Registered number: 10816512.
Registered office: Squiggle Consult Ltd, Suite 2069, Letraset Building, Wotton Road, Ashford, Kent, TN23 6LN
Squiggle Consult Ltd. is a limited company registered in England and Wales.
Squiggle Consult Ltd and Squiggle Probate Limited
Last updated: 7 August 2026
Version: 1.0
We are an estate planning and will writing firm. To do our job properly we need to know a lot about you, your family, your money and sometimes your health.
Who "we" are. Squiggle Consult Ltd, for wills, trusts, lasting powers of attorney and estate planning. Squiggle Probate Limited, for probate and estate administration. Each company is responsible for its own work, and the two are jointly responsible for the staff, the systems and the clients they share. There is a signed agreement between them saying so, and section 1.1 publishes what it says. Either way, you can use any of your rights against either company, and you never have to work out which one holds what.
What we hold about you. Who you are and how to reach you. Proof of identity. Who is in your family and how you are related. What you own and what you owe. What you want to happen after you die, or if you cannot make decisions for yourself, and the reasons behind those choices. Information about health and care where it matters to the work. If we are dealing with an estate, the same picture of the person who has died.
Who sees it. Our team. The companies that run the systems we use, such as client records, document storage, booking, live chat, payments, identity checks and the artificial intelligence tools our team works with. Where your work needs a solicitor, barrister or other specialist, the ones instructed on your matter. The registries and government bodies we deal with on your behalf, such as the Office of the Public Guardian, HM Land Registry, HMRC and the Probate Registry. We do not sell your information and we never have.
What happens to your will. If we hold your original documents, they stay yours and we will not destroy an original will. We keep them until you ask for them back, until a new document replaces them, or until we release them to your executors after you die. LegacyGuard is our yearly subscription. It keeps your plan under review, stores your original documents, and gives you a legal helpline. If a LegacyGuard subscription ends, we write to you, give you 60 days to tell us where to send your originals, and send them to your last known address by a tracked service if we do not hear back. If you do not have a LegacyGuard subscription, nothing in this paragraph applies to you.
How long we keep it. Your client file we keep for good, on purpose. A will written today might be argued about in forty years, and the file is the evidence that it was done properly. Everything else has a real end date. Section 9 gives a period for every kind of record and a reason for every period.
Artificial intelligence. We use AI tools to help us with our work. Your documents and your details do go into them. They go in on business accounts, where the provider is contractually prevented from using anything we put in to train its systems. There is no opt-out for the work you ask us to do. Section 12 explains what you get instead, and what is different if you are named in someone else's documents. A person, not a machine, makes every decision about you and your family, and our team are required to check anything a tool produces before it goes on your file.
Meetings may be transcribed. One of those tools can produce a written record of what was said in a meeting. We will tell you at the start if a meeting is being transcribed, and if you would rather we did not, say so and somebody will take the note by hand instead. Any transcript of a meeting about your work goes on your file and is kept for the same period as the rest of it. Section 12.3 has the detail.
Where all this happens. Your client file and your documents are held in the United Kingdom. Some of the companies that handle information for us, including the AI tools, may process it in the UK, in Europe or in the United States. When information leaves the UK the law requires a legal safeguard to travel with it, and section 8 explains in plain English what those safeguards are and how to ask us which one applies.
Cookies. We ask you when you first arrive, and saying no is as easy as saying yes. You can change your answer at any time from the Cookie settings link in the footer of any page, which is also where you will find the named list of which company sets which cookie. Section 10 and the cookie policy have the detail.
Your rights. You can ask to see what we hold, have it corrected, object to us holding it, and in some cases have it deleted. Tell us to stop marketing to you and that is the end of it. Section 11 sets them all out, including the two places they run into limits: we cannot tell you a living client's private business, and we usually cannot delete a client file.
If you are not happy. Tell us. Data protection is looked after by Kieran Osborne, so email kieran.osborne@squiggleconsult.co.uk, or phone 01233 659796, or write to 11 Park Barn, Station Road, Evegate Business Park, Ashford, Kent, TN25 6SX. We acknowledge within 30 days. You can also complain to the Information Commissioner's Office at any point, and talking to us first does not take that away.
One more thing. If someone has named you in their will, their power of attorney or their trust, we probably hold information about you even though you have never contacted us. Section 5 is written for you.
Two companies are responsible for the information described in this notice. Being "responsible for it", in data protection language, means being the controller: the one who decides what happens to your information and answers for it.
| Company name | Squiggle Consult Ltd |
|---|---|
| Company number | 10816512, registered in England and Wales |
| Registered office | Suite 2069, Letraset Building, Wotton Road, Ashford, Kent, TN23 6LN |
| Trading and correspondence address | 11 Park Barn, Station Road, Evegate Business Park, Ashford, Kent, TN25 6SX |
| hello@squiggleconsult.co.uk | |
| Phone | 01233 659796 |
| Company name | Squiggle Probate Limited |
|---|---|
| Company number | 13707046, registered in England and Wales |
| Registered office | Suite 2069, Letraset Building, Wotton Road, Ashford, Kent, TN23 6LN |
| Trading and correspondence address | 11 Park Barn, Station Road, Evegate Business Park, Ashford, Kent, TN25 6SX |
| hello@squiggleconsult.co.uk | |
| Phone | 01233 659796 |
Who to contact about your information. Data protection is looked after by Kieran Osborne, and you can reach him directly.
| kieran.osborne@squiggleconsult.co.uk | |
| Phone | 01233 659796 |
| Post | 11 Park Barn, Station Road, Evegate Business Park, Ashford, Kent, TN25 6SX |
Any of those is fine, and it does not matter which of the two companies your work sat with. If you would rather use our general address, email hello@squiggleconsult.co.uk with "Data protection" in the subject line and it will reach him.
