BRIEFLINK PRIVACY & FAIR PROCESSING NOTICE

This Privacy & Fair Processing Notice explains how BRIEFLINK LTD collects, uses, shares, stores and otherwise processes personal information in connection with the Brieflink platform, website and related services.

It also explains your rights under UK data protection law.

This Notice does not form part of our contractual Terms of Use.

1. Who we are

BRIEFLINK LTD Company No. 16158516 ICO Registration No. ZC284036 Registered office: 4 Waggon Road, EN4 0HL

Privacy enquiries: privacy@brieflink.co.uk General enquiries: enquiries@brieflink.co.uk

For the processing activities described in this Notice where BRIEFLINK LTD determines why and how personal information is used, BRIEFLINK LTD is the controller.

2. About Brieflink

Brieflink is a professional technology platform designed to help solicitors, law firms, barristers and chambers:

• maintain professional and organisational profiles;
• publish and discover requests for counsel;
• manage relevant availability information;
• express interest in professional opportunities;
• shortlist potential counsel;
• make and respond to booking offers;
• manage instruction and booking workflows;
• facilitate professional introductions; and
• administer related professional Platform activity.

Brieflink is not a law firm, barristers' chambers or legal adviser and is not a party to the professional retainer between the relevant legal professionals or their clients.

3. Scope of this Notice

This Notice applies to personal information we process in connection with:

• Brieflink user accounts;
• professional profiles;
• organisation workspaces;
• instruction and opportunity workflows;
• availability and administrative information;
• booking workflows;
• professional contact introductions;
• subscriptions and billing;
• Platform security;
• customer support;
• communications;
• website and Platform operation; and
• our legal and regulatory obligations.

It may apply to information concerning:

• solicitors and other instructing professionals;
• barristers;
• clerks and chambers personnel;
• law firm personnel;
• organisation administrators;
• prospective or former users;
• professional contacts;
• people who contact Brieflink; and
• limited third-party information entered by professional Users in connection with Platform activity.

This Notice is not intended to describe how a solicitor, law firm, Barrister or Chambers processes information for its own professional purposes outside Brieflink.

Those organisations and professionals may have their own privacy obligations and notices.

4. Our role and the role of professional organisations

Data protection roles depend on the particular processing activity.

BRIEFLINK LTD acts as controller where we determine the purposes and means of processing necessary to operate Brieflink, including activities such as:

• creating and administering Accounts;
• authenticating Users;
• managing Platform permissions;
• providing Platform functionality;
• maintaining Platform security;
• administering subscriptions;
• communicating with Users;
• operating support services;
• recording security and administrative events;
• determining Platform eligibility logic;
• operating Priority Visibility;
• maintaining our own legal and compliance records; and
• improving and administering the service.

Solicitors, law firms, Barristers and Chambers may separately act as controllers where they determine why personal information is entered into or used through Brieflink for their own professional purposes.

For example, a law firm may determine what limited information is appropriate to include when publishing an Instruction Request.

The legal status of each party depends on the actual processing activity and is not determined solely by the description used in a contract.

Where an Organisation asks Brieflink to undertake a processing activity solely on its documented instructions and that activity meets the legal definition of processor activity, appropriate controller-to-processor terms may be required.

INFORMATION WE PROCESS

5. Account and identity information

When you create or use an Account, we may process information such as:

• your name;
• email address;
• Account identifier;
• authentication information;
• Account status;
• assigned Platform role;
• Organisation membership;
• Account creation and administration information;
• authentication or multi-factor authentication events; and
• information concerning your access permissions.

Passwords are handled through our authentication infrastructure. We do not need access to your plain-text password.

6. Professional profile information

Depending on your role, we may process professional information such as:

• professional name;
• professional title;
• firm or Chambers;
• practice areas;
• year of call or professional seniority;
• rights of audience;
• languages;
• professional location;
• professional contact details;
• regulatory or practising information;
• professional biography;
• availability information;
• professional preferences relevant to Platform matching or eligibility;
• organisation association; and
• an optional profile photograph.

