Privacy Policy
Effective Date: 19 January 2026
This Privacy Policy explains how Lexis Bridge Atlantic (“LBA,” “we,” “us,” or “our”) collects, uses, and safeguards personal data obtained through our website and in the course of providing specialised legal strategy, forensic procedural, and litigation-support consultancy services.
LBA is committed to protecting sensitive legal, institutional, and procedural information entrusted to it by Client-Firms and Self-Representing Clients.
1. Data Controller and Data Processor Roles
LBA’s role under applicable data protection laws (including the UK GDPR and EU GDPR) depends on the nature of the engagement:
Client-Firms
Where a licensed attorney or law firm retains LBA, the Client-Firm remains the Data Controller for all case-related personal data. LBA acts solely as a Data Processor, processing data strictly in accordance with the documented instructions of the Client-Firm.
Self-Representing Clients (Pro Se)
Where an individual engages LBA directly without licensed counsel, LBA acts as the Data Controller for the personal data provided. Data is processed solely for the purposes of performing the contracted consultancy services and is not repurposed for unrelated analytics, marketing, or automated decision-making.
2. Information We Collect
A. Contact and Business Data
-
Identity details (name, firm, role, relationship to the inmate or defendant)
-
Billing and payment information (processed via secure third-party payment providers; LBA does not store full card details)
-
Communications (email correspondence and secure file-transfer records)
B. Sensitive Case and Procedural Data
Provided exclusively for forensic research and strategic analysis:
-
Court records, transcripts, pleadings, and sentencing documents
-
Special category data, including criminal history, custodial records, disciplinary reports, and relevant medical or psychiatric evaluations
-
Inmate identifiers, facility details, and institutional correspondence
3. Lawful Basis for Processing
LBA processes personal data on the following lawful bases:
Contact and Business Data
-
Purpose: Contract administration, billing, and service delivery
-
Legal Basis: Performance of a Contract
Sensitive Case and Procedural Data
-
Purpose: Forensic procedural analysis, postconviction strategy, appellate research, and preparation of litigation support materials
-
Legal Basis: Legitimate Interests and necessity for the establishment, exercise, or defence of legal claims, to the extent strictly necessary (Article 9(2)(f) UK/EU GDPR)
Website Usage Data
-
Purpose: Website security, functionality, and performance monitoring
-
Legal Basis: Legitimate Interests
4. Disclosure and International Transfers
A. Data Sharing
-
LBA does not sell personal data
-
Sponsoring Parties: Payment by a third party does not confer access to case data without the Client’s express written consent
-
Legal Obligations: Disclosure may occur where required by lawful court order or subpoena
B. International Data Transfers
As a transatlantic consultancy, LBA processes data in both the United Kingdom and the United States. All cross-border transfers are safeguarded using appropriate legal mechanisms, including Standard Contractual Clauses (SCCs).
5. Security and Retention
A. Data Security
-
Encrypted communications (SSL/TLS and secure file transfer)
-
Restricted access on a strict need-to-know basis
-
No open access to case materials by third parties
B. Data Retention
-
Case Data: Retained for the duration of the engagement plus one (1) year, unless a longer period is required by law or agreed in writing
-
Business Records: Retained for up to seven (7) years to comply with tax and audit obligations
6. Data Subject Rights
Individuals subject to UK or EU GDPR protections have rights of access, rectification, and erasure, subject to legal and contractual limitations.
These rights apply only where LBA is acting as Data Controller and where the individual qualifies as a UK/EU data subject.
7. Contact Information
For privacy-related enquiries or to exercise applicable data rights:
Data Protection Officer: