This policy explains how KHS Investments and Legal Ltd collects and uses your personal data, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Who we areWhat we collectHow we use itWho we share it withTransfers abroadHow long we keep itYour rightsComplaints 1. Who we are KHS Investments and Legal Ltd (“KHS”, “we”, “us”) is the controller of your personal data. We are a private limited company registered in England and Wales, company number 15983595. Registered office and office address: First Floor, 14–15 Brunswick Place, Southampton SO15 2AQ Email: info@khs360.co.uk Phone: 023 8155 0370 ICO registration number: [ICO registration number] Data protection contact: [name or role, e.g. Data Protection Lead] 2. What personal data we collect When you contact us Your name, email address, phone number and postal addressThe service you are interested in and what you tell us about your matterMessages you send by email, phone or our website form When you become a client Identity documents and proof of address, for identity and anti-money laundering checksCompany, financial and business information needed for your matterInformation about your family, property or employment where relevantPayment and billing details Special category and criminal offence data Some matters, such as family law, McKenzie Friend support or criminal law matters in India, may involve sensitive information. This can include information about your health, ethnicity, religion, sex life, or criminal allegations and convictions. We only collect this when it is needed for your matter. When you use our website Technical data such as your IP address, browser type and pages visited, collected by our website host for securityCookie data, explained in our Cookie Policy 3. How we use your data and our lawful basis PurposeLawful basis Responding to your enquiry and giving you a quoteSteps at your request before entering a contract; legitimate interests Providing our services and managing your matterPerformance of a contract Identity, anti-money laundering and fraud checksLegal obligation Billing, accounts and tax recordsLegal obligation; performance of a contract Sending you newsletters and updatesConsent, which you can withdraw at any time Running, securing and improving our website and businessLegitimate interests Special category dataYour explicit consent, or where it is needed to establish, exercise or defend legal claims Criminal offence dataA condition in Schedule 1 of the Data Protection Act 2018, such as legal claims or your consent We do not make decisions about you using only automated processing. 4. Who we share your data with We never sell your personal data. We share it only where needed: Independent SRA-regulated solicitors or Registered Foreign Lawyers we refer you to for immigration or lease work, only with your agreement KHS Associates and lawyers in our network in India, for NRI legal matters in India Courts and other parties, only when you ask us to or the law requires it Identity verification and anti-money laundering check providers Our IT, email, website hosting and cloud storage providers Our accountants, insurers and professional advisers HMRC, the police, regulators or other authorities where the law requires it 5. Transfers outside the UK For NRI matters, we share data with KHS Associates and lawyers in our network in India. Some of our service providers may also store data outside the UK. India is not covered by UK adequacy regulations, so we protect these transfers with appropriate safeguards, such as the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. Contact us for a copy of the safeguards we use. 6. How long we keep your data Enquiries that don't lead to work: [12 months] after our last contact Client files: [6 years] after your matter ends Identity and anti-money laundering records: 5 years after our relationship ends Accounting records: 6 years from the end of the financial year Newsletter list: until you unsubscribe 7. How we keep your data secure We use access controls, encrypted devices and secure storage, and we only let people see your data when they need it for your matter. Please don't email original documents unless we ask for them. 8. Your rights You have the right to: Access a copy of your personal data Correct data that is wrong or incomplete Ask us to delete your data Ask us to restrict how we use your data Object to how we use your data Receive your data in a portable format Withdraw your consent at any time, where we rely on consent To use any of these rights, email info@khs360.co.uk. We will reply within one month. Some rights have legal limits, for example where we must keep records by law. 9. Complaints If you're unhappy with how we use your data, please contact us first so we can try to put it right. You can also complain to the Information Commissioner's Office (ICO): Website: ico.org.uk/make-a-complaintPhone: 0303 123 1113Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF 10. Changes to this policy We may update this policy from time to time. The date at the top shows when it last changed.