also share data where the law requires it, or to establish or defend legal claims. Anyone else needs your permission first.
6 · International transfers
We are a UK company working with firms in the United States and with providers whose infrastructure sits in the United States and elsewhere, so personal data may be transferred outside the UK and the EEA. Where it is, we rely on UK adequacy regulations or on the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with the additional safeguards those require.
7 · How long we keep it
Inquiries that do not become engagements: two years, then deleted. Engagement and correspondence records: for the engagement and six years after it ends, which is the period during which a claim could be brought. Accounting records: six years plus the current financial year, as UK tax law requires. Marketing consents: until you withdraw them. Analytics: as set out in the Cookie Policy. Data we process for a client firm is deleted or returned on that firm's instruction at the end of the engagement.
8 · Security
Access is limited to the people who need it, protected by multi-factor authentication and unique credentials in a password manager. Data in transit is encrypted, and we use reputable providers who encrypt at rest. Systems we build for client firms are built inside the firm's own accounts wherever possible, so access can be revoked by the firm at any time. No system is perfect; if a breach affects your rights we will tell you and the regulator within the time the law allows.
9 · Your rights
Under UK data protection law you can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, object to processing based on legitimate interests, ask for it in a portable format, and withdraw any consent you have given. Exercising a right costs nothing and we will answer within one month. Email info@naelar.com and say what you want; we may ask a question or two to confirm who you are.
10 · Cookies
This site sets only the cookies it needs to function unless you consent to more. What each one does, how long it lasts and how to change your mind is set out in the Cookie Policy.
11 · Changes to this policy
If we change how we handle personal data we update this page and move the version and effective date at the top. Material changes are emailed to current clients rather than left to be discovered.
12 · Contact and complaints
Write to info@naelar.com and we will deal with it directly. If you are not satisfied with our answer you have the right to complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk — though we would rather you gave us the chance to put it right first.