Squiggle Consult Ltd and Squiggle Probate Limited are two separate companies under common ownership. We work closely together, and we share staff, IT systems and offices, so our people can see client information across both companies where they need it for their work.
Squiggle Consult looks after wills, trusts, lasting powers of attorney and estate planning. Squiggle Probate looks after probate and estate administration.
Who is responsible for what. Each company decides for itself how it uses information for its own work. If we are writing your will or your power of attorney, that is Squiggle Consult. If we are dealing with an estate, that is Squiggle Probate. For those matters each company is the controller in its own right.
Some things we decide together, and for those the two companies are joint controllers under Article 26 of the UK GDPR. They are the systems we share and who can see what on them, the staff who work for both companies, the information of anyone who is a client of both, what happens when a matter or a client moves from one company to the other, and this notice itself.
Each company answers for its own work, and both answer together for what they share.
There is a signed agreement between the two companies setting all of this out, and it is in force. Article 26 of the UK GDPR says the essence of an arrangement like that has to be made available to you. So here it is, in plain English.
You can contact either company. If you want to see the information we hold about you, correct it, delete it, or object to how we use it, contact whichever company you like. Whichever one you contact will make sure your request is dealt with properly, and will pass it to the other if that is where your information sits. You do not have to work out which company holds what.
Between ourselves, we split the work by subject. Squiggle Consult leads on estate planning matters and Squiggle Probate leads on probate matters. That is an arrangement between us, for our own tidiness. Neither company will turn a request away, put it off, or send you somewhere else because of it.
If your request covers both companies, for example if we wrote your will and later dealt with the estate, you will get one joined up answer covering everything both companies hold. You will not be asked to make two requests, and you will not be sent back and forth.
You can complain to either company if you think we have got something wrong. Section 14 explains how, and what happens next.
Our single point of contact is Kieran Osborne, at kieran.osborne@squiggleconsult.co.uk. Whichever company your work sat with, he is the person, and any of the details above will reach him.
If something goes wrong with your information, the directors of both companies decide together whether it has to be reported to the Information Commissioner's Office and whether the people affected have to be told. That decision is not left to one company to take on its own.
Each company keeps its own records of what it does with your information, and each can see the other's.
You can exercise every one of your rights against either company. Ask one, and you have asked both. That is your right under Article 26(3) of the UK GDPR, and nothing we agree between ourselves can take it away, narrow it or slow it down.
You always keep the right to complain to the Information Commissioner's Office at ico.org.uk. Section 14 has the details.
Estate planning and will writing are not regulated activities in the UK. There is no regulator for that part of what we do. We think that is a poor state of affairs, so we hold ourselves to the standards a regulated firm would be held to and we publish a Code of Practice setting out what we commit to. We are a certified B Corporation.
Probate is different. Preparing the papers that found an application for a grant of probate is a reserved legal activity under the Legal Services Act 2007, and only an authorised firm may carry it out. We manage the whole of your probate matter from start to finish, and the application for the grant is made through one of the regulated firms we instruct on your behalf. You deal with us throughout, and there is no second relationship for you to manage. Those firms are named on our Pre-Contract Information page, which you will find in the footer of every page on our website.
We are not a firm of solicitors and we are not regulated by the Solicitors Regulation Authority. We are not financial advisers and we are not regulated by the Financial Conduct Authority. Where a piece of work needs a solicitor or a barrister, we bring one in, and they are regulated by their own professional body.
This notice covers:
If you apply for a job with us, we will give you separate privacy information when you apply, and that is the notice which governs your application. Section 9 still tells you how long we keep recruitment records, because that is a fair question to be able to answer from here.
When you talk to us, meet us, or instruct us:
Mostly, no. There is no law that says you must give us anything. But there are things we cannot do without.
We cannot prepare a will or a power of attorney without knowing who you are, who your family are and what you own. We cannot verify your identity without seeing identification. A grant of probate cannot be applied for without the details the Probate Registry asks for. If you would rather not give us something, tell us and we will explain whether it matters and what your options are. Sometimes it matters a great deal and sometimes not at all.
If you leave out something we need, we may not be able to do the work. We will not take your money and produce a document that does not hold.
Some information gets extra legal protection. The law calls it "special category data" and it covers health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetics, biometrics used to identify someone, sex life and sexual orientation.
We handle some of it. Here is when, and on what legal footing.
Health information comes into our work in several ways:
To handle sensitive information lawfully we need two things: a general lawful basis under Article 6, and a specific condition under Article 9. We rely on three Article 9 conditions, and which one applies depends on what we are doing.
Article 9(2)(a), your explicit consent, for the work itself.
Where health information is part of the job you have asked us to do, we rely on your explicit consent. That covers a health and welfare lasting power of attorney, where your wishes about medical treatment and care are the whole point of the document. It covers a trust set up for someone with a disability or a long-term condition, where we need to understand that condition to protect their benefits. It covers care fees and care funding work.
