Privacy Policy

Last updated: 17 June 2026

1. About this Privacy Policy

X LAW LTD, trading as X Law, respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains:

• what personal information we collect;

• how and why we use it;

• the lawful bases on which we rely;

• who we may share it with;

• how long we normally retain it;

• how we use forms, customer relationship management systems, messaging services and artificial intelligence;

• your rights under data-protection law; and

• how you can contact us or make a complaint.

This policy applies when you:

• visit the X Law website;

• complete a website enquiry form;

• submit an enquiry through Facebook, Instagram or another advertising platform;

• contact us by telephone, email, SMS, WhatsApp or social media;

• book an appointment or consultation;

• speak with a member of staff or an automated assistant;

• receive immigration advice or services from us;

• download a guide or resource;

• make a payment; or

• otherwise provide personal information to X Law.

2. Who we are

X Law is a trading name of:

X LAW LTD

Company number: 14358643

Registered office:

3 Hardman Street
Manchester
M3 3HF
United Kingdom

Telephone: 0330 236 9248

Email: contact@xlaw.lawyer

Website: https://xlaw.lawyer

X Law is regulated by the Immigration Advice Authority under registration number F202200098.

For the purposes of the UK General Data Protection Regulation and the Data Protection Act 2018, X LAW LTD is generally the data controller responsible for the personal information described in this policy.

Questions about this policy or the use of your personal information should be sent to:

Data Protection Contact
X LAW LTD
3 Hardman Street
Manchester
M3 3HF
Email: contact@xlaw.lawyer

3. Personal information we may collect

The information we collect depends on the nature of your enquiry and whether you become a client.

3.1 Identity and contact information

This may include:

• full name;

• title;

• date of birth;

• postal address;

• email address;

• telephone number;

• nationality;

• passport or identity-document details;

• Home Office reference numbers; and

• details of family members, dependants, sponsors, employers or representatives.

3.2 Immigration and legal information

This may include:

• current and previous immigration status;

• visa type and expiry date;

• immigration history;

• previous applications and decisions;

• refusals, curtailments, cancellations or enforcement action;

• Home Office correspondence;

• travel and residence history;

• relationship and family information;

• employment, sponsorship and study information;

• financial and accommodation information;

• evidence and documents supplied in connection with an immigration matter;

• legal questions, instructions and advice; and

• information about deadlines, proceedings, reviews, appeals or other legal processes.

3.3 Special-category and sensitive information

Immigration matters may require us to process particularly sensitive information, including information revealing or concerning:

• racial or ethnic origin;

• religious or philosophical beliefs;

• political opinions, where relevant;

• trade-union membership, where relevant;

• physical or mental health;

• disability;

• biometric information;

• sex life or sexual orientation;

• domestic abuse, exploitation or safeguarding concerns; and

• other sensitive personal circumstances.

We may also process information relating to criminal allegations, convictions, offences, cautions, penalties or investigations where relevant to an immigration matter.

Please do not send sensitive documents through a general enquiry form unless we have asked you to do so. We will explain how documents should be provided securely where they are required.

3.4 Enquiry and communication information

This may include:

• the source of your enquiry;

• the advertisement, campaign, webpage or form through which you contacted us;

• form answers;

• notes made during telephone or online conversations;

• emails, messages and correspondence;

• call dates, durations and outcomes;

• call recordings or transcripts, where applicable;

• appointment and consultation information;

• your preferred communication method and time;

• communication consent and opt-out records; and

• records of follow-up attempts.

The fact that you entered through an advertisement about a particular visa route does not necessarily mean that we will classify your matter as relating to that visa. We may ask further questions to identify the nature of the help you require.

3.5 Financial and transaction information

This may include:

• quotations and agreed fees;

• invoices and payment status;

• transaction references;

• refund information;

• limited payment-card information provided through payment processors; and

• information required for accounting, fraud prevention and compliance.

We do not normally store complete payment-card details ourselves.

3.6 Website and technical information

When you use our website, we may collect:

• internet protocol address;

• browser type and version;

• device information;

• operating system;

• approximate location derived from technical information;

• pages visited;

• links or buttons selected;

• referral source;

• time spent on the website;

• cookie identifiers;

• form interaction and submission information; and

• website-security and error-log information.

