Last updated: 2 November 2026
Who we are
Legal Business is published by Legalease Ltd (“Legalease”, “we”, “us”), which also publishes The Legal 500. Legalease is the controller of the personal information described in this policy.
If you have any questions about this policy or how we use your information, email [email protected], call +44 (0)20 4604 0667, or write to Legalease Ltd, 188 Fleet Street, London, EC4A 2AG.
Who this policy covers
This policy applies to anyone who uses legalbusiness.co.uk (the “Website”), including:
- visitors who are not logged in;
- registered readers and individual subscribers;
- readers whose access is provided by their employer or firm under a firm subscription, and the firm’s nominated administrators;
- people who sign up to our newsletters; and
- people who contact us.
The information we collect
Information you give us
- Account details: your name, email address, company and job title, and your password if you set one. Passwords are stored only in a scrambled form that cannot be read back.
- Newsletter sign-up: your email address and the newsletters you choose.
- Correspondence: anything you send us by email, phone or through forms on the Website.
Information about your subscription
- Your subscription status and expiry date, and the type of access you have.
- If your access comes through your firm: the firm you belong to, the email domains that firm uses, whether you are one of the firm’s administrators, who added you and when, and, if your access ends, when and by whom it was ended.
Information we record when you use the Website
- Sign-in records: when you log in, and whether you used a password or an emailed login link. For login links we also record your email address, IP address and whether the attempt succeeded. For password logins and password resets, we count failed attempts from each network address for up to 4 hours. We use these records to keep accounts secure and to limit repeated failed attempts.
- Activity log (logged-in users only): a log of what logged-in users do on the Website, including when they log in and which articles they open, with the date, time and IP address. We use it to keep the Website secure and to investigate problems.
- Reading activity (logged-in readers only): which articles you open and on which days, how many times, when you log in, and when you were last active. We do not record this for visitors who are not logged in. So that a firm’s report shows its usage over time, it can include logins and article views already held in our sign-in records and activity log, going back no more than 24 months.
- Technical information: your IP address, browser and device type, and the pages you request. Our hosting, content delivery and security services process this to deliver the Website and protect it from attack.
- Analytics: if you agree to analytics cookies, Google Analytics records how you use the Website, such as the pages you visit and how you arrived. See our Cookie Policy.
Visitors who are not logged in
If you are not logged in, we may let you read a limited number of free articles, currently one every 30 days while the allowance is offered. A cookie on your device records which article you read free and when your allowance started. It contains no personal information, and we keep no record of it on our systems.
Information from other sources
- Your firm: if your firm has a subscription, its administrators may give us your name and work email address so that we can set up your access.
- The Legal 500: if you are registered with The Legal 500 and eligible for Legal Business access, we may create a Legal Business account for you using the details you gave The Legal 500.
How we use your information and our lawful bases
Under UK data protection law we must have a lawful basis for each use of your information. Where we rely on legitimate interests, we have balanced those interests against your rights, and you can object (see “Your rights”).
| What we do | Lawful basis |
|---|---|
| Create and run your account, give you access to articles, and send service emails such as welcome emails, login links and password resets. | Contract, where you subscribe with us yourself. Legitimate interests, where your firm provides your access: delivering the service your firm has paid for. |
| Manage firm subscriptions, including, where your firm manages its subscription on the Website, letting your firm’s administrators add and remove colleagues and see who has access. | Legitimate interests: ours and your firm’s, in administering a subscription with a limited number of seats. |
| Record reading activity and report it to your firm and to our account managers, including individual reports of articles read, active days, logins and last activity. | Legitimate interests: showing your firm how its subscription is used, supporting renewals, and improving our coverage. |
| Keep the Website and accounts secure, including blocking malicious traffic, limiting failed logins, and keeping security records and the activity log. | Legitimate interests: protecting our systems and our readers’ accounts. |
| Send newsletters you have signed up to. | Consent, which you give when you sign up. You can unsubscribe at any time using the link in every newsletter. |
| Measure how the Website is used with Google Analytics. | Consent, given through our cookie banner. |
| Respond to your enquiries and complaints. | Legitimate interests, or contract where the enquiry is about your subscription. |
| Meet our legal, tax and regulatory obligations, and establish or defend legal claims. | Legal obligation, or legitimate interests. |
We do not sell your personal information, and we do not use it to make automated decisions that have legal or similarly significant effects on you.
