Lettu Privacy Policy

Lewis Silkin Innovation Limited ("we", "us", "our" or "LSI") is the owner and operator of the Lettu platform made available at Lettu.com ("Platform"), and is wholly owned by Lewis Silkin LLP.

This Privacy Policy applies to users of the Platform and others that we may deal with in relation to the Platform.

Please take a moment to read this Privacy Policy as it provides you with important information about your personal data, including the rights you have in relation to it. Your access to and use of our Platform is also subject to our Terms of Use.

Scope of this Policy

This Privacy Policy explains how LSI processes your personal data in connection with our provision of the Platform and the provision of services we make available via the Platform (the "Services").

This Privacy Policy does not apply to the activities of our parent, Lewis Silkin LLP, including your use of Lewis Silkin LLP's website at https://www.lewissilkin.com/ and any services provided by Lewis Silkin LLP. Please refer to Lewis Silkin LLP's Privacy Policy at https://www.lewissilkin.com/information/privacy-policy for details of how personal data is processed by Lewis Silkin LLP in relation to such activities.

Who we are

LSI is the controller of personal data processed in connection with its provision of the Platform and Services.

Lewis Silkin Innovations Limited is a private limited company registered in England and Wales under number 16350957 and whose registered office is at Arbor, 255 Blackfriars Road, London, SE1 9AX.

How to contact us

If you have any questions about this Privacy Policy or want to exercise your rights set out in this Privacy Policy, please contact us by sending an e-mail to privacy@lewissilkin.com.

What personal data we collect and how we use it

Our primary purposes for collecting personal data are to: (i) verify your identity; (ii) help us deliver our Platform and Services; (iii) improve, develop and market new Services; (iv) carry out requests made by you on the Platform or in relation to the Services; (v) investigate or settle inquiries or disputes; (vi) comply with any applicable law, court order, other judicial process, or the requirements of any regulator; (vii) enforce our agreements with you; (viii) protect the rights, property or safety of us or third parties, including other users of the Platform or Services; (ix) provide support for the provision of the Platform and Services; (x) conduct surveys and obtain feedback in respect of the Platform and Services; and (xi) use as otherwise required or permitted by law.

To achieve these purposes, we may process personal data that we obtain from you or from third parties (including any organisation that you represent), as set out below.

If you are a User of the Platform, we may process the following personal data:

• Name.
• Name of the organisation you represent (for example your employer).
• Contact information including email address.
• Information required to comply with legal and regulatory requirements (including sanction requirements). This may include processing identity documentation containing address, date of birth, nationality, and any other relevant information. We may share personal data with our screening provider, Open Sanctions, to carry out this activity. For details of how Open Sanctions processes your personal data, please see its privacy policy at https://www.opensanctions.org/docs/privacy/.
• Other information relevant to provision of the Platform and Services, including technical data such as information about your device, browser, and usage of the Platform that is necessary for us to operate, secure, and improve the Platform and Services.

If you are a person that we deal with in connection our provision of the Platform and Services, including if you work for an organisation with whom we have an actual or prospective business relationship in respect of the Platform and Services:

• Name and job title
• Telephone number
• Email address
• Feedback that we obtain from you or your organisation in relation to the Platform or Services.
• Other information relevant to our relationship with you or your organisation.

Delivery of Platform and Fulfilment of Services

We collect and maintain personal data that you voluntarily submit to us during your use of the Platform and/or the Services to enable us to deliver the Platform and provide the Services, including features that allow you to book appointments with or contact a lawyer from Lewis Silkin LLP.

What is our legal basis? It is necessary for us to use your personal data to perform our obligations in accordance with any contract that we may have with you or it is in our legitimate interest or a third party's legitimate interest to use the personal data to ensure we provide the Platform and Services in the best way that we can.

Support for the Platform or Services

Our Platform uses various user interfaces to allow you to contact us or to request information about the Platform or Services. Contact information may be requested in each case, together with details of other personal data that is relevant to your enquiry. This information is used in order to enable us to respond to your requests and enquiries and solve any potential issues you might have with the use of the Platform or access to the Services.

What is our legal basis? It is in our legitimate interest or a third party's legitimate interest to use your personal data to ensure that we provide the Platform and Services in the best way that we can.

Insight and analysis for Platform and Service improvement

To develop and improve our Platform and Services, including the content that we make available, we carry out insight and analysis in relation to the use of our Platform and Services. This includes collecting information about user activity on our Platform, such as pageviews and events, and using this information to generate aggregate statistics that do not identify individual users (for example, the number of active users and number of contracts uploaded over any given time period). We do this to understand whether our Platform and Services are meeting user expectations, and to learn what content and features of our Platform and Services are most popular. We use these insights to develop and improve our Platform and Services.

What is our legal basis? Where we use non-essential cookies or other similar technologies, we rely on your consent for the collection of this data. Where we do not use non-essential cookies or other similar technologies, it is in our legitimate interest use your personal data to improve and enhance our Platform and Services.

