Privacy notice
How MatterLink handles personal data it holds in its own right. If you are a client of a solicitor who uses MatterLink, section 1 tells you where to look instead.
Which personal data this notice covers
MatterLink handles personal data in two quite different roles, and this notice covers only one of them. Getting this distinction right is the first thing a compliance reader will check, so it is the first thing on the page.
| Personal data | Our role | Where to look |
|---|---|---|
| People who visit our website, ask for a demo, or hold a MatterLink account at a solicitor firm — and our own business records | Controller | This notice |
| Clients, sellers, purchasers and other parties whose details a firm enters into a transaction | Processor, acting on the firm’s instructions | Data processing, and the firm’s own privacy notice |
If you are a client of a solicitor who uses MatterLink
Your solicitor is in charge of your information, not us. We hold it only to provide their software, and we act only on their instructions. Ask your solicitor if you want to see, correct or delete anything, or if you want to know how long they keep it — they are the right person to answer, and they have to. If you want to understand our side of it, the data processing page sets out what we do and do not do with it.
Who we are
The controller for the personal data described in this notice is MatterLink Ltd, a company registered in Scotland (number [Company number]), whose registered office is at [Registered office address], Glasgow, [Postcode].
We are registered with the Information Commissioner’s Office under registration [ICO registration number].
We have not appointed a data protection officer. We are not required to under Article 37 of the UK GDPR: we are not a public authority, and our own controller activities do not involve large scale regular and systematic monitoring or large scale processing of special category data. Data protection questions come to a named person rather than a role inbox — privacy@matterlink.co.uk reaches us directly.
What we collect, and where it comes from
If you enquire or book a demo
Your name, your firm, your work email address and phone number, and whatever you choose to tell us in the message. It comes from you.
If you hold a MatterLink account
Your name, work email address, the firm you belong to, your role within it, your password in hashed form (we never see it), and any multi-factor authentication settings. It comes from you or from your firm’s administrator.
Whenever anyone uses the service
Records of significant actions — who did what, in which firm, and when — as an audit trail; sign-in events; and technical logs including IP address, browser type and the pages requested. These are generated automatically. The audit trail is a deliberate product feature, not incidental logging: it exists so a firm can answer questions about who changed what.
Our own business records
Correspondence with you, notes of calls, contract records and, on paid plans, billing details. Payment card details are handled by our payment provider and never reach our systems.
What we do not do
- We do not buy personal data or scrape it from third-party sources.
- We do not use tracking or advertising cookies (see section 6).
- We do not send any personal data to any artificial intelligence model or model provider, for any purpose.
What we use it for, and our lawful basis
| Purpose | Data | Lawful basis |
|---|---|---|
| Responding to an enquiry or arranging a demo | Enquiry details | Legitimate interests — responding to someone who has asked us to get in touch. If it leads towards a contract, Article 6(1)(b). |
| Providing the service to your firm and administering accounts | Account details | Article 6(1)(b) where you contract with us personally; otherwise legitimate interests in performing our contract with your firm. |
| Keeping the service secure — sign-in monitoring, abuse prevention, audit | Account details, technical logs, audit records | Legitimate interests in protecting the confidentiality of legal data, which is also a security obligation under Article 32. |
| Support, and fixing faults | Account details, correspondence, logs | Legitimate interests in making the product work. |
| Improving MatterLink | Aggregate usage patterns, feedback you give us | Legitimate interests in developing the product. We do not use the contents of your firm’s matters for this. |
| Telling firms about the product | Work contact details | Legitimate interests in marketing to businesses, or consent where required. Every message has an unsubscribe link and we honour it immediately. |
| Billing, accounts and tax (paid plans) | Billing contact and transaction records | Legal obligation, and legitimate interests in getting paid. |
| Complaints, disputes and legal claims | Whatever is relevant | Legal obligation, and legitimate interests in establishing, exercising or defending claims. |
| Responding to a regulator, or reporting something we are required or entitled to report | Whatever is relevant | Legal obligation, or the recognised legitimate interest in Article 6(1)(ea) of the UK GDPR where it applies. |
Where we rely on legitimate interests, we have weighed those interests against your rights and concluded they do not override them. We will explain that assessment if you ask.
