Privacy notice

Last updated 25 October 2026

This notice explains how we use your personal data when you visit our website, use our free tools, ask for a callback, book or pay for a consultation, or contact us by email, phone, or WhatsApp. It also explains your rights and how to use them.

Who we are

Sony Law is the trading name of Sony Sadaf Haroon Ltd, a company registered in England and Wales (company number 10540366). We're authorised and regulated by the Solicitors Regulation Authority (SRA number 635480).

We're the controller of the personal data described in this notice. This means we decide how and why it's used.

We're registered with the Information Commissioner's Office (ICO), registration number ZB654766.

How to contact us about your data

If you have a question about this notice, or want to use any of your rights, please contact us:

Email: info@sonylaw.com
Post: Sony Law, Capstan House, 182–184 Hatfield Road, St Albans AL1 4JG
Phone: 01727 568353

Our Data Protection Officer is Sony Haroon, our principal solicitor. You can reach her using the details above.

The information we collect

When you ask for a callback or book an appointment

Our callback and booking forms ask for:

your name
your mobile number
your email address
the service you need
a description of your situation, if you choose to give one
your preferred language
how you heard about us, if you choose to tell us
the appointment slot you choose
your agreement that we can contact you about your enquiry (required)
whether you'd like to receive marketing from us (optional, and separate)

If you've accepted analytics cookies, your enquiry also includes:

campaign information about how you found us: utm_source, utm_medium, utm_campaign, and the Google click ID (gclid)
the page you booked from

If you rejected analytics cookies, or haven't made a choice, we don't receive this information.

Your submission is emailed to our team through Resend, and may also go to our own intake automation, which is built on n8n. From there it goes into our case management system.

We schedule appointments with Cal.com, which sends your booking confirmations.

When you pay for a consultation

Paid consultations are paid by card through Stripe Checkout. Stripe collects your card details directly. We don't see or store your full card details. Stripe confirms your payment to us.

When you contact us in other ways

If you email, phone, or write to us, we'll use what you tell us to deal with your enquiry.

We use WhatsApp only if you choose to message us there. If you do, we'll receive your WhatsApp name, your phone number, and the messages and files you send. WhatsApp is run by Meta, and its own privacy policy applies to your use of WhatsApp.

When you use our free tools

Our divorce cost estimator, ILR date checker, and sponsor compliance checklist run in your browser. Your answers aren't sent to us.

If you ask us to email you a copy of your results, we need your email address and your consent. We'll then receive your email address and the results you've asked us to send.

Our booking assistant, if we switch it on

We may add an AI booking assistant to our website. It isn't switched on at the moment.

If we switch it on, the messages you type will go through our intake automation to an AI model provider, so the assistant can reply and help you book. The assistant doesn't give legal advice. Please don't share sensitive details with it.

Information collected automatically

Our website is hosted by Vercel. Like most websites, it keeps server logs. These record technical information such as your IP address, your browser and device type, the pages you request, and when you request them.

If you click Accept on our cookie banner, Google Analytics and Google Ads conversion tracking also collect information about how you use our website. This includes the pages you visit, how you arrived, your device, and your approximate location. They don't load unless you click Accept. Our cookie policy has the details.

If you click Show map on our contact section, Google Maps loads and Google receives information such as your IP address. The map doesn't load unless you click.

The SRA digital badge in our website footer is served by Yoshki (cdn.yoshki.com) on behalf of the SRA. To show the badge, your browser connects to Yoshki, which receives your IP address and browser details.

Information from other people

Sometimes we receive information about you from someone else, for example a family member, an employer, or another solicitor who contacts us for you.

If you become a client, we may also receive information about you from others involved in your matter, such as the courts or the Home Office.

Sensitive information

When you describe your situation, you may tell us about things like your health, religion, ethnic origin, sex life, or sexual orientation. The law calls this special category data. You may also tell us about your immigration status, or about criminal offences.

We only use this information when we need it to deal with your enquiry or your legal matter. As well as one of the lawful bases in the next section, we rely on these conditions:

it's necessary to establish, exercise or defend legal claims (Article 9(2)(f) UK GDPR)
your explicit consent, where that's the right basis (Article 9(2)(a) UK GDPR)

For information about criminal offences, we rely on the equivalent conditions for legal claims and consent in Schedule 1 to the Data Protection Act 2018.

Please only include what we need to understand your enquiry. You can tell us more once we've spoken.

If you tell us about other people, such as your partner, your children, or an employer, we'll use that information only to deal with your enquiry.

How we use your information and why

The law says we must have a lawful basis for each way we use your personal data. This table sets out what we do and the basis we rely on.

What we do	Our lawful basis
Reply to your enquiry, call you back, and arrange your appointment	Taking steps you've asked for before entering into a contract with us. Our legitimate interest in responding to people who contact us.
Send booking confirmations through Cal.com	Taking steps you've asked for before entering into a contract with us
Take payment for a paid consultation through Stripe	Performing our contract with you
Pass your enquiry through our intake automation into our case management system	Our legitimate interest in running our business efficiently and keeping accurate records
Check for conflicts of interest before we agree to act for you	Legal obligation (our legal and regulatory duties). Our legitimate interest in meeting our professional obligations.
Check your identity and carry out anti-money laundering checks where the law requires	Legal obligation
Keep the records our regulator and the law require	Legal obligation
Keep our website secure and working, using server logs	Our legitimate interest in running a safe, reliable website
Measure how our website is used with Google Analytics	Your consent, given by clicking Accept
Measure which adverts lead to enquiries, using Google Ads and campaign information	Your consent, given by clicking Accept
Send you marketing	Your consent, given by ticking the separate marketing box
Email you a copy of your free tool results	Your consent
Run our booking assistant, if we switch it on	Taking steps you've asked for before entering into a contract with us. Our legitimate interest in helping you book quickly.
Deal with complaints, and establish or defend legal claims	Our legitimate interest in resolving complaints and protecting our position. Legal obligation, where our regulator requires it.

