Privacy Policy

1. Who we are and how to contact us

The Ex Files is the trading name of Rachael Amelia Harwin, a sole trader, who is the controller responsible for the personal information described in this policy. “We”, “us” and “our” mean that business.

We provide online family law advice and document drafting services concerning England and Wales, including Know Your Position, Check Your Deal and Make It Legal, and a personalised Free Divorce Guide. The business provides unreserved legal services and is not an SRA-authorised firm. Our services are delivered by Rachael Amelia Harwin, an individually regulated solicitor. Data protection law applies to our business irrespective of its regulatory status.

For privacy questions, rights requests or complaints, contact Rachael:

• Email: info@theexfiles.co.uk
• Business address for correspondence: Office 171956, PO Box 7169, Poole, BH15 9EL

Please say if you need this information in another accessible format or need a safe alternative means of communication.

2. Who this policy covers

This policy covers website visitors, people making enquiries or requesting our guide, prospective and existing clients, and other people whose information is relevant to an enquiry or matter. These may include spouses, former partners, children, dependants, witnesses, representatives and professional advisers.

It explains our use of information under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended, including by the Data (Use and Access) Act 2025. It does not give us permission to use information for any purpose we choose. We must have a lawful basis and comply with the applicable requirements for each use.

3. Information we collect

Depending on your interaction with us, we collect:

• Identity and contact information: names, former names, relevant dates of birth, addresses, email addresses and contact preferences. We request identity or authority evidence where proportionate and necessary.
• Account information: registration and purchase records, account identifiers, authentication information and account activity. When you complete the pre-purchase form, we save your registration details so that we can carry out conflict checks and clear or block your proposed order before payment. This creates a preliminary registration record, rather than a full account you can log into. After purchase, we ask you to confirm your email address as part of completing your account setup.
• Enquiries and conflict information: your enquiry, the identities of relevant parties, relationships between them and limited records of conflict-check outcomes.
• Family and matter information: marital and relationship history, children and dependants, relevant living arrangements, divorce eligibility answers, correspondence, instructions, legal documents, advice, draft agreements and reports.
• Financial information: income, expenditure, assets, liabilities, pensions, property interests, financial disclosure and supporting documents.
• Booking and payment information: the service purchased, appointments, invoices, payment status, refunds, transaction references and relevant billing information. Card details entered into Stripe’s payment service are processed by Stripe; please do not send us full card details or security codes by email or upload.
• Communications: emails, messages, questionnaire responses, meeting notes and, only where separately agreed as described below, meeting recordings and related transcripts.
• Technical information: IP addresses, device and browser information, access times, security and error logs, and Activity Log records, including the IP address of the customer who performed the recorded action. We also collect information through cookies or similar technologies as explained in section 12.

Family law information can reveal health, disability, racial or ethnic origin, religion, sex life or sexual orientation, or other special categories of personal information. It may also contain allegations, investigations or convictions concerning criminal offences, including allegations of domestic abuse. We only process these categories where necessary and legally permitted. Financial information is sensitive in ordinary language, although it is not automatically “special category” information under the UK GDPR.

Please provide only information relevant to the service. Avoid submitting detailed case histories or sensitive documents through an initial general enquiry. We will explain how to provide documents when needed.

4. Where information comes from

We receive information directly from you through our website, account portal (your “Ex File”), questionnaires, documents, payments, appointments and communications. We may also receive relevant information from our client, an authorised representative, another party or their adviser, documents supplied in the matter, and payment or technology providers.

Where necessary for a particular matter, we may consult relevant public registers or other lawful public sources, such as Companies House or HM Land Registry. We do not collect information simply because it is available online.

Where we receive information about someone else, we remain responsible for using it lawfully. A client cannot consent on behalf of their former partner merely by sending us their details. We provide privacy information to people whose data we obtain indirectly within the applicable time limits, unless a specific legal exception applies. We assess exceptions individually, including where notifying someone would seriously impair the purpose of the processing or breach a legally regulated duty of professional secrecy. We do not assume that all family matters are exempt. We also consider confidentiality and the safety of affected people.