Managing our relationship with you or the organisation that you represent

We may process personal data to manage our relationship with you or the organisation you work for, including to provide you with important information relating to the Platform and Services.

What is our legal basis? It is necessary for us to use your personal data to perform our obligations in accordance with any contract that we may have with you, or it is in our legitimate interests (or a third party's legitimate interests) to use the personal data to ensure we provide and support the Platform and Services in the best way that we can, and to achieve effective administration. We also process personal data where necessary to comply with our legal obligations.

Feedback about our Platform and Services

From time to time, we will invite feedback in the service or contact you to invite you to provide feedback about our Platform and Services. We use this information to monitor and help us improve the quality of the Platform and Service.

What is our legal basis? It is in our legitimate interest to use the information you provide to us in your feedback for the purposes described above.

Surveys and analysis

We may carry out surveys to improve the Platform and Services. The responses that you provide will be analysed and may be included in a report usually on an anonymised basis.

We will only contact you by telephone for the purposes of our research if your number is not registered on the Telephone Preference Service (TPS) or Corporate Telephone Preference Service (CTPS). We will not call you from a withheld number.

Should you raise an objection to our contacting you in this way we will not do so again.

What is our legal basis? It is in our legitimate interest to use your personal data in such a way to ensure that we can carry out surveys and provide the best service to the users of the Platform.

Business administration and legal compliance

We may use your personal data for the following business administration and legal compliance purposes:

• to comply with our legal and regulatory requirements (including sanction requirements), and any obligations to our regulators or other governmental or regulatory bodies or authorities (such as the National Crime Agency or Financial Conduct Authority);
• for internal training and administration purposes;
• to enforce our legal rights; and
• to protect rights of third parties.

What is our legal basis? Where we use your personal data in connection with a business transition, to enforce our legal rights, or to protect the rights of third parties, it is in our or a third party's legitimate interest to do so. For all other purposes described in this section, it is our legal obligation to use your personal data to comply with any legal obligations imposed upon us.

Information Security

We may monitor, access, examine, capture or otherwise intercept (by human or automated means) communications or data transmitted through our systems, to identify and protect against activity that poses a threat to our business, including to the security of our network and information systems, and to ensure compliance with our legal and regulatory obligations.

What is our legal basis? It is in our legitimate interests to protect our business against security threats, fraud or other criminal or malicious activities.

How we obtain your consent

Our use of cookies and similar technologies

Our Platform uses certain cookies, pixels, beacons, log files and other technologies of which you should be aware. Please see our Cookie Preference Centre to find out more about the cookies we use and how to manage your consent.

Sharing personal data

We only share personal data with third parties when we are legally permitted to do so. When we share personal data with others, we put contractual arrangements and security mechanisms in place to protect the personal data and to maintain the confidentiality and security of it.

The circumstances where we may typically share personal data are set out below, though there may be other circumstances where we need to share personal data that are not set out below.

• Lewis Silkin LLP. We may share your personal data with Lewis Silkin LLP where necessary to deliver the Platform or Services, including conducting sanction and compliance checks, facilitating the booking of appointments with lawyers, responding to your queries, complying with our legal obligations, or as is otherwise necessary to provide the Platform and Services in an effective manner.
• Third-party suppliers who provide applications/ functionality, data processing or IT services. We share personal data with third parties who support us in providing our Platform and help provide, run and manage our internal IT systems. Such third parties may also include, for example, providers of information technology, cloud-based software-as-a-service providers, identity management, website design, hosting and management, data analysis, data back-up, security and storage services. The servers powering and facilitating that cloud infrastructure are located in secure data centres around the world, and personal data may be stored in any one of them.
• Payment providers and banks. We share personal data with third parties who assist us with the processing of payments.
• Law enforcement or other government and regulatory agencies and bodies. We share personal data with law enforcement or other government and regulatory agencies or other third parties as required by, and in accordance with, applicable law or regulation.
• Other third parties. Occasionally, we may receive requests from third parties with authority to obtain disclosure of personal data, such as to check that we are complying with applicable law and regulation, to investigate an alleged crime, or to establish, exercise or defend legal rights. We will only fulfil requests for personal data where we are permitted to do so in accordance with applicable law or regulation.

International transfers

We may transfer personal data to third parties (as described in the Sharing personal data section) that are located in countries that do not have data protection laws that protect personal data to the same standard as the GDPR. These third countries may not give you the same rights as under the GDPR in relation to your personal data and may not have a data protection supervisory authority to help you if you have any concerns.

When transferring personal data to third countries, we usually rely on one of the following:

• Adequacy decisions: We may transfer your personal data to countries or organisations that have been deemed to provide an adequate level of protection for personal data by the European Commission, the UK Government, or any other relevant government body. This may include transfers to organisations that participate in the Data Privacy Framework listed here.
• Contractual safeguards: We may use specific contracts approved by the European Commission, the UK Government, or any other relevant governmental body to safeguard personal data. The contracts that we usually rely on are referred to as "Standard Contractual Clauses" or "SCCs", although we may from time to time use other approved mechanisms. To find out more about the SCCs we use, please see here (EU) and here (UK). You can also contact us using the contact details set out in the How to contact us section.

