Privacy Policy

1. Application

This Privacy Policy applies to personal information we collect and handle in connection with our legal services, client onboarding and administration, conflict checking, client identification and regulatory compliance, recruitment, events, publications, website use, and general practice operations.

We maintain practices, procedures, and systems designed to support compliance with applicable privacy laws and our professional obligations, including controls relating to confidentiality, information security, records management, direct marketing, access and correction requests, and complaints handling.

2. What personal information we collect

The kinds of personal information we collect and hold depend on the nature of your relationship with us, including whether you are a client, prospective client, a person connected with a client matter, a supplier, service provider, job applicant, employee, contractor, subscriber, event attendee, or website user. This may include:

• contact and identity information, including name, date of birth, address, phone number, email address, and postal address;
• occupation, role, employer, business activity, and professional information;
• identity documents and verification information, including document numbers, issuing authorities, expiry dates, photographs, and signatures;
• government-issued identifiers, where required or authorized by law;
• financial, banking, payment, transaction, source of funds, source of wealth, and ownership information;
• matter information, including instructions, communications, evidence, documents, and information about relationships between persons involved in a matter (such as the nature of proceedings and court dates);
• information about companies, trusts, partnerships, and other arrangements, including beneficial owners, controllers, directors, trustees, beneficiaries, shareholders, and other connected persons;
• information relevant to sanctions screening, risk assessment, and transaction monitoring in connection with applicable regulatory compliance obligations;
• recruitment, employment, and contractor information;
• event, subscription, marketing, and communication preferences; and
• technical information, including IP address, browser type, pages visited on our Website, and device information, collected automatically through server logs, cookies, and analytics tools.

3. How we collect personal information

We usually collect personal information directly from you when you instruct us, provide information or documents, communicate with us, complete a form or identity verification process, subscribe to our publications, register for an event, interact with our Website, or apply for employment or engagement with us.

We may also collect personal information from third parties where permitted by law, including clients, counterparties, witnesses, representatives, advisers, courts, tribunals, regulators, government bodies, public registers, commercial databases, identity verification providers, screening providers, financial institutions, recruitment agencies, referees, former employers, and technology or analytics providers.

If you provide us with personal information about another individual, please take reasonable steps to ensure that person is aware their information has been provided to us and of this Privacy Policy. You should only provide sensitive information about another individual where you have their consent or authority to do so, or where otherwise permitted by law.

4. How we use personal information

We use personal information for purposes including:

• responding to your inquiry, providing legal services, and carrying out your instructions;
• conflict checks, client onboarding, and matter opening and administration;
• providing advice, conducting due diligence, and managing transactions, litigation, and dispute resolution;
• trust accounting, billing, debt recovery, and practice management;
• complying with our professional, court, tribunal, and regulatory obligations, including client identification, sanctions and politically exposed person screening, risk assessment, and record-keeping;
• responding to notices, audits, investigations, and lawful requests from courts, regulators, law enforcement agencies, and government bodies;
• risk management, insurance, complaints handling, and professional indemnity matters;
• recruitment, employment, contractor, and human resources administration;
• operating, securing, and improving our Website and services, using de-identified or aggregated data where practicable; and
• sending you legal updates, publications, and event invitations where permitted by law.

We do not use personal information to make decisions solely by automated means where that decision would significantly affect your rights or interests (see clause 7).

5. Disclosure of personal information

We may disclose personal information to:

• courts, tribunals, regulators, and law enforcement agencies, in connection with legal proceedings, regulatory obligations, or as required or authorized by law;
• opposing parties, expert witnesses, and other professionals engaged in connection with your matter;
• financial institutions, insurers, identity verification providers, and screening providers;
• service providers who assist us with practice management, document storage, file transfer, email, website hosting, recruitment, payment processing, analytics, and similar functions, where those providers are bound by confidentiality and data-handling obligations;
• related or associated entities that support our practice for authorized business support functions; and
• any other person to whom you have authorized disclosure, or where disclosure is required or authorized by law.

We do not sell, rent, or trade personal information to third parties for marketing purposes.

6. Client identification and regulatory compliance

As a law practice, we may be required by applicable law to collect, verify, use, disclose, and retain personal information about clients and other relevant persons in connection with anti-money-laundering, client identification, and other legal and regulatory obligations that apply to law practices.

This may include information required to verify your identity, understand the nature and purpose of the service you have asked us to provide, identify beneficial owners (broadly, individuals with 25% or more ownership or control) or persons on whose behalf you act, verify your authority to act, establish source of funds or source of wealth, conduct sanctions and politically exposed person checks, assess risk, and monitor transactions or activity on an ongoing basis.

If you do not provide the information we request, we may be unable to provide the requested service, or may need to pause, limit, or terminate our work, subject to our professional obligations and applicable law.

We may be required to disclose information to government authorities or law enforcement agencies where required or authorized by applicable law. Applicable law may restrict what we can tell you about certain reports, notices, investigations, requests, or disclosures.

