Call +44 (0)1524 488 311

We will process data fairly and lawfully in accordance with the principals of Data Protection Act 1998 (the Act) and the General Data Protection Regulation ((EU) 2016/679) (GDPR).

The Data Controller

Sandstone Legal is the ‘Data Controller’ and the ‘Data Processor’ for any personal information you provide to us.

Our full details are:

Sandstone Legal Limited,
4 Jordan Street,
M15 4PY.

Phone: 0161 470 1511

What Data We Require

Sandstone Legal will be known as the ‘Controller’ of the personal data you provide to us. We will only collect the personal data about you that is needed to proceed with Claims Services through our Data Processor, on your behalf. This includes information you voluntarily provide to us, including: name, address, email, bank details, and any other information you provide to us as part of the claims process.

Why We Require Your Data

We require this information from you to provide you with a service. When you give this information on our website, you consent for us to use your personal information to:

  • Contact you via the contact methods you have chosen to provide, including via text message, telephone, email and by post.
  • Contact you regarding your flight delayed claim and other services that may be of interest to you.
  • Administer our website, including ensuring that we can enable your use of the services on our website (including enquiries and complaints about our website) and improve your browsing experience by personalising the website.
  • Internal record keeping.
  • Periodically send promotional emails about new products, special offers or other information which we think you may find interesting using the email address which you have provided.
  • From time to time, we may also use your information to contact you for market research purposes. We may contact you by email, phone, fax or mail.

During the provision of our services, you agree for us to process your personal information through signing our Letter of Authority which means you agree to our Terms and Conditions, to allow us to:

  • Supply services to you under your contract;
  • Send you general commercial communications by the contact details you have provided to us during our services;
  • Contact third-parties on your behalf, with your specific instruction;
  • Send you email notifications which you have specifically requested; and
  • Send statements and invoices to you, and collect payments from you.

Failure to Provide Data to Us

Please be aware, in order to be able to complete our services for you, we do require certain personal information to be provided to us from yourself. If this data is not provided, we may not be able to fulfil our contract with you. In this event, we will explain what data is required and why. If you do not wish to provide us with this, we have the right to terminate your contract with us in accordance with our Terms and Conditions, which you agree to upon signing these.

Legitimate Interests

We rely on legitimate interests as our lawful basis for processing. Processing is necessary for the performance of a contract to which you, the data subject, is party, and to take steps at the request of you, prior to entering in to a contract. We will only process your personal data in a way that you reasonably expect.

In respect of our legitimate interests, we have a legitimate interest in keeping you updated about any further services offered by us which may be of interest to you both during and after the conclusion of your contract with us, including communication of any developments that may have an impact on your original service (e.g. a change in the law that will make additional services available to you). We will use the details you have provided to contact you including by telephone, email and post. If you do not wish for us to contact you in this manner, or by a specific method, you will be able to unsubscribe at any time to one or all contact methods and this option will be easy for you to complete.

We also have a legitimate interest in using your data to help us to review our services and obtain analytics in respect of our customer base.

We may also be required to use your data due to a legal requirement which is placed upon us; this includes our regulatory requirements such as financial record keeping, staff training and monitoring, in addition to complaint handling. In these circumstances, we may be required to keep your data by law. We will always inform you if this is the case.

What Data Do We Collect?

We collect, store and use the following kinds of your data:

  • Information about your computer and about your visits to and use of this website (including your IP address, geographical location, browser type, referral source, length of visit and number of page views);
  • Information relating to any transactions carried out between you and us on or in relation to this website, including information relating to the supply of our services;
  • Information that you provide to us for the purpose of registering with us (including name, address, telephone number and any financial information);
  • Information that you provide to us for the purpose of subscribing to our website services, email notifications and/or newsletters);
  • Information required to complete our services that we will request directly from you, including your personal circumstances and information about your financial products and services; and
  • Any other information that you choose to send to us.

All personal data we hold is processed by our staff in the UK, including our ‘Processor’ Direct Connections Ltd who manage our Contact Centre.

Your information is held on our server (hosted by our contracted IT provider – compliant to ISO9001 and ISO27001), also based here in the UK.

As part of the service we provide to you, we do need to share your information with the specific Airline you have stated in your instruction to us to handle any claim on your behalf. Sandstone Legal will not sell, assign, disclose or rent your personal data to any other external organisation or individual except for where the law requires us to disclose it, or where it is necessary to disclose the information to comply with a regulatory or legal process. We may share generic aggregated demographic information not linked to any personal identification information regarding visitors and users of our website with our business partners, trusted affiliates and advertisers for the purposes outlined above.

