‘CrimeLine’ is CrimeLine Training Limited, a company registered in England and Wales.
CrimeLine holds a Cyber Essentials Plus accreditation that can be viewed here.
To view high-level data protection documentation, please contact us for a password, then access the documents via this page.
Privacy Notice
CrimeLine — Privacy Notice
CrimeLine Training Limited · Version 1.19 · 9 November 2026 · Owner: Data Protection Lead · Review: annually and on material change
This notice explains how CrimeLine collects and uses personal data, and the rights you have. It is written to be read by the people whose data we handle — our members and the individuals who use them, visitors to our website, and anyone who contacts us. It is deliberately plain and complete; a fuller technical account of our data flows and the suppliers we use is maintained separately in our DPIA Data Map, which we make available to customers carrying out due diligence.
1. Who we are
CrimeLine is the subscription legal reference service for criminal-law practitioners in England and Wales, operated by CrimeLine Training Limited (registered office: 41 Bridgeman Terrace, Wigan WN1 1TT; registered in England and Wales). We are registered with the Information Commission under registration number Z2096592. For anything in this notice, or to exercise any of your rights, contact our Data Protection Lead at [email protected]. We have assessed our activities under Article 37 UK GDPR and are not required to appoint a statutory Data Protection Officer; the Data Protection Lead named here is nonetheless our single point of accountability for data protection.
2. What this notice covers — and the important difference between your account data and the content you submit
For most of the personal data we handle — your account and membership details, how you use the service, security, support and marketing — CrimeLine is the controller, and this notice explains what we do and why. There is one important exception. When you use our AI tools (CrimeLine Ask and DocAssist) through a firm’s subscription, the documents and questions you submit to those tools (which we call “Submitted Content”) are handled on your firm’s behalf: your firm is the controller of that content and CrimeLine acts as its processor under a written contract. How that content is handled is summarised in section 5 below and governed by our subscriber terms and our standalone Data Processing Agreement, not primarily by this notice. This notice tells you how CrimeLine handles personal data for which CrimeLine itself is the controller.
3. The personal data we collect, why we use it, and our lawful basis
We collect only what we need to run the service. The table below sets out the personal data we hold as controller, why, and the lawful basis under Article 6 UK GDPR.
| What we collect | Why | Lawful basis |
| Account and membership data — your name, work email, firm, role, membership status and preferences, and a securely hashed password | To create and administer your account, give you access to the service, and provide the membership you have signed up for | Performance of a contract (Art 6(1)(b)) |
| Billing data — invoices and billing-contact details (payment card details are handled by our payment processor and are not stored by us) | To take payment for the service and keep the accounting records the law requires | Contract (Art 6(1)(b)) and legal obligation (Art 6(1)(c)) for statutory accounting retention |
| Login and security metadata — your login email, IP address, device/user-agent, login gateway, user ID and role at sign-in, and — for members using our second factor — a passkey, an authenticator-app code or, if you choose it, a one-time code sent to your email address, and the devices you have asked us to remember (at most three at a time); and, from 20 October 2026, the country you sign in from, the kind of device you use (for example “Chrome on a Mac”) and a device cookie that lets us recognise a device you have used before | To sign you in securely, enforce a second sign-in factor where it applies, limit how many devices an account can keep remembered, and protect accounts against unauthorised access and brute-force attempts; to show you when you last signed in, and to email you when your account is signed in on a device we have not seen before | Legitimate interests (Art 6(1)(f)) — securing the service and your account |
| Account-use records (from 15 October 2026): when you use the website while signed in, at most once every 15 minutes, the time, an anonymous code for your signed-in session, the network you are on (only the first part of your IP address, never the whole address), the kind of device you use (for example “Chrome on a Mac”) and, where our network provider supplies it, your country | To protect the service and members’ accounts by finding accounts that appear to be used by more than one person (for example, on two computers in two places at the same time), and to show you when you last signed in | Legitimate interests (Art 6(1)(f)) in protecting our service and members’ accounts against unauthorised sharing and use |
