Privacy Notice
1. Who we are
This notice explains how Complex Legal Limited, trading as The Source of Funds Company, handles your personal data when you use our source of funds checking service or visit our website. We are the controller of your personal data. We are registered with the Information Commissioner’s Office under registration ZA187776. Registered office: 16 High Lane, Manchester M21 9DF (company no. 10066369). Contact for anything in this notice: enquiries@sourceoffundscompany.com · 0161 706 0800.
2. The short version
You send us evidence of where the money for your property purchase is coming from. We use it for one purpose: preparing the source of funds report that goes to the law firm acting for you. Once that report has been sent, we delete your documents and information from our systems — we keep nothing except the payment and engagement records the law requires us to keep. We never sell your data, we never use it for marketing, and we share it only with the people this notice names.
3. What we collect and where it comes from
From you directly:
- your name and contact details, and details of the law firm acting for you and your matter, collected when you pay and instruct us;
- information about how your purchase is funded, given by phone or email; and
- the supporting evidence we ask for — typically bank statements, mortgage offers, gift letters, proof of sale of a property, or similar financial documents. These may reveal information about other people (for example, someone giving you a gift towards your purchase); we handle their data as we handle yours, and we ask that you make them aware of this notice.
From your law firm: your name and contact details and your matter reference, where the firm passes these to us in connection with its recommendation.
From our payment provider: confirmation of your payment. Your card details go directly to the payment provider and never pass through our systems.
4. Why we use your data, and our lawful bases
- To provide the service (contacting you, gathering and reviewing evidence, preparing and sending your report): necessary for the performance of our contract with you (UK GDPR Article 6(1)(b)).
- To send your report to your law firm: necessary for the performance of our contract with you, and for the legitimate interests of your law firm in meeting its anti-money-laundering obligations (Article 6(1)(f)).
- To keep payment and accounting records: necessary to comply with our legal obligations (Article 6(1)(c)).
- To handle complaints or legal claims: our legitimate interests in defending and enforcing legal rights (Article 6(1)(f)).
We do not use your data for marketing, we do not sell it, and we make no automated decisions about you.
5. Who we share it with
- The law firm acting for you. This is the point of the service: your report, containing your evidence, goes to your firm and is held on its file.
- Our payment provider (Stripe Payments Europe, and PayPal where you choose to pay that way), which processes your payment under its own privacy notice.
- Our IT and email providers (Microsoft, for our email and document systems), which process data on our behalf under contracts that meet UK GDPR requirements.
- Professional advisers, insurers, regulators or courts, where necessary in connection with legal obligations, claims or complaints.
No one else. We do not pass your data to marketing companies, list brokers, credit reference agencies or anyone not named above.
6. How long we keep it
Our policy is unusual and deliberate: once your report has been sent to your law firm, we delete your documents and information from our systems. We keep no copy of your evidence or your report. If we later need a copy of the report (for example, in connection with a complaint or claim), our agreement with your law firm allows us to request one from the firm’s file.
What we do retain: records of your payment, our engagement records (who instructed us, when, for which firm) and any complaint correspondence — kept for 6 years to meet accounting and legal requirements — and then deleted.
7. Where your data is processed
We are based in the UK and work on your matter in the UK. Our payment and IT providers may process some data outside the UK; where they do, transfers are protected by UK adequacy regulations or approved safeguards such as the UK International Data Transfer Agreement or Addendum.
8. Security
Financial documents are our day job and we treat yours accordingly: access is limited to the team member handling your case, and your documents are deleted once your report is delivered. If we ever suffered a breach affecting your data, we would notify you and the ICO where the law requires it.
9. Your rights
You have the usual rights under UK GDPR: to access your data, to have it corrected or erased, to restrict or object to our use of it, and to portability. Exercising them is free: contact enquiries@sourceoffundscompany.com. Two practical notes:
- because we delete your data once your report is sent, there may be little or nothing to provide in response to a request made after delivery — what exists will be on your law firm’s file, and a request to the firm may serve you better; and
- if you ask us to delete your data before your report is finished, we can do so, but we will usually then be unable to complete the service (clause 6 of our Terms of Engagement covers what happens to your fee).
If you are unhappy with how we handle your data, you can complain to us at complaints@sourceoffundscompany.com, and you always have the right to complain to the Information Commissioner’s Office (ico.org.uk · 0303 123 1113).
10. Cookies and our website
Our website is an information page: it sets no advertising or analytics cookies. Payment happens on our payment provider’s pages, which are covered by its own cookie and privacy notices.
11. Changes to this notice
This is version 1 of this notice. If we change how we handle your data we will update this notice on our website; changes that matter to live matters will be notified to affected clients directly.
← Back to main page