Privacy Policy

Effective Date: October 2025 

At One Place, we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and safeguard your information when you visit our website, contact us or use our services.

It also explains your rights in relation to your personal data and how UK data protection law protects you.

By using our website or providing your information to us in connection with a claim or enquiry, you acknowledge the practices described in this Privacy Policy.

We may update this Privacy Policy from time to time. We recommend that you review this page periodically to ensure you are aware of any changes.

If you have any concerns about how we handle your personal data, please contact us using the contact details provided on our website. You also have the right to complain to the Information Commissioner’s Office (ICO). We ask that you contact us first so that we have an opportunity to address your concerns.

Our Role and Where This Policy Applies

One Place Business Solutions Ltd (trading as Data Breach Redress) is the data controller for the personal data you provide when completing the initial enquiry on our website, including the pre-qualifying questions used to check whether you may be eligible to bring a claim. If your answers indicate that you may be eligible, we will refer your enquiry to Goldman Finch Limited (GFL), a firm of solicitors authorised and regulated by the Solicitors Regulation Authority. From the point we make that referral, GFL becomes the controller of your personal data, and GFL’s own privacy notice, provided to you at that stage, explains how GFL will use your information.

Contents

1. The Data We Collect About You
2. How We Collect Your Personal Data
3. How We Use Your Personal Data and Who We Share It With
4. Use of Cookies
5. Data Security
6. Data Retention
7. Your Legal Rights

 

1. The Data We Collect About You

Personal data is information that relates to an identified or identifiable individual. Information that has been anonymised so that you cannot be identified is not considered personal data.

Depending on the nature of your enquiry or claim, we may collect, store and use the following types of personal data:

Identity Information

This may include:

• First name and last name
• Previous names or maiden name
• Title
• Date of birth
• Other information required to verify your identity

Contact Information

This may include:

• Current and previous addresses
• Email address
• Telephone or mobile number
• Other contact details you provide to us

Claim and Financial Information

We may collect information relevant to assessing, preparing and progressing your claim. This may include financial information or other information relating to the circumstances of your claim.

Other Information Relevant to Your Claim

Depending on the type of claim, we may collect additional information that is reasonably required to assess and progress your case.

If we are required by law, or need certain information in order to provide our services to you, and you do not provide that information, we may be unable to assist with your enquiry or continue progressing your claim. Where this applies, we will explain what information is required and why.

Special Category Data

One of our pre-qualifying questions asks whether you have experienced distress, anxiety or concern since learning about the data breach in question. Your answer to this question may constitute special category data (health data) under UK data protection law. Where we process this data, our condition for doing so is Article 9(2)(f) UK GDPR — that the processing is necessary for the establishment, exercise or defence of legal claims, namely determining whether to refer your enquiry to a solicitor.

2. How We Collect Your Personal Data

We may collect personal information in a number of ways.

Directly From You

You may provide information to us through:

• Online forms and questionnaires
• Our website
• Telephone conversations
• Email
• SMS or other electronic communications
• Documents you provide
• Other communications relating to your enquiry or claim

This may happen when you:

• Make an enquiry about a potential claim
• Ask us to assist with a claim
• Complete an eligibility or claim questionnaire
• Provide information required to progress your claim
• Respond to requests for further information
• Provide feedback or communicate with us about our services

Automatically

When you visit our website, certain technical information may be collected automatically. This may include your IP address and information about how you use our website.

We may use cookies and similar technologies to help operate and improve our website and understand how visitors use it.

Further information about our use of cookies can be found in our Cookie Policy.

3. How We Use Your Personal Data and Who We Share It With

We only use your personal data where we have a lawful basis for doing so and where it is necessary for the purpose for which it was collected.

Your information may be used to:

• Assess your eligibility for a potential claim
• Collect and verify information required to progress your claim
• Complete claim forms and other documentation on your behalf
• Communicate with you about your enquiry or claim
• Obtain information required to support your claim
• Pass relevant information to the appropriate legal representatives or other organisations involved in progressing your claim
• Maintain accurate records
• Manage and administer our services
• Meet our legal and regulatory obligations
• Protect against fraud, misuse or unlawful activity
• Respond to complaints or enquiries
• Improve our services and processes

Internal Use

Your information is stored securely and access is restricted to people who require access in order to perform their role.

We only process information that is reasonably necessary for the purposes for which we have collected it.

Sharing Your Information

Where your pre-qualifying answers indicate that you may be eligible to bring a claim, we will share your information with Goldman Finch Limited (GFL), a firm of solicitors authorised and regulated by the Solicitors Regulation Authority, so that GFL can consider whether to act for you. We do this on the basis that it is in our legitimate interests, and yours, to connect you with a solicitor able to assess your potential claim (Article 6(1)(f) UK GDPR).

Where necessary to assess or progress your claim, we may share relevant personal information with third parties, which may include:

• Solicitors or law firms
• Legal representatives
• Experts or professional advisers
• Claims-related service providers
• Organisations or third parties holding information relevant to your claim
• Other service providers necessary to assist with the administration or progression of your claim

Where information is passed to a legal representative or law firm for the purpose of progressing a claim, that organisation may process your information in accordance with its own privacy policy and legal obligations.

