This Privacy Statement has been prepared by us, Morgans (otherwise The Morgan Law Partnership) having our principal place of Morgans (The Morgan Law Partnership) is registered as a data controller with the Information Commissioner’s Office and regulated by the Law Society of Scotland.
Dunfermline: 33 East Port, Dunfermline, Fife, KY12 7JE | 01383 620222 | enquiries@morganlaw.co.uk
Kinross: 01577 863424 | kinross@morganlaw.co.uk
This Privacy Notice explains how we collect, use and protect personal data if you are a client or prospective client of the firm, a visitor to our offices or website, or a person whose data we handle in the course of acting for one of our clients (for example, a beneficiary, counterparty or relative). It also applies to anyone who has contacted us to enquire about our services, even if you have not yet formally instructed us.
1. Personal Data We Collect
We collect and process the following categories of personal data. The categories relevant to you will depend on whether you are a current client, a prospective client making an enquiry, a non-client whose data arises in the course of a matter, or a visitor to our offices or website.
| Category | Examples |
|---|---|
| Identity Data | Full name, date of birth, gender, nationality, National Insurance number, passport or driving licence details |
| Prospective Client & Enquiry Data | Name, contact details and details of the legal matter or service you have enquired about, prior to formal instruction being accepted |
| Contact Data | Postal address, email address, telephone numbers |
| Financial Data | Bank account details, income, assets and liabilities, source of wealth information, mortgage details |
| Transaction Data | Details of payments to and from you, property transaction details, fee information |
| Client Matter Data | Information relating to your legal matter including correspondence, file notes, documents and advice given |
| Special Category Data | Health and medical information, racial or ethnic origin, family circumstances, criminal convictions — collected only where required for your legal matter |
| Third Party Data | Personal data relating to beneficiaries, counterparties, witnesses, defenders or other individuals connected to a matter we are handling on your behalf |
| Marketing & Communications Data | Your preference for receiving our newsletter, email alerts or other marketing communications |
| Website & Usage Data | IP address, browser type, pages visited and cookies — see our separate Cookie Policy for details |
| CCTV Data | Images recorded by CCTV cameras at our Dunfermline office only (CCTV is not in operation at our Kinross office). Cameras cover external elevations, the entrance, and internal reception and public areas only. CCTV does not record audio and cameras are not positioned in client meeting or consultation rooms |
We do not knowingly collect personal data from children under the age of 16. Our website and services are not directed at children.
2. How We Collect Your Personal Data
Directly from you
Most of the personal data we hold is provided by you when you contact us or instruct us to act on your behalf — in person, by telephone, email, letter or through our website enquiry form. This includes data collected at the initial enquiry stage, before any formal instruction is accepted, as well as throughout the course of your matter.
From other professionals and third parties
We may also receive personal data from:
- Your solicitor or other professional adviser where they refer your matter to us
- The other solicitor or party in a transaction (for example, in a property purchase or settlement agreement)
- Courts, tribunals and public authorities
- Public registers including the Registers of Scotland, Companies House and the Land Register
- Anti-money laundering and identity verification service providers
- Lenders, financial institutions and insurers
- Your doctor or other health professionals where relevant to your matter (e.g. personal injury claims)
CCTV
CCTV cameras operate at our Dunfermline office only — CCTV is not in operation at our Kinross office. Cameras cover external elevations and the entrance, and internal reception and public areas. CCTV does not record audio. No camera is positioned in any client meeting room, consultation room, or other private area, and cameras are not sited so as to capture client files or computer screens. Signage is displayed at the entrance to our Dunfermline office identifying Morgans as the operator of the system.