4. How we collect personal information

We may collect information:

Directly from you

For example, when you:

• complete a website or social-media form;

• telephone, email or message us;

• speak to an adviser or automated assistant;

• book a consultation;

• provide documents;

• instruct us to act;

• make a payment; or

• provide feedback or submit a complaint.

From third parties

Where lawful and relevant, information may be received from:

• a spouse, partner, family member or representative;

• an employer, sponsor or educational institution;

• another adviser or professional representative;

• the Home Office or another government body;

• the Immigration Advice Authority;

• courts or tribunals;

• interpreters, experts or counsel;

• advertising and social-media platforms, including Meta platforms;

• referral partners; and

• publicly available sources.

Where another person provides information about you, they should ensure that they have authority to do so.

5. How we use personal information

We may use personal information to:

5.1 Respond to enquiries

This includes:

• acknowledging receipt of an enquiry;

• identifying the general nature of the immigration matter;

• contacting you using an authorised channel;

• assessing urgency;

• allocating an enquiry to an appropriate member of staff;

• arranging an appointment;

• deciding whether we are able to assist; and

• providing preliminary information about our services.

5.2 Provide immigration advice and services

Where you become a client, this may include:

• completing identity, suitability and conflict checks;

• opening and administering a client file;

• reviewing your circumstances and evidence;

• providing immigration advice;

• preparing applications, representations and supporting documents;

• communicating with the Home Office and relevant third parties;

• managing deadlines;

• maintaining records required by our regulator;

• invoicing and collecting payment; and

• dealing with complaints, audits or regulatory enquiries.

5.3 Manage appointments and communications

This may include:

• sending confirmations and reminders;

• creating calendar appointments;

• generating video-meeting links;

• recording communication preferences;

• sending service-related emails, SMS or WhatsApp messages;

• following up on an enquiry;

• recording whether a person replied, booked or opted out; and

• preventing duplicate or inappropriate communications.

5.4 Improve and secure our services

This may include:

• training and quality monitoring;

• reviewing enquiry handling and response times;

• analysing service performance;

• testing and improving forms and workflows;

• detecting spam, fraud or misuse;

• maintaining website and system security;

• troubleshooting technical issues; and

• creating aggregated or anonymised reports.

5.5 Meet legal and regulatory obligations

This may include:

• record keeping;

• accounting and taxation;

• regulatory audits;

• responding to lawful requests;

• fraud prevention;

• safeguarding;

• complaints handling; and

• establishing, exercising or defending legal rights.

5.6 Send marketing communications

We will only send general marketing communications where permitted by law.

Marketing may include:

• immigration updates;

• guides and resources;

• newsletters;

• information about services;

• event invitations; and

• promotional communications.

Submitting an immigration enquiry does not automatically mean that you have agreed to receive unrelated marketing.

Where consent is required, marketing consent will be requested separately. You may unsubscribe or object to direct marketing at any time.

6. Our lawful bases

We only process personal information where we have a valid lawful basis.

Depending on the circumstances, we may rely on one or more of the following.

6.1 Steps before entering into a contract

We may use information where you have asked us to:

• respond to an enquiry;

• assess whether we can assist;

• provide a quotation;

• arrange a consultation; or

• take other steps before you formally instruct us.

6.2 Performance of a contract

Where you become a client, processing may be necessary to provide the services described in our Client Care Letter or other written agreement.

6.3 Legal obligation

We may process information where necessary to comply with obligations relating to:

• immigration-adviser regulation;

• taxation and accounting;

• fraud prevention;

• court or regulatory requirements;

• data protection;

• employment; or

• other applicable laws.

6.4 Legitimate interests

We may rely on legitimate interests where the processing is reasonably necessary for purposes such as:

• managing and responding to enquiries;

• operating our practice;

• communicating with clients and potential clients;

• maintaining accurate records;

• improving our services;

• protecting our systems;

• preventing fraud and misuse;

• recovering unpaid fees; and

• establishing or defending legal rights.