We will only share information where there is a lawful basis to do so and where it is reasonably necessary for the relevant purpose.

Credit Report or Verification Services

Where your claim requires identity, financial or other verification information, we may share relevant personal information with appropriate third-party service providers for the purpose of obtaining or verifying information required to assess or progress your claim.

The information shared will be limited to what is reasonably necessary for that purpose.

We will disclose personal data to our partner Valid8 IP Ltd for the provision of identity verification.

Communication Methods

We may contact you by:

• Email
• SMS
• Telephone
• Post

We may use these communication methods to request information, provide updates, discuss your claim or communicate with you about our services.

You may object to particular methods of communication. However, restricting certain communications may affect our ability to obtain information from you or progress your claim.

Legal and Regulatory Obligations

We may be required to disclose personal information where necessary to comply with legal, regulatory or statutory obligations.

This may include sharing information for:

• Fraud prevention
• Crime prevention and detection
• Regulatory compliance
• Legal proceedings
• Responding to lawful requests from public authorities
• Meeting applicable record-keeping requirements

We may also need to verify your identity before providing access to personal information.

Legitimate Interests

Where appropriate, we may process your personal data because it is necessary for our legitimate interests. This may include:

• Managing and administering our business
• Maintaining accurate records
• Managing enquiries and claims
• Referring your enquiry to Goldman Finch Limited where your answers indicate that you may be eligible to bring a claim
• Improving our systems and services
• Protecting our business against fraud or misuse
• Managing complaints
• Maintaining appropriate insurance and professional protections

Where we rely on legitimate interests, we will consider your rights and interests before processing your information.

Marketing Communications

Where permitted by law, we may contact you about services or information that we believe may be relevant to you.

You can opt out of marketing communications at any time.

Opting out of marketing communications will not affect communications that are necessary for the administration or progression of an existing claim or enquiry.

Third-Party Marketing

We will not share your personal data with another organisation for its own direct marketing purposes unless we have a lawful basis to do so and, where required, have obtained your consent.

4. Use of Cookies

We may use cookies and similar technologies on our website to improve your experience and understand how the website is used.

Cookies may be used to:

• Ensure the website operates correctly
• Remember certain preferences
• Understand how visitors use our website
• Monitor website performance
• Improve the services we provide

You can control or disable cookies through your browser settings. However, disabling certain cookies may affect the functionality of our website.

5. Data Security

We take the security of your personal information seriously and have appropriate technical and organisational measures in place to protect personal data against:

• Accidental loss
• Destruction
• Unauthorised access
• Unauthorised use
• Unauthorised disclosure
• Alteration

Access to personal information is restricted to authorised employees, agents, contractors and third-party service providers who need access for legitimate business or claim-related purposes.

Where we use third-party service providers to process personal information on our behalf, we take appropriate steps to ensure they are subject to suitable confidentiality and data protection obligations.

We also have procedures in place to deal with suspected personal data breaches. Where we are legally required to do so, we will notify the relevant regulator and/or affected individuals.

6. Data Retention

We will retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including where necessary to:

• Administer and progress a claim
• Meet our legal and regulatory obligations
• Resolve disputes
• Maintain appropriate business records
• Establish, exercise or defend legal claims

The length of time we retain information will depend on the nature of the information and the circumstances in which it was collected.

Where appropriate, you may request deletion of your personal data. However, there may be circumstances where we are legally required, or otherwise entitled, to retain certain information.

Where personal data is anonymised so that individuals can no longer be identified, it may be retained and used for analytical or statistical purposes.

7. Your Legal Rights

Under UK data protection law, you may have a number of rights in relation to your personal data.

Depending on the circumstances, these include the right to:

• Withdraw consent where we rely on your consent to process your information
• Request correction of inaccurate or incomplete personal data
• Request erasure of your personal data in certain circumstances
• Request restriction of the processing of your personal data
• Request access to the personal data we hold about you
• Request a copy of certain personal data in a commonly used electronic format
• Object to processing where we rely on legitimate interests or another applicable legal basis
• Object to direct marketing at any time
• Complain to the Information Commissioner’s Office (ICO) if you believe your personal data has been handled unlawfully

These rights are not absolute and certain legal exemptions or restrictions may apply.

Fees

In most circumstances, requests relating to your personal data will be dealt with free of charge.

However, we may charge a reasonable fee where a request is clearly unfounded, excessive or repetitive, or where permitted by applicable data protection law.

Verification

To protect your personal information, we may need to request additional information from you to verify your identity before responding to a data protection request.

This is intended to ensure that personal information is not disclosed to someone who is not authorised to receive it.

Response Time

We aim to respond to valid data protection requests within one month of receiving the request and any information required to verify your identity.

Where a request is particularly complex or you have made multiple requests, it may take longer to respond. Where this applies, we will let you know and provide an explanation.

Contact Us

If you have any questions about this Privacy Policy, would like to exercise any of your data protection rights, or have concerns about how your information is being handled, please contact One Place using the contact details provided on our website.

You also have the right to contact the Information Commissioner’s Office (ICO) if you are unhappy with how your personal data has been processed.

We ask that you contact us first wherever possible so that we have an opportunity to investigate and resolve your concerns.