Your Right to Be Forgotten (UK GDPR Article 17)
Last updated: 19 March 2026
Under UK GDPR Article 17, you have the right to request that we delete the personal data we hold about you. This is sometimes called the “right to be forgotten.”
When We Can Delete Your Data
We will delete your personal data where:
(a) your personal data is no longer necessary for the purpose we originally collected it;
(b) you withdraw your consent (where consent was the basis for processing) and there is no other lawful basis for the processing;
(c) you object to the processing and there are no overriding legitimate grounds;
(d) the personal data has been unlawfully processed; or
(e) the personal data must be erased to comply with a legal obligation.
When We May Need to Retain Data
There are circumstances where we may not be able to delete your data, or where we may need to retain certain data. These include:
(a) Legal and regulatory obligations. As an SRA-regulated law firm, we are required to retain case files for a minimum period after a matter concludes (typically 6 years). We cannot delete data where retention is required by law or regulation.
(b) Establishment, exercise, or defence of legal claims. If there are ongoing or potential legal proceedings, we may retain relevant data.
(c) AI provider retention. Where your data has been sent to our AI providers for processing (for example, for document drafting or case assessment), those providers temporarily retain inputs and outputs for abuse monitoring purposes. Retention periods are: up to 30 days (Anthropic and OpenAI), up to 55 days (Google Gemini), and up to 90 days for gateway logs (Lovable). We cannot instruct these providers to delete data before their standard retention period expires. After the retention period, the data is automatically deleted by the provider. Full details are in our Privacy Policy.
What Happens When You Make a Request
When we receive your erasure request:
1. We will verify your identity before taking any action.
2. We will respond within one calendar month. If your request is complex, we may extend this by up to two further months and will let you know.
3. We will delete the data we are able to delete and confirm what has been deleted.
4. Where we cannot delete certain data (for the reasons above), we will explain why and tell you how long we need to keep it. Where possible, we will restrict processing to storage only.
5. We will confirm when AI provider retention periods will expire for any data that has been sent to third-party AI providers.
How to Make a Request
Please send your erasure request to our Data Protection Officer:
Email: mail@tomstreet.co.uk
Post: Tom Street (DPO), Tom Street & Co. Solicitors Limited, Maidsgrove Farm, Frome, Somerset, BA11 2PY
Please include your full name, email address associated with your account, and a description of what data you would like deleted. If you have a LexConnectPro account, please include the email address you used to register.
Not Happy With Our Response?
If you are not satisfied with how we handle your erasure request, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
Website: ico.org.uk/make-a-complaint
Telephone: 0303 123 1113