| CPD and membership information shown to your firm’s practice manager (from 23 October 2026): your name, email address, membership plan, status and expiry date, and your CPD record — every podcast and webinar completion and every entry you have added yourself, including any description you typed | To let a practice manager, compliance lead or similar person at your firm, chambers or organisation, named to us by that organisation and signed in with a work email address at its email domain, see and produce reports of the CrimeLine memberships and CPD records of the accounts whose email address is at that domain or a subdomain of it. If your account’s email address is a firm, chambers or organisation address, the practice manager for that domain can obtain this information, whoever paid for the account. If you do not want this, use a personal email address on your account | Legitimate interests (Art 6(1)(f)) of your organisation in supervising its members’ CPD and in managing the memberships it provides or supports, and our legitimate interests in providing that service to organisations |
| Support correspondence — the content of support tickets you raise, and any attachments | To answer your query and provide support | Contract (Art 6(1)(b)) and legitimate interests (Art 6(1)(f)) in running an effective support service |
| Transcript access and usage data — when you view or download a court transcript through your membership, we record your member ID, the file, the date and time, and whether you viewed or downloaded it (we do not record your IP address), and we stamp your downloaded copy with your name and the time | To make our licensed transcript collection available to members, and to protect it against bulk downloading and redistribution in line with your membership terms | Legitimate interests (Art 6(1)(f)) — protecting our licensed materials — and contract (Art 6(1)(b)) |
| Opt-in research features — where you choose to use them: a question you expressly share as feedback (question text only, no identity); “watched questions” you ask us to monitor (held against your account); and “amendment watch” (a public statutory reference held against your account) | To improve the service, and to email you when new material or a legal change relevant to something you are following appears | Consent (Art 6(1)(a)) — you can withdraw it at any time |
| Citation checker and extradition search: your member number when you use these tools (to confirm you are a member and apply fair-use limits) and, for the citation checker, a record of each check (your member number, the kind of check, the result and how long it took, but never the citation) | To give members access to these tools, keep their use fair, and find faults | Contract (Art 6(1)(b)) and legitimate interests (Art 6(1)(f)) in protecting the service |
| Your task list (CrimeLine Task Manager), if you use it: the tasks you write (up to 300 characters each), with any date or repeat you set and whether each is done; your settings (whether the morning email and the daily panel are on, the time you choose and your time zone); and each day’s count of tasks due and missed. Your tasks are encrypted | To keep your list for you and show it to you, to tell you how many tasks are due or missed (in a daily panel, in the greeting drop-down and, if you switch it on, in a morning email), and to limit how quickly changes can be made | Contract (Art 6(1)(b)) |
| How you use CrimeLine Task Manager (from 6 November 2026), if you use it: how many tasks your list holds and, of those still to do, how many have a date and how many repeat; the week we first counted your use; and the last six weeks in which you opened or changed your list. Never what your tasks say | To count, across all members, how many use the Task Manager and how often they come back to it, so that we can judge whether it is useful and worth keeping and improving. Once a week we make a report of totals from these counts for CrimeLine’s own use: it names no one, says nothing about what anyone wrote, and leaves out the website’s administrators | Legitimate interests (Art 6(1)(f)): learning whether the Task Manager is useful to members |
| Your Duty Solicitor Compliance Record (from 6 November 2026), if you use it: the duty solicitor work you log (for each entry, the date, the kind of work, the police station or court, and the details that kind asks for, such as duty or own client, legal aid or private, and your Criminal Defence Work hours with an evidence reference), the UFN, an optional note of up to 80 characters, when you logged each entry and its earlier versions; your details (your CRM12 Office and duty schemes, your regulator, your route to Duty Solicitor status with any CLAS number and date, PSQ or PSRAS, and the Magistrates’ Court Qualification); annual leave you log as a reason, and any reason you record against a requirement you have not met (one of three fixed choices, duty work is scarce in the area, reasonable annual leave or a protected characteristic, which says only that one applies, never which), with its dates and, for a protected characteristic, the time you gave your consent to our keeping it and the version of its wording; which entries in My CPD record you tick for Paragraph 6.21(a) (not their titles); your choice of emails; the traffic lights we work out each night (the colours only) and the lights you last saw; when you accepted the first-use notice; when you downloaded a copy (a PDF, or your entries as a CSV file), had one emailed, or we emailed you; and the reviews your firm’s practice