3. How We Use Your Personal Data
We will only use your personal data where we have a lawful basis to do so. The table below sets out the main purposes for which we process personal data and the legal basis we rely upon.
| Purpose | Type of Data | Lawful Basis |
|---|---|---|
| To provide you with legal, estate agency and letting services as instructed | Identity, Contact, Financial, Matter, Special Category | Performance of contract |
| To respond to enquiries and carry out initial conflict checks before accepting instructions from prospective clients | Identity, Contact, Enquiry Data | Legitimate interests — taking steps at the request of a prospective client prior to entering a contract |
| To manage our ongoing relationship, including responding to queries, collecting fees and handling complaints | Identity, Contact, Transaction | Performance of contract / Legitimate interests |
| To carry out identity, address and source of wealth checks for anti-money laundering (AML) purposes | Identity, Contact, Financial | Legal obligation (Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017) |
| To comply with regulatory reporting obligations and Law Society of Scotland requirements | Identity, Matter | Legal obligation |
| To process personal data of third parties (e.g. beneficiaries, counterparties) as necessary to carry out our client’s instructions | Identity, Contact, Financial, Special Category as relevant | Legitimate interests — providing legal services on behalf of our clients |
| To send you updates about our services or changes in the law (existing clients) | Identity, Contact, Marketing | Legitimate interests — you may opt out at any time |
| To send our eNewsletter or other marketing materials (non-clients) | Identity, Contact, Marketing | Consent — you may withdraw at any time |
| To manage our business, improve our services and comply with legal obligations | Identity, Matter, Usage | Legitimate interests |
| To administer and protect our IT systems and website | Usage, Identity | Legitimate interests |
| To operate CCTV at our Dunfermline office for security, crime prevention and the protection of confidential client material | CCTV Data | Legitimate interests — security of our premises, staff and visitors |
| To record telephone calls for quality monitoring, training and to maintain an accurate record of advice given | Identity, Matter | Legitimate interests — you will be informed at the start of any recorded call |
4. Special Category and Sensitive Data
Certain types of personal data are treated as particularly sensitive under data protection law — including information about health, racial or ethnic origin, sexual orientation, religious beliefs, political opinions and criminal convictions.
We will only collect and process such data where it is strictly necessary for the legal matter you have instructed us in. Any special category data is stored in our access-controlled network and practice management system, accessible only by relevant solicitors and staff via secure username and password. Paper files containing such data are held in locked filing cabinets. No access is available to third parties in respect of this data.
5. Use of Artificial Intelligence
Morgans uses two AI tools in our workplace: Microsoft Copilot for general workplace productivity, and LawY for legal research and drafting. Both tools are operated under appropriate data processing agreements and neither uses your personal data to train AI models.
Microsoft Copilot
Microsoft Copilot is a generative AI tool built into Microsoft 365. Our team may use it to assist with tasks such as summarising documents, drafting correspondence, generating file notes from meetings, researching information or automating routine administrative work. This helps us work more efficiently and deliver a better service to our clients.
When Copilot is used in connection with client matters, it operates within our existing Microsoft 365 environment. This means:
- Copilot accesses only data within our firm’s secure Microsoft 365 tenancy — it does not connect to the public internet or share your data externally
- Your data is not used to train Microsoft’s underlying AI models — Microsoft’s enterprise commitments confirm that data processed by Copilot in Microsoft 365 is not used for model training
- All processing is subject to the same access controls and security measures that apply to all data held in our systems
- Our staff retain responsibility for reviewing and approving any AI-assisted output before it is used or shared
LawY
LawY (lawy.ai) is a purpose-built AI legal research and drafting tool, designed specifically for use by lawyers. Morgans uses LawY to assist our solicitors with legal research, drafting documents and correspondence, analysing case files, and reviewing contracts. It is used as a productivity and accuracy aid — our solicitors review and take responsibility for all output before it is used in your matter.
LawY operates with a ‘privacy-by-design’ approach. In particular:
- LawY operates a zero data retention policy — queries and documents processed through LawY are not stored beyond the immediate session
- Your data is never used to train any underlying AI model — this is a core commitment of LawY’s platform
- LawY’s optional verification feature uses a double-blind system, meaning any verification of research by a qualified lawyer is conducted without that lawyer knowing which firm or individual submitted the query, and vice versa
- All data processed through LawY is subject to appropriate contractual and technical safeguards under LawY’s Data Processing Agreement with Morgans
- Our solicitors retain full professional responsibility for reviewing and approving all LawY-assisted research and drafting before it is relied upon or shared
Lawful basis for both AI tools
Our lawful basis for using both Microsoft Copilot and LawY is our legitimate interests in providing an efficient, accurate and high-quality legal service to our clients. We will not use AI tools to make solely automated decisions about you that have legal or significant effects without human review.