Who we share your information with
Your firm
If your access is provided by your firm, the firm’s nominated administrators can see your name, email address and whether you currently have access, and can add or remove you. Your firm may also receive reports from us of your reading activity: the articles you read, the days you were active, your logins and when you were last active. You can ask us to stop at any time by emailing [email protected]. If you do, we stop reporting your activity to your firm and delete the reading activity we hold for reports. Your firm may still see your name, marked as not recorded at your request, but nothing about what you read or when you logged in. Our security records, including the activity log, are kept separately, used only for security, and deleted on their usual schedule.
Within our group
Our account managers and other staff at Legalease and The Legal 500 who need your information to run your subscription.
Service providers
We use the following providers to run the Website. They act only on our instructions.
| Provider | What they do |
|---|---|
| Microsoft Azure | Hosts the Website and its database. |
| Cloudflare | Delivers the Website quickly and protects it from attacks. |
| Twilio SendGrid | Sends account emails and newsletters. |
| Google Analytics and Google Tag Manager, used only if you consent to analytics cookies. | |
| CookieYes | Shows our cookie banner and keeps a record of your cookie choices. |
| Datadog | Monitors the Website’s performance and errors. |
Others
Professional advisers, regulators, law enforcement or courts, where the law requires it or to protect our rights; and a buyer or successor if all or part of our business is sold.
International transfers
Some of our providers process information outside the UK, including in the United States. Where they do, we make sure the transfer is protected as UK law requires, for example by relying on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework) or on the International Data Transfer Agreement or Addendum approved under UK law. You can ask us for details of the protection that applies.
How long we keep your information
- Account and subscription details: while your account is active, and for a reasonable period after your access ends so that it can be restored if your subscription is renewed.
- Reading activity and login dates used in reports: 24 months from the date of the activity, after which they are deleted automatically.
- Activity log: 6 months, after which entries are deleted automatically.
- Sign-in records and security logs: for as long as we need them to keep accounts and the Website secure and to investigate problems.
- Newsletter subscription: until you unsubscribe. After that we keep only what we need to respect your choice.
- Correspondence: for as long as we need it to deal with your enquiry and any follow-up.
- Free-article cookie: up to 30 days on your device. We keep nothing ourselves.
When we no longer need information, we delete it or make it anonymous.
Your rights
You have the right to:
- ask for a copy of the information we hold about you;
- ask us to correct information that is wrong or incomplete;
- ask us to delete your information;
- ask us to restrict how we use your information;
- object to any use we base on legitimate interests, including recording your reading activity and reporting it to your firm, which we will always stop when you ask. For anything else, we will stop unless we have compelling grounds to continue;
- object at any time to direct marketing, which we will always respect;
- ask for information you gave us in a portable format; and
- withdraw your consent at any time where we rely on it. This does not affect anything we did before you withdrew it.
To use any of these rights, email [email protected]. We will respond within one month. Some rights have exceptions, which we will explain if they apply.
Complaints
If you are unhappy with how we have handled your information, please tell us first at [email protected] so we can try to put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Security
We protect your information with measures including encrypted connections, filtering of malicious traffic, limits on repeated failed logins, restricted staff access and monitoring. No system is completely secure, so please keep your login details private and tell us if you think your account has been misused.
Cookies
For the cookies the Website uses and how to manage them, see our Cookie Policy.
Changes to this policy
We will update this policy when our use of personal information changes. The date at the top shows when it was last updated. If we make significant changes, we will tell registered readers by email or on the Website.