manager records (see below). The record has no place for a client’s name. UFNs, notes, evidence references, earlier versions and your reasons are encrypted | To keep your record for you, work out from it whether you meet Paragraphs 6.21 to 6.24 of the 2025 Standard Crime Contract Specification (shown as traffic lights), tell you what has changed since your last visit, and give you a PDF of it, or your entries as a CSV file, to download, or the PDF emailed to your own address; and, by email to your own address, tell you when a light turns red, or when leave you log no longer keeps your Duty Slots (unless you switch this off), and send you a monthly statement (if you switch it on) | Contract (Art 6(1)(b)); for a reason of “A protected characteristic”, also your explicit consent (Art 9(2)(a)), which you give with a tick when you record the reason and withdraw by deleting it |
| Leave in your Duty Solicitor Compliance Record, if you choose to log it: maternity or parental leave, or sick leave, with its dates and the dates your firm told the Legal Aid Agency. This is health data (special category data). The type of leave is encrypted and shown only to you: the PDF, and the read-only view CrimeLine’s administrators can open, show the dates of your leave but not its type, and your firm’s practice manager sees only “On leave”, and only while your leave keeps your Duty Slots under Paragraph 6.24, never its type, though a red light when leave runs past the period Paragraph 6.24 allows can show how long it lasted | So that your record can apply Paragraph 6.24, which lets your firm keep your Duty Slots while you are away, and show you the dates by which the Legal Aid Agency must be told | Contract (Art 6(1)(b)), with your explicit consent (Art 9(2)(a)), which you give when you log the leave and withdraw by deleting it |
| Your Duty Solicitor Compliance Record shown to your firm’s practice manager (from 6 November 2026), if you keep the record and your account’s email address is at your firm’s email domain: your name and email address; your traffic lights, figures and next dates, and how many month ends in a row a requirement was not met; your accreditation light; your entries for the 12 months to today, or to the end of any past month the practice manager chooses, up to six years back (the date, the kind of work and the UFN, nothing else); each three-month period, ending in those 12 months, whose hours fell short of 150, with its total; “Lapsed” if your membership has ended, until your account is deleted; “On leave” while leave you log keeps your Duty Slots; and the reviews recorded, with who recorded each and when. Never your notes, your reasons, the police stations and courts, evidence references, your details (such as your CRM12 Office or CLAS number) or the type of any leave | To let the practice manager your firm names to us (as for CPD records, above) supervise its duty solicitors’ compliance with Paragraphs 6.21 to 6.24, for which the firm answers to the Legal Aid Agency; keep a PDF of it with the firm’s records, downloaded or emailed only to the practice manager’s own address; and record that they have reviewed your record, which we keep with your record (their name and email address, and the time) so that you can see it too. If you do not want this, use a personal email address on your account | Legitimate interests (Art 6(1)(f)) of your firm in supervising its duty solicitors’ compliance with its contract with the Legal Aid Agency, and our legitimate interests in providing that service to firms. “On leave” comes from leave you log, which may be health data: it is shown to your firm with the explicit consent (Art 9(2)(a)) you give when you log the leave, whose wording says so and says that a red light when leave runs past the period Paragraph 6.24 allows may let your firm work out its length and type |
| Website and site-search data — pages you visit and searches you run; we keep only anonymous counts of searches, including those that return nothing, to improve results; we do not keep the text of what you searched for | To operate and improve the website and its search | Legitimate interests (Art 6(1)(f)) in operating and improving the site |
| Marketing data — your email address and how you engage with our newsletters and updates | To send you the newsletters and service updates you have asked for | Consent (Art 6(1)(a)), or our legitimate interests where we contact an existing customer about similar services (Art 6(1)(f)); you can opt out at any time |
4. Where your data comes from
Almost all of the personal data we hold comes directly from you — when you register, use the service, contact support, or sign up for updates. Some technical data (such as IP address and device information) is generated automatically when you use the site, and some billing information comes from our payment processor. We do not buy personal data or build profiles of you from third-party sources.
For our sanctions screening tool we also hold copies of the official sanctions lists published by UK, UN, EU and US authorities. They name the people and organisations those authorities designate, with details such as dates of birth, nationalities and the authority’s reasons. We hold them only so that members can search them, keep only the current and previous copies, and replace them about every four hours.
