Privacy Policy

1. About this policy

This Privacy Policy explains how Honour Legal Limited ("Honour Legal", "we", "us" or "our") handles personal data when you visit our website, create an account, start or complete an LPA application, contact us, use a staff-assisted application, purchase a service or otherwise interact with us.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable UK data-protection and privacy law, as amended from time to time.

This policy should be read alongside our Terms of Service and any privacy information displayed at the point where particular information is collected.

2. Who we are

Honour Legal Limited is the controller of personal data covered by this policy unless we specifically tell you otherwise.

Honour Legal Limited is registered in England and Wales under company number 16858194.

You can contact us about privacy or data-protection matters through our contact page or by telephone on 0800 055 4321.

3. Personal data we collect

The information we collect depends on how you use the service. It may include:

• Account and contact information — your name, email address, telephone number, account identifiers and authentication information.
• Donor information — title, full legal name, previous or other names where relevant, date of birth, address, postcode and other information needed to prepare an LPA.
• LPA application information — the type of LPA selected, attorney choices, replacement attorney choices, how attorneys should act, people to notify, certificate-provider information, preferences, instructions and other answers entered during the application.
• Health and Welfare information — where relevant, choices or information concerning care, medical treatment, life-sustaining treatment and other Health and Welfare preferences.
• Order and payment information — the service selected, price, transaction status, billing information and payment-related records. Where a separate payment provider processes card information, we do not need to store your full card number ourselves.
• Documents and uploads — files you upload or documents generated from your application, together with information about their status.
• Communications — messages, support enquiries, complaints, feedback and information you give us by telephone or through a staff-assisted application.
• Technical and security information — IP address, browser and device information, session information, access times, security events, error logs and information used to keep accounts and systems secure.
• Website usage information — information about how the website is used where this is collected lawfully, including page navigation and feature usage.

We do not intentionally collect information that is irrelevant to the LPA service.

4. Information about other people

An LPA application usually contains information about people other than the account holder or donor. This can include attorneys, replacement attorneys, certificate providers and people to notify.

We normally receive this information from the person completing the application. It may include a person's title, name, date of birth, address, email address, telephone number, relationship to the donor and role in the LPA.

If you give us another person's information, you should make sure you are entitled to do so and, where appropriate, make them aware that their details are being used for the LPA.

We use information about these other people only where reasonably necessary to prepare, administer, support or register the LPA, to keep appropriate records, or to meet legal and security requirements. We do not use attorney, certificate-provider or notification-person details for unrelated direct marketing merely because they appear in an application.

5. Health and special category data

Information about health is classed as special category personal data and receives additional protection under data-protection law.

If you create a Health and Welfare LPA, the information you choose to provide may include health, care or treatment preferences and decisions concerning life-sustaining treatment. We only process this information where it is relevant to preparing or supporting that LPA.

Alongside an appropriate Article 6 lawful basis, where the law requires an Article 9 condition for this processing we will rely on a valid condition such as your explicit consent where appropriate. Any explicit consent request will be presented clearly and separately where required.

You can withdraw consent where our processing relies on consent. Withdrawal does not make earlier lawful processing unlawful, but if the information is necessary to prepare your Health and Welfare LPA, we may be unable to continue that part of the service after consent is withdrawn.

We do not use health information for unrelated advertising or profiling.

6. How we collect information

We may collect personal data:

• directly from you when you create an account, answer application questions, upload a file, use checkout, contact us or speak with a member of staff;
• from another person completing an application where they provide information about you for an LPA;
• automatically from your browser or device where necessary for authentication, security, session management, reliability and website operation;
• from service providers that support payments, email delivery, hosting, authentication, security or other parts of our service; and
• from public bodies or other organisations where this is necessary and lawful for a service you have asked us to provide.

