Privacy Notice

Last updated: September 2026

1. Introduction

C. Lewis (UK) Ltd (“C. Lewis”, “we”, “us” or “our”) is committed to protecting personal data. This notice explains how we process personal data in the course of providing professional services, managing business relationships and meeting our legal, regulatory and professional obligations.

We operate primarily in a business-to-business and professional-services environment and do not provide consumer-facing products or services. We may send limited communications to existing clients and professional contacts about events, briefings or other matters relevant to our professional services, where permitted by law.

2. Our role

For the processing described in this notice, C. Lewis will generally act as a data controller. In some engagements we may process personal data on the documented instructions of another organisation as a processor. Where that applies, the relevant controller determines the purposes and means of that processing and its own privacy information may also apply.

3. Personal data we process

The personal data we process depends on the nature of the engagement or relationship. It may include:

  • contact details, such as name, business email address, telephone number and postal address;
  • professional and employment information relevant to an engagement;
  • identification information where required to meet legal, regulatory or professional obligations;
  • financial, commercial, claims or dispute-related information relevant to our professional work;
  • correspondence, reports, schedules, supporting documents and other information supplied in connection with an engagement; and
  • where relevant, information relating to individuals that may include special category personal data, such as health information, or criminal-offence information.

We seek to process only personal data that is relevant and reasonably necessary for the purpose for which it is received or used.

4. Where we obtain personal data

We may obtain personal data:

  • directly from the individual;
  • from clients or other instructing parties;
  • from insurers, brokers, loss adjusters, law firms, experts, professional advisers, counterparties or other participants in a claim, dispute or engagement;
  • from public, regulatory or corporate records where appropriate; and
  • from other sources where this is necessary and permitted by law for the professional services we provide.

Where personal data is obtained indirectly, we use it only for the relevant professional, legal, regulatory or business purpose for which it was received.

5. How we use personal data

We may use personal data where necessary to:

  • provide professional services to clients and manage engagements;
  • assess, analyse or report on financial matters arising from claims, disputes, investigations or other professional instructions;
  • communicate with clients, instructing parties, professional contacts and other relevant participants;
  • manage our business, protect our legal rights and maintain appropriate security and records;
  • comply with legal, regulatory or professional obligations; and
  • send limited professional updates, invitations or briefings to existing clients and professional contacts where permitted by law.

We do not carry out consumer profiling or automated decision-making that produces legal or similarly significant effects on individuals. You may opt out of professional marketing communications at any time.

6. Legal basis for processing

Depending on the circumstances, we rely on one or more of the following lawful bases under the UK GDPR:

  • performance of a contract with an individual, or taking steps at that individual’s request before entering into a contract, where applicable;
  • compliance with a legal or regulatory obligation; and
  • our legitimate interests, including the proper conduct of our professional services, administration of engagements and business relationships, protection of legal rights, and appropriate business and information security.

Where we process special category personal data, we also identify an applicable condition under Article 9 UK GDPR. Depending on the circumstances, this may include processing necessary for the establishment, exercise or defence of legal claims. Criminal-offence data is processed only where permitted by applicable law.

7. Data sharing

We share personal data only where necessary and appropriate. Depending on the engagement, recipients may include:

  • clients, instructing parties and other professional participants in the relevant engagement;
  • professional advisers, experts and consultants;
  • IT, cloud, document-management and other service providers acting under appropriate contractual arrangements;
  • courts, tribunals, regulators, law-enforcement bodies or other public authorities where required or permitted by law; and
  • other C. Lewis offices or related professional organisations where necessary for an engagement and permitted by law.

We do not sell personal data.

8. International transfers

Where an engagement, professional relationship or service provider involves access to or transfer of personal data outside the United Kingdom, we take steps to ensure that the transfer is lawful. Where required, this includes relying on UK adequacy regulations or approved contractual and other safeguards.

9. Data security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss or misuse. Access is limited to people who need the information for legitimate business or professional purposes.

10. Data retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected or received, taking account of the nature of the engagement and applicable legal, regulatory, professional, contractual, dispute-resolution and record-keeping requirements. Personal data is securely deleted or otherwise disposed of when it is no longer required, subject to any continuing legal or regulatory obligation to preserve it.

11. Your rights and complaints

Depending on the circumstances, individuals may have rights under UK data protection law including the right to:

  • request access to personal data we hold about them;
  • request correction of inaccurate or incomplete personal data;
  • request erasure of personal data in certain circumstances;
  • request restriction of processing in certain circumstances;
  • object to certain processing based on legitimate interests; and
  • request data portability where the statutory conditions apply.

Right to object. You may object at any time to the use of your personal data for direct marketing. You may also object to processing based on our legitimate interests, subject to the circumstances and any overriding legal grounds that apply.

If you have a concern or complaint about how C. Lewis has handled your personal data, please contact us using the details below. We will acknowledge a data-protection complaint within 30 days, make such enquiries as are appropriate in the circumstances, keep you informed where necessary and provide an outcome without undue delay.

You also have the right to raise a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection. Further information is available at www.ico.org.uk.

12. Contact

For data protection queries, requests or complaints, please contact:

C. Lewis (UK) Ltd

28 Lime Street
London
EC3M 7HR
Email: jamie.sparrow@clewis.com