1. Who we are and how to contact us

King Street Estate Planning (KSEP) is the trading name used for this service. The legal operator and data controller is: King Street Estate Planners Ltd Company / LLP registration number: 169646516 167 London Road, Leicester, LE1 2EG Privacy enquiries and data-protection complaints: enquiries@kingstep.co.uk. Telephone: 0330 6518 818 VAT registration number: 5189419874 This notice covers use of this website, enquiries, registered accounts, estate-planning instructions, document storage and the configured KSEP analytics system. A third party supplying its own service may give you a separate privacy notice. Our Privacy Policy explains data use; it does not replace the service contract or make cookie consent a condition of receiving a service.

2. Information involved in estate planning

The information needed depends on the services you use. KSEP’s workflows may involve the following categories; the confirmed processing schedule below explains the purposes and lawful bases that apply to the live service.

• Account and contact details, including legal name, date of birth, address, email and telephone, plus account, identity-check and permission records.
• Family and relationship details, dependants, beneficiaries, executors, guardians, attorneys, certificate providers, witnesses and other named people relevant to your instructions.
• Property, assets, liabilities, insurance, pensions and intended gifts or distributions, where relevant to your selected service.
• Will or LPA instructions, expressions of wishes, draft and signed documents, review records, uploads and sharing permissions.
• Orders, charges, payment references, plan status, communications, enquiries, complaints and administrative audit records.
• Health, disability, care preferences, beliefs or other sensitive information only where relevant and with the additional safeguards and legal conditions described below.

We ask for information needed to provide the chosen service or meet a legal requirement. Where required information is missing, we may be unable to prepare, check or release the requested documents. Optional information and marketing or analytics choices are separate. Do not put passwords, full payment-card details or unnecessary sensitive information into assistant conversations or general enquiry fields.

3. Purposes, lawful bases and legitimate interests

The schedule below identifies each processing purpose, the relevant data, the lawful basis and any legitimate interests relied upon. Consent to optional analytics is separate from the processing needed for an account, a service contract, security or a legal obligation. Acceptance of terms is not blanket consent to every use of personal information. KSEP identifies the lawful basis for each processing purpose rather than applying one general basis to all personal data. Contract and steps requested before entering a contract may apply to account creation, requested estate-planning services, appointments, document preparation, payments and service administration. Legal obligation may apply to accounting, taxation, regulatory, rights-handling and other statutory requirements. Legitimate interests may apply where necessary and proportionate for security, fraud prevention, service administration, system integrity, quality assurance, internal business administration, audit and the establishment, exercise or defence of legal claims, subject to appropriate balancing and individual rights. Consent is used where consent is the appropriate or legally required basis, including relevant optional marketing permissions and non-essential cookies or tracking. Service communications are kept separate from direct marketing. Electronic marketing permissions, soft-opt-in eligibility, objections, withdrawals and suppression are recorded separately by channel and are not inferred from a client's acceptance of essential service contact. Where we rely on legitimate interests, we assess necessity and balance those interests against the rights and expectations of the people affected. You may object to that processing. Consent-based uses can be withdrawn as explained in the rights section.

4. Health and other sensitive information

Health information, religious beliefs and certain other information are special-category personal data. An ordinary contract or legitimate-interest basis does not by itself authorise this processing. The following explains the additional Article 9 condition, the information needed, who provides it and the relevant safeguards. A person entering someone else’s details cannot simply give that other adult’s explicit consent by accepting website terms. KSEP may receive special-category personal data where it is genuinely relevant to an estate-planning service, for example information concerning health, capacity or other sensitive circumstances. Such information must not be collected merely because it may be useful. Processing requires both an appropriate UK GDPR Article 6 lawful basis and, where applicable, a valid Article 9 condition. Depending on the specific purpose and circumstances, this may include explicit consent or processing necessary for the establishment, exercise or defence of legal claims. Where no valid condition exists, KSEP must not process the special-category data. Sensitive information is subject to data minimisation, restricted role-based access, appropriate technical security, access/audit controls, purpose limitation and defined retention. It must not be repurposed for direct marketing. Criminal-offence data must only be processed where a specific lawful basis and the required additional legal safeguards apply.