If you do not provide the personal information we have requested, it may affect our ability to provide the services that we are offering and you will be informed of this at the appropriate time.

We control the use of your data as you have directed.

To allow us to provide our services to you, the following third parties provide critical functions to our business and will process your personal information as directed by us and in accordance with strict data security arrangements:

  • Our Services: during our services we will provide your data, under your specific instruction, to named Airlines. We will also provide a referral to any legal partner, at your request.
  • Our Contact Centre: We use third party telephony services provided by Direct Connections Ltd who manage our Contact Centre.
  • Our Advertising: We also use third party advertising services who provide analytical information about our advertising to help us improve this in the future. In any event, the data held by analytics firms is on an anonymised basis meaning they cannot identify you.
  • Our Systems and IT: we use third party firms who provide essential storage arrangements (including call recordings), software and support to our infrastructure.
  • Post and Printing: we use an outsourced print-house who manages our printing, they receive a copy of postal communication and print and send this on our behalf.
  • Our Regulators: we may be required to provide your data to our Regulators, who include the Solicitors Regulation Authority and the Information Commissioner’s Office;
  • Our Professional Services: we use professional legal, consultancy and accountancy services to help us fulfil our legal obligations.

We will not sell, assign, disclose or rent your personal data to any other external organisation or individual except for where the law requires us to disclose it, or where it is necessary to disclose the information to comply with a regulatory or legal process. We have carefully selected our third parties due to their commitment to keeping your data safe, and all data is processed within the European Union and subject to the same legislation. If you request for us to stop processing your data, we will also communicate this to the relevant third parties if they are processing this on our behalf. If you have any concerns about the above third parties, please let us know and we can provide advice and support to help you manage your data preferences.

Your Rights

You are in complete control. You can object or withdraw your consent to the use of your personal data at any time. Though in some cases this may not be possible, for example, if there is a live, successful claim that we are handling on your behalf as part of our Claims Service, as set out in your signed Terms and Conditions. We will tell you if this is likely to be the case.

If you do wish to withdraw your consent, please email our Data Processor’s inbox at

If at any point you believe the information we process on you is incorrect you can request to see this information, and have it corrected or deleted (subject to conditions).

If you wish to raise a complaint on how we have handled your personal data, you can write to us on the address below:

Complaints Department,
Sandstone Legal,
4 Jordan Street,
M15 4PY.

Or, we can be emailed at

If you are dissatisfied with our response you can complain to the Information Commissioner's Office

Information Commissioner's Office
Wycliffe House
Water Lane

Telephone: 0303 123 1113 (local rate) or 01625 545 745
Fax: 01625 524 510

To learn more about your rights please see the ICO website.

You can control, access or restrict the use of your data, and you have rights under this policy.


A cookie is a small file which asks permission to be placed on your computer's hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

We use traffic log cookies to identify which pages are being used. This helps us analyse data about web page traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.

Overall, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

You may also wish to visit: for further information.

Withdrawing Your Consent

You can withdraw your consent (opt-out) for us to contact you at any time. Please note: if you have signed a contract to complete a claim, our contractual rights will still apply and we can contact you in relation to a cancellation fee or any outstanding monies owed to us.


We may disclose information about you to any of our employees, officers, agents, suppliers or subcontractors insofar as reasonably necessary for the purposes as set out in this privacy policy.

In addition, we may disclose information about you:

  • To the extent that we are required to do so by law;
  • In connection with any legal proceedings or prospective legal proceedings; and
  • In order to establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention and reducing credit risk).

Third-Party Data Transfers

We do not specifically transfer your data to countries outside of the European Union. However, some of our third-party service providers may provide services which mean your data is transferred outside of the European Union. In any case, we ensure that there are appropriate security measures in place such as technical security, including encryption and restricted access to your data. The only circumstance in which this may happen is if one of our third-party data processors backs up their systems (to keep their data secure) outside of the European Union. In any event, we have strict contracts in place to make sure your data is kept safe and your data is always under our control. If you have any questions, please feel free to contact us for further information.

Third-Party Websites

There may be times when our website contains links to other websites. We are not responsible for the privacy policies or practices of third-party websites. We also do not have any control over those websites, therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

Policy Amendments

We may, at times, update this privacy policy by posting a newer version to our website. You should check this page occasionally to ensure you are happy with any changes, although anything that will affect you will be communicated directly to you.


Should you have any questions about this Privacy Policy, the practices of this site, or your dealings with this site, please contact us on:

Sandstone Legal Limited,
4 Jordan Street,
M15 4PY.

Phone: 0161 470 1511