We will ask you clearly, we will tell you exactly what we are asking for and why, and we will keep a record that you agreed. You can withdraw your consent at any time. We will stop using your health information for the work from that point, and for some pieces of work we will not be able to carry on without it. We will tell you if that is the case before you decide. Withdrawing it does not undo anything we did beforehand, and it does not empty the file, because once a document has been made the record of how it was made is kept under the legal claims condition described below. Section 9.1 explains why.
Article 9(2)(f), the legal claims condition, for our file and our records.
This condition permits processing that is necessary for the establishment, exercise or defence of legal claims. We rely on it for a narrower and more specific purpose: keeping the evidence of what was done and why.
The documents we prepare are made to be relied on, and challenged, after our client has died and can no longer explain themselves. The notes we take about your capacity, and about what we saw and heard when you signed, exist precisely so that if someone later says the will was invalid, or that you did not know what you were doing, there is evidence from the time to answer them with. Keeping those records is necessary to defend a claim that may be brought many years later. Section 9 explains this properly, because it is also the reason we keep client files for good. Registering an LPA with the Office of the Public Guardian, and applying for a grant of probate, are steps in formal legal processes.
Article 9(2)(g), the substantial public interest condition, where we are worried about someone.
Occasionally we identify a client we think may be at risk, of undue influence, financial abuse or exploitation. Acting on that concern can mean writing down health information, or passing a concern to someone who can help, sometimes without asking the person first, because asking would put them at greater risk or because they cannot safely be asked.
Where that happens we rely on Article 9(2)(g) together with paragraph 18 of Schedule 1 of the Data Protection Act 2018, which covers safeguarding children and adults at risk. That condition is narrow, and we treat it as narrow. It only applies where we are acting to protect someone from neglect or from physical, mental or emotional harm, where that person is under 18 or is an adult at risk, where we are acting without their consent for one of the specific reasons the paragraph lists, and where it is necessary for reasons of substantial public interest.
We keep a written policy explaining how we do this. The law requires it: a condition of this kind can only be relied on if the firm has an appropriate policy document in place. Ours sets out how we comply with the data protection principles when we rely on that condition, and how long the resulting records are kept and when they are erased. We keep it under review, and we have to produce it to the Information Commissioner on request. You can ask us for a summary of it.
Which conditions need an appropriate policy document, and which do not. Explicit consent under Article 9(2)(a) and the legal claims condition under Article 9(2)(f) do not require one. The substantial public interest condition does, and that is the one described above.
Where we verify your identity electronically, you are asked to photograph your identity document and then photograph your face. The two images are compared automatically to check they are the same person. That comparison is biometric processing and the result is sensitive information.
We rely on your explicit consent under Article 9(2)(a). You are asked for it at the point of verification and you can decline. If you would rather not do it this way, tell us and we will verify your identity another way, in person or by post. Nobody is turned away for saying no to a selfie.
The check itself is carried out by a specialist identity verification provider. Section 12 explains what happens if the automatic check does not work, and section 9 says how long we keep the record of it.
We do not go looking for this and we do not keep it as a matter of routine. Occasionally a client tells us something about a conviction or an allegation, usually when explaining why they are leaving someone out or raising a concern about an attorney or an executor.
Where that happens and it genuinely bears on the work, we record only what is needed to understand the instruction. For that we rely on the conditions in Part 3 of Schedule 1 of the Data Protection Act 2018: the legal claims condition at paragraph 33, the public domain condition at paragraph 32 where the person concerned has clearly made the information public themselves, or your consent at paragraph 29. None of those three requires an appropriate policy document. If none of them applies, we do not record it.
This section is for people who have never contacted us and may not know we hold their details. Beneficiaries, executors, trustees, attorneys, guardians, witnesses and certificate providers.
If someone has made a will, a trust or a power of attorney with us, they will have named other people in it. Beneficiaries who inherit. Executors who sort out the estate. Trustees who look after a trust. Attorneys who make decisions if our client cannot. Guardians who would look after the children. If you are one of those people, we hold information about you. You did not give it to us. Our client did, and occasionally another family member or a professional adviser added to it.
What we hold about you. Usually your name, address, date of birth, phone number, email address and your relationship to our client. Sometimes more: your circumstances, whether you are financially dependent, whether you are going through a divorce, whether you receive means-tested benefits, whether you have a disability or a health condition, or the reasons our client had for the decisions they made about you. Sometimes that includes reasons you would not enjoy reading.
Why we hold it. Because a will that does not identify its beneficiaries clearly does not work. Because executors have to be findable when the time comes. Because attorneys have to be identified to the Office of the Public Guardian. And because if the document is ever challenged, the file is the evidence.
Our legal basis. Legitimate interests, under Article 6(1)(f). The interests are our client's interest in having a document that does what they intended, our interest in doing our job properly and being able to stand behind it, and in most cases your own interest in the document being valid when you come to rely on it. We have weighed that against your rights and privacy and concluded it is justified, because what we record is limited to what the document needs, because it is held confidentially, and because you would generally expect a professional preparing a will to write down who is in it. Where sensitive information about you is involved, the Article 9 conditions in section 4 apply.
When we tell you, and why not sooner.
The law says that when we get information about you from somebody else, we should normally tell you within a month. We do not do that. Here is why.
