BTO Solicitors LLP (“BTO”) is a Scottish law firm providing legal advice and services to individual and corporate clients. This privacy notice explains how we process personal data in delivering our services.
This Privacy Notice was last updated on 11 August 2026.
Who we are
BTO acts as a data controller when determining how and why we collect and process your data. You can contact us using the details below:
Data Protection Manager
One Edinburgh Quay, 133 Fountainbridge, Edinburgh EH3 9QG
gdpr@bto.co.uk
+44 (0)131 222 2939
BTO’s Data Protection Officer is RGDP LLP:
Data Protection Officer
RGDP, One Edinburgh Quay, 133 Fountainbridge, Edinburgh EH3 9QG
info@rgdp.co.uk
+44 (0)131 222 3239
This Privacy Notice may be amended, and we will notify you of any significant changes.
What personal data do we process?
As a full-service law firm, BTO collects, stores, uses, and transfers information, including personal and special category data, as necessary to provide our services.
When we provide legal services Anti-Money Laundering Obligations
We process identification documents (e.g., passport, driving licence, and address verification) to comply with anti-money laundering regulations. We use Amiqus, a third-party provider, to conduct identity checks.
Identity Verification for Companies House
As an Authorised Corporate Service Provider (ACSP) registered with Companies House, BTO Solicitors LLP conducts identity verification checks in accordance with the Registrar (Identity Verification and Authorised Corporate Service Providers) Regulations 2025.
Provision of Legal Services
We process your contact details and any additional information required to provide legal services. This may include financial data or special category data specific to your legal matter.
Credit Card Payments
Occasionally, we accept payments by credit or debit card, either online or by phone. Our processes comply with the Payment Card Industry Data Security Standard (PCI DSS), and we do not store card details. Bank details may be stored if required for your matter.
Call and Video Recordings
We may record calls conducted via Microsoft Teams, which may include video recording, for quality assurance, training, or documentation purposes. Such recordings will be securely stored and accessed only by authorised personnel.
Lawful Basis for Processing Personal Data
Our lawful bases for processing personal data include:
- Consent
- Contract: To provide legal services under our contract with you, including pre-contractual negotiations
- Legal obligation: To meet statutory and regulatory requirements, such as anti-money laundering checks
- Legitimate interests: including processing data regarding persons other than clients involved in a matter, operation of our door entry system and visitors book, CCTV imagery, the usage of AI tools and statutory legitimate interests, as provided for in the Data (Use and Access) Act 2025
- Vital interests
- Performing a task carried out in the public interest or in the exercise of official authority vested in us
Our lawful bases for processing special category data (e.g., health data, racial or ethnic origin, political opinions religious or philosophical beliefs, trade-union membership, genetic data, biometric data and data concerning a person’s sex life or sexual orientation) include:
- Consent
- Carrying out our obligations and exercising our rights in relation to employment and social security and social protection law
- Vital interests
- Processing of personal data which has been manifestly made public by individuals themselves
- To establish, exercise or defend legal claims
- Where processing is necessary for reasons of substantial public interest
- Where processing is for reasons of public interest in the area of public health
We also process criminal conviction or offence data in accordance with Data Protection Law.
We retain personal data according to legal requirements and / or best practice and in accordance with our Data Protection Policy.
If you apply for a position with BTO
A separate Recruitment Privacy Notice is available on request.
When you work with BTO
A specific Privacy Notice for employees is available on request.
If you are one of our suppliers
We collect and process contact details of third parties or their employees to provide services. Typically, this data includes corporate contact information.
If you visit our premises
We may collect CCTV images at certain premises for staff and client security and to aid in crime prevention and detection. Notices are placed in areas where CCTV operates.
When you visit our website
We may place cookies on your device to enhance your website experience. For more details, please refer to our Cookie Policy.
Links to Other Websites
Our website may contain links to other sites. This notice only applies to our site, so please review the privacy notices on any linked websites.
Social Media
Interactions with BTO on social platforms (e.g., LinkedIn, Twitter) may allow us to obtain certain information depending on your platform privacy settings.
Keeping in touch
If you become a client, show interest in our services, or attend an event, we may use your email to send updates, legal news, and event information. You can opt out at any time by emailing marketing@bto.co.uk or unsubscribing via the link in our emails.
Even if you opt out, we may still contact you for service-related purposes.
Collecting your data
We collect data directly from you and from third parties involved in your legal matter, such as Settify Pty Ltd, referring organisations, healthcare providers, employers, HMRC, insurers, or your appointed representatives.
If you enter into a legal services contract with us, failure to provide data may prevent us from fulfilling our obligations.
Sharing your data
Third Parties
BTO uses third-party providers, e.g. for IT support, case and document management, cloud services, payment processing, identity verification, email marketing (such as MailChimp), and document storage. Contractual arrangements ensure these third parties do not misuse data, maintain confidentiality, and implement security measures.
We also share data with other parties as necessary to provide services, including solicitors, medical professionals, employers, expert witnesses, insurers, advocates, translators, and agents.
Other Situations
In a sale or restructuring of BTO’s business or where required by law, we may transfer data to a third party. We will take steps to protect your privacy rights in such transfers.
Data security
BTO uses appropriate security standards to protect personal data from unauthorised loss, use, or access. Access to data is limited to trained, authorised personnel bound by confidentiality obligations.
Where international data transfers take place, we ensure adequate safeguards are in place, such as adequacy decisions or appropriate contractual clauses.
Your rights
Under data protection law, you have several rights regarding your personal data, which are briefly outlined below:
- Access: Obtain a copy of your personal
- Rectification: Request corrections to inaccurate or incomplete
- Erasure/Restriction: Request data deletion or restriction in certain
- Objection: Object to data processing
- Portability
Much of the personal data we process is subject to client confidentiality, which may exempt us from enabling some data subjects to exercise their data subjects’ rights.
How to raise a concern
If you have concerns about how BTO Solicitors LLP processes your personal data, you may raise these with us directly.
You can do this by completing our UK GDPR/DPA Complaints Form.
Alternatively, you can contact our Data Protection Manager at gdpr@bto.co.uk or by post at:
Data Protection Manager
BTO Solicitors LLP
One Edinburgh Quay, 133 Fountainbridge, Edinburgh EH3 9QG
If you remain unhappy after contacting us, you have the right to complain to the Information Commissioner’s Office: www.ico.org.uk/concerns