Privacy Policy

Last updated: 4 October 2026

Who we are (data controller)

Controller: Defencelegalservices Limited (trading as Defence Legal Services / PoliceStationRepUK), a company registered in England and Wales, company number 09900871
ICO registration: ZA198500 (see our ICO statement)
Registered office: shown in the company details at the foot of every page
Privacy contact: robertcashman@defencelegalservices.co.uk
Website: policestationrepuk.org

We have not appointed a formal data protection officer (DPO). Privacy and data protection enquiries are handled by our management team using the contact details above.

Advertising & Promotions Disclosure — how we label third-party promotions on this site.

What personal data we collect

Representatives who register for the directory

Identity and contact details (name, email, phone, firm details)
Professional information (accreditation type, counties and stations covered, availability)
Verification data kept private: your DSCC PIN and/or SRA number and any proof document you upload, used only to check you against the public DSCC, SRA and Law Society registers. Some applications made before October 2026 also included a postal address. We no longer ask for a postal address. When your listing is verified automatically against the registers, we keep only the last four digits of your DSCC PIN (and your SRA number, if given). If your application needs a manual check, the full PIN is kept with the application record so we can complete and evidence that check. These details are never shown on public profile pages. We do not collect your date of birth.
Sign-up security data: the IP address and browser user agent recorded when you register, used to detect impersonation and fraud
Optional public profile content you choose to publish (notes, website, WhatsApp link, and any phone number or email you consent to display)

Website visitors

Technical and security data (IP address, user agent, request logs) via our host and security tools
Cookie and storage choices (see our Cookies Policy)
We do not use Google Analytics or any other analytics or advertising cookies. Our host (Vercel) may record cookieless, aggregate page-view and performance statistics.
Questions to the guided assistant are processed to return answers from our published guides. Where the AI answer feature is switched on, the text of your question is sent to OpenAI to generate the answer. We do not store the text of assistant questions in our database. Please do not type personal or case details into the assistant. Rate-limit counters may record request counts by IP address for a short period.

Law firms (business contact)

Where we hold business contact details for criminal defence firms (for example from public sources or directory relationships), we may use them for proportionate B2B outreach about the directory. You can opt out of marketing email at any time (see Lawful bases below).

What appears on public rep profiles

If you consent to a public directory listing, the information you choose to make public appears on your profile page in the directory. That typically includes your name, professional category, coverage areas, availability, and any optional notes or links you provide.

If you consent during registration (or in your profile), the phone number and email address you choose to make public are shown to visitors who click “Show contact details”. They are not included in the page source or structured data, and requests are rate-limited (with a bot check when enabled). A website link you add is shown on the profile page.

Your DSCC PIN, SRA number, any postal address or postcode, and any proof document are never published on public profile pages.

Lawful bases and purposes

We process personal data only where we have a lawful basis under UK GDPR Article 6 (and, where relevant, Article 9). The main purposes are:

Directory listings and public profiles — consent (Article 6(1)(a))

Publishing your public profile in the searchable directory, including contact details you choose to display, is based on your explicit consent via the unticked consent box at registration (or equivalent confirmation when you update your profile). You may withdraw consent at any time by contacting us or editing your listing; withdrawal does not affect processing that was lawful before withdrawal.

Account, registration and listing administration — contract (Article 6(1)(b))

Creating and managing your account, verifying eligibility, administering your listing, and providing the directory service you sign up for.

Firm contact and B2B outreach to business addresses — legitimate interests (Article 6(1)(f)), with PECR opt-out

Proportionate email to business addresses about the directory and related professional services, where permitted under PECR. You can unsubscribe using the link in each message or by emailing us. We balance our interests against yours and keep outreach data to what is necessary.

Security, fraud prevention and site integrity — legitimate interests (Article 6(1)(f))

Protecting the website, detecting abuse (including rate limiting and bot checks on some forms), recording admin review decisions, and maintaining accurate directory data.

Featured listing payments — contract (Article 6(1)(b))

Processing payment and subscription data when you purchase a featured listing, including records we must keep for accounting.

Processors and international transfers

We use trusted service providers who process data on our instructions:

Vercel — website hosting and deployment (may involve processing in the United States). Safeguarded by UK IDTA / Addendum where applicable and, where relevant, participation in the UK extension to the EU–US Data Privacy Framework.
Resend — transactional and operational email (United States). Safeguarded by UK IDTA / Addendum and/or Data Privacy Framework UK extension as applicable.
Upstash — Redis data storage for sessions, rate limits, directory registration data and related application state (may involve US processing). Safeguarded by UK IDTA / Addendum and/or Data Privacy Framework UK extension as applicable.
Lemon Squeezy — payment processing for featured listing subscriptions (United States). Safeguarded by UK IDTA / Addendum and/or Data Privacy Framework UK extension as applicable.
Cloudflare (Turnstile) — bot and abuse checks on some forms; processes your IP address and browser signals for that check (may involve US processing). Safeguarded by UK IDTA / Addendum and/or Data Privacy Framework UK extension as applicable.
OpenAI — only where the guided assistant's AI answer feature is switched on: the text of questions you type into the assistant is sent to OpenAI to generate an answer (United States). Safeguarded by UK IDTA / Addendum and/or Data Privacy Framework UK extension as applicable.

We do not sell your personal data. We share data with processors only as needed to run the directory and website, or where the law requires it.

How long we keep data

Active directory profiles: while your account is active and you remain listed, unless you ask us to delete sooner.
Re-verification: listings are re-verified annually. If you do not complete re-verification, your listing may be hidden from the directory until you do.
Listings you remove: if you ask us to delete your listing and account, we delete your personal data within 30 days unless we must keep it for legal reasons.
Applications not approved: where an application is not approved, or is flagged for possible impersonation or fraud, we keep the application record for as long as needed to protect the directory and deal with any dispute.
Sign-up IP address and user agent: 12 months from sign-up, then deleted automatically. This does not apply while an application or listing is flagged, rejected, under review or awaiting re-verification; we then keep it with the application record as described above.
Payment and tax records: up to seven years where required for accounting and tax law.
Hosting logs and rate-limit data: hosting request and error logs are kept for our hosting provider's standard period; rate-limit counters expire automatically, typically within minutes to a day.
Marketing suppression lists: kept as long as needed to honour opt-outs.

Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict processing, data portability, and to object to certain processing (including direct marketing). Where we rely on consent, you may withdraw it at any time.

Representatives can update many details via their account profile. For deletion, export or other requests, email robertcashman@defencelegalservices.co.uk with a clear subject (for example “Delete my profile” or “Data subject access request”). We aim to respond within one month (and usually within seven working days for straightforward requests).

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk, telephone 0303 123 1113.

Questions about your data?

Contact our privacy team using the email above — we have not appointed a separate DPO.