LexConnectPro. Operated by Tom Street & Co. Solicitors Limited
Last updated: 19 March 2026
Effective from: 19 March 2026
This policy applies to all personal data held on the LexConnectPro platform as of the effective date, including data collected before this policy was published. The processing activities described in this policy reflect how personal data has been handled on the platform since its launch.
1. Who We Are
LexConnectPro is an AI-powered employment tribunal case management platform operated by Tom Street & Co. Solicitors Limited (company number 07798646, trading as Tribunal Claim Solicitors), a company registered in England and Wales.
| Data Controller | Tom Street & Co. Solicitors Limited |
| Registered Address | Maidsgrove Farm, Frome, Somerset, BA11 2PY |
| SRA Registration | 566718 |
| Data Protection Officer | Tom Street |
| DPO Contact | mail@tomstreet.co.uk |
| ICO Registration | Z3316298 |
When solicitor firms use LexConnectPro to manage their own clients’ cases, the solicitor firm is the data controller for their clients’ personal data and Tom Street & Co. Solicitors Limited acts as a data processor on their behalf. A separate Data Processing Agreement governs that relationship.
When individuals (claimants) use LexConnectPro directly (for example through the case assessor, chatbot, or tools on tribunalclaimsolicitors.co.uk), Tom Street & Co. Solicitors Limited is the data controller.
2. What Personal Data We Collect
The type and extent of data we collect depends on how you interact with our platform. We collect the following categories of personal data:
2.1 Account & Identity Data
Full name, email address, telephone number, date of birth, postal address, and professional details (for solicitor users including SRA number and firm name).
2.2 Case & Employment Data
Details of your employment situation, employer information, dates of employment, salary and benefits information, details of grievances or disputes, and any information you provide through our case assessor, Schedule of Loss generator, or document drafting tools.
2.3 Special Category Data
Employment tribunal cases frequently involve information that falls within special categories under UK GDPR Article 9. This may include:
- Health and medical information (for example, in disability discrimination or personal injury claims)
- Racial or ethnic origin (in race discrimination claims)
- Religious or philosophical beliefs (in religion or belief discrimination claims)
- Sexual orientation (in sexual orientation discrimination claims)
- Trade union membership
- Political opinions (in certain whistleblowing or detriment cases)
We only collect special category data where it is directly relevant to your case or enquiry and where we have a lawful basis to do so (see Section 3 below).
2.4 Financial Data
Bank account details (for settlement payments), payment card information (processed by Stripe (we do not store card numbers). Invoicing and billing data.
2.5 Communications Data
Records of telephone calls, voicemail transcriptions, emails, live chat transcripts (including interactions with our AI chatbot Lexi), SMS messages sent via Twilio, and any documents or files you upload to the platform.
2.6 Technical & Usage Data
IP address, browser type and version, device information, pages visited, time spent on pages, referral source, and cookies (see our Cookie Policy).
2.7 Voice Data
Where you use voice features on the platform, audio recordings and transcriptions processed via our voice transcription service (Deepgram). Voice data is processed in real time for transcription purposes and is not retained in audio form beyond the transcription session unless you are informed otherwise.
3. Lawful Bases for Processing
We process your personal data on the following lawful bases under UK GDPR Article 6:
| Purpose | Lawful Basis (Article 6) |
|---|---|
| Providing legal services and managing your case | Contract (Art. 6(1)(b)): processing is necessary for the performance of our contract with you |
| Initial case assessment and triage | Legitimate interests (Art. 6(1)(f)): to assess whether we can assist you and to provide an initial indication of claim viability |
| AI-powered features (Lexi chatbot, document drafting, Schedule of Loss generation) | Contract (Art. 6(1)(b)) and Consent (Art. 6(1)(a)) where the processing involves automated decision-making with legal or significant effects |
| Regulatory and legal obligations (SRA requirements, anti-money laundering, court orders) | Legal obligation (Art. 6(1)(c)) |
| Billing, invoicing and payment processing | Contract (Art. 6(1)(b)) |
| Sending marketing communications about our legal services | Consent (Art. 6(1)(a)). You can withdraw this at any time |
| Website analytics and platform improvement | Legitimate interests (Art. 6(1)(f)): to understand how our platform is used and to improve it |
| Safeguarding (where we identify a risk of harm) | Vital interests (Art. 6(1)(d)) or Legal obligation (Art. 6(1)(c)) |
3.1 Special Category Data: Additional Lawful Bases (Article 9)
Where we process special category data, we rely on the following additional conditions under Article 9:
| Condition | When It Applies |
|---|---|
| Establishment, exercise or defence of legal claims (Art. 9(2)(f)) | Where processing is necessary in connection with actual or prospective employment tribunal proceedings. This is our primary basis for processing special category data. |
| Explicit consent (Art. 9(2)(a)) | Where you voluntarily provide sensitive information during case assessment or through our AI tools, and we obtain your explicit consent to process it |
| Substantial public interest (Art. 9(2)(g), read with DPA 2018 Schedule 1) | Where processing is necessary for the purposes of equality of opportunity or treatment, or for safeguarding purposes |
4. Artificial Intelligence and Automated Processing
LexConnectPro uses artificial intelligence to enhance the services we provide. We believe in full transparency about how AI is used in our platform. A detailed explanation is available in our separate AI Transparency & Automated Decision-Making Policy. A summary is provided here.
