MOTORREDRESS — a service operated by Milberg London LLP
Third Floor, Sutton Yard, 65 Goswell Road, London EC1V 7EN
Authorised and regulated by the Solicitors Regulation Authority (SRA No. 670230)
Last Updated: March 2026 | Document Version: v3.0
1. Introduction
Milberg London LLP, trading as MotorRedress (“we”, “us”, “our”, “the Firm”) is committed to protecting your privacy and handling your personal data responsibly. This Privacy Notice explains how we collect, use, store and share your personal data when you instruct us to act on your behalf in a motor finance commission claim.
This notice is provided in accordance with Articles 13 and 14 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Data Controllers and Processors
2.1 Data Controller
| Data Controller | Milberg London LLP (trading as MotorRedress) |
| Registered Address | Third Floor, Sutton Yard, 65 Goswell Road, London EC1V 7EN |
| SRA Number | 670230 |
| Company Number | OC430853 |
| Data Protection Contact | The Data Protection Officer |
| [email protected] | |
| Telephone | [Freephone TBC] |
2.2 Data Processors
We engage the following data processors who process personal data on our behalf under written data processing agreements (in accordance with Article 28 of the UK GDPR):
| Processor | Purpose | Data Processed |
|---|---|---|
| AX-ai Ltd | Credit reference searches to identify motor finance agreements | Name, date of birth, address, credit file data |
| [Case management system provider TBC] | Hosting and maintaining our case management platform | All client matter data |
| [E-signature provider TBC] | Electronic signature collection and verification | Name, email, IP address, signature data |
| Cloudflare, Inc. | Secure data storage, CDN and backup | All client matter data (encrypted) |
| [Litigation funder TBC] | Assessing and funding claims | Claim summary data, redress estimates |
3. Personal Data We Collect
3.1 Identity Data
- Full name, title, date of birth
- National Insurance number (where required for lender identification)
- Photographic ID (where required for identity verification or AML checks)
3.2 Contact Data
- Home address (current and previous)
- Email address
- Telephone number(s)
3.3 Financial Data
- Details of your motor finance agreement (lender, agreement number, amounts, interest rates, term)
- Bank or building society account details (for payment of compensation)
- Credit history information obtained via AX-ai Ltd (soft search only — does not affect your credit score)
- Commission amounts disclosed by the lender
3.4 Vehicle Data
- Vehicle make, model, registration number, purchase date and price
- Dealer/supplying garage details
3.5 Claim Data
- Correspondence with lenders, the Financial Ombudsman Service and courts
- Records of complaints and their outcomes
- Settlement offers and final awards
- Subject Access Request responses
- Expert reports and legal opinions
- FCA redress scheme correspondence (if applicable)
3.6 Communication Data
- Records of our correspondence with you (email, post, telephone)
- Telephone call recordings (if applicable, with prior notice)
- File notes and attendance notes
- Online portal activity logs
3.7 Technical Data (from electronic onboarding)
- IP address at the time of electronic signature
- Device type and browser information
- Timestamp and geolocation data associated with electronic signatures
- Audit trail data from the e-signature platform
3.8 Special Category Data
We do not routinely collect special category data (e.g. health data, racial or ethnic origin). However, if you disclose such information to us (for example, if a health condition is relevant to your claim or communication needs, or if you disclose a vulnerability), we will process it only with your explicit consent and solely for the purpose of providing our legal services and making reasonable adjustments in accordance with the Equality Act 2010.
4. How We Collect Your Data
We collect personal data from the following sources:
- Directly from you — when you complete our onboarding forms, correspond with us, or provide documents;
- From AX-ai Ltd — who conduct credit reference searches on your behalf (with your consent). This is a soft search and will not appear on your credit report or affect your credit score;
- From credit reference agencies (Equifax, Experian, TransUnion) — via AX-ai Ltd;
- From your finance provider — in response to our complaint or Subject Access Request;
- From the Financial Ombudsman Service — during FOS proceedings;
- From the FCA — in connection with any motor finance consumer redress scheme;
- From public sources — such as the electoral register, Companies House, or court records;
- From our litigation funder or ATE insurer — where relevant to funding your claim;
- From third-party introducers — if you were referred to us by a marketing partner (with your consent).
5. Legal Basis for Processing
We process your personal data on the following legal bases under Article 6 of the UK GDPR:
| Legal Basis | Purpose |
|---|---|
| Contract (Art. 6(1)(b)) | To perform our obligations under the retainer agreement, including investigating and pursuing your claim, conducting credit searches, and distributing settlement funds |
| Legal obligation (Art. 6(1)(c)) | To comply with our regulatory duties under SRA rules, the Consumer Duty (PS22/9), anti-money laundering legislation, HMRC requirements, and FCA/SRA joint expectations on multiple representation |
| Legitimate interests (Art. 6(1)(f)) | To manage our business, improve our services, prevent fraud, verify the absence of multiple representation, enforce our legal rights, and conduct quality assurance |
| Consent (Art. 6(1)(a)) | For processing special category data (where applicable), credit reference searches via AX-ai Ltd, marketing communications, and sharing data with third parties not essential to the claim |
Where we process special category data, we rely on: Explicit consent (Art. 9(2)(a)) — you may withdraw consent at any time; and Establishment, exercise or defence of legal claims (Art. 9(2)(f)).