Your right to object
If you have any concerns about the use of AI tools in connection with your matter, please speak to your solicitor or contact us using the details in Section 12. You have the right to object to processing based on legitimate interests — see Section 10 for further details.
6. Who We Share Your Data With
We only share your personal data where it is necessary to provide our services, where we are legally required to do so, or where it is in our or your legitimate interests. We do not sell your personal data or share it with third parties for their own marketing purposes.
We may share your data with:
- Other parties to your transaction or legal matter (e.g. the other side’s solicitors, advocates, expert witnesses, courts and tribunals)
- Public registers and bodies, including the Registers of Scotland, Land Register and Companies House
- Our IT support providers, practice management system suppliers, Microsoft as our cloud platform provider, and LawY as our AI legal research platform (see Section 5)
- Our external file storage and secure document destruction provider
- Professional advisers including law accountants and auditors
- The Law Society of Scotland, who may access our records for regulatory inspection purposes
- Government departments, regulators and law enforcement agencies where required by law
- Anti-money laundering and identity verification service providers
- Our email marketing platform (see Section 7)
- In the event of a business sale or restructuring, a successor firm or acquiring party — you will be notified if this occurs
We require all third parties to whom we disclose personal data to respect its security and to process it only for specified purposes and in accordance with data protection law.
7. International Data Transfers
Your personal data is held primarily on our UK-based systems and we do not routinely transfer it outside the United Kingdom. There are two exceptions:
Email marketing (Mailchimp)
Our eNewsletter and email marketing activities are managed by Client Communications Ltd., who use Intuit Inc. (trading as Mailchimp), based in the United States. Transfers to Mailchimp are covered by the UK-US Data Bridge (the UK Extension to the EU-US Data Privacy Framework), which provides an adequate level of protection. You can view Mailchimp’s Privacy Policy at: www.intuit.com/privacy/statement
Microsoft Copilot and Microsoft 365
Our use of Microsoft 365 and Copilot may involve processing on Microsoft’s cloud infrastructure, which can include datacentres within the UK and the European Economic Area. Microsoft operates under the UK GDPR as a data processor on our behalf, under a Data Processing Agreement, and applies appropriate technical and organisational security measures. Data is not transferred to the USA in connection with our use of Copilot for Business.
LawY
LawY is operated by LawY Pty Ltd, an Australian-headquartered company with operations in the UK, Ireland, and other jurisdictions. Data processed through LawY may be hosted on infrastructure in Australia, the UK, or other countries in which LawY operates. LawY applies a zero data retention policy meaning queries and documents are not stored beyond the immediate session. Where any international transfer occurs, LawY is required under our Data Processing Agreement to apply appropriate safeguards in accordance with UK GDPR requirements.
If you ask us to transfer personal data outside the UK in the course of your matter, we will do so on your instructions with appropriate safeguards in place.
8. How Long We Keep Your Personal Data
We retain personal data only for as long as is necessary for the purpose for which it was collected, including to satisfy any legal, regulatory or reporting obligations.
| Type of Record | Standard Retention Period |
|---|---|
| Client files (conveyancing purchase, family, executry, personal injury, etc.) | Law Society of Scotland recommended retention period. Minimum 10 years from the date the matter is closed for Conveyancing Purchase and 20 years for executry |
| Wills, Powers of Attorney, Title Deeds and other principal legal documents | Retained indefinitely while we hold custody, or until we receive instructions to deliver them up |
| Anti-money laundering and identity verification records | 5 years from the end of our business relationship (Money Laundering Regulations) |
| Phone call recordings | Up to 3 months in most cases, unless required for a specific purpose such as a complaint or legal matter, in which case until that matter is resolved |
| CCTV recordings | 14 days in the great majority of cases; longer only where footage is required in connection with an incident, complaint or legal proceedings, and only for as long as necessary |
| eNewsletter subscribers (non-clients) | Until you unsubscribe or ask us to delete your record |
In some circumstances we may retain data for longer where required by law or to defend or pursue legal claims. We may also anonymise data so it can no longer be associated with you, in which case we may use it without further notice.