Some of this information may be visible to other professional Users where this forms part of the Platform functionality.

7. Organisation information

Where you use Brieflink on behalf of a law firm, Chambers or other professional Organisation, we may process:

• Organisation name;
• Organisation contact information;
• membership records;
• User roles;
• administrator permissions;
• invitations;
• Workspace membership;
• authority or administrative records; and
• actions undertaken through the Organisation Workspace.

An Organisation Administrator may provide us with information about other authorised members of their Organisation.

8. Instruction Request information

Where an instructing professional creates or manages an Instruction Request, we may process information such as:

• practice area;
• hearing or work type;
• court or geographical area;
• hearing date and time;
• expected duration;
• attendance requirements;
• urgency;
• seniority requirements;
• year-of-call requirements;
• language requirements;
• rights-of-audience requirements;
• legal-aid status where relevant;
• response deadlines;
• publication settings;
• visibility settings;
• status information; and
• limited descriptions or notes entered by the User.

Brieflink is designed so that Users should provide only the information reasonably necessary to describe and administer the professional opportunity.

9. What Brieflink is not designed to collect

The Platform is not designed to require or intentionally collect through its ordinary workflow:

• party names solely for conflict checking;
• full case files;
• evidence bundles;
• witness statements;
• medical records;
• detailed evidence;
• detailed conflict information;
• the substance of an external conflict check; or
• unnecessary special-category or criminal-offence information.

Users must not enter unnecessary confidential, privileged, special-category, criminal-offence or other sensitive information into general free-text fields.

Brieflink is not intended to operate as a general case-management, evidence-management or conflict-checking system.

The current Platform does not provide a general user-facing facility for uploading full instruction bundles, case papers or professional verification documents.

10. Third-party information in Instruction Requests

An instructing professional may occasionally enter information that relates to someone who is not a Brieflink User.

This could occur, for example, if limited third-party information is included in:

• an Instruction Request;
• a note;
• an administrative field;
• a diary entry;
• support correspondence; or
• another professional communication.

Professional Users are responsible for minimising this information and ensuring that they are entitled to disclose it.

Where BRIEFLINK LTD processes such information for its own Platform purposes, we process only what is reasonably necessary for those purposes.

Where the information has been entered by an Organisation for a purpose determined by that Organisation, our precise data protection role may depend on the particular activity concerned.

11. Conflict checks

Brieflink does not carry out professional conflict checks.

Our Platform is designed so that, at the appropriate point in the workflow, relevant professional contact information may be made available so that solicitors, Barristers or Chambers can undertake required conflict and pre-instruction checks directly.

Those checks take place outside Brieflink unless we expressly state otherwise.

We do not require detailed conflict-search results or information about the substance of a conflict check merely to record that the relevant professional process has been completed.

Users should not enter detailed conflict information into general Platform fields.

12. Availability and administrative information

We may process information entered by Users or authorised administrators concerning:

• professional availability;
• diary availability relevant to Platform use;
• administrative preferences;
• booking availability;
• organisation allocation;
• delegated actions; and
• related professional administration.

Where a clerk or administrator acts for a Barrister or Organisation, we may record which authenticated User performed the action.

13. Booking and workflow information

We process information about the progress of opportunities through the Platform, which may include:

• expressions of interest;
• shortlist activity;
• Booking Offers;
• acceptance or decline actions;
• booking status;
• conflict-check confirmations;
• cancellation or reopening activity;
• status changes;
• timestamps;
• responsible Users; and
• related workflow events.

These records help operate the service, provide accountability, support Users and maintain an appropriate record of Platform activity.

A Platform booking record does not itself make Brieflink a party to the underlying professional retainer.

14. Subscription and billing information

Where you or your Organisation purchases a paid Brieflink service, we may process:

• Subscription type;
• billing status;
• customer or billing identifiers;
• transaction status;
• invoice or payment-related information;
• Subscription dates; and
• limited payment information returned by our payment provider.

Payment processing is provided using third-party payment infrastructure.