6. Who We Share Your Data With
| Recipient | Purpose |
|---|---|
| AX-ai Ltd | Credit reference searches and identification of finance agreements |
| Credit reference agencies | Via AX-ai Ltd, to access your credit file (soft search only) |
| Your finance provider | To submit the complaint, request disclosure, and negotiate settlement |
| Financial Ombudsman Service | To refer and progress your complaint through FOS |
| Financial Conduct Authority | To comply with regulatory requirements or participate in any redress scheme |
| Courts and tribunals | If litigation is necessary |
| Litigation funders | To assess and fund your claim (bound by confidentiality obligations) |
| ATE insurers | To obtain costs protection insurance |
| Counsel and expert witnesses | If instructed in connection with your claim |
| IT service providers | Who host and maintain our systems (under data processing agreements) |
| Auditors and regulators | The SRA, HMRC, and external auditors, as required by law |
We will never sell your personal data to third parties for marketing purposes.
7. Credit Reference Searches (AX-ai Ltd)
What happens: When you consent to a credit reference search, AX-ai Ltd accesses your credit file (held by Equifax, Experian and/or TransUnion) to identify motor finance agreements in your name.
Type of search: This is a soft search. It will not appear on your credit report when viewed by lenders. It will not affect your credit score.
What data is used: Your full name, date of birth and current/previous addresses are provided to AX-ai Ltd to conduct the search.
What data is returned: AX-ai Ltd returns details of motor finance agreements found on your credit file, including lender name, agreement type, start date, and outstanding balance.
8. International Transfers
Your personal data is primarily processed and stored within the United Kingdom. If we need to transfer your data outside the UK, we will ensure appropriate safeguards are in place, including UK adequacy decisions, standard contractual clauses approved by the ICO, binding corporate rules, or the UK International Data Transfer Agreement (IDTA).
9. Data Retention
| Data Type | Retention Period | Basis |
|---|---|---|
| Client matter file (successful claim) | 6 years from conclusion | SRA guidance and Limitation Act 1980 |
| Client matter file (unsuccessful claim) | 3 years from closure | SRA guidance |
| Financial records | 6 years | HMRC requirements |
| Anti-money laundering records | 5 years | MLR 2017, Reg. 40 |
| Complaints records | 6 years from resolution | SRA requirements |
| Credit search data | Duration of claim + 12 months | Contractual necessity |
| E-signature audit trails | 6 years from signature | Limitation Act 1980 |
10. Your Rights
| Right | Description |
|---|---|
| Access (Art. 15) | Request a copy of all personal data we hold about you |
| Rectification (Art. 16) | Ask us to correct inaccurate or incomplete data |
| Erasure (Art. 17) | Ask us to delete your data, subject to legal obligations |
| Restrict processing (Art. 18) | Limit how we use your data in certain circumstances |
| Data portability (Art. 20) | Request your data in a structured, machine-readable format |
| Object (Art. 21) | Object to processing based on legitimate interests |
| Withdraw consent | Withdraw consent at any time without affecting prior processing |
To exercise any of these rights, contact: [email protected]. We will respond within one month.
11. Data Security
We take appropriate technical and organisational measures to protect your personal data, including:
- Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
- Multi-factor authentication for all staff accessing client data
- Access controls on a need-to-know basis
- Secure case management systems with audit trails
- Regular security assessments and penetration testing
- Staff training on data protection (annually and on induction)
- Secure disposal of physical documents (DIN 66399 Level P-4)
- Data processing agreements with all third-party processors
- Incident response plan with mandatory breach notification
12. Data Breaches
In the event of a personal data breach that poses a risk to your rights and freedoms, we will:
- Notify the ICO within 72 hours of becoming aware of the breach (Article 33 UK GDPR)
- Notify you without undue delay if the breach poses high risk (Article 34 UK GDPR)
- Document the breach, its effects, and remedial action taken
- Take immediate steps to contain and mitigate the breach
13. Right to Complain
If you are dissatisfied with how we handle your personal data, you have the right to complain to:
| Address | Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF |
| Telephone | 0303 123 1113 |
| Website | www.ico.org.uk |
| [email protected] |
We would appreciate the opportunity to address your concerns before you contact the ICO. Please contact our Data Protection Officer first.
14. Cookies and Online Tracking
If you use the MotorRedress website or online portal, we may collect data through cookies and similar technologies. Our Cookie Policy sets out the types of cookies we use, their purposes, and how you can manage your preferences.
15. Children's Data
Our services are not directed at individuals under the age of 18. If we become aware that we have collected data from a person under 18, we will delete it promptly.
16. Changes to This Notice
We may update this Privacy Notice from time to time. We will notify you of any material changes by email or through our website. The “Last Updated” date at the top of this notice will always reflect the most recent revision.
17. Consent Acknowledgement
By signing the Letter of Authority and instructing Milberg London LLP (trading as MotorRedress) to act on your behalf, you acknowledge that you have read, understood and accepted this Privacy Notice.
MotorRedress is a trading name of Milberg London LLP, a limited liability partnership registered in England and Wales (OC430853). Registered office: Third Floor, Sutton Yard, 65 Goswell Road, London EC1V 7EN. Authorised and regulated by the Solicitors Regulation Authority (SRA No. 670230). Credit searches are conducted by AX-ai Ltd on behalf of Milberg London LLP.