5. Content you submit to our AI tools
When you use CrimeLine Ask or DocAssist, the documents and questions you submit are treated as highly sensitive and are handled under a strict rule: they are processed only for the moment needed to produce your answer and are not added to any search index, log or training process, and DocAssist does not ask the AI service to cache them. The AI processing is carried out for us by Amazon Web Services in London, United Kingdom, using Anthropic’s Claude models run by AWS. Your questions, documents and answers travel directly between your browser and AWS in London, where our UK-hosted website collects them to prepare your answer. While your answer is being prepared, temporary copies are held in an encrypted CrimeLine store in London. Your browser deletes the copy of your request and answer as soon as it has collected the answer, and DocAssist documents are deleted as soon as the analysis finishes. Any other copy (for example, the prepared request for our longer-running tools, or anything left behind if you close your browser) is removed by a clean-up that runs every 10 minutes and deletes anything more than 30 minutes old, with an automatic one-day deletion rule as the final backstop. The store is used for no other purpose and no one at CrimeLine reads it. CrimeLine Ask no longer accepts uploaded documents (please use DocAssist to work with a document), so no document you submit is stored on our website, and question text is not otherwise retained after your answer is produced. AWS processes your content under a “zero data retention” setting: it is not kept by AWS once your answer is returned, is never used to train any model, and is not shared with the model provider. A correction. From 17 September 2026, DocAssist asked the AI service to keep a temporary working copy of the documents it was analysing (a “prompt cache”), so that a follow-up question on the same documents cost less. AWS kept that copy within the AI service for up to five minutes after it was last used and, from 12 October 2026, for up to an hour. It was held in Ireland until 10 October 2026 and in London after that, it was not used to train any model, it was not shared with the model provider, and CrimeLine could not read it. Earlier versions of this notice said that AWS kept nothing once your answer was returned; for DocAssist documents during that period, that was not accurate. DocAssist stopped asking for the prompt cache on 16 October 2026 (version 3.30.2), and CrimeLine Ask asks the AI service to cache only its own instructions, never anything you submit. AWS’s logging of requests and answers is switched off, and we check both settings automatically every day. If no London model is available to handle a request, the request is refused; it is never sent to another region or provider. Two narrow opt-in features (feedback and watched questions) are the only exceptions in which any element of what you type is retained, and only with your express consent, as described in section 3. Watched-question alert emails say only that there is new material, with a link: the question and the material found are shown only on CrimeLine after you sign in. Because this content belongs to your firm’s matters, your firm is its controller and we process it on your firm’s behalf; the full terms are in our subscriber agreement and Data Processing Agreement. Three DocAssist tools (Exhibits and Legislation & authorities, under Extract, and the comparison of two versions of one document) work in your browser without AI. Legislation & authorities then checks the case citations it finds automatically, using CrimeLine’s citation checker on our London server (our website also looks them up in CrimeLine’s library): it sends each citation with its paragraph numbers, and nothing else from your documents (the case name written beside a citation stays in your browser, where it is compared with the name the register gives). Those citations are part of the content you submit through DocAssist, so, under a firm’s subscription, they are handled on your firm’s behalf in the same way.
Our citation checker and extradition case-law search use no AI. They run on a CrimeLine server in the AWS London region, and for these tools CrimeLine is the controller. When you check a document with the citation checker, your browser reads it and it is never uploaded: only the citations go to our server, each with the case name, the paragraph numbers and any quotation you ask us to check. Our server checks them against Find Case Law and legislation.gov.uk (both run by The National Archives) and keeps nothing once the check is done, and our website looks the same citations up in CrimeLine’s library. The extradition case-law search sends the words you type, with your other choices, to public case-law databases in other countries (see section 9). Please search with legal terms, and do not type a person’s name or other personal data into it. Your recent searches, and any digest you download, are held on our server until the search service restarts, which it does every night.
Our hidden text check runs entirely in your browser. The document you check is not uploaded, nothing about it is sent to CrimeLine or anyone else, and no AI is used. CrimeLine does not receive or keep anything from it.
Our redaction tool also runs entirely in your browser. The document you redact is not uploaded, nothing about it is sent to CrimeLine or anyone else, and no AI is used. Each redacted copy is marked “Redacted by CrimeLine.co.uk redaction tools. Prepared for [your name] only.”, using the name on your CrimeLine account, which our website puts in the page for that purpose; the copy is made in your browser, and CrimeLine does not receive or keep it.
Our sanctions screening tool also runs in your browser and uses no AI. The name and details you screen, the results and your screening record are not sent to CrimeLine or anyone else; your browser fetches only the official sanctions lists from our website. Our website puts your name in the “screened by” box for you to keep or change.
