KPEA (UK) LIMITED – PRIVACY NOTICE

Last Updated: 28 October 2026

1. Introduction

   KPEA (UK) Limited (“KPEA”, “we”, “us” or “our”) is committed to protecting and respecting personal data and complying with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and other applicable data protection legislation.

   Our services include process serving, tracing services, investigations, surveillance and observation assignments, road traffic investigations, witness interviewing, status reporting, transcription services and other legal support services.

   2. Who We Are

   KPEA (UK) Limited is registered in England and Wales under company number 05720243.

   KPEA is registered with the Information Commissioner’s Office under registration number ZA372096.

   Data Protection Lead: Lorna Bevins
   Email: enq@keithparsons.co.uk

   3. Personal Data We Collect

   We may process names, addresses, dates of birth, contact details, employment information, financial information, family information, vehicle information, investigation reports, process serving records, photographs, video recordings, witness statements, litigation-related information and information obtained from publicly available sources.

   4. How We Obtain Personal Data

   We obtain personal data from solicitors, law firms, corporate clients, insurers, local authorities, private clients, approved agents, public registers, open-source intelligence sources, publicly available records, individuals who contact us directly and information gathered during investigations.

   4A. Information Obtained Indirectly

   In many cases, KPEA does not obtain personal data directly from the individual concerned.

   Personal data may be obtained from solicitors and legal professionals, commercial organisations, insurers, local authorities, approved agents, publicly available sources, open-source intelligence, public registers and other lawful third-party sources.

   Under Article 14 UK GDPR, individuals are generally entitled to be informed when their personal data is obtained indirectly. However, UK GDPR and the Data Protection Act 2018 recognise circumstances where providing such information is not required or may be restricted.

   We assess whether a specific exception under Article 14 UK GDPR or an applicable statutory exemption permits us not to provide information directly to an individual. Any such decision is made case by case and documented where appropriate; an ongoing investigation or legal claim does not automatically remove the duty to provide privacy information.

   5. Why We Process Personal Data

   We process personal data to carry out client instructions, locate individuals, serve legal documents, conduct investigations, undertake surveillance and observations, produce reports and evidence, verify information, establish, exercise or defend legal claims, prevent fraud, support debt recovery, maintain business records and respond to enquiries.

   6. Lawful Basis for Processing

   We process personal data under contract, legal obligation, legitimate interests, legal claims and other lawful bases permitted by UK GDPR and the Data Protection Act 2018.

   7. Controller and Processor Status

   Depending upon the instruction, KPEA may act as either a Data Processor or an Independent Data Controller.

   8. Sharing Personal Data

   We may share personal data with solicitors, barristers, courts, approved process servers, approved tracing agents, approved investigators, insurers, regulators, government agencies, law enforcement agencies, professional advisers and IT providers where necessary and lawful.

   9. Surveillance and Investigations

   Such processing is undertaken only where lawful, necessary, proportionate and subject to appropriate safeguards.

   10. Security of Personal Data

   KPEA uses Microsoft 365 Business Premium, Microsoft OneDrive for Business, multi-factor authentication, BitLocker device encryption, Microsoft Defender security controls, firewalls, anti-malware protection, restricted access permissions and secure disposal procedures.

   Paper records are stored in locked fire-resistant filing cabinets within secure office premises with restricted access.

   11. International Transfers

   Where personal data is transferred outside the United Kingdom, appropriate safeguards will be implemented in accordance with UK GDPR.

   12. Retention of Personal Data

   Core case files are normally retained for seven years following closure of the instruction. This is our standard business retention period, not a universal legal requirement. Records may be retained longer where necessary for legal obligations, contractual requirements, ongoing disputes or legal claims. Information no longer needed, including surplus copies and unnecessary raw surveillance footage, may be deleted earlier.

   13. Your Rights

   Individuals have rights including access, rectification, erasure, restriction, objection and data portability where applicable.

   Not all rights apply in every circumstance. KPEA may refuse, restrict or defer compliance where an exemption applies under UK GDPR or the Data Protection Act 2018, including crime prevention, legal proceedings, legal professional privilege, regulatory functions, protection of others’ rights or the establishment, exercise or defence of legal claims.

   14. Subject Access Requests

   Requests should be submitted to enq@keithparsons.co.uk. Proof of identity may be required.

   15. Complaints

   If you remain dissatisfied after contacting KPEA, you may complain to the Information Commissioner’s Office.

   16. Website and Cookies

   Our website may use cookies and similar technologies to improve functionality, analyse website traffic and enhance user experience.

   17. Changes to this Privacy Notice

   We may update this Privacy Notice from time to time.