Privacy Policy

The controller of your personal data is ELSG Ltd, a company registered in England and Wales under number 04520558, registered office: Building 2, 1st Floor, Croxley Green Business Park, Watford, England, WD18 8YA. Contact: info@elsg.co.uk, tel. 0203 627 0223, elsg.co.uk.

For all data-protection matters, including exercising your rights, contact: info@elsg.co.uk (marked “Data protection / GDPR”).

If we have appointed a Data Protection Officer or representative, we will provide their contact details on request.

This Policy covers the processing of data of people who, through apply.elsg.co.uk, submit employment claims, create a client account, communicate with us or upload documents. It does not cover separate legal services provided under a distinct agreement, which are governed by a separate notice/engagement.

Identity and contact data: name, email address, phone number, and possibly an address.

Employment and case data: employer name, job title, employment dates, description of events, type of claim, new-job and pay information (if provided).

Documents you upload: contracts, correspondence, dismissal letters, payslips, images and other attachments.

Special category data (Art. 9 UK GDPR): e.g. health, pregnancy, disability, origin, religion, sexual orientation — only where you provide it as relevant to your case (e.g. discrimination).

Communication data: chat messages and email correspondence.

Consent-evidence data: IP address, server and browser time, Terms and Policy versions, cryptographic signature (immutable record — for evidential purposes).

Technical data: device/browser information to the extent necessary to operate and secure the service.

Directly from you — via the form, uploaded documents and correspondence.

From uploaded documents — we may extract data relevant to assessing your case.

Automatically — technical and consent-evidence data generated while using the system.

From public sources — e.g. the Companies House register, to verify the correct employer (respondent) name.

Receiving and preliminarily assessing your submission and contacting you — based on your consent (Art. 6(1)(a)) and pre-contractual steps (Art. 6(1)(b) UK GDPR).

Handling your case and providing legal services if we take it on — based on contract (Art. 6(1)(b)) and legal/professional obligations (Art. 6(1)(c)).

Special category data — for the establishment, exercise or defence of legal claims (Art. 9(2)(f) UK GDPR) and your explicit consent (Art. 9(2)(a)).

System security, abuse prevention, record-keeping and consent evidence — our legitimate interests (Art. 6(1)(f)).

Complying with legal obligations (e.g. record retention, fraud prevention) — Art. 6(1)(c).

You can withdraw consent at any time (see the rights section); this does not affect the lawfulness of processing before withdrawal.

We process sensitive data (e.g. health, pregnancy, origin) only where you provide it, and only to the extent necessary to assess and handle your case (e.g. discrimination). Please do not submit sensitive data that is not relevant to your case.

To speed up and support our lawyers' review, we may send your submission data and attached documents to a trusted AI model provider (Anthropic) to generate a preliminary supporting analysis (e.g. prospects, estimated value, preparing data for ACAS).

The AI analysis is advisory only and is NOT an automated decision producing legal effects for you — a human (a lawyer) always makes the final assessment. The AI provider does not use your data to train its models.

By submitting and accepting this Policy you consent to such AI-assisted processing. You may withdraw consent by contacting us, in which case your case will be assessed by a human only.

We use email (provider: Resend) for confirmations, status notifications and messages from the team. Panel sign-in uses a secure magic link — we do not store your password in plain text. Staff use multi-factor authentication (MFA).

We use trusted providers acting on our instructions under data processing agreements: Supabase (database, authentication, file storage), Vercel (application hosting), Resend (email), Cloudflare (protection/security), Anthropic (AI model for supporting analysis).

We verify the employer name against the public Companies House register (GOV.UK).

With your knowledge, if we take on your case, we may transfer case data into a practice-management system (Clio) to run the matter.

We may also disclose data to authorities or bodies where required by law, or to advisers (e.g. insurer, auditor) to the extent necessary.

We do not sell your personal data.

Some providers may process data outside the UK/EEA (e.g. in the USA). Where they do, we ensure appropriate safeguards required by the UK GDPR — adequacy decisions, standard contractual clauses (SCCs / UK IDTA) or other permitted mechanisms. We will provide a copy of or information about the safeguards on request.

We keep case data for as long as necessary to assess and handle it, then in line with the Firm's professional obligations and limitation periods. Deleted submissions are moved to trash and permanently erased after 30 days.

Consent records (evidence of consent) are kept in an immutable, signed record even after a case is deleted — as evidence of legal compliance (Art. 17(3)(b)/(e) UK GDPR).

After retention periods expire, data is deleted or anonymised.

We use appropriate technical and organisational measures: encryption in transit (HTTPS/HSTS), row-level data isolation (RLS), mandatory MFA for staff, least-privilege access control, private file storage with short-lived links, and cryptographic signing of submissions and consents. No system is 100% secure — we work to minimise risk and respond to incidents as required by law.

You have the rights to: access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, and withdrawal of consent at any time.

In your panel you can permanently delete your entire submission and its attachments yourself.

To exercise your rights, email info@elsg.co.uk. We may ask you to verify your identity. We generally respond within one month.

You have the right to complain to the supervisory authority: the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; ico.org.uk; tel. 0303 123 1113. Please contact us first so we can try to resolve the matter.

We do not make decisions about you based solely on automated processing (including profiling) that produce legal effects or similarly significantly affect you. The AI analysis is only advisory for a decision made by a human.

We use essential cookies and browser local storage solely to operate the service: session/authentication, remembering the theme, autosaving your form draft, and app (PWA) mode. We do not use marketing tracking cookies without your consent.

The service is intended for adults and is not directed at children. We do not knowingly collect data from persons under 18 in the context of submissions.

We may update this Policy. Each version has a number and a cryptographic hash (shown at the bottom of the page), and on submission we record the version you accepted. We will notify you of material changes appropriately.

For personal-data matters: info@elsg.co.uk. Controller details are in section 1. You may complain to the ICO (section 13).