Writing to every person named in every document we prepare would take an effort out of all proportion to the benefit. The law recognises this. Article 14(5)(b) of the UK GDPR says that where telling people individually would take disproportionate effort, we do not have to, so long as we make the information publicly available instead.
There is a second reason, and it matters too. Telling you would mean telling you that our client has made a will, a trust or a power of attorney, and that you are named in it. That is our client's private business. It is confidential for as long as they are alive, and in a good many cases they have chosen not to tell you themselves. Writing to you would break that confidence and cause real upset in families.
So this is how you are being told. This notice sits openly on our website, not behind a login, and it is where anyone can find out what a firm like ours holds about people named in other people's documents.
In practice, the first you will usually hear from us directly is at the point it matters: when our client dies and you are an executor or a beneficiary, when an LPA is registered and you are an attorney, or when a trust is set up and you are a trustee. Whenever we do contact you, we will point you back here.
One important thing we cannot do. We cannot tell you what is in a living client's will, or whether they have made one at all. That is their business and it is confidential until they die. This applies even if you ask us directly and even if you make a formal request for your own information. Section 11 explains the rule we rely on.
We will not market to you either. We will not sell your details, and we will not add you to a mailing list because you happen to be someone's nephew.
Your rights. You have all the rights in section 11, including the right to object to us holding your information. If you object we will look at it properly and weigh your objection against the reasons above. Contact us using the details in section 1.
The law says we need a lawful basis for everything we do with your information. Here is ours, purpose by purpose.
| What we do | Why | Legal basis |
|---|---|---|
| Meeting you for a free first consultation and working out what you need | You have asked us to look at your situation | Contract, Article 6(1)(b), steps taken before entering a contract |
| Preparing and drafting wills, trusts, powers of attorney and related documents | It is the service you asked for | Contract, Article 6(1)(b) |
| Administering an estate, and managing the application for a grant of probate through the regulated firm we instruct | It is the service the executors asked for | Contract, Article 6(1)(b), with the person who instructs us. Legitimate interests, Article 6(1)(f), for beneficiaries and others involved |
| Recording information about people named in your documents | The documents do not work without it | Legitimate interests, Article 6(1)(f). See section 5 |
| Verifying your identity | To confirm you are who you say you are, and to protect you and us against fraud and impersonation | Legitimate interests, Article 6(1)(f). Where we are required to carry out these checks by the money laundering rules, legal obligation, Article 6(1)(c) |
| Storing your original documents and keeping copies | It is part of what we provide, and it keeps your documents from being lost, damaged or destroyed | Contract, Article 6(1)(b) |
| Taking payment and keeping accounts | To get paid and to keep proper books | Contract, Article 6(1)(b), and legal obligation, Article 6(1)(c), for tax and company records |
| Making applications and registrations for you, to the Office of the Public Guardian, HM Land Registry, HMRC and the national will register, and arranging the application to the Probate Registry through the regulated firm we instruct | Because you have asked us to handle the application or registration for you | Contract, Article 6(1)(b). Where the law places a duty on you and we are carrying it out on your behalf, legal obligation, Article 6(1)(c), applies as well |
| Using software tools, including artificial intelligence tools, to help our team carry out the work, and to transcribe meetings | To do the work carefully and without wasting your time or ours | The same basis as the work itself. Contract, Article 6(1)(b), for client work, and legitimate interests, Article 6(1)(f), for running the firm. Using a tool does not create a new purpose. See section 12 |
| Keeping our file after the work is done | So we can answer questions later, deal with a claim, and show what was done and why | Legitimate interests, Article 6(1)(f) |
| Reviewing and updating your plan, including under LegacyGuard | It is what you subscribed for | Contract, Article 6(1)(b) |
| Running the firm, training our team and checking the quality of our work | So the service gets better and mistakes get caught | Legitimate interests, Article 6(1)(f) |
| Keeping our systems and our office secure, and preventing fraud | To protect your information | Legitimate interests, Article 6(1)(f) |
| Answering complaints, and bringing or defending legal claims | To sort problems out and protect our position | Legitimate interests, Article 6(1)(f) |
| Where we email existing clients about services like the ones we have already done for you | To tell you about things that are relevant to you | Legitimate interests, Article 6(1)(f). Separate rules govern the email itself, and every message carries an unsubscribe link |
| Where we send marketing to anyone who is not already a client | To tell you what we do | Consent, Article 6(1)(a) |
| Website analytics and advertising measurement | To see what works and to reach people who might need us | Consent, Article 6(1)(a). |
Where we rely on legitimate interests, we have thought about whether our reasons are outweighed by your rights and concluded that they are not. You can ask us for the reasoning behind any of them, and you can object. See section 11.
On marketing. Tell us to stop and we stop, at any time, by any means, with no questions and no retention offer. We do not market to people who are named in someone else's documents.
We do not sell your information. We never have and we will not.
We share it where we have to, in order to do the job. This section describes the kinds of organisation we share it with rather than listing individual companies by name. The law allows that, and it means this notice stays accurate when we change a supplier instead of going quietly out of date. If you want to know who any of them are, ask us and we will tell you.
Some things can only be done by a regulated lawyer, and some are better done by a specialist. Where your work needs that we bring one in and share what they need to do their part. That can include solicitors, barristers, tax advisers, specialist trust and probate practitioners, capacity assessors, and the lawyer who staffs the LegacyGuard legal helpline. They are regulated by their own professional bodies and they are responsible for your information in their own right once it reaches them.