5. People named by someone else, and children

Someone planning their estate may name other people or provide information about them. A named person may also supply or confirm their details through an invitation. This does not automatically create an account for every named person or give every family member access to a document. KSEP may receive information about other people where a client names them as an executor, attorney, guardian, beneficiary, family member, linked person or other participant in an estate-planning matter. The client is responsible for providing accurate information and KSEP will provide appropriate privacy information to the named person where required. Children and dependants are recorded as Manual People rather than normal KSEP account holders unless and until they are legally eligible and separately register. Only information necessary for the relevant estate-planning purpose should be recorded. Information about children and vulnerable individuals receives enhanced access control, data-minimisation and disclosure safeguards and must not be used for unrelated marketing. Where information is obtained indirectly, privacy information is normally provided within a reasonable period and no later than one month, or earlier where first contact or disclosure requires it, unless a lawful exception applies. An adult account holder should share this notice with people whose details they provide; that request does not remove KSEP’s own transparency responsibilities. Children’s details may be needed for beneficiaries, guardianship or dependants, but the adult estate-planning account is not a child-facing service.

6. Website analytics and cookie choices

Optional analytics, account/service records and ordinary hosting/security logs are separate processing activities. The current audited analytics arrangement is described below; a restored legal page does not itself enable tracking. KSEP currently uses website analytics to understand website usage, page performance and technical behaviour. Analytics must be limited to information necessary for those purposes and must follow the applicable cookie/consent rules. Anonymous or aggregated website analytics must not automatically be converted into identifiable client-profile information. Where KSEP later links an analytics event to a registered account, the purpose, lawful basis, data fields, retention period and client transparency must be documented before that linkage is enabled. Marketing profiling must not be inferred from ordinary service or account activity without the appropriate lawful basis and, where required, consent. Essential cookies required for security, authentication, account operation and requested website functions may operate where legally permitted without optional consent. Non-essential analytics, advertising or similar technologies must not be activated until the required consent has been obtained. Cookie choices must be capable of being accepted, refused and changed without making access to ordinary services conditional on accepting optional tracking. The website must provide an accessible Cookie Settings control through which a visitor can review or change their choices. Consent choices and their version/evidence are retained for an appropriate period and renewed where required by law, a material change in purpose/provider occurs, or the recorded consent is no longer reliable. The Cookie Policy identifies the currently approved providers, purposes and durations.

7. Assistants and automated processing

Jenny, Seema and Anna are software-assisted workflows, not people. Their processing may include structured questions, validation and suggestions. The actual provider, information sent to it, retention, human review and any consequential automated decisions must be explained in the confirmed arrangement below; a product name alone does not establish those facts. KSEP may use automated or AI-assisted services to support fact-finding, client guidance, document preparation, administration and internal review. A live external assistant provider must not receive production personal data until the provider, purpose, information flow, processing location, contractual safeguards, retention behaviour and security controls have been reviewed and entered in KSEP's approved technology register. Only the minimum information required for the specific task may be supplied. Assistant output is not treated as automatically correct or as a substitute for any required professional or human review. Sensitive information must not be sent to an assistant unless there is a documented lawful basis, an applicable Article 9 condition where required, and an approved processing arrangement. Provider retention and model-training settings must be assessed and recorded before production use. Contact the privacy address for an explanation or to challenge an outcome. Where significant solely automated decisions are made, the applicable rights and safeguards include information about the decision and a route to make representations and obtain human intervention. No claim is made here that data is never sent to an external AI provider or never used for training unless the confirmed arrangement expressly supports that statement.

8. Access, recipients and overseas processing

Access is limited by the functions people need to perform: authorised KSEP staff, relevant service providers, and people with appropriate permissions in a document workflow. Sharing one item does not imply access to every document or to an entire account. We may also disclose information when lawfully required, to establish or defend legal claims, or to protect against misuse where a valid legal basis applies. KSEP uses selected suppliers to provide website hosting, email delivery, backup, security, document, analytics and other operational services. Access is limited to what each supplier needs to perform its contracted function. KSEP maintains a supplier/technology register recording the provider, purpose, categories of personal data, processing location and applicable contractual safeguards. Personal data is not routinely disclosed to unrelated third parties. Where a supplier processes personal data outside the UK, KSEP will use an applicable UK adequacy regulation or appropriate transfer safeguard, such as the UK International Data Transfer Agreement or UK Addendum, together with any additional safeguards required following transfer-risk assessment. Legal, regulatory or professional recipients may receive information where necessary and lawful. A UK website address does not prove that every supplier processes data in the UK. Where a restricted international transfer is made, its lawful transfer mechanism and how to obtain information about the safeguards must be identified. The relevant mechanisms may include UK adequacy regulations or appropriate safeguards, with the required data-protection assessment; they are not presumed merely because a supplier is widely used.