6. Special category and criminal-offence data
Given the nature of criminal-law practice, the content you submit to our AI tools or to support may include criminal-offence information and special-category data, and may be legally privileged. We handle it under the strict controls described above and in our Information Security Policy, and we never use it for any purpose other than providing the service you have asked for. The court transcripts in our library are public court documents; the personal data we create around your use of them is only the access record described in section 3. If you use CrimeLine Task Manager, what you write in your list is yours: it is encrypted, it is shown only to you, and no one at CrimeLine reads it or uses it for anything else. For client matters, please use initials or a reference rather than a name.
If you use the Duty Solicitor Compliance Record, it is kept for you. If your firm has named a practice manager to us and your account’s email address is at your firm’s email domain, that practice manager can see a summary of it on CrimeLine (section 8), never your notes, your reasons or the type of any leave; otherwise no one at your firm can see it on CrimeLine, and you decide whether to give your firm a copy. CrimeLine’s administrators can open it, read only, to help you with it or to answer a request you make, and each opening is recorded with who opened it and when. The record has no place for a client’s name: enter the UFN, which is your firm’s own file number, and keep client names and details out of the note. If you log sick leave, or maternity or parental leave, that is health data: we keep it only with the explicit consent you give when you log it, and deleting it withdraws your consent and removes it at once. Any view your firm has shows only “On leave”, and only while your leave keeps your Duty Slots, never the type of leave, though a red light when leave runs past the period Paragraph 6.24 allows can show how long it lasted. A reason you record against a requirement you have not met is a fixed choice, shown only to you and in your PDF: “A protected characteristic” says only that one applies, never which. A protected characteristic can be something such as a disability or pregnancy, so we keep that reason only with the explicit consent you give, with a tick, when you record it; deleting the reason withdraws your consent and removes it at once.
7. Cookies
We use cookies and similar technologies that are strictly necessary to run the website and keep it secure — for example, to sign you in, keep you signed in, remember your session, and support two-factor authentication. These are always on because the service cannot work without them. The extradition case-law search sets its own sign-in cookie, which lasts 12 hours. From 20 October 2026, when you sign in we set a device cookie (cl_dev), lasting 400 days, which lets us recognise a device you have used before, so that we can tell you when your account is signed in on a new one. We also set a short cookie (clsw_b), lasting one day, which only limits how often the account-use record described in section 3 is written. Where we use any non-essential cookies (for example, to measure how the site is used), we set them only with your consent, which you can give or withdraw through our cookie controls. You can also manage cookies in your browser settings.
8. Who we share your data with
We do not sell your personal data and we do not share it for anyone else’s marketing. We use a small, carefully chosen set of service providers who process personal data on our behalf under written contracts (Article 28 UK GDPR), each permitted to use it only to provide their service to us:
WP Engine — our website and application hosting (United Kingdom), including the membership system, the transcript library and short-lived processing stores.
Amazon Web Services (AWS) — the AI processing behind CrimeLine Ask, DocAssist and our search (model inference and search embeddings), our secure relay, the stamping of transcript downloads, and the encrypted store that holds temporary copies of your questions, documents and answers, all in the United Kingdom (AWS London region). Answers are produced by Anthropic’s Claude models, run by AWS in London; Anthropic, as their developer, receives no content from us and is not one of our service providers. Search embeddings are produced by an Amazon model in London. We no longer use Cohere, and search reranking has been switched off. AWS also hosts the CrimeLine server in London that runs our citation checker and extradition case-law search (neither uses AI).
Cloudflare — our global edge network and web application firewall (traffic protection and delivery); it carries website traffic in transit (such as page loads, and the reference our website uses to collect an AI request from London) and does not store your content. The questions, documents and answers you exchange with our AI tools do not pass through Cloudflare: they travel directly between your browser and AWS in London.
Stripe — payment processing (your card details are provided directly to Stripe and are not stored by us).
Xero — our accounting system, for invoices and billing records.
Google Workspace — our email and business productivity systems.