5. Our purposes and lawful bases

Respond to your request, assess the service you seek and take steps towards an engagement

Information used: Contact details, enquiry and relevant preliminary information

Lawful basis under Article 6 UK GDPR: Article 6(1)(b), steps at your request before a contract; Article 6(1)(f), legitimate interests in responding to general enquiries where no contract is contemplated

Provide paid services, organise appointments, prepare advice and documents, maintain your Ex File and communicate about your matter

Information used: Account, family, financial, document and communication information

Lawful basis under Article 6 UK GDPR: Article 6(1)(b), performance of our contract with you

Provide the free guide you request

Information used: Contact details and relevant questionnaire answers

Lawful basis under Article 6 UK GDPR: Article 6(1)(f), our legitimate interests in providing the requested information service and your interest in receiving it

Use information about people who are not our contracting client

Information used: Relevant third-party identity, family, financial and matter information

Lawful basis under Article 6 UK GDPR: Article 6(1)(f), legitimate interests in providing legal advice and protecting or establishing legal rights, balanced against the rights of those people

Check and manage conflicts and protect confidential information

Information used: Limited identities, relationships, matter references and relevant conflict information

Lawful basis under Article 6 UK GDPR: Article 6(1)(f), legitimate interests in avoiding conflicting engagements and protecting confidentiality; Article 6(1)(c) where a specific binding legal or professional obligation requires the processing

Collect fees, issue invoices, deal with refunds and maintain business accounts

Information used: Billing, transaction and service records

Lawful basis under Article 6 UK GDPR: Article 6(1)(b) for your payments and refunds; Article 6(1)(c) for applicable tax and accounting requirements

Protect the website and accounts, investigate misuse and maintain reliable systems

Information used: Relevant technical, account and security records

Lawful basis under Article 6 UK GDPR: Article 6(1)(f), legitimate interests in security, fraud prevention and reliable service delivery

Handle complaints, notify insurers where appropriate, and establish, exercise or defend legal claims

Information used: Relevant matter, communication and complaint records

Lawful basis under Article 6 UK GDPR: Article 6(1)(f), legitimate interests in resolving complaints, protecting legal rights and managing insurance; Article 6(1)(c) where disclosure or action is required by law

Meet a court order or other applicable legal obligation

Information used: Information necessary for the particular obligation

Lawful basis under Article 6 UK GDPR: Article 6(1)(c), compliance with that obligation

Make an optional meeting recording

Information used: Voice, image and relevant discussion

Lawful basis under Article 6 UK GDPR: Article 6(1)(a), consent, with separate explicit consent where required for special category information

Use cookies or similar technologies requiring consent

Information used: Relevant device and browsing information

Lawful basis under Article 6 UK GDPR: Consent under PECR and Article 6(1)(a) where personal information is processed on that basis

Where we rely on legitimate interests, we assess necessity, your reasonable expectations and the possible impact on you, particularly for children, vulnerable people and confidential family information. You can ask us about that assessment and object as explained below. A professional rule is not a blanket justification for retaining all information indefinitely.

Additional conditions for particularly sensitive information

For special category information necessary for legal advice, actual or prospective proceedings, or establishing, exercising or defending legal rights, we generally rely on Article 9(2)(f). This condition applies only where the particular use is necessary; it is not permission to collect unrelated sensitive information.

For relevant criminal offence information, we require an Article 6 basis and authority under Article 10 and the Data Protection Act 2018. Where necessary for legal proceedings, obtaining legal advice or establishing, exercising or defending legal rights, we rely on Schedule 1, Part 3, paragraph 33 of that Act.

For an optional use outside these conditions, such as recording a consultation containing special category information, we obtain the necessary separate consent or identify another valid condition before processing. If no appropriate basis and condition exist, we do not carry out that use. We keep any additional policy documentation required for the conditions we use.