How long we keep your personal data

We will only keep your personal data for as long as necessary for the purposes set out in this Privacy Policy. We will retain and use your personal data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

In respect of personal data processed to provide the Platform and Services, we will retain relevant personal data for a period of six years following the termination of a user's subscription or our last interaction with you.

If any personal data is only useful for a short period (e.g. for a specific activity), we will not retain it for longer than the period for which it is used by us.

Confidentiality and security of your personal data

We are committed to keeping the personal data provided to us secure and we will take reasonable precautions to protect personal data from loss, misuse or alteration.

We have implemented information security policies, rules and technical measures to protect the personal data that we have under our control from:

• unauthorised access;
• improper use or disclosure;
• unauthorised modification; and
• unlawful destruction or accidental loss.

All of our members, employees, workers and data processors (i.e. those who process your personal data on our behalf, for the purposes listed above), who have access to, and are associated with, the processing of personal data, are obliged to respect the confidentiality of the personal data of all visitors to the Platform and all users of our Platform and Services.

Your rights

You have the following rights in relation to the personal data we hold about you. Please note that these rights are subject to certain exemptions which may be applicable to any request you make.

• Your right of access — If you ask us, we'll confirm whether we're processing your personal data and, subject to any applicable exemptions, provide you with a copy of that personal data (along with certain other details) within the timescales or extended timescales provided for by the GDPR for complex requests, or where applicable, provide you with an explanation as to why we will not be complying with your request. If you require additional copies, we may need to charge a reasonable fee.
• Your right to rectification — If the personal data we hold about you is inaccurate or incomplete, you're entitled to have it rectified. If you are entitled to rectification and if we've shared your personal data with others, we'll let them know about the rectification where possible and where this would not involve disproportionate effort. If you ask us, where possible and lawful to do so, we'll also tell you who we've shared your personal data with so that you can contact them directly.
• Your right to erasure — You can ask us to delete or remove your personal data in some circumstances such as where we no longer need it or if you withdraw your consent (where applicable because that was the legal basis on which we were processing your personal data). If you are entitled to erasure and if we've shared your personal data with others, we'll take reasonable steps to inform those others where possible and where this would not involve disproportionate effort. If you ask us, where it is possible and lawful for us to do so, we'll also tell you who we've shared your personal data with so that you can contact them directly.
• Your right to restrict processing — You can ask us to 'block' or suppress the processing of your personal data in certain circumstances such as where you contest the accuracy of that personal data or you object to us. If you are entitled to restriction and if we've shared your personal data with others, we'll let them know about the restriction where it is possible for us to do so. If you ask us, where it is possible and lawful for us to do so, we'll also tell you who we've shared your personal data with so that you can contact them directly.
• Your right to data portability — With effect from 25 May 2018, you have the right, in certain circumstances, to obtain personal data you've provided us with (in a structured, commonly used and machine readable format) and to reuse it elsewhere or to ask us to transfer this to a third party of your choice.
• Your right to object — You can ask us to stop processing your personal data, and we will do so, if we are: relying on our own or someone else's legitimate interests to process your personal data, except if we can demonstrate compelling legal grounds for the processing; or processing your personal data for direct marketing.
• Your rights in relation to automated decision-making and profiling — You have the right not to be subject to a decision when it's based on automatic processing, including profiling, if it produces a legal effect or similarly significantly affects you, unless such profiling is necessary for entering into, or the performance of, a contract between you and us.
• Your right to withdraw consent — If we rely on your consent (or explicit consent) as our legal basis for processing your personal data, you have the right to withdraw that consent at any time.
• Your right to lodge a complaint with the supervisory authority — If you have a concern about any aspect of our privacy practices, including the way we've handled your personal data, you can report it to the Information Commissioner's Office (ICO) in the UK where your concern relates to Lewis Silkin LLP. You can find details about how to do this on the ICO website at https://ico.org.uk/concerns/ or by calling their office on 0303 123 1113.

If you want to exercise any of these rights you can do so by contacting us.

Collection of information by third-party sites and sponsors

The Platform may contain links to sites or other online services of third parties, whose information practices may be different from ours. Visitors should consult the other sites' privacy policies as LSI has no control over information that is submitted to, or collected by, these third parties.

Changes to this Privacy Policy

We may make changes to this Privacy Policy from time to time.

To ensure that you are always aware of how we use your personal data we will update this Privacy Policy from time to time to reflect any changes to our use of your personal data. We may also make changes as required to comply with changes in applicable law or regulatory requirements. We encourage you to review this Privacy Policy periodically to be informed of how we use your personal data.

This Privacy Policy was last updated on 4 March 2026.