Amazon Web Services (AWS): Amazon Simple Email Service — delivers the emails we send you (the CrimeLine Alert, renewal reminders, account and service emails, watched-question and watched-provision alerts, the emails of the Duty Solicitor Compliance Record and, if you switch it on, the Task Manager morning email) from the AWS London region in the United Kingdom, for which it receives your name, your email address and the email itself. Watched-question alerts say only that there is new material for a question you are watching, with a link (the question and the material found are shown only on CrimeLine after you sign in). The Task Manager morning email gives only the number of tasks due and missed, never what they say. The Duty Solicitor Compliance Record emails you only at the email address on your account: a copy when you ask for one; an email when a light turns red, or when leave you log no longer keeps your Duty Slots, unless you switch it off; and a monthly statement, if you switch it on. No more than three a day are sent automatically. None names the type of any leave or gives its dates, and the PDFs they carry show the dates of any leave but not its type. We stopped using Mailchimp and Mailchimp Transactional (services of Intuit in the United States) for our emails on 16 October 2026 and have closed our Mailchimp account.
Our citation checker and extradition case-law search also send searches to public services that are not our service providers: The National Archives (Find Case Law and legislation.gov.uk, in the UK) for the citation checker, and public case-law databases in other countries for the extradition search. The searches come from our server, so these services receive nothing that identifies you.
We may also disclose personal data where we are required to by law, by a court order, or to establish, exercise or defend legal claims. A full, current list of these providers — with the data each receives, its location and the transfer safeguard — is maintained in our DPIA Data Map, available to customers on request.
Your firm’s practice manager. From 23 October 2026, an organisation can name a practice manager to us. Once named, and signed in to our Practice Manager dashboard with a work email address, that person can see and produce reports of the memberships and CPD records of every CrimeLine account whose email address is at the same email domain or a subdomain of it (for example everyone at yourfirm.co.uk): name, email address, membership plan, status and expiry date, and the full CPD record, including any entries and descriptions the member added. This applies to every account at that domain, whoever paid for it: if your account uses your firm’s email address, your firm’s practice manager can obtain this information even if you paid for the membership yourself. From 6 November 2026, if you keep a Duty Solicitor Compliance Record, the practice manager can also see your traffic lights, figures and next dates, how many month ends in a row a requirement was not met, your accreditation light, your entries for the 12 months to today or to the end of any past month they choose, up to six years back (the date, the kind of work and the UFN only), each three-month period, ending in those 12 months, whose hours fell short of 150, with its total, the reviews recorded and, if your membership has ended, “Lapsed”, until your account is deleted. They never see your notes, your reasons, the police stations and courts, evidence references, your details or the type of any leave: leave shows only as “On leave”, while it keeps your Duty Slots, though a red light when leave runs past the period Paragraph 6.24 allows can show how long it lasted. They can download what they see as a PDF, or have it emailed to their own address, and mark your record as reviewed: we then keep their name, their email address and the time with your record, where you can see them, until your account is deleted. Reports are sent only to the practice manager’s own named address, and every report produced is logged, as is each look at the duty solicitors’ records and each review. CrimeLine’s administrators can open a practice manager’s view to help them; what they do there is logged as theirs, and they cannot record a review. If you would rather your firm did not see your records, change the email address on your account to a personal one, or ask us at [email protected]. If you are a practice manager, we keep your name, your email address and the domains you cover, and log the addresses typed into the sign-in form with the IP address, your sign-ins, the reports you produce, your looks at the duty solicitors’ records and the reviews you record.
9. Sending data outside the UK
All AI processing behind CrimeLine Ask, DocAssist and our search, and the temporary storage connected with it, takes place in the United Kingdom (AWS London region, with our website hosted by WP Engine in the UK). The questions, documents and answers you exchange with our AI tools travel directly between your browser and AWS in London. No “restricted transfer” arises for this processing.
We use service providers outside the UK only for services that do not involve AI processing, and none of them receives the questions, documents or answers you exchange with our AI tools. Our emails are sent from the United Kingdom, by Amazon Simple Email Service in the AWS London region (since 16 October 2026; before that, Mailchimp and Mailchimp Transactional, services of Intuit in the United States, sent them). Some of our other providers (for example, for payments, email and business productivity) are based in, or transfer data to, the United States or process it globally. Where personal data is transferred outside the UK to a country without UK “adequacy”, we rely on the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK Addendum, as the appropriate safeguard. You can ask us for more detail about the safeguards that apply to a particular transfer.