6. Conflict checks and personalised guide logic

Our website compares the identifying details supplied at registration, including relevant former-partner details, against a restricted conflict register. A clear match can prevent an online booking; an uncertain match is referred for review. The purpose is to avoid conflicting engagements and protect confidential information. A match is not proof that a named person is or has been our client. We use a general response and do not disclose another person’s relationship with us.

If the check prevents you from proceeding, you can email info@theexfiles.co.uk to ask Rachael to review the decision, explain your circumstances or correct an apparent error. A person with authority to change the outcome will consider the request. We may be unable to disclose confidential reasons, but will explain what we lawfully can.

The free guide uses rules based on your questionnaire answers, including your connections with England and Wales, to select relevant sections and display eligibility information. This affects the guidance shown and may indicate that we cannot confirm eligibility. It is based on the answers provided and is not a court determination. You can ask us to review an apparent error or explain an outcome.

We do not use special category information to make solely automated decisions with legal or similarly significant effects. Where an automated outcome otherwise has such effects, we apply the safeguards required by the UK GDPR, including information about the decision and opportunities to make representations, obtain human intervention and contest it.

7. Consultations and recordings

Consultations take place using Microsoft Teams. Meeting invitations and reminders contain your name, the service, date, time and meeting link. We aim to use minimal, neutral calendar information and avoid including detailed family or financial information in invitations.

We do not record a consultation merely because you have accepted our terms or attended the meeting. Before an optional recording, we explain its purpose, who can access it, whether transcription is involved and how long it will be kept, and obtain the necessary separate agreement from participants. You can decline recording without losing access to the consultation, or ask us to stop. We can instead take written notes.

We do not enable AI meeting summaries or other AI processing of your matter without first assessing the provider and lawful basis, updating the relevant information and obtaining consent where required. An ordinary recording consent does not automatically authorise a separate AI use.

8. Who receives information

We share only what is necessary for the particular purpose, with appropriate safeguards. Recipients may include:

• People authorised to work on our matters or administer our business, subject to confidentiality and access restrictions.
• Our website host, the developer maintaining the website, and providers of account systems, security, backups and technical support. Access is restricted to what their work requires.
• Microsoft, as the provider of Microsoft 365 for Business, for business email, calendars, document and financial-schedule storage and collaboration, and Microsoft Teams consultations, as applicable to the services we use. Any additional provider connecting our website to these services receives only the information necessary for that function.
• Stripe and relevant banks or payment providers for payment processing, refunds, fraud prevention and payment disputes.
• Accountants, legal advisers and professional indemnity insurance providers where necessary. Our supplied insurance documents name Professional Liability Brokers Limited (trading as PLB Professional Indemnity Brokers), XS Assure Limited and SCOR UK Company Limited. Only relevant information is shared for insurance administration or a claim.
• Other professional advisers, your authorised representative, or other parties and their advisers where necessary and appropriate for the agreed service, your lawful instructions or legal rights. We do not routinely send your file to your former partner.
• Courts, regulators, public authorities and law enforcement bodies where disclosure is required or otherwise lawfully justified.

Providers processing information on our instructions must have appropriate contractual obligations, including security and confidentiality. Some recipients, such as payment providers, insurers and professional advisers, also act as independent controllers for their own legally defined purposes and explain those uses in their own privacy notices. We can identify relevant providers on request.

We do not sell personal information or provide client information to advertisers.

9. International processing

Some technology providers and their support teams or subcontractors may process information outside the UK. We check the arrangements before using them and apply the UK GDPR’s international transfer requirements where relevant.

For restricted transfers, we use applicable UK adequacy arrangements or appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to EU standard contractual clauses, with the required assessment and supplementary protections. We do not assume that a UK account or UK-facing website means all processing stays in the UK.

Contact us for details of the countries and safeguards relevant to your information and how to obtain a copy of the applicable safeguards, subject to lawful redactions.

10. How long we keep information

We retain information only for as long as justified by its purpose. The following schedule applies unless a specific legal obligation, complaint, dispute, safeguarding concern or legal hold justifies a different period. We document exceptions and review their continuing necessity.