7. Automated decision-making and tools

We use technology, including automated and computer-assisted tools, for functions such as identity verification, document verification, sanctions and politically exposed person screening, risk assessment, and conflict checking.

We do not use these tools to make solely automated decisions that significantly affect an individual's rights or interests. Automated outputs may inform decisions made by appropriately trained personnel, including whether we can act for you, whether enhanced due diligence is required, or whether other legal or regulatory steps are required.

8. Attorney-client privilege and confidentiality

Our duties of confidentiality and attorney-client privilege remain important and are not displaced by this Privacy Policy. Some laws may require or authorize us to collect, use, disclose, or retain personal information despite those duties. Where privilege may apply to information or documents requested under applicable laws, we assess and manage privilege claims in accordance with applicable legal requirements.

In certain circumstances, applicable law may prohibit us from disclosing to you, or to anyone else, that a report has been made or is proposed to be made to a government authority. Separately, where the sole basis for a required report is privileged information, we will assess our obligations in accordance with our professional duties and applicable law, and we will only ever disclose non-privileged information where privilege applies.

We do not adopt a government-issued identifier as our own identifier of an individual unless permitted by law. We may collect, use, or disclose government-issued identifiers where reasonably necessary for identity verification, legal services, regulatory compliance, court or tribunal processes, or where otherwise required or authorized by law.

9. Direct marketing

Where we are permitted by law to do so, we may use your contact details to send you marketing communications, legal updates, publications, and event invitations about our services. Electronic marketing communications are sent in compliance with the CAN-SPAM Act and only to recipients who have consented, expressly or by inference, to receive them.

Each electronic marketing message will identify us as the sender and include a functional unsubscribe facility. You can opt out at any time by using the unsubscribe link in the message or by contacting us using the details in clause 17. We do not use sensitive information for direct marketing without your consent.

10. International transfers of personal information

Some of our service providers (for example, cloud hosting, email, practice management, and screening providers) may store or process personal information outside the United States. We may also disclose personal information overseas where necessary for your legal services, where you have consented, or where a matter involves an overseas party, transaction, court, tribunal, regulator, registry, or authority.

Before we transfer personal information internationally, we take reasonable steps to ensure that the overseas recipient handles your personal information in accordance with applicable law and with a level of protection consistent with our obligations under this Privacy Policy, unless an exception applies.

11. Storage, security, and retention

We take reasonable steps to ensure the personal information we collect, use, and disclose is accurate, up to date, complete, and relevant, and to protect it from misuse, interference, loss, unauthorized access, modification, and disclosure. Those steps include physical, technical, and administrative safeguards, such as access controls, password protection, secure cloud services, staff training, and confidentiality obligations on our staff and contractors.

We retain personal information only for as long as we reasonably need it for the purposes set out in this Privacy Policy, or as otherwise required or permitted by law, including legal profession record-keeping obligations, tax and audit requirements, professional indemnity insurance arrangements, and applicable regulatory compliance. We retain personal information for the period required by law.

When we no longer need personal information for a lawful purpose, we will take reasonable steps to destroy it or de-identify it, subject to these retention requirements.

12. Data breach notification

We have a data breach response plan. If we have reasonable grounds to believe that a reportable data breach has occurred, we will notify affected individuals and the relevant authorities as required by applicable state data-breach notification laws, including Texas Business and Commerce Code Chapter 521, and any other applicable federal or state law, as soon as practicable.

13. Accessing and correcting your personal information

You have the right to ask for access to personal information we hold about you and to ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant, or misleading.

To make a request, please contact us using the details in clause 17. We will respond within a reasonable period (usually within 30 days) and we may need to verify your identity before providing access.

We will tell you if there is a reason we are unable to provide access or make a correction.

14. Complaints

If you believe we have handled your personal information in a way that does not comply with applicable privacy law or this Privacy Policy, please contact us using the details in clause 17 to make a complaint. We will respond within a reasonable period (usually within 30 days).

If you are not satisfied with our response, you may escalate your complaint to the relevant state authority, including the Office of the Attorney General of Texas. We encourage you to contact that office directly for current contact information and complaint procedures.

15. Cookies and analytics

Our Website uses cookies, pixels, analytics tools, and similar technologies to enable functionality, understand website usage, improve our services, and support communications. We use Google Analytics 4 and PostHog to collect analytics data. Analytics data is collected in aggregated and de-identified form where practicable.

Most internet browsers allow you to delete or block cookies, or to receive a warning before a cookie is stored. If you disable cookies, some parts of the Website may not function as intended.

16. Changes to this policy

We may update this Privacy Policy from time to time. The current version will always be available at lexmedica.net/privacy.

17. Contact us

If you have any questions about this Privacy Policy or wish to exercise any of your rights, please contact us via the contact details set out on this Website.