Privacy policy

Important Information and Who We Are

Purpose of this privacy policy

This privacy policy explains how Boult Wade Tennant collects and uses your personal data under the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR). We may collect your data through your use of our websites, when we onboard you as a client, when you instruct us to act on your behalf, when we correspond with you, when you attend our events or seminars, when you subscribe to our publications or newsletters, or through other business interactions with us.

Our websites are not intended for children, and we do not knowingly collect data relating to children.

Controller

We issue this privacy policy on behalf of Boult Wade Tennant LLP and its related entities so when we mention "Boult", "we", "us" or "our" in this privacy policy, we are referring to the relevant entity responsible for processing your data. Boult Wade Tennant and its related entities comprise:

Boult Wade Tennant LLP (OC421876)
8 Salisbury Square House
London
EC4Y 8AP
United Kingdom

Boult Wade Tennant, Spain S.L.P. (Reg No to be added)
Avda. De Europa 26
Ática 5 Planta 2
28224 Pozuelo De Alarcón
Madrid

Boult Wade Tennant LLP (for German offices based in Frankfurt and Munich)
Mindspace Eurotheum
Neue Mainzer Str. 66-68
60311 Frankfurt am Main

We will let you know which entity will be the controller for your data when you engage us and will include details of the controller in the engagement paperwork. If you interact with Boult other than as a client (for example, as a business contact, visitor, or job applicant), we will tell you who the relevant controller is when or before we collect your personal data, or as soon as we reasonably can after that.

Our Chief Operating Officer, is responsible for overseeing this policy. If you have any concerns or questions regarding data protection at Boult, or would like to exercise any of your legal rights (see section 9, ‘Your Legal Rights’) please contact us using the details found in section 10 (‘Contact Details’).

The Types of Personal Data We Collect About You

Personal data means any information about an individual from which someone can identify that person.

We may collect, use, store and transfer different kinds of personal data about you, which we have grouped together as follows:

• Identity Data includes first name, last name, any previous names, username or similar identifier, marital status, title, date of birth, gender, photography and videography (including those taken from events or interactions) and nationality or citizenship status.
• Contact Data includes your address, email address and telephone numbers.
• Financial Data includes bank account.
• Transaction Data includes details about payments to and from you, and details of other times where you may have engaged us.
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device ID and other technology on the devices you use to access our websites.
• Profile Data includes your username and password for use of the BoultRenew™ platform, your interests, preferences, feedback and survey responses.
• Usage Data includes information about how you interact with and use our websites and services.
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
• Professional Data includes professional or employment-related details, publicly available social media content (such as LinkedIn) and news coverage.
• Intellectual Property Data includes information relating to your intellectual property portfolio, such as patent, trade mark and design application and registration numbers and related correspondence with intellectual property offices.
• Invention Data includes technical information relating to inventions disclosed to us, such as descriptions of inventions, technical drawings, specifications, prior art references, and details of inventors and their contributions.
• Event Data includes dietary requirements, health conditions, or disabilities that could affect your participation in events, and delivery addresses for gifts or other items.
• Data protection law classifies some of this information, such as health conditions and disabilities, as special category data. Where we need to collect special category data from you, we will obtain your explicit consent before collection and provide you with clear information about how we will use this data.

We also collect, use and share aggregated data such as statistical or demographic data which is not personal data as it does not directly (or indirectly) reveal your identity. For example, we may aggregate individuals' Usage Data to calculate the percentage of users accessing a specific website feature. This helps us analyse general trends in how users interact with our website so we can improve the website and our service offering.

How Is Your Personal Data Collected?

We use different methods to collect data from and about you including through:

• Your interactions with us. You may give us your personal data by filling in online forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:
• engage our services;
• engage with us through our websites;
• subscribe to our publications;
• request marketing to be sent to you;
• give us feedback or contact us;
• register for an event organised by Boult, whether independently or in partnership with other organisations, and whether held online or in person;
• use our BoultRenew™ platform to manage your IP portfolio renewals.
• Automated technologies or interactions. As you interact with our websites, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We may collect the following types of data: the browser types and versions you use, the operating system your system uses, the website from which your system accesses our websites (so-called referrer), the sub-websites you access, the date and time you access the website, your internet protocol address (IP address), and your internet service provider.
• Third parties or publicly available sources. We will receive personal data about you from various third parties and public sources as set out below:
• Technical Data from analytics providers (such as Google).
• Contact, Financial and Transaction Data from providers of technical, payment and delivery services (such asWordlPay).
• Identity and Contact Data from publicly available sources such as Companies House and the Electoral Register.
• Identity, Contact and Intellectual Property Data from intellectual property offices and registries (such as the UK Intellectual Property Office, European Patent Office and World Intellectual Property Organization) in connection with the management of your IP portfolio.

How We Use Your Personal Data

Legal basis

The law requires us to have a legal basis for collecting and using your personal data. We rely on one or more of the following legal bases:

• Performance of a contract with you: Where we need to perform the contract we are about to enter into or have entered into with you.
• Legitimate interests: We may use your personal data where it is necessary to conduct our business and pursue our legitimate interests, for example to prevent fraud and enable us to give you the best and most secure client experience. We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).
• Legal obligation: We may use your personal data where it is necessary for compliance with a legal obligation that we are subject to. We will identify the relevant legal obligation when we rely on this legal basis.
• Consent: We rely on consent only where we have obtained your active agreement to use your personal data for a specified purpose, for example if you subscribe to receive marketing content.

