Privacy Notice
Last updated: June 2026
1. Data Controller
The data controller is CourtBundleUK, operating at familycourtbundle.co.uk.
ICO registration number: [to be inserted after ICO registration].
For all privacy enquiries, please contact us at the email address shown on your order confirmation.
2. Data We Collect
We collect and process the following personal data:
- Email address (collected at the payment step)
- Intake form data: hearing details, your position in proceedings, other party information, children's circumstances, and supporting information you provide
- Order metadata: client reference, hearing type, order status, and timestamps
3. Lawful Basis for Processing (Article 6 UK GDPR)
We process your personal data under Article 6(1)(b) of the UK GDPR -- performance of a contract. Processing is necessary to perform the court bundle preparation service you have paid for. We do not rely on consent as the lawful basis for this processing.
4. Special Category Data (Article 9 UK GDPR)
Court bundle content may include information that constitutes special category data under Article 9 of the UK GDPR, including health information, welfare concerns, and details about children.
We rely on Article 9(2)(f): processing is necessary for the establishment, exercise, or defence of legal claims, or whenever courts are acting in their judicial capacity.
5. Data Processors and International Transfers
We use the following third-party processors. Where personal data is transferred outside the UK, we rely on the transfer mechanisms described below.
| Processor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Anthropic, Inc. | AI document generation | USA | UK Addendum (ICO B.1.0) to EU SCCs Module 2. DPA auto-incorporated into Anthropic Commercial Terms. Training on customer data prohibited. |
| Stripe, Inc. | Payment processing | Global | PCI-DSS; Stripe DPA |
| Amazon Web Services | Bundle PDF storage | eu-west-2 (London) | UK -- no transfer mechanism required |
| Railway | Order and intake database | eu-west-1 (Frankfurt) | EU -- adequate protections apply |
| Resend | Transactional email | eu-west-1 | EU -- adequate protections apply |
| Fly.io | Application hosting | London (lhr) | UK -- no transfer mechanism required |
| Inngest | Background job processing | USA | Inngest DPA / Standard Contractual Clauses |
6. Retention Periods
- Intake form data: deleted automatically 7 days after bundle delivery
- Bundle PDF: deleted 7 days after delivery (S3 lifecycle policy)
- Order records: retained for 30 or more days for audit purposes
- Anthropic processing: data deletion within 30 days per DPA
7. Your Rights (Articles 15-22 UK GDPR)
You have the following rights in relation to your personal data. To exercise any of these rights, please contact us at the email address on your order confirmation. We will respond within 30 days.
- Right of access (Art 15): request a copy of the personal data we hold about you
- Right to rectification (Art 16): request correction of inaccurate or incomplete data
- Right to erasure (Art 17): request deletion of your data. Note that intake form data and bundle PDFs are also deleted automatically within 7 days of delivery.
- Right to restrict processing (Art 18): contact us to request that we restrict processing of your data
- Right to data portability (Art 20): request your data in a structured, commonly used, machine-readable format
- Right to object (Art 21): this right applies to processing based on legitimate interests or for direct marketing purposes. CourtBundleUK carries out no marketing or profiling, and processes data only to perform your contract.
Automated decision-making (Art 22): CourtBundleUK uses AI (Anthropic) for document generation only. No automated decisions are made that produce legal effects or similarly significantly affect you.
8. Cookies and Tracking
CourtBundleUK sets no cookies and uses no tracking technology.
9. Complaints
You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data has been processed unlawfully.
ICO website: ico.org.uk
ICO registration number: [to be inserted after ICO registration].