GDPR Compliance

Data controller

Willsure is the data controller for the personal data we collect directly from consumers using our platform. Where we process data on behalf of solicitors or enterprise partners, we act as a data processor in accordance with our contractual agreements. Our Data Protection Officer can be contacted via our Contact Us page.

Personal data we process

As part of providing our services, we may process the following categories of personal data:

• Identity data - name, date of birth, marital status.
• Contact data - email address, phone number, postal address.
• Special category data - information revealing health, religion, or ethnicity that may appear within uploaded Wills and supporting documents.
• Financial data - details of assets, property, pensions, and beneficiaries.
• Document data - uploaded Wills, LPAs, trusts, and related estate planning documents.
• Usage data - information about how you interact with our platform, including IP address and device information.

Because uploaded Wills may contain special category data, we rely on the explicit consent of the data subject (Article 9(2)(a) UK GDPR) to process this information for the purpose of AI-assisted review and risk analysis.

Lawful basis for processing

We process your personal data under the following lawful bases:

• Consent - where you have given clear consent for us to process your data, including the review of special category data within your documents.
• Contract - where processing is necessary to provide the services you have requested under our terms of service.
• Legal obligation - where we are required to retain data to comply with applicable law, regulation, or regulatory guidance.
• Legitimate interests - where processing is necessary for our legitimate interests in operating a secure, reliable platform, provided it does not override your rights and freedoms.

How we use your data

We use your personal data to:

• Provide AI-powered Will reviews and health assessments.
• Match consumers with verified solicitors through our marketplace.
• Securely store and manage documents within your encrypted vault.
• Monitor life events that may trigger a Will review.
• Communicate with you about your account and our services.
• Maintain audit trails for security and regulatory compliance.

Data sharing and recipients

We do not sell your personal data. We share your data only with the following categories of recipients, and only where necessary to provide our services:

• Verified solicitors you choose to engage through our marketplace.
• Enterprise partners acting as referrers, under contractual data processing agreements.
• Cloud infrastructure and AI processing providers who support our platform, all bound by confidentiality and data processing obligations.
• Regulatory or law enforcement authorities where required by law.

International data transfers

Your data is primarily stored and processed within the United Kingdom and the European Economic Area. Where any data is processed outside the UK, we ensure appropriate safeguards are in place, such as UK International Data Transfer Agreements or recognised adequacy decisions, to protect your data to UK GDPR standards.

Data security

Given the sensitive nature of estate planning documents, we apply industry-leading security measures including encryption in transit and at rest, strict access controls, regular security testing, and comprehensive audit logging. Access to your documents is restricted to authorised personnel and only to the extent necessary to provide the service.

Data retention

We retain your personal data only for as long as necessary to provide our services and to comply with legal and regulatory obligations. Documents held in your vault are retained for the duration of your account and may be deleted at your request. Following account closure, we retain limited data where required for legal, regulatory, or audit purposes, after which it is securely destroyed.

Your rights under UK GDPR

You have the following rights regarding your personal data:

• The right to be informed about how we use your data.
• The right of access to your personal data.
• The right to rectification of inaccurate or incomplete data.
• The right to erasure, also known as the right to be forgotten.
• The right to restrict processing of your data.
• The right to data portability.
• The right to object to processing based on legitimate interests or for direct marketing.
• Rights relating to automated decision-making and profiling.

To exercise any of these rights, please contact us via our Contact Us page. We will respond within one month of receiving your request.

Automated decision-making and AI

Our platform uses AI to analyse uploaded Wills and produce risk assessments and recommendations. These outputs are advisory only and do not constitute legal advice. We do not make solely automated decisions that produce legal or similarly significant effects. Any decisions affecting your estate planning are made by you and your chosen solicitor, supported by our tools.

Children's data

Our services are not directed at individuals under 18 and we do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us so we can delete it.

Changes to this policy

We may update this policy from time to time to reflect changes in our practices, the law, or our services. We will notify you of any significant changes through our platform or by email where appropriate.

Complaints

If you have a concern about how we handle your data, please contact us first and we will do our best to resolve it. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Contact us

To exercise any of your GDPR rights, or if you have any questions about this policy, please contact our support team via our Contact Us page.