4.1 AI Features
The following features on our platform use AI:
- Lexi (AI Chatbot): provides initial guidance, answers frequently asked questions about employment law, and assists with enquiries. Lexi is powered by large language models and is not a solicitor. Responses are for general guidance only.
- Case Assessor: analyses information you provide to give an initial indication of whether you may have a viable employment claim. This is a preliminary assessment only and does not constitute legal advice.
- Schedule of Loss Generator: uses information you provide about your employment, earnings, and losses to generate a draft Schedule of Loss for tribunal proceedings.
- AI-Assisted Document Drafting: assists in generating draft legal documents including particulars of claim, witness statements, grievance letters, skeleton arguments, and other tribunal documents.
- Document Analysis: AI-powered classification, OCR extraction, and analysis of uploaded documents.
- Voice Transcription: real-time transcription of telephone calls and voice recordings.
- Text-to-Speech: voice greetings and audio generation for call handling.
4.2 Human Oversight
Where documents are generated under a signed Retainer, no AI-generated output is treated as final legal advice or a final legal document without review by a qualified solicitor. Where documents are generated through the free self-service Tribunal Preparation tool, the user is the human in the loop and is responsible for reviewing all outputs before use. AI tools assist. They do not replace professional legal judgement.
4.3 Your Rights Regarding Automated Decisions
Under UK GDPR Article 22 (as amended by the Data (Use and Access) Act 2025, in force from 5 February 2026), where a decision is made based solely on automated processing that has legal or similarly significant effects on you, you have the right to:
- Be informed that automated decision-making is taking place
- Receive meaningful information about the logic involved
- Request human intervention in the decision
- Express your point of view and contest the decision
If you believe an automated decision has been made about your case without appropriate human oversight, please contact our DPO at mail@tomstreet.co.uk.
4.4 AI and Your Data
When your data is processed by our AI features:
- Your personal data is sent to third-party AI providers (see Section 5) via encrypted API connections solely for the purpose of generating the specific output you have requested.
- We do not permit any AI provider to use your personal data to train their models. Our agreements with AI providers, and the terms of their commercial API products, prohibit the use of input and output data for model training.
- AI provider data retention: When your data is sent to an AI provider for processing, the provider may temporarily retain your inputs and outputs for abuse monitoring and policy enforcement purposes. The retention periods vary by provider (see Section 5). After this period, the data is automatically deleted by the provider. Your data is not stored permanently by any AI provider.
- AI-processed data returned to our platform is stored in our database (hosted in the EU) and is handled subject to the same retention and security policies as all other personal data on the platform.
5. Third-Party Processors (Sub-Processors)
We share your personal data with the following categories of third-party service providers who process data on our behalf. All processors are bound by data processing agreements or commercial API terms requiring them to process data only for the purposes described and to maintain appropriate security measures.
5.1 AI and Machine Learning Providers
The following providers process personal data (including, where relevant to your case, special category data) through their AI systems. None of these providers use your data to train their AI models under their commercial API terms.
