Privacy Notice

Version 1.1 · September 2026

1. Who we are

This notice explains how Complex Legal Limited, trading as The Source of Funds Company, handles your personal data when you use our source of funds checking service or visit our website. We are the controller of your personal data. We are registered with the Information Commissioner’s Office under registration ZA187776. Registered office: Charter Buildings, 9 Ashton Lane, Sale, Cheshire M33 6WT (company no. 10066369). Contact for anything in this notice: enquiries@sourceoffundscompany.com · 0161 706 0800.

2. The short version

You send us evidence of where the money for your property purchase is coming from. We use it for one purpose: preparing the source of funds report that goes to the law firm acting for you. Once that report has been sent, we delete your documents and information from our systems — we keep nothing except the payment and engagement records the law requires us to keep. We never sell your data, we never use it for marketing, and we share it only with the people this notice names.

3. What we collect and where it comes from

From you directly:

• your name and contact details, and details of the law firm acting for you and your matter, collected when you pay and instruct us;
• information about how your purchase is funded, given through the questionnaire on our website, by phone or by email; and
• the supporting evidence we ask for — typically bank statements, payslips, gift letters, proof of sale of a property, or similar financial documents. These may reveal information about other people (for example, someone giving you a gift towards your purchase); we handle their data as we handle yours, and we ask that you make them aware of this notice.

From your law firm: your name and contact details and your matter reference, where the firm passes these to us in connection with its recommendation.

From our payment provider: confirmation of your payment. Your card details go directly to the payment provider and never pass through our systems.

4. Why we use your data, and our lawful bases

• To provide the service (contacting you, gathering and reviewing evidence, preparing and sending your report): necessary for the performance of our contract with you (UK GDPR Article 6(1)(b)).
• To send your report to your law firm: necessary for the performance of our contract with you, and for the legitimate interests of your law firm in meeting its anti-money-laundering obligations (Article 6(1)(f)).
• To pass our reasons and concerns to your law firm where we cannot complete the service: our and your law firm’s legitimate interests in the proper handling of your purchase and in the prevention of crime (Article 6(1)(f), relying on DPA 2018 Schedule 1 conditions where information about suspected unlawful acts is involved).
• To keep payment and accounting records: necessary to comply with our legal obligations (Article 6(1)(c)).
• To handle complaints or legal claims: our legitimate interests in defending and enforcing legal rights (Article 6(1)(f)).

We do not use your data for marketing, we do not sell it, and we make no automated decisions about you.

5. Who we share it with

• The law firm acting for you. This is the point of the service: your report, containing your evidence, goes to your firm and is held on its file. If we are unable to complete the service, the material you provided, together with our reasons for not producing a report, goes to your firm instead, addressed to its nominated compliance contact.
• Our payment provider (Stripe Payments Europe), which processes your payment as an independent controller of your payment data under its own privacy notice.
• Our website host (Netlify, Inc.), which hosts our website and receives your questionnaire answers on our behalf until we collect them, under a data processing agreement that includes the safeguards UK law requires for transfers outside the UK.
• Our IT, telecoms and email providers (inTec Business Solutions Ltd, Microsoft, and Callitech Ltd), which process data on our behalf under contracts that meet UK GDPR requirements.
• Professional advisers, insurers, regulators or courts, where necessary in connection with legal obligations, claims or complaints.

No one else. We do not pass your data to marketing companies, list brokers, credit reference agencies or anyone not named above.

6. How long we keep it

Our policy is unusual and deliberate: once your report has been sent to your law firm, we delete your documents and information from our systems. We keep no copy of your evidence or your report. If we later need a copy of the report (for example, in connection with a complaint or claim), our agreement with your law firm allows us to request one from the firm’s file.

If we end the engagement without producing a report, the material you provided goes to your law firm and is then deleted from our systems in the same way; our internal record of that decision forms part of the engagement records below.

What we do retain: records of your payment, our engagement records (who instructed us, when, for which firm) and any complaint correspondence — kept for 6 years to meet accounting and legal requirements — and then deleted.

7. Where your data is processed

We are based in the UK and work on your matter in the UK. Our payment and IT providers may process some data outside the UK; where they do, transfers are protected by UK adequacy regulations or approved safeguards such as the UK International Data Transfer Agreement or Addendum.

8. Security

We take the protection of your information seriously. Within our own systems, access to your material is limited to the team member handling your case; our email and document systems are professionally provided and managed (see section 5); we screen email for viruses; and because your documents are deleted once your report — or, where we cannot complete the service, the material you provided — is with your law firm, the window in which we hold your data is short by design.

One honest limitation, though, and we would rather you knew it: we work by ordinary email, and ordinary email is not a fully secure channel. Messages can be intercepted or misdirected, we do not routinely encrypt email, and the documents you send us are only as safe as the email account and devices you send them from. If you would prefer not to use email, or would like documents encrypted, tell your case handler and we will agree an alternative with you. You can reduce the risk at your end by using an email account only you can access, protected by a strong password and two-step verification.

And one warning worth more than any of the above: property transactions attract payment fraud. We will never email you asking you to pay anything beyond the fee stated on our website, and we will never email you new or changed bank details. If you receive an email like that appearing to come from us, do not act on it — telephone us on 0161 706 0800 first. We will never telephone you asking for your card details, and the money for your purchase only ever goes to your own solicitor: before you send it, telephone your solicitor on a number you already know, not one taken from an email, to check their account details.

We do not take documents by post. If you cannot email documents to us, you can hand paper copies to your law firm, which may pass them to us at your request; your law firm already holds your documents as a controller in its own right. We read and reconcile the documents you send us; we do not run forensic authentication checks on them unless our authentication policy requires it, and where we do, your report says so.

If we ever suffered a breach affecting your data, we would notify you and the ICO where the law requires it.

9. Your rights

You have the usual rights under UK GDPR: to access your data, to have it corrected or erased, to restrict or object to our use of it, and to portability. Exercising them is free: contact enquiries@sourceoffundscompany.com. Three practical notes:

• because we delete your data once your report is sent, there may be little or nothing to provide in response to a request made after delivery — what exists will be on your law firm’s file, and a request to the firm may serve you better; and
• if you ask us to delete your data before your report is finished, we can do so, but we will usually then be unable to complete the service (clause 6 of our Terms of Engagement covers what happens to your fee); and
• your data rights are not absolute and may be overridden by other legal obligations. If we cannot comply with one of your requests, we will always explain why and tell you what rights of redress are available to you.

If you are unhappy with how we handle your data, you can complain to us at complaints@sourceoffundscompany.com, and you always have the right to complain to the Information Commissioner’s Office (ico.org.uk · 0303 123 1113).

10. Cookies and our website

Our website is an information page: it sets no advertising or analytics cookies. Payment happens on our payment provider’s pages, which are covered by its own cookie and privacy notices.

11. Changes to this notice

This is version 1 of this notice. If we change how we handle your data we will update this notice on our website; changes that matter to live matters will be notified to affected clients directly.