Free Divorce Guide requests and questionnaire answers

Delete or anonymise no later than 24 months after delivery; earlier where the purpose has ended and there is no justification to retain them

Client matter files, substantive preliminary advice and associated correspondence

Normally retain for 6 years from closure or the end of the substantive engagement, then review promptly for secure deletion or anonymisation; retain longer only for a documented, matter-specific reason

Minimal conflict register for substantive prospective and actual engagements

Review entries every 6 years from matter closure or, where no matter is opened, from the last substantive interaction. Retain a limited record only while an identified continuing confidentiality or conflict risk makes it necessary. Review sooner where a rights request, correction or material change in circumstances calls its continued retention into question; securely delete or anonymise information that is no longer needed.

Routine appointment recordings and transcripts, if separately agreed

Delete within 90 days of the consultation after preparing and checking any necessary written record, unless an identified complaint, dispute or other documented legal reason justifies longer retention

Tax and accounting records

Keep for the period required by the tax rules applicable to our sole-trader business, normally at least 5 years after the 31 January submission deadline for the relevant tax year; longer where a specific rule or enquiry requires it

Website Activity Log and related technical and security records

Activity Log records, including the IP address of the customer who performed the recorded action, are normally retained for 6 years from the date of that action to provide an audit trail of website and customer activity, investigate misuse or disputes and protect legal rights. Other technical and security records are kept only for as long as necessary for their documented purpose. We assess requests for earlier deletion individually and delete or anonymise records at the end of the applicable period unless a documented legal reason justifies longer retention.

Privacy requests and complaint handling records

Normally 6 years after resolution, subject to necessity and proportionality review and removal of unnecessary underlying material

Payment records may remain in our business accounts after a client portal account is closed where required for accounting or other justified purposes. If information from a guide or enquiry becomes relevant to a client engagement, the relevant material follows the client-file schedule, rather than remaining as an unnecessary duplicate.

Preliminary registration details are saved before payment to enable conflict checking and order review; a full login account is completed after purchase, including email confirmation. Records relating to an accepted client engagement follow the client-matter retention period. If a proposed order does not proceed, preliminary registration information is kept only for as long as necessary to complete the conflict or order review, resolve any related query or meet another documented purpose, and is then securely deleted or anonymised. Separately justified minimal conflict records and Activity Log entries follow their respective retention rules above. A name-only preliminary conflict check does not automatically create a permanent conflict or justify keeping former-partner details indefinitely. Substantive confidential information received before a paid engagement can, however, justify a limited continuing conflict record.

A six-year review is not a promise to retain every document forever. Longer retention may be justified by the nature of a claim, a child’s involvement, capacity issues, a continuing obligation or a live dispute; it is assessed individually. A deletion request is considered against the actual information and purpose, rather than refused automatically.

Deletion covers live systems and duplicates under our control. Backup copies are isolated from ordinary use and expire through the backup cycle. If restored, applicable deletions are reapplied. Copies held by independent controllers are subject to their own lawful retention obligations. Your Ex File is not a permanent archive; please retain your own copies of important documents.

11. Security and safe communications

We use appropriate technical and organisational measures for the sensitivity and risks of the information, including access controls, confidentiality obligations and arrangements for secure storage, transmission, backups and incident management. Access to client matters and conflict records is limited to those who need it. No online system can guarantee absolute security.

Keep account credentials and meeting links private. Tell us promptly if you suspect unauthorised access or an incorrect disclosure. If you share a device or email account, or communications could place you at risk, tell us a safe contact method before sending sensitive material. We will consider proportionate alternatives. We do not disclose detailed security arrangements publicly where doing so would compromise protection.

Where a personal data breach occurs, we assess it, take appropriate action and notify the regulator and affected people when legally required.