| Provider | Purpose | Data Processed | Provider Retention Period | Location |
|---|---|---|---|---|
| Anthropic (Claude API) | Tribunal document drafting (particulars of claim, witness statements, skeleton arguments, schedules of loss, and other tribunal documents), case assessments, legal chat, settlement agreement analysis, transcript extraction, and dictation formatting | Case details, employment information, and text inputs provided to these features, which may include special category data | Up to 30 days for abuse monitoring, then automatically deleted. Not used for model training. | USA* |
| OpenAI | AI assistant chat, case assessment scoring, case summaries, document classification, OCR text extraction from PDFs, legal Q&A, content enhancement, and data extraction from notes and comments | Case details, uploaded documents, and text inputs provided to these features, which may include special category data | Up to 30 days for abuse monitoring, then automatically deleted. Not used for model training. | USA* |
| Google (Gemini API, via Lovable gateway) | Document analysis with image/vision capabilities, changelog and bug report generation, and document suggestions for chronologies | Uploaded documents and associated text for analysis. Document analysis may include case-related content. | Up to 55 days for abuse monitoring, then automatically deleted. Not used for model training under paid API terms. | USA/EU* |
| Deepgram | Speech-to-text transcription of telephone calls and audio recordings, and real-time voice agent interaction | Audio recordings and transcribed text from calls and voice interactions | Audio data is processed in real time and not retained after transcription is complete. | USA* |
| ElevenLabs | Text-to-speech voice synthesis for call greetings and voice agent responses | Text content provided for speech generation (typically greeting scripts and short responses, not case data) | By default, ElevenLabs retains generation history. Customers can delete generations via the API at any time, with backup data retained for up to 30 days after deletion. Enterprise customers can enable Zero Retention Mode for immediate deletion. Data is not used for model training unless explicitly opted in via account settings. | USA* |
| Lovable (AI Gateway) | Gateway/proxy service routing requests to Google Gemini API | Data routed through this gateway for Google Gemini features (document analysis, suggestions). Lovable acts as a conduit; requests pass through to Google. | Pass-through basis. Data not retained by Lovable unless explicitly saved. Log data retained up to 90 days. Customer data deleted within 30 days of account termination. Data is not used for AI model training. | EU/USA* |
5.2 Infrastructure and Platform Providers
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Supabase | Database hosting, user authentication, and platform infrastructure | All platform data including account details, case data, and documents | EU (Frankfurt) |
| Vercel | Website and application hosting | Technical data, IP addresses, request logs | Global (edge network)* |
5.3 Payment, Communications, and Business Providers
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Stripe | Payment processing | Name, email, payment card details, billing address, transaction records | USA/EU* |
| Twilio | SMS notifications, WhatsApp messaging, and telephone communications | Phone numbers, message content | USA* |
| Google Analytics | Website and platform usage analytics | Anonymised/pseudonymised usage data, IP addresses (truncated), device and browser information | USA/EU* |
| Google Workspace | Email, document storage, and internal communications | Emails, documents, contact information | EU/Global* |
| FreeAgent | Accounting and invoicing | Name, contact details, billing information, invoice records | UK |
| External call centre services | Telephone answering and initial enquiry handling | Name, contact details, brief case details | UK |
* For transfers to countries outside the UK, see Section 6 (International Transfers) below.
We may also share your data with:
- Panel solicitors and barristers: where your case is referred to or handled by external legal professionals (with your knowledge)
- HM Courts & Tribunals Service: where required for the conduct of tribunal proceedings
- Regulatory bodies: including the SRA and the Legal Ombudsman, where required
- Law enforcement or safeguarding authorities: where we have a legal obligation or where there is a risk of serious harm (see our Safeguarding Policy)
6. International Data Transfers
Our primary database is hosted within the European Union (Frankfurt) via Supabase. However, several of our sub-processors are based in the United States or operate globally.
Where personal data is transferred outside the UK, we ensure that appropriate safeguards are in place in accordance with UK GDPR Article 46, including:
- UK adequacy regulations: transfers to countries or territories that the UK Secretary of State has determined provide an adequate level of data protection
- UK Extension to the EU-US Data Privacy Framework: for transfers to US-based processors that are certified under the framework
- Standard Contractual Clauses (UK International Data Transfer Agreement or UK Addendum): where adequacy decisions or the Data Privacy Framework do not apply
AI provider transfers: When your data is sent to AI providers based in the United States for processing (Anthropic, OpenAI, Google, Deepgram, ElevenLabs), the data is transmitted via encrypted API connections, processed for the specific purpose requested, and retained temporarily by the provider only for abuse monitoring purposes (see retention periods in Section 5.1). The data is not stored permanently by these providers and is not used for model training. We consider that the temporary and limited nature of this processing, combined with the international transfer safeguards listed above, provides appropriate protection for your data.
You may request details of the specific safeguards applied to any international transfer by contacting our DPO.
7. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our specific retention periods are:
| Data Category | Retention Period | Reason |
|---|---|---|
| Active case files and associated documents | Duration of the matter plus 6 years from closure | SRA regulatory requirements and limitation periods for professional negligence claims |
| Enquiries that did not proceed to instruction | 12 months from last contact | Legitimate interest in following up and conflict-checking |
| Financial and billing records | 7 years from the date of the transaction | HMRC requirements and Companies Act obligations |
| AI chatbot transcripts (Lexi) | 12 months, or duration of matter if linked to a case | Service improvement and quality assurance |
| Voice recordings and transcriptions | Transcriptions retained for duration of matter plus 6 years; raw audio deleted after transcription | Case management; audio not retained beyond processing |
| Data held temporarily by AI providers | Up to 30 days (Anthropic, OpenAI) or up to 55 days (Google Gemini), then automatically deleted by the provider | Provider abuse monitoring and policy enforcement. We do not control this retention. It is a condition of the provider’s commercial API terms. |
| Website analytics data | 26 months (Google Analytics default) | Website improvement and marketing analysis |
| Marketing consent records | Duration of consent plus 12 months after withdrawal | Evidence of consent compliance |
| Account data (after deletion request) | Deleted within 30 days of verified request, subject to legal retention obligations | GDPR Article 17 compliance |
| Tribunal Preparation self-service data (free tool) | 12 months from last activity, or duration of matter if the user proceeds to instruct a solicitor | To allow users to return to their case preparation; deleted after inactivity |
Where data must be retained for legal or regulatory reasons after you request deletion, we will restrict processing to storage only and inform you of the specific retention period and reason.
8. Your Rights
Under UK GDPR, you have the following rights in relation to your personal data:
| Right | What It Means |
|---|---|
| Access (Article 15) | You can request a copy of the personal data we hold about you. We will respond within one month. |
| Rectification (Article 16) | You can ask us to correct inaccurate or incomplete personal data. |
| Erasure (Article 17) | You can ask us to delete your personal data where there is no compelling reason for continued processing. This is subject to legal and regulatory retention requirements. Please note that where data has been sent to AI providers, it will be retained by those providers for their stated abuse monitoring period (see Section 5.1) and cannot be deleted earlier by us. |
| Restriction (Article 18) | You can ask us to restrict the processing of your data in certain circumstances (for example, while we verify accuracy). |
| Data portability (Article 20) | You can request your data in a structured, commonly used, machine-readable format. |
| Object (Article 21) | You can object to processing based on legitimate interests or for direct marketing purposes. |
| Automated decision-making (Article 22) | You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, and to request human intervention. See Section 4.3 above. |
| Withdraw consent | Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. |
How to Exercise Your Rights
To exercise any of these rights, please contact our Data Protection Officer:
- Email: mail@tomstreet.co.uk
- Post: Tom Street (DPO), Tom Street & Co. Solicitors, Maidsgrove Farm, Frome, Somerset, BA11 2PY
- Online: Request for Information | Request for Erasure
We will respond to all requests within one calendar month. If your request is complex or we receive a large number of requests, we may extend this by up to two further months and will inform you if this is the case. We will verify your identity before processing any request.
9. Data Security
We take the security of your personal data seriously and implement appropriate technical and organisational measures, including:
- Encryption in transit: all data transmitted to and from LexConnectPro is encrypted using TLS 1.2 or higher
- Encryption at rest: database storage is encrypted using AES-256 encryption via our hosting provider
- Access controls: role-based access control (RBAC) ensures that users can only access data relevant to their role; Row Level Security (RLS) policies enforce data isolation at the database level
- Authentication: multi-factor authentication is available for all user accounts; session management includes automatic timeouts
- API security: all AI API calls are made server-side through Supabase Edge Functions; API keys are stored in environment variables and are never exposed to client-side code
- Regular review: we conduct periodic security reviews of our platform, access controls, and processor arrangements
- Staff training: all personnel with access to personal data receive data protection training
If you become aware of any security concern relating to LexConnectPro, please contact us immediately at mail@tomstreet.co.uk.
10. Tools and Calculators
Our website and platform include various free tools and calculators (such as the redundancy calculator, unfair dismissal compensation calculator, and employment tribunal time limit calculator). These tools process the data you input to generate results in real time. The data entered into these tools is not stored, logged, or associated with any personal record unless you are logged in and choose to save results to your case. No personally identifiable information is collected through standalone use of these tools.
11. Children
LexConnectPro is not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact our DPO immediately.
12. Complaints
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
- Website: ico.org.uk/make-a-complaint
- Telephone: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We would appreciate the opportunity to address your concerns before you contact the ICO. Please reach out to our DPO in the first instance.
13. Changes to This Policy
We may update this policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Where changes are significant, we will notify you by email or through a prominent notice on the platform. We encourage you to review this page periodically. The “Last updated” date at the top of this policy indicates when it was most recently revised.
14. Contact Us
If you have any questions about this privacy policy, your personal data, or our data practices, please contact:
Tom Street (Data Protection Officer)
Tom Street & Co. Solicitors Limited
Maidsgrove Farm, Frome, Somerset, BA11 2PY
Email: mail@tomstreet.co.uk
Telephone: 020 3835 3940