The extradition case-law search is the one exception for what you type. It sends your search words, with your other choices, to public case-law databases in other countries, including countries without UK “adequacy” such as the United States (one database, in Lebanon, is reached without encryption). These services receive the search from our server, with nothing that identifies you, and we have no contract with them, so no transfer safeguard applies. That is why the search should be used with legal terms only, and never with a person’s name or other personal data.
10. How long we keep your data
Account and membership data — for the life of your membership and for six months afterwards. On the first day of each month we delete the accounts whose membership ended more than six months before, so an account is deleted within about seven months of its membership ending. An account that never had a membership is deleted once it is more than six months old and has not been used for six months.
Billing and accounting records — for the period required by law, then destroyed.
Login-security records — for members using our self-hosted second factor, your passkey public key and/or encrypted authenticator secret and hashed recovery/remember-device tokens are kept while you remain enrolled; a “remembered device” is trusted for up to 14 days, and an account can keep at most three remembered at a time (a device you remove yourself holds its place for 14 days). Login-protection and sign-in records used for security are kept on a short rolling basis. For sign-in notices we keep your last five sign-ins and up to 20 devices you have used, replacing the oldest as new ones arrive, while your account exists.
Support tickets — deleted when the ticket is closed.
Content submitted to AI tools — temporary copies in our encrypted London store are deleted by your browser as soon as your answer is collected, or as soon as a DocAssist analysis finishes; any other copy is removed by a clean-up every 10 minutes once it is more than 30 minutes old, with a one-day automatic deletion as the final backstop. CrimeLine Ask no longer accepts uploaded documents, and question text is not otherwise retained after your answer is produced. Our London relay keeps a technical record of each request it handles (for example, timings, the model used and your user ID, but no question, document or answer text and no IP address) for 14 days.
Opt-in feature data — “watched questions”, with the list of new material found for each, expire automatically after 90 days (and on your removal or account deletion); shared-feedback question text is kept only as a small rolling set with no identity; “amendment watch” references are kept until you remove them or close your account.
Transcript access log — kept only as a rolling record of the most recent entries and then overwritten; the associated usage counters reset each hour and day.
Citation checker and extradition search: what you send to the citation checker is not kept once the check is done; its access pass lasts 30 minutes, and our server’s record of each check (your member number, the kind of check, the result and how long it took) is kept for 14 days. The extradition search keeps recent searches, and any digest you download, until the search service restarts each night, and keeps its technical records, which never include your search words, for 14 days. Our server’s security records are kept for 90 days.
Account-use records: kept for 90 days and then deleted. The weekly summary we send ourselves, which names the accounts most likely to be shared, is kept in our mailbox.
Sanctions screening — what you screen and your screening record stay in your browser and are not kept by us. The official sanctions lists we hold for the tool are replaced about every four hours, and only the current and previous copies are kept.
Your task list (CrimeLine Task Manager): kept for as long as your account exists, so it is there when you come back. Once a list passes 1,000 tasks, the oldest done tasks are deleted. Delete my list, on the Task Manager page, deletes your list, your Task Manager settings and the counts of how you use it at once. If your membership lapses, your list is kept but hidden and we send you no Task Manager emails; it is deleted with your account.
Your Duty Solicitor Compliance Record: kept while your account exists, so that you can look back over any period. An entry you delete stops counting and leaves your record, but it is kept with its earlier versions until your account is deleted, so that the record shows what changed and when. Leave you delete, and a reason you delete (with any consent you gave for it), are deleted at once. The lights we keep each night, the CPD entries you tick and the reviews recorded by your firm’s practice manager are kept with the record. When your membership ends, or is otherwise no longer active, you can no longer open the record: it is kept, locked, and deleted with your account, six months after your membership ends (see Account and membership data above). We do not send you a copy when your membership ends. Your firm must keep its own copy for six years (Clause 8.6 of the 2025 Standard Crime Contract Standard Terms), so please download your record regularly, and before your membership ends, and give your firm a copy; our renewal reminders remind you of this. The record is not open to CPS or judiciary memberships: if your only memberships are of those kinds and you kept a record before, it is kept, locked, until your account is deleted, or sooner if you ask us.
Marketing data — until you unsubscribe or ask us to stop.