Brieflink does not need to store complete payment-card credentials in order to operate the Subscription service.

Counsel's professional fees are separate from Brieflink Subscription charges. Brieflink does not collect or distribute counsel's professional fees.

15. Communications and support information

If you contact us, we may process:

• your name;
• email address;
• Organisation;
• the content of your enquiry;
• support history;
• attachments or information you choose to send us;
• correspondence records; and
• information reasonably required to investigate or resolve your enquiry.

You should avoid sending unnecessary client, case or other sensitive information when contacting Brieflink support.

16. Technical, security and audit information

When you use Brieflink, our systems may create technical and security records such as:

• IP-derived security or rate-limiting information;
• timestamps;
• Account identifiers;
• login and authentication events;
• multi-factor authentication events;
• last-seen or recent-activity timestamps;
• administrative actions;
• security events;
• request information;
• technical error information;
• device or browser information where available; and
• audit records.

We use this information to protect Accounts, detect misuse, maintain system integrity, investigate incidents and administer the Platform.

We do not use these security records to monitor Users for unrelated purposes.

17. Profile photographs

Users may optionally provide a profile photograph where that functionality is available.

Profile photographs are used to support professional profiles and identification within the Platform.

Users should upload only photographs that they are entitled to use.

A profile photograph should not contain unnecessary information about another person.

WHERE INFORMATION COMES FROM

18. Sources of personal information

We may obtain personal information:

Directly from you

For example, when you:

• create an Account;
• complete a profile;
• update professional information;
• join an Organisation;
• create or respond to an Instruction Request;
• manage availability;
• purchase a Subscription;
• contact support; or
• otherwise use the Platform.

From your Organisation

For example, where an authorised Administrator:

• invites you to a Workspace;
• assigns a role;
• maintains professional information;
• manages permissions; or
• takes authorised administrative action on your behalf.

From other professional Users

For example, when another User:

• invites you to an Organisation;
• sends a Booking Offer;
• shortlists you;
• records an authorised delegated action; or
• enters limited information relating to a professional interaction.

From public professional sources

We may check information against publicly available professional or regulatory sources where reasonably necessary to verify professional status or protect the integrity of the Platform.

From our service providers

We may receive information such as:

• payment status;
• email delivery status;
• authentication information;
• security information; or
• technical service information

from providers used to operate Brieflink.

WHY WE USE INFORMATION

19. Purposes and lawful bases

The lawful basis depends on the particular processing activity and our relationship with the individual concerned.

Where we rely on legitimate interests, the relevant interests may include:

• operating a secure professional platform;
• facilitating legitimate professional connections;
• preventing fraud and misuse;
• protecting Users and Organisations;
• maintaining accurate professional information;
• administering and improving Platform operations;
• maintaining appropriate audit evidence;
• supporting Users;
• enforcing our contractual rights; and
• establishing, exercising or defending legal rights.

We consider whether those interests are necessary and balanced against the rights and interests of affected individuals.

20. Where we rely on contract

We rely on contractual necessity only where the processing is objectively necessary to:

• enter into a contract with you; or
• perform our contractual obligations to you.

Not every processing activity associated with a Brieflink User is therefore treated as contractual processing.

For example, some security, fraud-prevention and legal-compliance processing is based on legitimate interests or legal obligation instead.

21. Special-category and criminal-offence information

Brieflink does not ordinarily need special-category personal information or criminal-offence information to provide its core service.

Users are instructed not to enter such information unless genuinely necessary and legally appropriate.

If BRIEFLINK LTD knowingly needs to process special-category or criminal-offence information, we will identify an appropriate lawful basis and any additional legal condition required before undertaking that processing.

The fact that a professional User independently enters information into the Platform does not necessarily mean that Brieflink requested or intended to collect that category of information.

PROFESSIONAL DISCOVERY AND VISIBILITY

22. Eligibility

Brieflink may use information supplied by Users to determine which opportunities or professionals meet specified Platform criteria.

