Last updated: 15 October 2026
Who we are
Legal Business is published by Legalease Ltd (“Legalease”, “we”, “us”), which also publishes The Legal 500. Legalease is the controller of the personal information described in this policy.
If you have any questions about this policy or how we use your information, email [email protected], call +44 (0)20 4604 0667, or write to Legalease Ltd, 188 Fleet Street, London, EC4A 2AG.
Who this policy covers
This policy applies to anyone who uses legalbusiness.co.uk (the “Website”), including:
- visitors who are not logged in;
- registered readers and individual subscribers;
- readers whose access is provided by their employer or firm;
- people who sign up to our newsletters; and
- people who contact us.
The information we collect
Information you give us
- Account details: your name, email address, company and job title, and your password if you set one. Passwords are stored only in a scrambled form that cannot be read back.
- Newsletter sign-up: your email address and the newsletters you choose.
- Correspondence: anything you send us by email, phone or through forms on the Website.
Information about your subscription
- Your subscription status and expiry date, and the type of access you have.
Information we record when you use the Website
- Sign-in records: when you log in, and whether you used a password or an emailed login link. For login links we also record your email address, IP address and whether the attempt succeeded. We use these records to keep accounts secure and to limit repeated failed attempts.
- Technical information: your IP address, browser and device type, and the pages you request. Our hosting, content delivery and security services process this to deliver the Website and protect it from attack.
- Analytics: if you agree to analytics cookies, Google Analytics records how you use the Website, such as the pages you visit and how you arrived. See our Cookie Policy.
Visitors who are not logged in
If you are not logged in, you can read one free article every 30 days. A cookie on your device records which article you read free and when your allowance started. It contains no personal information, and we keep no record of it on our systems.
Information from other sources
- The Legal 500: if you are registered with The Legal 500 and eligible for Legal Business access, we may create a Legal Business account for you using the details you gave The Legal 500.
How we use your information and our lawful bases
Under UK data protection law we must have a lawful basis for each use of your information. Where we rely on legitimate interests, we have balanced those interests against your rights, and you can object (see “Your rights”).
| What we do | Lawful basis |
|---|---|
| Create and run your account, give you access to articles, and send service emails such as welcome emails, login links and password resets. | Contract, where you subscribe with us yourself. Legitimate interests, where your firm provides your access: delivering the service your firm has paid for. |
| Keep the Website and accounts secure, including firewall protection, limiting failed logins and keeping security logs. | Legitimate interests: protecting our systems and our readers’ accounts. |
| Send newsletters you have signed up to. | Consent, which you give when you sign up. You can unsubscribe at any time using the link in every newsletter. |
| Measure how the Website is used with Google Analytics. | Consent, given through our cookie banner. |
| Respond to your enquiries and complaints. | Legitimate interests, or contract where the enquiry is about your subscription. |
| Meet our legal, tax and regulatory obligations, and establish or defend legal claims. | Legal obligation, or legitimate interests. |
We do not sell your personal information, and we do not use it to make automated decisions that have legal or similarly significant effects on you.
Who we share your information with
Within our group
Our account managers and other staff at Legalease and The Legal 500 who need your information to run your subscription.
Service providers
We use the following providers to run the Website. They act only on our instructions.
| Provider | What they do |
|---|---|
| Microsoft Azure | Hosts the Website and its database. |
| Cloudflare | Delivers the Website quickly and protects it from attacks. |
| Twilio SendGrid | Sends account emails and newsletters. |
| Google Analytics and Google Tag Manager, used only if you consent to analytics cookies. | |
| CookieYes | Shows our cookie banner and keeps a record of your cookie choices. |
| Defiant (Wordfence) | Provides the firewall and login security for the Website. |
| Datadog | Monitors the Website’s performance and errors. |
Others
Professional advisers, regulators, law enforcement or courts, where the law requires it or to protect our rights; and a buyer or successor if all or part of our business is sold.
International transfers
Some of our providers process information outside the UK, including in the United States. Where they do, we make sure the transfer is protected as UK law requires, for example by relying on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework) or on the International Data Transfer Agreement or Addendum approved under UK law. You can ask us for details of the protection that applies.
How long we keep your information
- Account and subscription details: while your account is active, and for a reasonable period after your access ends so that it can be restored if your subscription is renewed.
- Sign-in records and security logs: for as long as we need them to keep accounts and the Website secure and to investigate problems.
- Newsletter subscription: until you unsubscribe. After that we keep only what we need to respect your choice.
- Correspondence: for as long as we need it to deal with your enquiry and any follow-up.
- Free-article cookie: up to 30 days on your device. We keep nothing ourselves.
When we no longer need information, we delete it or make it anonymous.
Your rights
You have the right to:
- ask for a copy of the information we hold about you;
- ask us to correct information that is wrong or incomplete;
- ask us to delete your information;
- ask us to restrict how we use your information;
- object to any use we base on legitimate interests. We will stop unless we have compelling grounds to continue;
- object at any time to direct marketing, which we will always respect;
- ask for information you gave us in a portable format; and
- withdraw your consent at any time where we rely on it. This does not affect anything we did before you withdrew it.
To use any of these rights, email [email protected]. We will respond within one month. Some rights have exceptions, which we will explain if they apply.
Complaints
If you are unhappy with how we have handled your information, please tell us first at [email protected] so we can try to put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Security
We protect your information with measures including encrypted connections, a web application firewall, limits on repeated failed logins, restricted staff access and monitoring. No system is completely secure, so please keep your login details private and tell us if you think your account has been misused.
Cookies
For the cookies the Website uses and how to manage them, see our Cookie Policy.
Changes to this policy
We will update this policy when our use of personal information changes. The date at the top shows when it was last updated. If we make significant changes, we will tell registered readers by email or on the Website.