How Stolen Legacy uses information submitted through the evidence register

1. Information we collect

The case-analysis form may collect the optional information you choose to provide, including your name or preferred identifier, contact details, claim or appeal number, court or tribunal, case type, representation status, ethnic group, procedural issues, why you believe the hearing was unfair, property outcome, estimated loss, a request for free initial analysis and interest in the proposed group action. The Open Justice Judge Register form may additionally collect the judge or tribunal member’s name, the exact judicial act, the source relied upon, the law or safeguard allegedly not applied, and any appeal, correction or complaint outcome.

Ethnicity is special-category personal data. We process it only where you give explicit consent. You may select “prefer not to say”.

2. Why we use the information

• to receive and assess reports of possible racial disparity and procedural unfairness in civil property proceedings;
• to contact you, where authorised, to verify your account and request limited supporting material;
• to produce anonymised research and statistics about recurring patterns;
• to prepare parliamentary, policy and public-interest material;
• to verify potential entries for the Open Justice Judge Register, including source checking, redaction, legal review and seeking a response where appropriate;
• where you separately agree, to prepare an anonymised issue summary for independent solicitors or counsel considering possible coordinated proceedings; and
• where you opt in, to send campaign, petition or group-action updates.

3. Lawful bases

For the first-stage submission, our principal lawful basis is your consent under Article 6(1)(a) UK GDPR. For ethnicity information, we rely on your explicit consent under Article 9(2)(a). You may withdraw consent by emailing info@stolenlegacy.co.uk. Withdrawal does not affect processing carried out before withdrawal.

Where information is required to establish, exercise or defend legal claims, a further lawful basis or special-category condition may apply. Stolen Legacy will obtain appropriate legal and data-protection advice before using information for a materially different purpose.

4. How the form is sent

The form is submitted to a submission service and stored in the Stolen Legacy secure records system. The database record includes the form information you choose to provide, the submission time, a unique reference, consent selections, and technical metadata used for security and statistical analysis.

The website also records the submitting IP address, a protected hash of that address, browser and operating-system information, device type, preferred language, page URL, referring page, client timezone, screen and viewport dimensions, and optional region, country and postcode. This information is used to prevent abuse, diagnose technical problems, understand regional patterns and evaluate how the service is accessed. Do not submit passwords, bank details, children’s names, full medical records or complete unredacted evidence bundles.

5. Access and sharing

Database submissions are accessed through a password-protected administration area. Access is restricted to Mr Jason Grant, as Data Controller, and any specifically authorised person acting under his instructions. Administrative access is session-protected and the password is stored as a one-way hash rather than readable text.

Identifiable submissions are not published. Access is limited to authorised persons who need it for intake and verification. We may share information:

• with website-hosting and database providers acting as processors;
• with independent solicitors or counsel where you have given the relevant permission or another lawful basis clearly applies;
• where required by law, court order or a competent regulator; or
• where lawful and necessary to address a serious and immediate risk.

Public reports will use anonymised or aggregated contributor information unless you provide separate informed written consent and publication has passed legal review. A judge’s name or public judicial act may be reported where lawful under open-justice principles, but contributor identities and private information will not be published without separate consent.

6. Retention

First-stage submissions and related correspondence are normally retained for up to 24 months after the last meaningful contact. Information may be kept longer where verification or legal assessment remains active, a legal claim is reasonably contemplated or active, or retention is required by law. Information no longer needed will be deleted or anonymised.

7. Security

Stolen Legacy will use proportionate safeguards including access controls, strong authentication, limited permissions, secure hosting, software updates and careful redaction. No internet transmission is completely risk-free. Contributors should provide only the minimum information necessary at the first stage.

8. Your rights

Depending on the circumstances, you may have rights to be informed, access your information, correct inaccurate information, withdraw consent, request erasure, restrict processing, object to processing and receive certain information in a portable format. Requests should be sent to info@stolenlegacy.co.uk. We may need to confirm your identity.

9. Complaints

Please raise concerns first with Stolen Legacy at info@stolenlegacy.co.uk. You also have the right to complain to the Information Commissioner’s Office.

10. Children and prohibited information

The register is for adults aged 18 or over. Do not identify children by name or provide their dates of birth, school, medical records or other identifying details. Describe their involvement only in general terms.

11. Changes

Material changes will be posted on this page with a revised effective date. Where appropriate, contributors will be notified by email.