Criteria may include:

• practice area;
• hearing type;
• location;
• date and time;
• attendance requirements;
• seniority;
• year of call;
• language;
• rights of audience;
• availability; and
• other objective criteria selected through the Platform.

This processing helps avoid displaying opportunities or professionals that do not meet relevant requirements.

23. Priority Visibility

Certain eligible Barristers may subscribe to Priority Visibility.

Where it applies, Priority Visibility may affect the order or prominence in which an otherwise eligible Barrister is displayed.

It does not:

• override mandatory eligibility requirements;
• make an ineligible Barrister eligible;
• determine professional competence;
• automatically shortlist a Barrister;
• automatically generate a Booking Offer;
• accept an instruction;
• determine professional suitability; or
• make a final booking decision.

The instructing professional remains responsible for deciding whom to shortlist and approach.

24. Automated processing and decision-making

Brieflink uses deterministic software rules to operate parts of the Platform, including eligibility and display ordering.

We do not currently use artificial intelligence to make professional selection or booking decisions.

We do not use solely automated processing to take a decision about a User that produces a legal effect or similarly significant effect merely because:

• a professional meets or does not meet an opportunity's eligibility criteria; or
• Priority Visibility changes display order.

Final decisions about shortlisting, making a Booking Offer and accepting professional instructions remain with human professional Users.

If we introduce processing that involves solely automated significant decision-making within the meaning of applicable data protection law, we will update this Notice and provide the safeguards required by law.

COMMUNICATIONS

25. Service communications

We may send communications necessary for use of the Platform, such as:

• Account messages;
• authentication or security messages;
• Organisation invitations;
• Instruction Request notifications;
• workflow notifications;
• Booking Offer notifications;
• Subscription or payment communications;
• changes materially affecting the service;
• changes requiring contractual acceptance; and
• support communications.

These are service communications rather than optional promotional marketing where they are necessary to provide or administer the service.

26. Marketing

Brieflink does not currently operate a general Platform marketing-subscription system using marketing consent, unsubscribe and suppression functionality.

We will not describe a person as having consented to marketing unless an appropriate consent mechanism has actually been used.

If we introduce optional electronic marketing through the Platform, we will implement the appropriate preference and unsubscribe controls and update this Notice where necessary.

This does not prevent Brieflink from communicating directly with businesses or professionals where a lawful basis and applicable electronic-marketing rules permit that communication.

WHO WE SHARE INFORMATION WITH

27. Other Brieflink Users

Information may be shared with other professional Users where this is necessary for Platform functionality.

For example:

• professional profile information may be displayed to relevant Users;
• an Instruction Request may be displayed to eligible professionals;
• expressions of interest may be displayed to the instructing User;
• shortlisted professionals may become visible within relevant workflows;
• professional contact details may be disclosed at an appropriate stage; and
• relevant Organisation members may see activity within their Workspace.

We apply Platform roles and permissions to limit access according to the relevant functionality.

28. Organisations

If you are a member of a law firm, Chambers or other Organisation Workspace, authorised members of that Organisation may be able to access information relating to:

• your professional profile;
• your Organisation membership;
• relevant Platform activity;
• permissions;
• availability;
• delegated actions; and
• relevant instruction or booking administration.

The precise visibility depends on the permissions and functionality made available through the Platform.

29. Service providers

We use third-party service providers to operate Brieflink.

Current providers include services supporting:

Cloudflare

Infrastructure, delivery, network and security-related services.

Supabase

Database, authentication, storage and related backend infrastructure.

Stripe

Subscription and payment processing.

Resend

Transactional and service email delivery.

Google / Gmail

Certain business email and communications functions.

Browser and device providers

Where web-push or browser-level functionality is enabled, relevant browser or operating-system providers may process information necessary to deliver that functionality.

These providers process information according to their role and the services they provide.

We disclose only information reasonably necessary for the relevant service.

30. Professional advisers and authorities

We may disclose personal information where reasonably necessary to:

• lawyers;
• accountants;
• insurers;
• auditors;
• professional advisers;
• regulators;
• courts;
• law-enforcement authorities; or
• other competent authorities.

