Last updated: 12 September 2026.
Who is responsible for your data?
Christodoulos Ltd trading as Theodorous is the data controller for personal information processed in connection with the firm’s legal services and business activities. The firm is based at The Barbon Buildings, 14 Red Lion Square, London WC1R 4QH and is authorised and regulated by the Solicitors Regulation Authority under SRA number 809508.
Privacy enquiries can be sent to info@theodorous.com.
Information we may collect
Depending on the reason for your contact with us, we may process identification and contact details, information about your legal matter, correspondence, financial information, documents and evidence, information about third parties, professional or employment information, technical website information and other data necessary to consider an enquiry or provide legal services.
Legal matters may involve special category data or information about criminal allegations, offences or proceedings. We process such information only where there is an appropriate legal basis and where it is necessary for the relevant legal, regulatory or professional purpose.
Why we process personal data
We may use personal data to assess whether we can act, carry out conflict and identity checks, provide legal advice and representation, manage files and client relationships, communicate with courts and other parties, meet professional and regulatory obligations, administer billing and accounts, protect legal rights, prevent fraud and misuse, respond to complaints and operate and secure our website and business systems.
Legal bases
The legal basis will depend on the processing activity. It may include taking steps at your request before entering a contract, performing a contract, complying with legal or regulatory obligations, pursuing legitimate interests where those interests are not overridden by your rights, and establishing, exercising or defending legal claims. Where consent is the appropriate basis, it may be withdrawn subject to applicable legal limitations.
Who we may share information with
Where necessary and lawful, information may be shared with barristers, experts, courts and tribunals, law-enforcement bodies, prosecutors, regulators, professional advisers, counterparties and their lawyers, medical or other specialist professionals, insurers, banks, identity-verification providers, IT and secure-storage providers and other organisations required for the proper conduct of a matter or the operation of the firm.
We do not sell personal data.
Confidentiality and legal professional privilege
Solicitors are subject to professional duties of confidentiality. Some communications may also attract legal professional privilege. Nothing in this privacy notice is intended to waive privilege or require disclosure where the law protects information from disclosure.
International processing
Some service providers may process information outside the United Kingdom. Where this occurs, we take steps appropriate to the circumstances to ensure that a lawful transfer mechanism and suitable safeguards are in place.
How long we keep information
Retention periods vary according to the nature of the information, the legal matter, regulatory obligations, limitation periods, insurance requirements and the need to establish or defend legal rights. We do not retain personal information for longer than is reasonably necessary for the relevant purpose and applicable obligations.
Your rights
Subject to the law and any relevant exemptions, you may have rights to request access to personal data, correction of inaccurate data, erasure, restriction of processing, objection to certain processing and data portability. These rights are not absolute and may be limited where information must be retained or processed for legal, regulatory or privileged purposes.
Contact us first at info@theodorous.com if you have a question about how your information is being used. You also have the right to complain to the Information Commissioner’s Office if you believe your data-protection rights have been infringed.
Information Commissioner’s Office →Website data and cookies
When you use this website, technical information such as IP address, device or browser information and page interactions may be processed for security, functionality and analytics where those services are enabled. Any non-essential cookies or analytics technologies should be used in accordance with applicable consent requirements.
Changes to this notice
We may update this notice to reflect changes in our services, systems, legal obligations or regulatory guidance. The date at the top of the notice shows when this version was last updated.