11. How we protect your data
We operate a documented set of security controls — including encryption in transit and at rest, two-factor authentication on administrative access and a self-hosted member second factor (passkeys, authenticator-app codes or emailed codes), least-privilege access, endpoint protection, independent penetration testing and a defined incident-response and breach-notification process. Your CrimeLine Task Manager list is also encrypted, with a key used for nothing else. In your Duty Solicitor Compliance Record, UFNs, notes, evidence references, the earlier versions of your entries, the reasons you record and the type of any leave are encrypted in the same way, with a separate key. These are described in our Information Security Policy, which we make available to customers on request.
12. Your rights
Under UK data protection law you have the right, in the circumstances the law provides, to: access the personal data we hold about you; have inaccurate data corrected; have your data erased; restrict or object to our processing; obtain your data in a portable form (data portability); and, where we rely on your consent, withdraw that consent at any time (which does not affect processing already carried out). Where CrimeLine acts as processor for content submitted through your firm, a request about that content should usually be directed to your firm as controller, and we will support your firm in responding. You can delete your CrimeLine Task Manager list yourself at any time, with Delete my list on the Task Manager page. While your membership lasts, you can download your Duty Solicitor Compliance Record as a PDF, or your entries as a CSV file to use elsewhere, or have the PDF emailed to you, at any time, and correct or delete its entries and reasons; deleting leave you have logged, or a reason of “A protected characteristic”, withdraws your consent to our keeping it. You can switch its red-light email and its monthly statement on or off on the record’s page. To exercise any right, or if you have any question, contact [email protected]. We will respond within the statutory time limit (usually one month). We do not charge a fee for a valid request unless the law allows it.
13. Marketing choices
You can opt out of our marketing at any time — use the unsubscribe link in any marketing email, or email us. Opting out of marketing does not stop essential service messages (for example, about your account, security or a change to the service), which we need to send you to provide the service.
14. Automated decision-making
We do not make decisions about you by solely automated means that produce legal or similarly significant effects (Article 22 UK GDPR). Our AI tools produce research assistance for you to review and use in your own professional judgement; they do not make decisions about individuals.
We do look for accounts that appear to be used by more than one person. A score, worked out automatically from the account-use records described in section 3, ranks accounts for us to review. It does not change anything about your account by itself; any decision about an account is taken by a person after reviewing it. You can object to this processing (section 12).
The Duty Solicitor Compliance Record works out its traffic lights automatically from the entries you make, and again each night, so that it can tell you what has changed and email you if a light turns red. They are there for you and your firm to check where you stand (a practice manager your firm names to us sees the same lights); they decide nothing about you, and CrimeLine takes no action on them.
15. Changes to this notice
We keep this notice under review and update it when our processing changes. Each version carries a version number and date at the top; this is version 1.19. Recent changes: version 1.15, dated 6 November 2026 (updated to describe the counts we keep of how each member uses CrimeLine Task Manager, never what their tasks say, and the weekly report of totals we make from them, which names no one); version 1.16, dated 6 November 2026 (updated to describe the Duty Solicitor Compliance Record, in which members can keep their own record of duty solicitor work: what it keeps, the leave you can log with your explicit consent, who can see it, how it is protected and how long it is kept); version 1.17, dated 6 November 2026 (updated for the Duty Solicitor Compliance Record’s new features: what your firm’s practice manager can see of it and the reviews they can record, the emails it can send you, the lights it keeps each night, the reasons and CPD entries you can record, the CSV download, and that it is not open to CPS or judiciary memberships; and corrected to say that a practice manager can see the accounts whose billing email address, as well as whose account email address, is at their domain); version 1.18, dated 6 November 2026 (updated to say that the Duty Solicitor Compliance Record no longer emails you your record when you can no longer open it, so please download it while your membership lasts; and that from 6 November 2026 a practice manager sees only the accounts whose own email address is at their domain, no longer those found by their billing email address); version 1.19, dated 9 November 2026 (updated for changes to the Duty Solicitor Compliance Record before it opens to members: a reason of “A protected characteristic” is kept only with your explicit consent; the red-light email also tells you when leave you log no longer keeps your Duty Slots; and your firm’s practice manager sees “On leave” only while your leave keeps your Duty Slots, no longer “After leave”, and also sees each three-month period in which your hours fell short). Where a change is significant we will bring it to your attention. Earlier versions are available on request.
16. How to complain
If you have a concern about how we handle your personal data, please contact us first at [email protected] so we can try to put it right. You also have the right to complain to the Information Commission, the UK’s data protection regulator: Information Commission, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; helpline 0303 123 1113; ico.org.uk.