We will do so where required by law or where necessary for legitimate purposes such as establishing, exercising or defending legal rights.

31. Corporate transactions

If BRIEFLINK LTD is involved in a genuine:

• restructuring;
• financing;
• merger;
• acquisition;
• sale of business or assets; or
• similar corporate transaction,

relevant information may be disclosed to appropriate parties and advisers subject to suitable confidentiality and data-protection arrangements.

32. We do not sell personal information

BRIEFLINK LTD does not sell User personal information to data brokers or advertisers.

Paid Priority Visibility concerns the positioning of an eligible professional within the Brieflink service. It does not involve selling another User's personal information to that professional.

INTERNATIONAL PROCESSING

33. International transfers

Some of the service providers used to operate Brieflink may process information outside the United Kingdom or permit access from outside the United Kingdom.

Where our use of a provider involves a restricted transfer of personal information, we will ensure that the transfer is covered by a mechanism permitted by UK data protection law.

Depending on the destination and recipient, this may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved EU Standard Contractual Clauses;
• another legally recognised safeguard; or
• an applicable exception where the law permits its use.

Where required when relying on appropriate safeguards, we assess the relevant transfer risks and any additional protections needed.

You may contact privacy@brieflink.co.uk for further information about safeguards applicable to a relevant transfer.

SECURITY

34. How we protect information

We use technical and organisational measures intended to protect personal information against:

• unauthorised access;
• accidental loss;
• inappropriate alteration;
• unlawful disclosure; and
• misuse.

Measures used within the Platform may include, as appropriate:

• authenticated access;
• role-based permissions;
• private storage;
• encryption in transit;
• security controls provided by our infrastructure providers;
• multi-factor authentication for relevant access;
• logging and audit records;
• rate-limiting or abuse-prevention measures; and
• administrative access controls.

No online service can guarantee absolute security.

Users are also responsible for protecting their own login credentials, devices and professional systems.

35. Security monitoring

We may use security and audit information to:

• detect unauthorised access;
• investigate suspected compromise;
• protect Accounts;
• enforce rate limits;
• investigate misuse;
• maintain audit evidence; and
• protect the security and integrity of the Platform.

Security information is not used to make substantive legal or professional decisions about instructions.

RETENTION

36. How long we retain information

We retain personal information only for as long as it is reasonably necessary for the purpose for which it is processed, taking account of:

• the nature of the information;
• the purpose for which it was collected;
• our contractual obligations;
• professional Platform requirements;
• security needs;
• legal and regulatory requirements;
• accounting obligations;
• limitation periods;
• the need to establish, exercise or defend legal claims; and
• whether continued retention remains proportionate.

Different categories of information therefore have different retention periods.

Further category-specific information may be provided through Brieflink's published privacy information.

37. Account closure does not mean immediate deletion of every record

Closing or deleting an Account does not necessarily require or result in the immediate deletion of every record connected with that Account.

We may need to retain appropriate information concerning matters such as:

• historic Organisation activity;
• Instruction Request records;
• booking and status history;
• security records;
• administrative audit records;
• Subscription and accounting information;
• support correspondence;
• contractual records;
• legal claims; and
• compliance records.

Where continued retention is no longer justified, information should be deleted or anonymised in accordance with the applicable retention rules.

38. Account deletion and erasure requests

An Account-deletion function and a data-protection erasure request are not necessarily the same thing.

If you exercise a legal right to erasure, we assess the request across the relevant information and systems rather than treating Account closure alone as the determination of the request.

The right to erasure is not absolute.

We may retain information where an applicable legal basis permits or requires us to do so, for example where information is needed for:

• legal obligations;
• the establishment, exercise or defence of legal claims;
• security or fraud prevention; or
• another lawful purpose that overrides or limits the request under applicable law.

Where information can appropriately be deleted, we will take reasonable steps to do so across relevant active systems.