9. Marketing, introductions and promotions

Cookie choices, service messages and consent to promotional contact are distinct. A marketing-cookie choice is not agreement to receive every email or to disclose the full estate-planning fact-find to an introducer. Necessary account or service communications are not the same as advertising. KSEP keeps service communications separate from direct marketing. Registration, account administration, document delivery, appointments, support, security messages, competition administration and winner notifications may be sent where necessary for the service or activity requested. Marketing permission is recorded separately by channel for email, SMS and telephone and must not be inferred from required service contact. Marketing opt-out does not prevent necessary service communications. Competition entry does not create blanket marketing permission, and runner-up discounts or other promotional offers are treated separately from competition administration. Referral information is shared only where an appropriate basis exists and the client has been given the relevant information. Marketing objections, withdrawals, soft-opt-in eligibility and suppression records are retained centrally so an opt-out is honoured across relevant KSEP systems. You can object to direct marketing at any time, including related profiling. Use the unsubscribe method in a marketing message or contact us. Withdrawal does not undo disclosures already lawfully made, but future consent-based sharing and contact must reflect your updated choice.

10. How long information is kept

Different records have different purposes and retention periods. We do not describe estate-planning documents as being kept forever. The service schedule below must explain the applicable periods or meaningful criteria, including retained originals, version histories, legal claims, closed accounts and backup rotation. KSEP applies purpose-specific retention rather than one blanket retention period. Account, service, document, payment, enquiry, audit and support records are retained only for as long as reasonably necessary for the service, contractual obligations, accounting and taxation, security, dispute handling, legal claims and applicable legal or regulatory requirements. Final and superseded estate-planning documents may require different retention from routine enquiries or temporary working data. Backup copies are retained according to the backup schedule and expire through controlled rotation rather than being used as permanent archives. When the relevant retention period ends, records are securely deleted, anonymised or retained only where a continuing lawful reason applies. Exact retention periods must be maintained in KSEP's approved retention schedule and reviewed before public launch. Analytics, security and server records are retained only for the operational period required for measurement, troubleshooting, fraud prevention, security monitoring and evidential purposes. KSEP does not treat technical logs as permanent client records. Identifiable technical information should be minimised, access restricted and deleted or anonymised when it is no longer required. Different records may have different retention periods according to purpose. The approved technology and retention registers must record the current period for each analytics, security, mail and server-log source. Changing a provider or retention setting requires the register and relevant privacy information to be reviewed.

11. Your data-protection rights

Depending on the circumstances and legal basis, you may ask to access your personal information, correct inaccuracies, erase it, restrict its use or receive qualifying data in a portable form. These rights are not absolute: we may need to retain particular records for a lawful reason and must protect other people’s information when responding. You have a right to object to direct marketing, including related profiling. You may also object to processing based on legitimate interests. You may withdraw consent at any time without affecting the lawfulness of earlier consent-based processing. Use the current cookie controls described in the Cookie Policy for this browser’s optional analytics, or contact the privacy email for other consent-based uses. Changing a cookie choice does not delete legal documents or service records. Send rights requests to enquiries@kingstep.co.uk. You do not have to use a particular form. We may reasonably check identity or authority before disclosing information. We normally respond within one month, with any legally permitted extension or necessary clarification explained to you. Contact the privacy address for an analytics-history or wider erasure request. The response must reflect the identifiers and records actually held and any lawful retention requirements; this notice does not itself perform deletion.

12. Complaints and updates

You can raise a data-protection complaint with us using enquiries@kingstep.co.uk or the business contact details above. Explain what happened and the outcome you seek; a particular form is not required. We will acknowledge a data-protection complaint within 30 days, take appropriate steps to investigate without undue delay, keep you informed and communicate the outcome. This acknowledgement deadline is not a replacement for the deadline for a subject access or other rights request. You can also complain to the Information Commissioner’s Office: ICO complaints information. The version and review date appear at the start of this notice. Material changes in processing must be explained and, where needed, a fresh choice sought. A revised notice does not retrospectively authorise a new use of data or silently change the contract for an earlier purchase.