Privacy Policy

Who we are

Bancroft Law Office ("Bancroft", "we", "us") is a law firm practising from offices in Chicago, Illinois and London, United Kingdom. We are the controller of the personal data described in this notice.

For personal data processed by our London office, the controller for UK GDPR purposes is Bancroft Law Office (London), 9 Fisher's Ln, Chiswick, London W4 1RX, United Kingdom. For personal data processed by our Chicago office, the controller is Bancroft Law Office, 122 N Dearborn St, Chicago, Illinois 60602, United States.

You can reach us about anything in this notice at info@bancroftlawoffice.com or +1 (405) 816-9782. Please mark data protection enquiries for the attention of the Data Protection Lead.

What we collect

Information you give us. When you use the contact form, email us, or call, we collect your name, email address, telephone number, the office and practice area you select, whether you are contacting us as an individual, a business or an institution, and whatever you choose to tell us in your message.

Information we collect if you become a client. Once an engagement is confirmed we collect what the matter requires: identification and proof-of-address documents for client due diligence, the facts and documents of the matter itself, correspondence, and billing and payment details. Depending on the matter this can include special category data — health, ethnicity or trade union membership in an employment case, for example — or information about criminal offences and proceedings.

Information about applicants. If you apply for a role we collect your CV, covering letter, right-to-work documentation, and any references you provide or authorise us to take up.

Information collected automatically. Our web server records the IP address, browser type, referring page and pages requested in standard access logs. We do not run advertising, analytics or cross-site tracking technology on this website.

Why we collect it and our lawful basis

To answer your enquiry and decide whether we can act. Our legitimate interests in responding to people who approach the firm, and steps taken at your request before entering into a contract.

To run conflict checks and client due diligence. Compliance with a legal obligation — in the United Kingdom the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, and in the United States the applicable rules of professional conduct — together with our legitimate interests in avoiding conflicts of interest.

To provide legal services and run your matter. Performance of our engagement contract with you, or our legitimate interests where our client is an organization and you are its employee, officer or counterparty.

To invoice, take payment and keep accounting records. Performance of that contract and compliance with tax and accounting obligations.

To keep the website and our systems secure. Our legitimate interests in protecting the firm, its clients and their confidential information.

To send you firm updates and insights. Your consent, which you may withdraw at any time without affecting anything we did before you withdrew it.

Where we process special category data, or data about criminal offences and proceedings, we do so because it is necessary for the establishment, exercise or defence of legal claims, or because you have given explicit consent.

How long we keep it

Enquiries that do not become matters — 12 months from your last contact with us.

Client matter files — 7 years from the date the file is closed. Some documents are kept longer because their nature requires it: wills, trust deeds, powers of attorney and property titles are retained until they are no longer needed, or returned to you.

Client due diligence records — 5 years from the end of the business relationship, as the UK money laundering regulations require.

Accounting and billing records — 6 years from the end of the financial year they relate to.

Recruitment records for unsuccessful applicants — 6 months from the decision, unless you ask us to keep your details on file for future roles.

Website server logs — 12 months.

At the end of a retention period we securely delete or destroy the records. Where we keep something longer because of an actual or anticipated legal claim, we keep only what that purpose needs and delete the rest.

Who we share it with

Within the firm. Chicago and London operate as one practice, and your information may be seen by colleagues in either office where your matter requires it.

Our service providers. Email and file hosting, practice management, secure document storage, IT support, our website host, and our payment processor. These act as our processors under written contracts and may not use your data for their own purposes.

People we instruct for your matter. Barristers and other counsel, experts, translators, process servers, costs draftsmen, agents, and — in cross-border work — law firms in other jurisdictions.

Courts, tribunals, arbitrators and other parties, where the conduct of your matter requires disclosure.

Our regulators, auditors, insurers and professional advisers, including the Solicitors Regulation Authority in relation to our London office and the Attorney Registration and Disciplinary Commission in relation to our Illinois attorneys.

Law enforcement and other authorities, where we are legally required to disclose. Some disclosures — a suspicious activity report, for instance — we are prohibited by law from telling you about.

We do not sell personal data, and we do not share it with third parties for their own marketing.

International transfers (US–UK)

Because Chicago and London operate as a single practice, personal data held by one office may be accessible to the other. Personal data collected in the United Kingdom may therefore be transferred to, and stored in, the United States.

Where we transfer personal data out of the United Kingdom we rely on one of the following safeguards: the UK Extension to the EU–US Data Privacy Framework, where the recipient is certified under it; the UK International Data Transfer Agreement, or the UK Addendum to the European Commission's standard contractual clauses, supported by a transfer risk assessment; or, for a specific transfer, your explicit consent, or the necessity of the transfer for the establishment, exercise or defence of legal claims.

You can ask us for a copy of the safeguards that apply to a particular transfer by writing to info@bancroftlawoffice.com.

Your rights

Where UK data protection law applies, you have the right to ask us to: give you a copy of the personal data we hold about you; correct it if it is inaccurate or incomplete; delete it; restrict how we use it; give it to you in a portable format; or stop processing it where we rely on legitimate interests. Where we rely on consent, you can withdraw it at any time.

These rights are not absolute. Where we are under a legal or regulatory duty to keep records, where the information is covered by legal professional privilege, or where we need it for a legal claim, we may not be able to act on a request in full. If that happens we will tell you which exemption applies and why.

We do not make decisions about you by solely automated means, and we do not carry out profiling.

To exercise any of these rights, email info@bancroftlawoffice.com with enough detail for us to identify you and understand what you are asking for. We respond within one month, and will tell you if we need longer because the request is complex or because you have made several. There is no charge unless a request is manifestly unfounded or excessive.

If you are in the United States we will honor the same requests on the same terms, in addition to any rights you have under the law of your state.

Cookies

This website sets no advertising cookies, no analytics cookies and no third-party tracking of any kind. Nothing on the site profiles you or follows you to other websites.

Our host may set a strictly necessary cookie to keep the site secure and to make the contact form work. Strictly necessary cookies do not require your consent under UK law.

If we later add analytics or any other non-essential cookie, we will update this notice and ask for your consent through a banner before anything is set. You can block or delete cookies at any time in your browser settings, and the site will continue to work.

How to complain

If you are unhappy with how we have handled your personal data, please tell us first — email info@bancroftlawoffice.com or call +1 (405) 816-9782. We would far rather put something right ourselves.

United Kingdom. You can complain to the Information Commissioner's Office at any time: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; helpline 0303 123 1113; ico.org.uk. Coming to us first does not affect that right.

United States. You can contact the Office of the Illinois Attorney General, Consumer Protection Division, illinoisattorneygeneral.gov.

Complaints about our professional conduct, as distinct from our handling of your data, are dealt with separately — our Disclaimer identifies the regulator for each office.

Last updated: July 28, 2026