Privacy notice
Version 2.1 | Dated 17 October 2026
What changed on 17 October 2026: an enquiry that goes nowhere is now reduced after twelve months rather than deleted after two years, the out of hours line and the transfers to the United States are named, and the complaint route to us first is set out.
This notice explains what happens to personal data on this website. It is written to be read, not skimmed past, and it is short because the site collects little. It covers the website alone: what a law firm's clients' data receives inside the Bracton platform is governed by that firm's own privacy notice and by the written data processing agreement between the firm and us, not by this page.
Who we are
The controller of the personal data this website collects is Bracton Limited, registered in England and Wales as Bracton Ltd under company number 17360622, whose registered office is at Arden Hall, Brooklands Road, Sale, Cheshire M33 3SJ. We are registered with the Information Commission as a data controller under registration number ZC227137. The registration carried over unchanged when the Information Commission took over the functions of the Information Commissioner on 30 September 2026. We have not appointed a data protection officer. Our privacy contact deals with anything about your personal data, and you reach that contact by email at dpo@bractonlegal.co.uk, by telephone on 0161 520 2700 or by post to the registered office.
What we collect, and why
When you contact us, whether about the platform, a demonstration or anything else, we hold what you send: your name, your firm, how to reach you and what you wrote. We use it to answer you and, if the conversation continues, to carry it on. The lawful basis is our legitimate interest in responding to the people who write to us, and from the point a contract is in prospect, the steps needed to enter into it. Where you book a conversation through the site, the appointment is managed in Microsoft Bookings inside our own Microsoft 365 environment, Microsoft acting as our processor under its data protection addendum, and the booking holds your name, your contact details and anything you write in the message box. The enquiry form on the contact page is carried by Netlify, Inc., which hosts this site and holds each submission on our behalf as our processor under its data processing terms before passing it to us, and we delete it from Netlify once it has reached us, within minutes in the ordinary course and within two days at the latest. An enquiry from a law firm about Bracton goes on our sales record, and our privacy notice for the people at law firms we talk to explains what we keep there and for how long.
Outside 7am to 7pm on weekdays, an automated voice answers 0161 520 2700. It tells you that it is automated and that the call is transcribed, and it takes your name, your firm, a number to call you back on, the reason for your call and whether the matter is urgent. Only those five details reach our records. No recording of the call is made. The transcript stays with ElevenLabs, the company that runs the line for us as our processor, which deletes it seven days after the call.
The site itself takes measurements without identifying anyone. We use Umami, a measurement tool that counts visits and pages using no cookies and building no profile of you, so the counts tell us which pages earn their keep and nothing about who read them. There is no advertising on this site, no advertising cookies, and no tracking that follows you elsewhere.
Like every website, this one is delivered by a hosting service, and a server sees the technical detail any server sees: the network address your browser calls from, the page asked for and the moment it was asked. Our host is Netlify, which processes those server logs to deliver the pages and to defend the service against attack. Where that processing happens outside the United Kingdom it takes place under the safeguards set out in the next section.
Transfers outside the United Kingdom
Netlify, Inc. holds a website enquiry in the United States until our server collects it, and ElevenLabs holds the transcript of an out of hours call in the United States for seven days. Those two transfers take place under the UK Extension to the EU-US Data Privacy Framework, which UK law treats as giving adequate protection, where the provider takes part in it, and otherwise under the International Data Transfer Addendum to the EU standard contractual clauses that each provider’s terms contain. Where any other provider reaches the data from outside the United Kingdom, the same safeguards apply. We send you a copy of the safeguard on request.
Cookies
This site sets no cookies. None for measurement, none for advertising, none at all. What it stores on your device is one thing only: the choices you make in the site's own cookie settings, reached from the small control on every page, including the off switch for measurement if you use it. That record exists solely to honour what you chose on your next visit, which is why the Privacy and Electronic Communications Regulations ask no consent for it, and why no banner interrupts you. The measurement itself stores nothing on your device and reads nothing from it. The full cookie policy sits below on this page.
What we do not do
We do not sell personal data, we do not share it for marketing, we do not profile visitors, and we make no decision about you by automated means. Nothing you send through this site is used to train any model.
Your right to object
Where we rely on legitimate interests, as we do to answer enquiries and to keep the service secure, you have the right to object at any time on grounds relating to your particular situation. Object by telephone, email or post to the contacts above, and we stop unless the law lets the processing continue and we tell you why. This paragraph stands on its own because the law says the right to object should be put to you plainly, not folded into a list.
How long we keep things
An enquiry that goes nowhere is reduced twelve months after the last exchange to your firm’s name and any do not market entry, unless we have recorded a reason to keep the discussion open. If you ask us through the website to write once before your current agreement ends, we keep your details for that note alone and do not treat you as a sales contact, and we delete them 30 days after we write unless you reply. Where you become a client, what you sent joins the client record and follows our retention policy, and records the law requires us to keep, such as accounting records, are kept for the periods it sets. The site's measurements are aggregate from the start and hold nothing to delete about any one person.
Your rights
You have the rights UK data protection law gives you: to ask for a copy of what we hold about you, to have it corrected, to have it erased, to restrict or object to its use, and to receive what you gave us in a portable form. Ask our privacy contact by telephone, by email to dpo@bractonlegal.co.uk or by post, and we answer within a month. You are never obliged to give this site any personal data at all: every page works without it.
Complaints
If you are unhappy with how we have handled your data, tell our privacy contact first at dpo@bractonlegal.co.uk, on 0161 520 2700 or by post to the registered office. Section 164A of the Data Protection Act 2018 gives you that right, and we acknowledge your complaint within 30 days, look into it and tell you the outcome. You may also complain to the Information Commission at ico.org.uk, by post at Wycliffe House, Water Lane, Wilmslow, SK9 5AF, or by telephone on 0303 123 1113, whether or not you have come to us first.
Changes
If this notice changes, the change appears on this page with a new date, and a change that matters is said plainly at the top rather than buried.
Registered in England and Wales | Company number 17360622
Privacy notice version 2.1 | Dated 17 October 2026