The firms and specialists we work with regularly are named on our Pre-Contract Information page, which you will find in the footer of every page on our website. That is where the current list lives, because it is the page you would read before deciding whether to instruct us. We will always tell you if your matter is being referred to someone else.
We make applications and registrations on your behalf. That means sending your information to:
| Who | Why |
|---|---|
| The Office of the Public Guardian | Registering lasting powers of attorney |
| HM Land Registry | Property ownership checks, and registering changes to a title |
| HM Revenue and Customs | Inheritance tax and other tax reporting |
| HM Courts and Tribunals Service, Probate Registry | Applications for grants of probate and letters of administration, made through the regulated firm we instruct on your behalf |
| The national will register | Registering your will so it can be found, and searching for an existing one |
These are our processors. They act on our instructions, under contract, and they cannot use your information for their own purposes.
| What kind of company | What they do for us |
|---|---|
| Website hosting and content delivery | Runs our website and serves the pages you are reading |
| Website analytics and advertising measurement | Tells us how people find and use the site, and whether our advertising works |
| Appointment booking software | Lets you book a consultation and puts it in the right diary |
| Live chat software, and the trained operators who answer it | The chat window on our website. Real people read and answer what you type |
| Affiliate and referral tracking | Records that a partner sent you to us, so they can be paid if you become a client |
| Identity verification | Checks that you are who you say you are |
| Payment processing and direct debit collection | Takes your payment and collects subscription payments |
| Client records and secure digital document storage | Holds our client database and the documents in it, including scanned wills, letters and identity documents, and provides the vault and executor notification behind LegacyGuard |
| Physical document storage and archiving | Keeps original documents and paper files in secure storage |
| Case management software | Runs probate and estate administration matters |
| Accounting and bookkeeping software | Our invoices, payments and accounts |
| Email, telephony and IT support | Our email, phones, devices and the people who keep them working |
| Artificial intelligence tools | Help our team with the work, under our instructions and within our control. Client documents and personal information do go into them, on business accounts where the provider is contractually prevented from using what we put in to train its systems. Meetings may be transcribed by them. Section 12.2 sets this out in full, including what these tools do not decide, and section 12.3 covers transcription |
| Video hosting and embedding | Plays a video where one appears on a page |
Our client database and the documents we hold for you are kept in the United Kingdom.
Some of your information is handled outside the UK. The companies described in section 7.3, including the artificial intelligence tools described in section 12.2, may process your information in the United Kingdom, in the European Economic Area, or in the United States.
That is ordinary for website, booking, chat, analytics, advertising, identity verification and payment tools, many of which are American, and for accounting software, which is often not British either. It also applies to the artificial intelligence tools. Client documents and personal information go into those. Where a booking form is processed matters less. Where your will and your family's details are processed matters a great deal.
What the law requires when information leaves the UK. When we send your information to an organisation outside the UK, or let one see it, the protection has to travel with it. The law calls that a restricted transfer, and it has to be covered by one of a small number of legal routes. In everyday terms, the protection your information has here must not end up materially lower somewhere else. That is the test, and it is the wording Parliament settled on in the Data (Use and Access) Act 2025.
The routes are these.
Which route applies depends on the company and on where it handles your information, so this notice does not try to pin one route to one supplier. It would go out of date, and a general statement here is worth less to you than a specific answer about the thing you are asking about.
So ask us. If you want to know which countries a particular part of your information is processed in, which of the routes above covers it, or what the safeguards actually say, we will tell you, and you can ask us for a copy of the safeguards themselves. Email Kieran Osborne at kieran.osborne@squiggleconsult.co.uk, or use any of the details in section 1. You will get a straight answer rather than a form letter.
Estate planning is unusual, and our retention periods are unusual as a result. Most of this section is ordinary. One part of it is not, so we will deal with that part first.
A will is not like other documents. It sits in a drawer for years, sometimes for decades, and it only matters on the day the person who made it is no longer here to explain what they meant. If somebody then argues that the will was not valid, that the person did not really understand it, or that they were pressed into making it, the only evidence left is our file. The notes of what was said. Who was in the room. What we asked. What we checked. What we were told.
There is a long-standing expectation in this country because of that. It comes from a case called Larke v Nugus, and it is set out in the Law Society's guidance on disputed wills. It applies to solicitors as a professional duty. We are not solicitors, and we hold ourselves to it anyway, because whoever prepared a will is the only person who can say how it came to be made. Where a will is later challenged, the person who prepared it is expected to provide a full statement of what happened: how the instructions were taken, what the circumstances were, and how the will came to be signed. That statement is given to anyone with a proper interest in the dispute, whether or not we are acting for them. Its purpose is to get the truth out early and stop families spending money arguing about something the file could have settled.
We take that seriously. We cannot honour it if we have shredded the file.
The second reason is insurance. Professional indemnity cover responds to claims made years, sometimes decades, after the work was done, including after a firm has stopped trading. A claim about a will can arrive a very long time after the will was written. Answering it needs the file.
So we keep client matter files indefinitely, on purpose. Destroying them at the ten or fifteen year mark would tidy our cupboards and leave your family with nothing to hold on to at the exact moment they need it most.
