Privacy Policy

Nexal Solutions Limited is the data controller for personal data processed through Nexal Legal. For data protection enquiries, contact hello@nexallegal.co.uk.

Depending on how you use the platform, we may process:

• Identity and contact details (name, email address, firm name, telephone number)
• Account credentials (hashed passwords; we never store plain-text passwords)
• Firm registration details (SRA number, business address, subscription package)
• Billing and Direct Debit instruction details submitted during subscription setup
• Support and training request content you submit through the portal
• Technical and security data (session identifiers, IP address, browser type, audit logs)
• Staff invitation and team membership records for authorised firm users

Client matter data entered into the ledger application is processed on behalf of your firm. Your firm remains responsible for the lawfulness of that processing under applicable professional and regulatory obligations.

We use personal data to:

• Provide, operate, and maintain Nexal Legal
• Create and manage customer, staff, and operations accounts
• Process subscription applications and firm approvals
• Send transactional emails (registration, invitations, approvals, password reset)
• Provide customer support and respond to training requests
• Enforce subscription limits, permissions, and platform security
• Maintain audit records required for regulated legal environments
• Comply with legal and regulatory obligations

Under UK GDPR we rely on the following lawful bases, as applicable:

• Contract — to provide the service you subscribe to and manage your account
• Legitimate interests — to secure the platform, prevent fraud, and improve service reliability
• Legal obligation — where we must retain records or respond to lawful requests
• Consent — where you explicitly agree (for example, accepting these terms during registration)

We do not sell personal data. We share data only where necessary with infrastructure providers that host our platform (for example, cloud hosting and database services), email delivery providers, and where required by law or professional advisers bound by confidentiality. All processors are subject to appropriate contractual safeguards.

Data is primarily processed within the United Kingdom and European Economic Area. Where data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements.

We retain personal data for as long as your account is active and for a reasonable period thereafter to comply with legal, accounting, and audit requirements. Subscription records, approval audit trails, and security logs may be retained longer where required for compliance or dispute resolution.

We implement technical and organisational measures to protect personal data, including encryption in transit, access controls, tenant isolation, and audit logging. See our Security page for further detail.

Under UK GDPR you may have the right to access, rectify, erase, restrict, or object to processing of your personal data, and to data portability where applicable. You may also lodge a complaint with the Information Commissioner's Office (ICO). To exercise your rights, contact hello@nexallegal.co.uk.

We use essential cookies for authentication and security. See our Cookie Policy for details.

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last updated” date at the top of this page.

Privacy enquiries: hello@nexallegal.co.uk
Support: support@nexallegal.co.uk