Special category and criminal offence data
We do not ask for, and have no use for, special category data or criminal offence data about the people covered by this notice. A firm’s conveyancing matter may occasionally contain such data — a client’s health, for example, in the background to a sale. Where it does, we hold it only as that firm’s processor, on the firm’s lawful basis and its Schedule 1 condition, and we do not use it for any purpose of our own.
Where your data is held
The database and all stored files are in the United Kingdom, in Amazon Web Services’ London region (eu-west-2). Everything in transit is protected with TLS; everything stored is encrypted at rest with AES-256.
We do not routinely transfer personal data outside the UK. If a supplier ever needed to process data elsewhere — for example, support staff in another country — we would only do it under a transfer mechanism recognised by the UK GDPR, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, after a transfer risk assessment. Any such arrangement would be named on the data processing page before it started, with notice to affected firms.
How long we keep it
| What | How long | Why |
|---|---|---|
| Enquiries that do not become a customer relationship | 12 months from the last contact | Long enough to pick up a conversation, short enough not to hoard. |
| Account records for a user | While the account is active, then 5 years | The short negative prescriptive period under the Prescription and Limitation (Scotland) Act 1973. |
| Audit trail for a transaction | For as long as the firm’s data is held, then deleted with it under section 18 of the terms | An audit trail that outlives its subject matter serves nobody. |
| Technical and security logs | 12 months | Long enough to investigate an incident found late. |
| Accounting and tax records | 6 years from the end of the financial year | Companies Act and HMRC requirements. |
| Correspondence about a complaint or claim | 5 years from resolution | Prescription, as above. |
Content that belongs to a firm follows that firm’s instructions and the termination provisions in section 18 of the terms of service, not this table. Deletion from routine backups happens as those backups age out rather than instantly.
Automated decision-making
We do not make automated decisions that produce legal effects for you or similarly significantly affect you, and we do not profile you. MatterLink calculates progress from the statuses people have set — it does not decide anything about a person.
Your rights
In relation to personal data we hold as controller, you can ask us to:
- give you a copy of it, and tell you what we do with it;
- correct anything inaccurate or incomplete;
- delete it, where we no longer need it and no legal obligation requires us to keep it;
- restrict what we do with it while a question about it is resolved;
- transfer it to you or someone else in a structured, machine-readable format, where we hold it on the basis of consent or a contract and process it automatically;
- stop processing it where we rely on legitimate interests, and stop using it for direct marketing — for marketing, this one is absolute and we will act on it immediately.
Where we rely on your consent for anything, you can withdraw it at any time. That does not affect what we did before you withdrew it.
Write to privacy@matterlink.co.uk. We will respond within one month, and will tell you if we need to extend that by up to two further months because the request is complex. We may ask you to confirm your identity first, and we may ask you to narrow a very wide request so that we can search reasonably and proportionately for what you are actually looking for — if we do, the clock pauses until you come back to us. It is free unless a request is manifestly unfounded or excessive, in which case we will tell you why before doing anything.
If your request is about a conveyancing matter, we are the processor and not the controller. Send it to the solicitor firm instead — we will point you to them, and we will help them answer it.
How to complain
If you think we have handled your personal data badly, tell us first. We would rather fix it than have you find out from the regulator that we should have.
- By electronic form: matterlink.co.uk/privacy/complaint
- By email: privacy@matterlink.co.uk
- By post: Data Protection, MatterLink Ltd, [Registered office address], Glasgow, [Postcode]
We will acknowledge your complaint within 30 days of receiving it, as section 164A of the Data Protection Act 2018 requires, and then take appropriate steps to respond to it — including investigating and telling you the outcome.
You can also complain to the Information Commissioner’s Office at any time, and you do not have to come to us first — though the ICO will normally expect you to have tried.
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline 0303 123 1113 · ico.org.uk
Changes to this notice
We will update this notice when what we do changes, and when the law does. The version number and date at the top of the page tell you which version you are reading. If a change materially affects how we use personal data about you, we will tell you directly rather than relying on you noticing — by email where we hold an address for you, and by a notice in the service for account holders.