12. Cookies, website technologies and marketing

Our website only uses cookies that are strictly necessary for it to work, so they do not need your consent. WordPress sets login cookies that keep you signed in to your Ex File until you close your browser (or for 14 days if you tick “remember me”), and a test cookie that checks your browser accepts cookies. Our own basket cookie remembers the service and details you chose while you pay, for 48 hours. When you pay, Stripe sets its own cookies on its payment page for security and fraud prevention, as explained in Stripe’s privacy policy. You can block or delete cookies in your browser settings, but the account and payment pages may not work without them.

Where consent is required, optional technologies are not activated until you choose them. You can reject optional technologies or change your choice through the website controls as easily as accepting them. Some technologies may qualify for a statutory exception; where we rely on an exception, we meet its conditions, including information and any required means of objection. Blocking essential technologies may prevent account, booking or payment functions from working.

We do not currently send marketing emails. Requesting a guide, creating an account or purchasing a service does not enrol you in a marketing list. If you start a booking but do not complete payment, we may send you one reminder email about that booking, unless you tick the box at checkout asking us not to; you can also reply to that email to tell us not to contact you again. Service emails include information needed to provide the guide, administer your account or deliver a purchased service. If we introduce marketing, we will explain it separately, establish the required lawful basis and PECR permission, and provide a straightforward way to unsubscribe. Marketing consent will be optional and separate from service terms.

13. Your rights

Depending on the circumstances, you may:

• Ask whether we process your information and obtain a copy and supporting information.
• Ask us to correct inaccurate information or complete incomplete information.
• Ask us to erase information or restrict its use.
• Object to processing based on legitimate interests, including related profiling. We must stop unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is needed for legal claims.
• Receive information you supplied in a structured, commonly used, machine-readable format, and request transfer where the portability right applies to automated processing based on consent or contract.
• Withdraw consent at any time where we rely on it. This does not make earlier lawful processing unlawful. We explain any effect on an optional activity; withdrawing recording consent does not end the consultation service.
• Obtain the applicable safeguards for automated decisions described above.
• Object absolutely to any use of your information for direct marketing if we introduce it.

Email info@theexfiles.co.uk to exercise a right. You do not need legal wording or a particular form. We normally respond without undue delay and within one calendar month. Where the law allows an extension of up to two further months for complexity or the number of requests, we explain this and the reason within the initial period. We may ask for proportionate identity or authority evidence, or clarification where legally justified, and explain any lawful effect on the response period. Requests are normally free; any permitted fee or refusal will be explained.

Rights are not absolute. We may need to retain information for a legal obligation or legal claim, and must consider other people’s rights, confidentiality and any applicable legal privilege or statutory exemption. We assess restrictions case by case and explain our decision as far as we lawfully can. Confidentiality is not a blanket exemption from data protection rights.

If you provide information about someone else, that person has rights in their own information. This does not automatically entitle them to your entire file or confidential advice.

14. Children and information you need to provide

Our services and accounts are intended for adults. We may need limited information about children to advise an adult on a family matter. We take particular care with children’s information and assess their rights and interests independently. A parent’s involvement does not automatically give them unrestricted access to a child’s information.

You do not have to use our website or services. If you ask us to act, we need sufficient contact, conflict, payment and matter information to provide the requested service safely and competently. If necessary information is missing, we may be unable to accept instructions, process a booking or provide reliable advice. Optional information and consent-based activities are identified separately. Please tell us when relevant information changes.

15. Complaints

If you are concerned about our handling of personal information, contact Rachael at info@theexfiles.co.uk or the correspondence address above. We acknowledge data protection complaints within 30 days, investigate appropriately without undue delay, keep you informed and explain the outcome and any action taken without undue delay.

You may complain to the UK data protection regulator, the Information Commissioner’s Office, through ico.org.uk/make-a-complaint. You do not need our permission to do so. You also have the right to seek a judicial remedy where applicable.

16. Changes

We review this policy when our services, systems or legal requirements change. The published policy will show its effective date. We provide additional notice of material changes where appropriate and explain any new purpose before using information for it, obtaining consent where required.