YOUR RIGHTS

39. Your data protection rights

Depending on the circumstances, you may have the right to:

• be informed about how your personal information is used;
• request access to your personal information;
• request correction of inaccurate information;
• request completion of incomplete information;
• request erasure of personal information;
• request restriction of processing;
• object to certain processing;
• receive certain information in a portable format;
• withdraw consent where processing depends on consent; and
• exercise rights concerning qualifying automated decision-making.

These rights do not all apply in every circumstance.

Exemptions and limitations may apply under data protection law.

40. Exercising your rights

To exercise a data protection right, contact:

privacy@brieflink.co.uk

Please explain:

• who you are;
• the right you wish to exercise; and
• enough information for us to identify the relevant records.

We may ask for proportionate information to verify your identity where reasonably necessary.

You are not normally required to pay a fee to exercise your data protection rights.

We will respond within the period required by applicable law.

Where the law permits an extension because a request is complex or numerous, we will tell you.

41. Information concerning another person

Your data protection rights relate to your own personal information.

Where records also contain information relating to another person, legal or confidentiality considerations may affect what we can disclose.

This is particularly relevant in a professional legal environment.

42. Objecting to legitimate-interests processing

Where we rely on legitimate interests, you may have a right to object to the processing.

We will consider the circumstances and whether we have compelling legitimate grounds to continue the processing or whether processing remains necessary for the establishment, exercise or defence of legal claims.

CHILDREN

43. Children

Brieflink is a professional service intended for adult legal professionals and professional organisations.

Users must be at least 18 years old to create a professional Account.

The Platform is not directed at children.

Information concerning a child may nevertheless appear incidentally where a professional User enters limited information connected with a legal matter.

Users must apply particular care to such information and must not enter children's personal information unless it is genuinely necessary, proportionate and legally appropriate.

COOKIES, STORAGE AND NOTIFICATIONS

44. Cookies and browser storage

Brieflink may use cookies, browser storage or similar technologies where necessary to:

• authenticate Users;
• maintain sessions;
• protect Account security;
• remember necessary settings;
• operate core Platform functionality; and
• support related technical functions.

Further information is provided in the Brieflink Cookie & Storage Notice where that Notice has been published.

Where a technology requires consent under applicable electronic-communications law, we will obtain the required consent before using it.

45. Push notifications

Where web-push or similar notification functionality is available, notifications require permission through your browser or device.

Your browser or device provider may process technical information in order to deliver those notifications.

You can normally withdraw notification permission through your browser or device settings.

DATA PROTECTION COMPLAINTS

46. Complaints to Brieflink

If you believe we have handled your personal information improperly, you may make a data protection complaint to:

privacy@brieflink.co.uk

Please state that you are making a data protection complaint and provide enough information for us to understand and investigate the issue.

We will take appropriate steps to investigate the complaint, keep you appropriately informed and provide an outcome within the period required by applicable law.

A data protection complaint is separate from a request to exercise one of your information rights, although you may make both at the same time.

47. Complaints to the Information Commissioner's Office

You also have the right to complain to the Information Commissioner's Office (ICO), the United Kingdom's data protection supervisory authority.

We would normally welcome the opportunity to consider your concern first, but you are not required to give up your right to contact the ICO.

CHANGES TO THIS NOTICE

48. Changes

We may update this Notice to reflect:

• changes to Brieflink;
• changes in our processing activities;
• new service providers;
• changes in data protection law;
• regulatory guidance;
• security requirements; or
• improvements to the information we provide.

The current version will display its effective date.

Where a change materially affects how we process personal information, we will take appropriate steps to bring the change to the attention of affected individuals.

The Privacy & Fair Processing Notice is a transparency document and does not form part of the Brieflink Terms of Use.

CONTACT

49. Privacy contact

Questions about this Notice, our processing of personal information or your data protection rights should be sent to:

BRIEFLINK LTD Company No. 16158516 ICO Registration No. ZC284036 4 Waggon Road EN4 0HL

Privacy: privacy@brieflink.co.uk

General enquiries: enquiries@brieflink.co.uk