9. How We Protect Your Data
We take the security of your personal data seriously and have appropriate technical and organisational measures in place, including:
- Secure, access-controlled network and practice management systems, protected by usernames and passwords
- Microsoft 365 cloud platform with enterprise-grade security including encryption at rest and in transit
- Locked filing cabinets for paper files containing sensitive data
- CCTV operating at our Dunfermline office only, with clear entrance signage; footage retained for no more than 14 days unless required in connection with an incident, complaint or legal proceedings
- Phone call recordings stored securely with access restricted to authorised staff only
- Restricted access — only those who need the information to carry out their role can access it
- Regular review of our information security arrangements
- Staff training on data protection and information security
In the event of a personal data breach, we will notify you and the ICO in accordance with our legal obligations.
10. Your Rights
Under the UK GDPR and Data Protection Act 2018 you have the following rights in relation to your personal data:
| Right | What this means |
|---|---|
| Right to be informed | We must tell you how we collect and use your personal data — this Privacy Notice is how we do that |
| Right of access | You can request a copy of the personal data we hold about you (a Subject Access Request). There is no charge in most cases |
| Right to rectification | You can ask us to correct or complete any inaccurate or incomplete data we hold about you |
| Right to erasure | You can ask us to delete your personal data where we no longer have a lawful reason to hold it — subject to any legal or regulatory obligations we may have to retain it |
| Right to restrict processing | You can ask us to pause processing of your data, for example while a dispute about its accuracy is resolved |
| Right to data portability | Where processing is based on your consent or a contract, you can ask for your data in a structured, machine-readable format |
| Right to object | You can object to us processing your data where we rely on legitimate interests. Please note that objecting to certain processing may affect our ability to continue providing services to you |
| Automated decision-making | We do not use automated tools to make decisions about you that have a legal or significant effect without human review |
To exercise any of these rights, please contact us using the details in Section 12. We will ask you to verify your identity before processing your request. We will respond within one calendar month — or notify you if we need up to two months for a complex request.
11. Marketing Communications
Where you are an existing client, we may contact you from time to time with information about our services or changes in the law relevant to you. You can opt out at any time by contacting us at enquiries@morganlaw.co.uk or by telling your solicitor.
Where you have signed up to our eNewsletter, we process your data on the basis of your consent. You can unsubscribe at any time by clicking the unsubscribe link in any of our emails or by contacting us directly.
12. Contact Us
We have appointed a Data Protection Officer (DPO) who is responsible for overseeing compliance with this Privacy Notice and data protection law. If you have any questions about how we handle your personal data, or wish to exercise any of your rights, please contact our DPO in the first instance:
Data Protection Officer: Samantha Kennedy
Dunfermline: 33 East Port, Dunfermline, Fife, KY12 7JE | 01383 620222 | enquiries@morganlaw.co.uk
Kinross: 01577 863424 | kinross@morganlaw.co.uk
Website: www.morganlaw.co.uk
13. Complaints
If you have a complaint about how we have handled your personal data, please contact us in the first instance using the details above. Our complaints procedure for legal work is set out in our Terms of Business.
If you remain dissatisfied, you have the right to complain to the UK’s data protection regulator:
Information Commissioner’s Office (ICO) — Scotland
45 Melville Street, Edinburgh, EH3 7HL
Telephone: 0303 123 1113 | Email: Scotland@ico.org.uk | Website: www.ico.org.uk/concerns
14. Changes to This Privacy Notice
We keep this Privacy Notice under regular review. The current version will always be available on our website. Where we make material changes, we will notify you directly where we hold your contact details.
This Privacy Notice was last reviewed and updated: August 2026