Where we rely on legitimate interests, we consider whether our interests are overridden by your rights and interests.

6.5 Consent

We may rely on consent where you have made a clear and informed choice, including for:

• certain marketing communications;

• optional automated or AI-assisted voice calls;

• certain cookies or tracking technologies; and

• particular uses of sensitive information where explicit consent is appropriate.

You may withdraw consent at any time. Withdrawal does not affect processing that took place lawfully before consent was withdrawn.

7. Special-category and criminal-offence information

Where we process special-category information, we will identify both:

• an appropriate lawful basis under Article 6 of the UK GDPR; and

• an additional condition permitted under Article 9 of the UK GDPR and the Data Protection Act 2018.

Depending on the circumstances, relevant conditions may include:

• your explicit consent;

• processing necessary for the establishment, exercise or defence of legal claims;

• protection of vital interests where a person is unable to consent;

• processing necessary for reasons of substantial public interest where the relevant legal conditions are met; or

• another condition permitted by law.

Where we process criminal-offence information, we will do so only where authorised by law and subject to appropriate safeguards.

We collect sensitive information only where it is relevant and reasonably necessary.

8. Facebook, Instagram and other online lead forms

Where you submit an enquiry through Facebook, Instagram or another online advertising platform:

• the platform may initially collect the information on its own systems;

• it may send the submitted information to X Law or our customer relationship management system;

• we may record the relevant page, advertisement, campaign and form;

• we may contact you about the specific enquiry you submitted; and

• we may use the information to create a contact record and an enquiry opportunity.

The platform will also process information under its own privacy policy.

Entering through an advertisement about a particular visa does not confirm that the advertised route is appropriate for you. Your actual immigration matter will remain unconfirmed until it has been reviewed.

9. Customer relationship management and automation

X Law may use customer relationship management, form, workflow and communication software to:

• receive enquiries;

• create and update contact records;

• record the source of an enquiry;

• assign enquiries;

• create staff tasks;

• send acknowledgements and reminders;

• record communication preferences;

• organise appointments;

• record pipeline progress;

• produce management reports; and

• avoid unnecessary or duplicate messages.

Automated workflows may take routine administrative actions based on information such as:

• the form submitted;

• whether a message has been answered;

• whether an appointment has been booked;

• whether permission for a communication channel has been recorded; and

• the stage of an enquiry.

Automated workflows do not provide final immigration advice and do not make final decisions about your eligibility, the merits of your matter or whether an application will succeed.

10. Automated and AI-assisted voice calls

Where this service is enabled and you have provided the necessary permission, X Law may use an automated or AI-assisted voice system to contact you about an enquiry.

The automated assistant may:

• identify itself as an automated assistant;

• acknowledge receipt of an enquiry;

• verify basic contact information;

• ask preliminary intake questions;

• establish whether your matter concerns the advertised service or another issue;

• identify an urgent deadline;

• record answers in our customer relationship management system;

• arrange an appointment;

• create a task for a member of staff;

• send a follow-up message; or

• transfer a call to a human member of staff.

An automated assistant will not:

• make a final legal assessment;

• guarantee eligibility or success;

• make the final decision about whether X Law accepts a matter;

• replace formal advice from an authorised adviser; or

• make a solely automated decision that produces a legal or similarly significant effect.

You may ask to speak with a human member of staff, decline to answer a question or end the call.

11. Call recording and transcription

Telephone or online calls may be recorded or transcribed where this is necessary and proportionate for:

• enquiry handling;

• confirming instructions;

• maintaining an accurate record;

• training and quality assurance;

• monitoring staff and automated systems;

• handling complaints;

• regulatory compliance; and

• protecting legal rights.

Where appropriate, you will be informed that recording or transcription is taking place.

Access to recordings and transcripts is restricted to authorised persons and relevant service providers.

12. Email, SMS and WhatsApp

Where you submit an enquiry and authorise contact, we may communicate with you by:

• telephone;

• email;

• SMS; or

• WhatsApp.

Communications about the enquiry you submitted are treated separately from general marketing.

You may ask us to stop using a particular communication channel. However, where you become a client, we may still need to retain previous communications or contact you by an appropriate method to fulfil our agreement or comply with legal obligations.