Our forms ask you to agree that we can contact you about your enquiry. We need this so we can reply. Marketing is a separate, optional choice. You can say no to marketing and still send an enquiry.

Where we rely on legitimate interests, we've weighed our interests against your interests and rights. You can ask us for more information about this, and you can object.

You don't have to give us your information. But if you don't give the details our forms ask for, we may not be able to reply or book your appointment. If you instruct us, the law may require us to collect some information, for example to check your identity.

We share your information only where we need to. These organisations help us run our website and our business:

Vercel hosts our website and keeps server logs.
Resend delivers the enquiries you send through our website to our team by email.
Our intake automation, built on n8n, receives your form and passes it to our case management system.
Our case management system stores enquiries and client records.
Cal.com schedules appointments and sends booking confirmations.
Stripe processes card payments through Stripe Checkout.
Google provides Google Analytics and Google Ads conversion tracking, but only if you click Accept on our cookie banner. Google also provides Google Maps, which loads only if you click Show map.
Meta runs WhatsApp, which we use only if you choose to message us there.
Yoshki serves the SRA digital badge on behalf of the SRA.
An AI model provider, only if we switch on our booking assistant.
Our IT and email service providers, who help us run our systems.

Most of these organisations use your data only on our instructions. Some, such as Stripe, Google, and Meta, also use data for their own purposes, such as fraud prevention, under their own privacy policies.

We may also share your information with:

our regulator, the SRA, and the Legal Ombudsman
the police, HMRC, or other authorities, where the law requires
our professional advisers, accountants, and professional indemnity insurers, where needed
if you instruct us, others involved in your matter, such as the courts, the Home Office, other parties and their solicitors, barristers and experts, as needed to act for you

We don't sell your personal data.

Sending your information outside the UK

Some of the organisations we use are based outside the UK, or store or access data outside the UK, for example in the United States or the European Economic Area.

When your data is transferred outside the UK, we make sure appropriate safeguards are in place, such as:

UK adequacy regulations, which confirm that a country, or a scheme within it, protects personal data to the standard the UK requires
the UK International Data Transfer Agreement
the International Data Transfer Addendum to the EU standard contractual clauses

You can contact us for more information about these safeguards.

How long we keep your information

We keep personal data only for as long as we need it for the purposes in this notice. This includes meeting our legal, regulatory, and insurance obligations. How long we keep it depends on the type of information and whether you become a client.

If you make an enquiry but don't instruct us, we keep your enquiry for 12 months, then delete it.

If you instruct us, we keep your client file for 10 years after the date of our final bill, so we can deal with any later questions, complaints, or claims. Wills and related documents may be kept for longer.

We keep payment and accounting records for 6 years after the end of the financial year they relate to, as tax law requires.

Server logs are kept for up to 30 days. Google Analytics data is kept for 14 months.

How long cookies and browser storage last is set out in our cookie policy.

How we protect your information

We use appropriate technical and organisational measures to protect your data. Our website uses an encrypted (HTTPS) connection. We limit access to your information to people who need it. Everyone at the firm must keep client information confidential.

No way of sending information over the internet is completely secure. If you'd rather not send sensitive details online, you can call us.

Your rights

You have rights over your personal data. You can ask us to:

give you a copy of your data (a subject access request)
correct data that's wrong or incomplete
delete your data
restrict how we use your data
send data you gave us to you or to another organisation, in a commonly used format (data portability)

You can also:

object to how we use your data where we rely on legitimate interests
object to marketing at any time, and we'll stop
withdraw your consent at any time, where we rely on consent. This won't affect anything we did before you withdrew it.

Some rights only apply in certain situations. For example, we may need to keep information to meet our legal or regulatory duties, or because it's protected by legal professional privilege. If we can't do what you ask, we'll explain why.

Using your rights is usually free. We may need to check your identity first. We'll reply within one month. If your request is complex, or you make several requests, we may extend this by up to two more months. If we do, we'll tell you why within the first month.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

Cookies and your choices

We only use Google Analytics and Google Ads cookies if you click Accept on our cookie banner. Reject is just as easy. You can change your choice at any time using the button below, or the Cookie settings link in our website footer.

Our cookie policy explains each cookie we use.

Marketing

We'll only send you marketing if you tick the marketing box on our forms. This is separate from agreeing that we can contact you about your enquiry.

You can opt out at any time by contacting us, or by using the unsubscribe link in our emails.

Complaints about how we use your data

If you're unhappy with how we've used your data, please tell us first so we can try to put it right.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection:

Website: ico.org.uk
Phone: 0303 123 1113

Complaints about our legal service are covered by our complaints procedure.

Changes to this notice

We may update this notice from time to time, for example if we change how our website works. The date on this page shows when we last updated it.