Privacy Policy

This policy explains how Legal Pandas Ltd, trading as AskPanda, collects and uses personal data through the askpanda.ai website and the AskPanda platform, and the rights you have over that data. It is written for three groups of people: visitors to our website, people at law firms who use the platform, and members of the public whose enquiries a law firm manages using AskPanda.

1. Who we are

Legal Pandas Ltd is a company incorporated in England and Wales with company number 12280256. Our registered office is at Archer House, Britland Estate, Northbourne Road, Eastbourne, East Sussex, BN22 8PW. We are registered with the Information Commissioner's Office (ICO) under registration number ZB193262.

For any question about this policy or about your personal data, email support@legalpandas.com or write to the address above.

2. Our two roles: controller and processor

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 we act in two different capacities, and it matters which one applies to you.

1. We are the controller for personal data about website visitors, people who contact us or book a demo, and the staff of law firms who hold AskPanda accounts. Sections 3 to 5 describe that processing.
2. We are a processor for the enquiry data that law firms bring into AskPanda. That data, which we call Client Enquiry Data, belongs to the firm. The firm decides why and how it is processed, and we act only on the firm's instructions under our Data Processing Agreement . Section 6 explains this.

If you have contacted a law firm and believe your details are held in AskPanda, the firm is the controller of that information. Please direct any request about it to the firm. We will help the firm respond.

3. Personal data we collect as a controller

4. Why we use it and our lawful basis

Where we rely on legitimate interests we have considered the impact on you and concluded that our interests are not overridden by your rights. You can object at any time, as described in section 9.

5. Who we share controller data with

We share personal data only where necessary, with:

1. service providers that host and run our website and platform, send our emails, provide support chat and monitor errors (the current list is in section 7);
2. our professional advisers, such as accountants, insurers and lawyers, where they need it to advise us;
3. regulators, courts and law enforcement where the law requires or permits it; and
4. a buyer or prospective buyer of our business, in which case the new owner may use the data only for the purposes described in this policy.

We never sell personal data, and we never share one firm's data with another firm.

6. Client Enquiry Data: how we act as a processor

A law firm using AskPanda brings in enquiries from its website forms, emails and telephone messages. Those enquiries typically contain the enquirer's name, contact details, the description of their legal matter, and any further correspondence. Because enquirers write in their own words, the description may include sensitive information, for example about health, family circumstances or criminal proceedings.

On the firm's behalf, and only on its instructions, we store those enquiries in the firm's account, use artificial intelligence to organise and summarise them so the firm's staff can respond quickly, route them to the people the firm chooses, send the communications the firm chooses to send, and report to the firm about its own enquiries. The AI organises and summarises; it does not make decisions about anyone that produce legal or similarly significant effects. The firm's staff review what it produces and decide what to do.

Client Enquiry Data is never used to train AI models, never used for our own marketing, and never shared with any other firm. Only sub-processors listed in section 7 handle it, under written contracts. Full details, including retention, security and breach notification, are in our Data Processing Agreement , which forms part of every customer contract.

7. Service providers and sub-processors

In addition, the askpanda.ai website uses Google Analytics (Google LLC) to measure visits, if you consent to analytics cookies. Our demo booking buttons link out to Calendly (Calendly LLC), a separate website with its own privacy policy; nothing from Calendly runs on askpanda.ai. These handle website-visitor data only, not Client Enquiry Data. Our source code is hosted with Atlassian (Bitbucket) and contains no personal data.

8. International transfers

We are based in the United Kingdom and the platform, including its database and backups, is hosted in the AWS London region. Some of the providers listed above process data in the European Union, which the UK recognises as providing adequate protection, and some in the United States. Where personal data leaves the UK we rely on one of the safeguards recognised by UK law: the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or the ICO's International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. You can ask us for a copy of the relevant safeguard at the address in section 1.

9. How long we keep data

10. Cookies and similar technologies

Our website and platform use the following cookies and local storage.

Strictly necessary cookies are set without consent because the website, platform and support chat cannot work without them. Analytics cookies are not essential. We ask for your consent through the cookie banner before setting them, and we record your choice in your browser for six months. You can change your choice at any time using the "Cookie settings" link in the website footer. You can also block or delete cookies in your browser settings, and Google offers a browser add-on that disables Google Analytics. Blocking cookies may stop the support chat working.

11. Security

We protect personal data with technical and organisational measures appropriate to the risk. They are summarised in Annex 2 of the Data Processing Agreement and described on our Security page. If you suspect any misuse of or unauthorised access to your data, please tell us immediately at support@legalpandas.com.

12. Your rights

Where we are the controller you have the right to:

1. access the personal data we hold about you and receive a copy;
2. correct data that is inaccurate or incomplete;
3. erase your data where there is no good reason for us to keep it;
4. restrict how we use your data while a query or objection is resolved;
5. receive data you gave us in a portable, machine-readable format;
6. object to processing based on legitimate interests, and to direct marketing at any time;
7. withdraw consent where consent is the basis for processing, without affecting processing that has already taken place.

To exercise any right, email support@legalpandas.com. We will respond within one month and will not charge a fee unless a request is manifestly unfounded or excessive. We may ask you to confirm your identity first.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would welcome the chance to resolve your concern first.

13. Children

Our website and platform are for legal professionals and are not directed at children. We do not knowingly collect personal data from anyone under 18 as a controller. Enquiries that a firm receives about matters involving children are Client Enquiry Data controlled by that firm.

14. Links to other websites

Our website links to other sites, including Calendly for demo bookings and social media. This policy does not cover those sites and we are not responsible for their content or privacy practices.

15. Changes to this policy

We will post any changes on this page and update the date at the top. If a change materially affects how we use account users' data we will also notify customers by email. This policy is governed by the law of England and Wales.