"Indefinitely" is not the same as "forgotten about." Closed files are held securely and out of day-to-day circulation rather than sitting open on somebody's desk. We do not put more on a file than the work needs. We keep our retention practice under review, and if a category of record stops needing to be kept, we stop keeping it. If you ever want to know what we hold about you, ask us using the details in section 1 and we will tell you. Section 11 sets out the rest of your rights, including the right to have something corrected and the right to object.
| What | How long we keep it | Why that long |
|---|---|---|
| Original wills and other original documents we store for you | For as long as you want us to. Until you ask for them back, until a new document replaces the one we hold, or until we release them to your executors after you die. We will never destroy an original will | They are yours. An original will cannot be replaced |
| Client matter files. Wills, trusts, lasting powers of attorney and the papers that go with them, including your instructions, our attendance notes and any transcripts of meetings, drafts, correspondence and any evidence about capacity | Indefinitely | Section 9.1 explains this in full. In short: a will can be disputed decades later, we may be asked for a Larke v Nugus statement about how it was made, and a claim against us can be brought long after the work was done. The file is the evidence, and it cannot be recreated |
| Trust deeds and trust files | Indefinitely | A trust can run for generations. Trustees and beneficiaries need to be able to find out what was set up, why, and on what terms, long after everyone involved at the start has gone |
| Probate and estate administration files | Indefinitely | Claims about how an estate was administered surface years later, often when a beneficiary who was a child at the time grows up and starts asking questions |
| Identity verification records | 5 years from the end of our work for you. Where the check forms part of a client matter file, the record of it stays with that file | 5 years is the period the money laundering rules use, and we apply it whether or not those rules apply to us |
| Enquiries that did not turn into instructions | 2 years from your last contact with us, then deleted | People often think about a will for a year or two before going ahead. After that we have no reason to keep your details, and keeping them would not be fair to you |
| Booking records, live chat transcripts, call records, and transcripts of meetings that did not turn into a piece of work | 12 months. If your enquiry turns into a piece of work, the relevant part moves onto your client file and is kept with it | Long enough to pick up a conversation where we left off, short enough not to become a hoard |
| Marketing preferences and records of consent | For as long as we market to you, and 2 years afterwards | So we can show that you agreed, or that you asked us to stop, if it ever matters |
| A record that you asked us not to contact you | For as long as we hold any marketing data at all | If we deleted this, you would land back on a list by accident the next time somebody uploaded a spreadsheet. Keeping it is how we honour the request |
| Cookie and consent records from the website | 12 months, then we ask you again | So we can show what you chose, and so your choice does not sit there unrefreshed for years |
| Website analytics data | No more than 14 months | That is the limit we set in the analytics tool itself. The cookie that sits on your device can last up to 2 years. The data inside the analytics tool is deleted after 14 months |
| Accounting and tax records | 6 complete financial years, plus the current one | HMRC requires company records to be kept for at least 6 years from the end of the accounting period they relate to. Company law sets its own minimum too, and we work to the longer of the two |
| Recruitment records for people who applied for a job and were not appointed | 6 months from the decision, then deleted, unless you agree that we can keep them longer to tell you about future roles, in which case 12 months | Long enough for us to answer a question or a claim about the decision, and no longer. You get separate privacy information when you apply, and that is the notice which governs your application |
| Supplier, introducer and professional contact records | For as long as we are dealing with each other, and 6 years after the last piece of business | It lines up with our accounting records and with the time within which a claim about a contract can be brought |
| Records of data protection requests, complaints and any personal data breach | 6 years from when the matter is closed | So we can show what was asked, what we did about it and when. The law requires us to document breaches whether or not they were reported |
What happens if a LegacyGuard subscription ends. LegacyGuard is our yearly subscription, which keeps your plan under review and stores your original documents. Your documents are still yours. If your subscription stops, we will write to you at your last known address and give you 60 days to tell us where to send your original documents. If we do not hear from you, we will send them to that address by a tracked service rather than destroy them, unless we have reason to believe you no longer live there, in which case we go on holding them securely and keep trying to reach you. We keep the file itself for the periods above.
When one of these periods ends, we delete the record securely, or where it is an original document belonging to you, we return it. Original wills and other original documents are never destroyed.
Records live in backups for a short period after we delete them, and those backups are overwritten on a cycle rather than searched individually. Deleted information is not restored to use.
Our website uses cookies and similar technologies. Some are needed to make the site work at all. Others are there to tell us how people use the site, to measure whether our advertising is working, to record when a partner has referred you to us so they can be paid, and to run the booking calendar and the live chat window.
Broadly, they fall into four groups:
How we ask. When you first arrive, we ask you. You can accept everything, reject everything, or choose group by group, and saying no is as easy as saying yes. Nothing in the analytics, advertising or functional groups is set unless you agree to it, and if you close the banner without choosing, we take that as no.
Strictly necessary cookies are the exception. They do not need your permission, because the law accepts that a website has to be allowed to work. One of them is the cookie that remembers the choice you made, so we do not have to ask you again on every page.
Changing your mind. You can change your answer at any time from the Cookie settings link in the footer of any page. Withdrawing your consent is as easy as giving it, through that same link, and it takes effect straight away.
Where the detail lives. Cookie settings names each company that sets a cookie on our site, what it is for, and how long it lasts. We check that list at least every three months, and whenever we change something on the website. Our cookie policy explains the four groups and what each one is for.
Doing it yourself. You can also block or delete cookies in your browser settings, and most browsers will let you block third-party and tracking cookies across every site you visit.
If you block the functional cookies, the booking calendar and the live chat window will not appear. You can always book by calling us on 01233 659796.
You have the following rights over your information. They are free to use, and we will answer within one month. If your request is complicated we can extend that by up to two months, and we will tell you if we need to.
You can use any of these rights against either company. Section 1.1 explains how Squiggle Consult Ltd and Squiggle Probate Limited divide responsibility between themselves. That is our arrangement, not your problem. Ask either of them and you have asked both, and if your request touches both you will get one answer covering everything.
Where these rights run into limits.
These rights are not absolute, and in our line of work they run into other duties more often than in most businesses.
If we cannot do what you have asked, we will tell you why, and we will tell you what you can do about it.
To exercise any right, contact Kieran Osborne at kieran.osborne@squiggleconsult.co.uk, or ring 01233 659796, or write to 11 Park Barn, Station Road, Evegate Business Park, Ashford, Kent, TN25 6SX. The details are also in section 1. We may ask you to confirm your identity first, so that we do not hand your information to the wrong person.
We do not make decisions about you that are based solely on automated processing and that have legal effects or similarly significant effects on you. One check is done by software in the first instance, and section 12.1 explains it and how to ask a person to look again. Every decision about your estate plan is made by a person.
The check that compares the photograph of your face with the photograph on your identity document is done automatically by software, which scores how well the two match. A failed check does not mean we will not act for you. It means we have to verify you another way.
These checks fail for perfectly ordinary reasons. Poor light, an old passport photograph, a phone camera that will not focus. If yours does not work, tell us and we will verify you in person or by post instead. You can always ask for a person to look at it. Tell us you want the result reviewed, tell us anything you think we should know, and a member of our team will check it themselves. Nobody is turned away by software alone.
We use artificial intelligence tools to help us with our work. You are trusting us with some of the most private information you own, and you are entitled to know what touches it.
As with section 7, we describe these tools by what they do rather than by naming the companies behind them, for the same reason: a named list would be out of date within months, and the category is what matters to you. Ask us and we will tell you which ones we use.
What we use them for. Our team may use these tools to draft documents and check drafts, to research and look things up, to summarise the attendance notes we take when we meet you, to prepare and work through correspondence, to handle day to day administration, and to transcribe meetings.
We say may use on purpose. It describes what our team are permitted to do with these tools, not what happens on every file. Some of those things will not happen on yours at all. Any of them could, so all of them are listed.
Yes, your information goes into them. Client documents, our notes of what you told us, and personal information about you and about the people named in your documents are put into these tools as part of doing your work. If you have given something to us, you should assume a tool may have seen it.
The provider is not allowed to train on it. The accounts we use are business accounts, and the provider is contractually prevented from using anything we put in to train its systems. That is a term of the contract behind the account. It is not a tick box in a settings menu that somebody could switch off by accident, and it does not depend on any of our team remembering to turn something on. Free and personal accounts do not come with that protection, which is exactly why we do not use them for your work.
Where your information goes. These tools may process your information in the United Kingdom, in the European Economic Area, or in the United States. Section 8 explains what the law requires when information leaves the UK, sets out the routes available, and tells you how to ask which one applies.
There is no opt-out for the work you have asked us to do. We cannot keep your matter out of these tools. They are part of how the firm works, in the same way our client database and our document storage are part of how it works. That work runs on our contract with you, and the right to object in section 11 applies where we rely on legitimate interests rather than on a contract, so it does not reach it.
If you are named in someone else's documents, your position is different. We hold your information under legitimate interests, as section 5 explains, and that does give you the right to object under Article 21. It also applies to the things we do with information for running the firm rather than for a client matter. If you object, we will look at it properly, weigh it against the reasons in section 5, tell you the outcome, and stop unless we have compelling grounds to carry on.
There is one exception to the no opt-out rule, and it is a narrow one. You can ask us not to transcribe a meeting you are in, and we will take the note by hand instead. Section 12.3 explains that. It works because a meeting happens in front of you and there is an obvious alternative. The rest of the work does not have one.
What you get instead is this. The accounts are set up so that nobody can train on your information. The providers are under contract with us, on the same footing as every other company in section 7.3, and they cannot use your information for their own purposes. We do not put more into a tool than the work needs, and our team are trained on what may and may not go into one, which section 13 covers. And our team are required to read and check anything a tool produces before it goes into your documents or onto your file. That is a rule we train on and supervise, not a claim that nobody ever makes a mistake. If that sits badly with you, tell us and we will talk it through. Your other rights in section 11 are unaffected, and you can still ask us what we hold, have it corrected, and object.
A person decides. These tools help our team work more carefully and more quickly, and they decide nothing. A member of our team reads what comes out, checks it against your file, corrects it, and decides what goes into your documents and what goes on your record. Your will is written by a person who met you.
This is not a machine making decisions about you. Article 22 of the UK GDPR is about decisions taken solely by automated means that have legal effects on you, or that affect you in a similarly significant way. That is not what is happening here. Your information does go into these tools, as we have said above, but what comes out is a draft for a person to check, not an answer that stands on its own. Because a member of our team reviews that output and makes the decision, this is assistance rather than automated decision-making, and Article 22 does not apply to it. No tool decides whether we act for you, what you should do, who gets what, whether you have capacity, or anything else about you or your family.