Email, SMS and WhatsApp may not always be completely secure. You should not send passports, bank statements, medical evidence or other highly sensitive documents unless we have approved the method of transmission.

13. Who we may share personal information with

We do not sell personal information.

Where necessary and lawful, we may share information with:

• authorised X Law staff and advisers;

• the Home Office and other government departments;

• the Immigration Advice Authority;

• courts, tribunals and law-enforcement bodies;

• barristers, solicitors, interpreters, translators and experts;

• employers, sponsors, educational institutions or family members where authorised and relevant;

• professional indemnity insurers;

• accountants, auditors and professional advisers;

• website-hosting and IT-support providers;

• customer relationship management and workflow providers;

• email, SMS, telephone and WhatsApp service providers;

• cloud-storage and document-management providers;

• calendar and video-conferencing providers;

• payment processors;

• analytics, advertising and social-media providers;

• fraud-prevention and cybersecurity providers;

• debt-recovery providers; and

• a purchaser, investor or professional adviser involved in a genuine business restructuring, subject to appropriate confidentiality protections.

Service providers acting on our behalf are permitted to use personal information only for the contracted services and must protect it appropriately.

We may also disclose information where required by law or where necessary to protect a person’s vital interests, prevent fraud, safeguard an individual or establish or defend legal rights.

14. International transfers

Some technology and communication providers may process or store information outside the United Kingdom.

Where personal information is transferred internationally, we will take reasonable steps to ensure that a lawful transfer mechanism and appropriate protections are in place.

Depending on the destination and provider, these protections may include:

• a UK adequacy regulation;

• the UK International Data Transfer Agreement;

• the UK Addendum to approved contractual clauses;

• binding contractual and security obligations; or

• another transfer safeguard permitted by data-protection law.

15. How long we keep personal information

We retain information only for as long as reasonably necessary for the purpose for which it was collected, subject to legal, regulatory, accounting, complaints and dispute requirements.

Our normal retention approach is:

General enquiries that do not become client matters

Normally up to 24 months after the last meaningful interaction, unless:

• you ask us to delete the information sooner and no lawful reason requires retention;

• an unresolved complaint or dispute exists;

• a longer period is reasonably necessary to establish or defend legal rights; or

• the information has been anonymised.

Client files

Client files and associated records will normally be retained for at least six years after the matter closes, in accordance with applicable regulatory requirements.

Some information may be retained for longer where necessary because of:

• the nature of the matter;

• limitation periods;

• safeguarding concerns;

• a complaint or dispute;

• legal or regulatory requirements; or

• continuing obligations to the client.

Call recordings and transcripts

Recordings and transcripts will normally be retained for up to 12 months, unless they form part of a client file, complaint, regulatory matter, safeguarding record or dispute requiring longer retention.

Financial and accounting records

Normally retained for at least six years, or for another period required by law.

Marketing records

Marketing-contact information will normally be retained until:

• you withdraw consent;

• you object;

• the information is no longer accurate or useful; or

• we discontinue the relevant marketing activity.

We may retain a minimal suppression record after an opt-out so that we can ensure that marketing is not sent again inadvertently.

Website security and technical records

Normally retained for up to 12 months, unless needed for investigating security incidents, fraud or legal claims.

When retention is no longer necessary, information will be deleted, anonymised or securely destroyed.

16. How we protect personal information

We use reasonable technical and organisational measures designed to protect information against:

• unauthorised access;

• loss;

• alteration;

• disclosure;

• misuse; and

• accidental destruction.

Measures may include:

• access controls;

• individual staff accounts;

• multi-factor authentication;

• role-based permissions;

• encryption where appropriate;

• secure backups;

• logging and monitoring;

• supplier due diligence;

• staff confidentiality requirements;

• data-protection and security training; and

• incident-response procedures.

No website, email system or internet transmission can be guaranteed to be completely secure.

17. Cookies and similar technologies

Our website may use cookies, pixels and similar technologies for:

• essential website operation;

• security;

• remembering preferences;

• measuring website performance;

• understanding how visitors use the website;

• improving forms and content;

• advertising measurement; and

• remarketing, where permitted.