7. How and why we use your data

We may use personal data to:

• create and manage your Honour account;
• save your application and allow you to continue it across sessions or devices;
• prepare Property and Financial Affairs and/or Health and Welfare LPA documents from the answers you provide;
• prepare information required for relevant Office of the Public Guardian forms;
• show application progress and order status in your account;
• provide staff-assisted application support where requested;
• respond to enquiries, support requests and complaints;
• process orders and maintain transaction records;
• send essential service, security and application messages;
• identify common application errors and allow corrections before documents are finalised;
• protect accounts, prevent fraud, investigate misuse and maintain system security;
• maintain business, tax, accounting, audit and legal records where required;
• improve the reliability, usability and security of our service; and
• establish, exercise or defend legal claims where necessary.

8. Our lawful bases

We only process personal data where we have a lawful basis. Depending on the purpose, we may rely on:

Contract

Where processing is necessary to take steps at your request before entering into a contract or to perform the contract for the Honour service. This includes managing your application, preparing documents, supporting your order and communicating with you about the service.

Legitimate interests

Where necessary for legitimate business interests that are not overridden by your rights. These may include keeping the service secure, preventing fraud, maintaining business records, improving service reliability, responding to enquiries, handling unfinished applications appropriately and processing the details of other people named in an LPA so that we can prepare the document requested by the donor or customer.

Legal obligation

Where we need to process or retain information to comply with tax, accounting, court, regulatory, law-enforcement or other legal requirements.

Consent

Where consent is the appropriate basis, including certain optional communications, non-essential cookies and particular uses of special category information. You may withdraw consent at any time, subject to the limitations explained in this policy.

Where special category data is involved, we also identify an applicable Article 9 condition as required by law.

9. Staff-assisted applications

If you ask a member of the Honour team to help complete an application by telephone or through the admin system, the member of staff may enter the information you provide into the same application system used to prepare your documents.

We may keep relevant notes about the assistance provided so that we can continue the application, answer later questions, maintain an accurate service record and resolve any complaint or dispute.

Staff access to customer information should be limited to what is reasonably required for their role. Staff-assisted entry does not change your responsibility to review the application details and confirm they are accurate before the documents are finalised.

10. Automated document preparation

Our service uses software rules to turn the answers supplied in an application into LPA documents and to control the application journey. For example, the system may populate official document fields, show or hide relevant questions, save progress and flag missing information.

This document assembly is not intended to make a solely automated decision that determines whether you have a legal right to create an LPA, nor does it replace the donor's choices or the role of the Office of the Public Guardian in registration.

If we introduce automated tools that make decisions producing legal or similarly significant effects, or use personal data in a materially different way, we will provide the privacy information and safeguards required by law before doing so.

11. Who we share data with

We do not sell personal data.

We may share personal data with carefully selected service providers where reasonably necessary to operate or deliver the service. These may include:

• Supabase, which is used for parts of our database, authentication and secure file-storage infrastructure;
• Vercel, which is used to host and deliver the Honour website and application;
• payment providers used to process a payment securely;
• email and communications providers used to send account and service messages;
• printing, postal or document-fulfilment providers where those services form part of the order;
• technical, security and professional advisers where necessary to operate, protect or support the business;
• the Office of the Public Guardian or another public body where our service includes submission or support for registration and you ask or authorise us to provide that assistance; and
• courts, law-enforcement bodies, regulators or other authorities where disclosure is required or permitted by law.

Service providers acting on our behalf are expected to process personal data only for the agreed purposes, to protect it appropriately and to comply with applicable data-protection obligations.

If Honour Legal is reorganised, sold or merged, personal data may be transferred as part of that transaction subject to appropriate confidentiality and data-protection safeguards.

12. International transfers

Some technology or service providers may process or make personal data accessible from countries outside the United Kingdom.

Where a transfer is a restricted transfer under UK data-protection law, we will use an appropriate transfer mechanism. Depending on the destination and provider, this may include UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with any additional assessment or protections required by law.

You can contact us if you would like more information about the safeguards used for a particular category of transfer.

13. How we protect your data

We use technical and organisational measures designed to protect personal data against accidental loss, unauthorised access, alteration, disclosure or destruction.

These measures may include encrypted connections, protected database and storage services, authentication controls, access restrictions, logging, backups, secure development practices and limiting staff access according to role and need.

No internet service can guarantee absolute security. You are also responsible for keeping your account access details secure and should tell us promptly if you believe another person has accessed your account without permission.

14. How long we keep your data

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including providing the LPA service, maintaining access to your account and documents, handling complaints, meeting legal or accounting requirements, preventing fraud and dealing with legal claims.

Different categories of information may therefore be kept for different periods. When deciding how long to retain information, we consider the nature and sensitivity of the data, the stage of the application, whether an order was completed, our legal obligations, limitation periods and whether the information is still needed for the customer relationship.

Incomplete applications and dormant account information may be deleted or anonymised under our retention schedule after an appropriate period of inactivity. Transaction, complaint, security or other records may need to be retained for longer where the law or a legitimate legal need requires this.

When information is no longer required, we aim to delete it securely or anonymise it so that it can no longer be linked to an identifiable person.

15. Cookies and similar technology

Our website may use cookies, browser storage and similar technologies that are necessary to provide functions such as authentication, keeping you signed in, remembering a session, security and saving application progress.

Where we use non-essential analytics, advertising or similar technologies that require consent, we will provide an appropriate choice before using them. You can also control cookies through your browser, although blocking essential cookies may prevent account or application features from working correctly.

16. Service messages and marketing

We may send messages that are necessary for the service, for example account-security messages, application status updates, checkout or order messages, responses to support requests and important changes affecting an active service. These are service communications rather than optional marketing.

Where appropriate, we may also remind you about an application or checkout that you started but have not completed. We will only do this where we have an appropriate lawful basis and in a proportionate way.

We will not send optional direct marketing where consent is legally required unless you have chosen to receive it. You can withdraw marketing consent or object to direct marketing at any time.

17. Your data protection rights

Depending on the circumstances, UK data-protection law gives you rights including:

• Access — to ask for a copy of personal data we hold about you.
• Rectification — to ask us to correct inaccurate or incomplete information.
• Erasure — to ask us to delete personal data in circumstances where the law gives you that right.
• Restriction — to ask us to restrict how we use information in certain circumstances.
• Data portability — to receive certain information you provided in a structured, commonly used and machine-readable format where the right applies.
• Objection — to object to certain processing based on legitimate interests and to object to direct marketing at any time.
• Withdrawal of consent — where processing is based on consent, to withdraw it at any time.
• Rights relating to automated decision-making — where applicable to solely automated decisions with legal or similarly significant effects.

These rights are not absolute in every situation. For example, we may need to retain information where the law requires it or where it is necessary for the establishment, exercise or defence of legal claims.

To exercise a right, contact us through our contact page. We may need to verify your identity before disclosing or changing personal data. We will respond within the period required by law.

18. Data protection complaints

If you are concerned about how Honour Legal has handled your personal data, please contact us so that we can investigate.

We maintain a process for data-protection complaints. We will acknowledge a data-protection complaint within the period required by law, investigate it appropriately and explain the outcome.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data-protection regulator. The ICO's public helpline is 0303 123 1113. You can find further information through the ICO's official website.

19. Changes to this policy

We may update this Privacy Policy to reflect changes in law, our LPA service, technology, security, processors or the way we handle personal data.

When we make changes, we will update the date at the top of this page. Where a change materially affects how we use personal data, we will provide additional notice where required or appropriate.

20. Contact us

Honour Legal Limited
Registered in England and Wales
Company number: 16858194

Telephone: 0800 055 4321

For privacy enquiries, requests to exercise your rights or data-protection complaints, please use our contact page and make clear that your message concerns privacy or personal data.