If that ever changed, it would need its own section in this notice, its own legal basis and its own safeguards, and we would tell you before it started rather than afterwards.
Our meetings with you may be transcribed. One of the tools described in section 12.2 can produce a written record of what was said, whether we meet you at your home, at our office or on a video call.
What the transcript is for. It is there so that the person who met you can write an accurate attendance note, which is our record of what you told us, what we advised and what was agreed. Getting that right matters more in our line of work than in most, because years later the attendance note may be the only account of what you wanted and why, at a point when you are no longer here to say it yourself. Section 9.1 explains why that record is worth having.
What happens to it. A transcript of a meeting about your work goes on your client matter file, alongside our attendance notes and our correspondence. It is held in the same systems, seen by the same people, and kept for the same period. Section 9 sets those periods out. Client matter files are kept indefinitely, and section 9.1 gives the reasons. Where a meeting never turns into a piece of work, the transcript is kept for the shorter enquiry period in the same table and then deleted.
You will be told, and you can say no. If a meeting you are in is going to be transcribed, we will tell you at the start. If you would rather we did not, say so and we will not. Somebody will take the note by hand instead, which is how it was done for years and works perfectly well.
That applies to everyone in the room, not only to the person we are acting for. A first meeting often has a husband or wife in it, sometimes an adult child, sometimes another adviser. Any of you can say no, and one no is enough.
This is the one place in section 12 where you get a choice. Section 12.2 explains that you cannot generally keep your matter out of these tools. A meeting is different, because it is happening in front of you and there is an obvious alternative sitting in somebody's notebook.
What it does not do. A transcript is a record of a conversation. It does not decide anything, and everything earlier in section 12.2 about a person checking the work applies to it in full.
We know what we hold. Wills, powers of attorney, identity documents, and a complete picture of a family's money. We treat it accordingly.
Our team only get access to the files they need for the work they are doing. Client records and the documents in them are held in secure cloud systems run by specialist providers under contract with us. Original documents are kept in secure physical storage.
We train our people, not just our systems. Everyone who works here is trained on confidentiality and data protection when they join, and it carries on from there. We run training weekly, monthly and annually, and we run it whenever something comes up that the team needs to know about. That includes what may and may not go into the tools described in section 12. The law asks for appropriate technical and organisational measures to keep your information safe, which is Article 32 of the UK GDPR, and training the people who handle it is one of the organisational ones. A tool being safe is only half of it.
Encryption is the standard we apply. The client records and documents held in our client database and our document storage are encrypted while they are stored, and information is encrypted while it travels between you, us and those systems.
We are not going to publish the details of how our security is set up, because it would help the wrong people and it would not help you. Our Code of Practice sets out the confidentiality standards we hold ourselves to.
Nobody can promise nothing will ever go wrong. If it does, and there is a risk to you, we will tell you what happened and what we are doing about it, and we will report it to the Information Commissioner's Office where the law requires us to. Where the two companies are both involved, that decision is taken by the directors of both of them together, as section 1.1 explains.
If you are unhappy with how we have handled your information, tell us first. You have a right to make a data protection complaint directly to us, and we want to hear about it so we can put it right.
You can do that whichever way suits you:
It does not matter which of the two companies in section 1 your work sat with. Complain to either and you have complained to both.
We will acknowledge your complaint within 30 days of receiving it, look into it, keep you posted on how it is going, and tell you the outcome when we reach one. If a request about your information is what you are really asking for rather than a complaint, we will answer that within one month, as section 11 explains.
If you are not happy with how we deal with it, or you would rather go straight to the regulator, you can complain to the Information Commissioner's Office. Complaining to us first does not take away your right to complain to them.
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint
You also have the right to go to court over a data protection matter, and to claim compensation if you have suffered damage or distress.
We will update this notice when what we do with your information changes, or when the law changes.
Sections 7 and 12 describe the kinds of company and the kinds of tool we use rather than naming each one. That is on purpose. It means we do not have to reissue a legal document every time a supplier changes, and it means what you read here stays true. If you want to know who any of them are at any given moment, ask us and we will tell you.
The version number and the date at the top will tell you when this notice last changed. Where we make a change that materially affects you, we will tell current clients by email and put a notice on the website for a reasonable period. We keep previous versions and you can ask us for one.
The two companies review this notice together at least once a year, and whenever something about the way we work changes. Neither company changes it without the other.
Squiggle Consult Ltd, registered in England and Wales, company number 10816512
Squiggle Probate Limited, registered in England and Wales, company number 13707046
Registered office: Suite 2069, Letraset Building, Wotton Road, Ashford, Kent, TN23 6LN
Trading and correspondence address: 11 Park Barn, Station Road, Evegate Business Park, Ashford, Kent, TN25 6SX
hello@squiggleconsult.co.uk | 01233 659796
Data protection contact: Kieran Osborne, kieran.osborne@squiggleconsult.co.uk
Registered number: 10816512.
Registered office: Squiggle Consult Ltd, Suite 2069, Letraset Building, Wotton Road, Ashford, Kent, TN23 6LN
Squiggle Consult Ltd. is a limited company registered in England and Wales.