Essential cookies may operate without consent where they are strictly necessary.

Non-essential analytics or advertising cookies will be used only where legally permitted and, where required, after you have made a choice through our cookie controls.

You can manage non-essential cookies through the cookie banner or your browser settings. Disabling some cookies may affect website functionality.

Third-party content, such as videos, maps, booking tools or social-media features, may place its own cookies and process information under the provider’s privacy policy.

18. Direct marketing

We may send general marketing only where there is a lawful basis and the requirements of applicable electronic-marketing rules have been met.

Where consent is required:

• the request will be separate from permission to respond to an enquiry;

• consent will not be assumed from silence or a pre-ticked box; and

• you may withdraw consent at any time.

Every electronic marketing communication will provide an appropriate way to unsubscribe.

You have an absolute right to object to direct marketing at any time.

To stop marketing, use the unsubscribe facility in the message or email contact@xlaw.lawyer.

19. Your data-protection rights

Depending on the circumstances, you may have the right to:

Be informed

To receive clear information about how your personal information is used.

Access your information

To request confirmation of whether we process your personal information and obtain a copy of it.

Correct inaccurate information

To ask us to correct or complete inaccurate or incomplete information.

Request deletion

To ask us to erase information where there is no continuing lawful reason to retain it.

This right is not absolute. We may need to retain information to meet legal or regulatory obligations, deal with complaints or establish or defend legal rights.

Restrict processing

To ask us to limit how information is used in certain circumstances.

Data portability

To receive certain information in a structured, commonly used and machine-readable format, or ask us to transfer it to another organisation, where the legal conditions apply.

Object to processing

To object to processing based on legitimate interests in certain circumstances.

You may object to direct marketing at any time.

Withdraw consent

Where processing is based on consent, you may withdraw consent at any time.

Withdrawal does not affect processing that was lawful before withdrawal.

Rights concerning automated decision-making

You may have rights concerning decisions made solely by automated means that produce legal or similarly significant effects.

X Law does not use an automated system to make final legal or similarly significant decisions about your immigration matter without appropriate human involvement.

20. Exercising your rights

To exercise a right or ask a question, contact:

Data Protection Contact
X LAW LTD
3 Hardman Street
Manchester
M3 3HF
Email: contact@xlaw.lawyer

We may ask for information to confirm your identity before responding.

We will normally respond within one month. Where a request is particularly complex or numerous, the permitted response period may be extended, and we will explain this to you.

Data-protection requests are normally free of charge. A reasonable fee may be charged, or a request refused, where permitted by law because it is manifestly unfounded or excessive.

21. Complaints

Please contact us first if you have concerns about how X Law has used your personal information.

Write to:

Data Protection Contact
X LAW LTD
3 Hardman Street
Manchester
M3 3HF
Email: contact@xlaw.lawyer

You also have the right to complain to the Information Commissioner’s Office.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint/

You may complain to the ICO at any time, although the ICO will normally expect you to have raised the concern with us first.

22. Children’s information

Our website and services are not directed at children acting independently.

Immigration matters may nevertheless involve children and their personal information.

Where we process information about a child, we will take account of:

• the child’s age and understanding;

• parental responsibility or lawful authority;

• the best interests of the child;

• confidentiality;

• safeguarding; and

• the sensitivity of the information involved.

23. Third-party websites

Our website may contain links to government websites, social-media platforms, booking tools, payment providers and other third-party websites.

X Law does not control how third parties process personal information. You should review the privacy information of the relevant provider before supplying information through its service.

24. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in:

• law or regulation;

• our services;

• our technology;

• communication channels;

• data-processing practices; or

• service providers.

The latest version will be published on this page with the revised date.

Significant changes may also be communicated through an appropriate notice.

25. Contact details

For privacy questions, requests or complaints, contact:

X LAW LTD trading as X Law

3 Hardman Street
Manchester
M3 3HF
United Kingdom

Telephone: 0330 236 9248
Email: contact@xlaw.lawyer
Website: https://xlaw.lawyer

Company number: 14358643
Immigration Advice Authority registration number: F202200098