Use of Artificial Intelligence Tools

We may use artificial intelligence (‘AI’) tools to help us process your personal data when providing our services. We may use these tools to improve efficiency and enhance service quality. We do not use AI tools to make solely automated decisions that produce legal or similarly significant effects on you without appropriate safeguards and, where required, your explicit consent. When we use AI tools, we make sure we have appropriate safeguards in place, including human oversight of AI-generated outputs. We require any third-party AI service providers we engage to comply with our data protection standards and to process your personal data only as we instruct.

Purposes for which we will use your personal data

We have set out below, in a table format, a description of all the ways we plan to use the various categories of your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Direct marketing

You will receive marketing communications from us if you have requested information from us or purchased goods or services from us and you have not opted out of receiving the marketing. When signing up through our website, you can specify the topics and sectors you are interested in, and you can update your preferences or opt out at any time. We may also analyse your Identity, Contact, Technical, Usage and Profile Data to understand which products and services may interest you so that we can send you relevant marketing communications.

Third-party marketing

We will get your express consent before we share your personal data with any third party for their own direct marketing purposes.

Opting out of marketing

You can ask us to stop sending you marketing communications at any time by following the opt-out links within any marketing communication sent to you or by contacting us using the details in section 10 below.

If you opt out of receiving marketing communications, you will still receive service-related communications that we consider essential for administrative or client service purposes or for checking that your contact details are correct.

Cookies

Our websites use cookies. Cookies are small text files that your web browser or device saves when you visit a website. These files store a unique string of characters that allows us to recognise your browser when you return to the site. We use cookies to enhance your experience on our website, to identify your browser across different pages, and to help us analyse how visitors navigate and use the site. When you visit our website, you will see a banner telling you about our use of cookies, which also links to our full cookie policy.

Third-party tools and technologies

We use several third-party tools and technologies on our websites. We only use these tools if you give your express consent. You may withdraw your consent at any time, and this will take effect going forward. However, withdrawing your consent does not affect the lawfulness of any processing we carried out before you withdrew it. Below we explain how each tool processes your personal data.

Google Analytics

We use Google Analytics (with IP anonymisation) on our websites. Google LLC (1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA) provides this web analysis service. We use it to analyse visitor traffic to our website and to understand how users interact with our content. Google Analytics uses cookies to collect information about your use of our website. For more information, please see our cookie policy.

We have a data processing agreement with Google LLC, which includes the European Commission's standard contractual clauses (for transfers from the European Economic Area ('EEA') and the UK International Data Transfer Addendum (for transfers from the UK), to safeguard your personal data. Where Google LLC is certified under the EU-U.S. Data Privacy Framework, this certification also applies. For more information about how Google handles your data, please see Google's privacy policy: https://support.google.com/analytics/answer/6004245

Cloudflare

Cloudflare Inc. (101 Townsend St., San Francisco, CA 94107, USA) provides the Content Delivery Network (CDN) we use to optimise the performance and security of our website. Cloudflare uses cookies and processes Technical Data. If you withdraw your consent, we will delete your personal data unless the law requires us to keep it.

We have a data processing agreement with Cloudflare Inc., which includes the European Commission's standard contractual clauses (for transfers from the EEA) and the UK International Data Transfer Addendum (for transfers from the UK). Where Cloudflare Inc. is certified under the EU-U.S. Data Privacy Framework, this certification also applies. For more information about how Cloudflare handles your data, please see Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/

LinkedIn

LinkedIn Corporation (2029 Stierlin Court, Mountain View, CA 94043, USA) operates LinkedIn, on which we maintain a company presence at https://www.linkedin.com/company/boult-wade-tennant/. For individuals in designated GDPR countries, LinkedIn Ireland Unlimited Company (Wilton Place, Dublin 2, Ireland) acts as the data controller for LinkedIn's processing activities. We use our LinkedIn profile to inform users about our services, share information, communicate with users, and for recruitment and professional networking.

When you interact with us through our LinkedIn profile, LinkedIn Corporation collects and processes your personal data in accordance with its own privacy policy. We do not control how LinkedIn processes your data. LinkedIn may collect profile data, login data, contact details, IP addresses, and information about the content you publish, and uses cookies and similar technologies to identify you across devices.

Although we do not collect data directly from your LinkedIn account, we may process content and data you publish when you interact with us through our LinkedIn profile. We act as an independent data controller for this processing and base it on our legitimate interest in promoting our services and developing professional relationships. We have standard data protection clauses with LinkedIn, which include the UK International Data Transfer Addendum for transfers from the UK. Where LinkedIn Corporation is certified under the EU-U.S. Data Privacy Framework, this certification also applies.

You may object to our processing of your personal data at any time by contacting us using the details in section 10 below. For more information about how LinkedIn handles your data, please see LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy

Disclosures of Your Personal Data

We may share your personal data where necessary with the parties set out below for the purposes described in the table 'Purposes for which we will use your personal data' above.

• Within Boult Wade Tennant and its related entities, to provide our services.
• When required by law or a court order. This may include sharing your data with tax authorities, courts, law enforcement, auditors, credit agencies, public registries and identity verification providers.
• IPReg (the Intellectual Property Regulation Board) or other regulatory bodies may require us to disclose personal data in connection with regulatory enquiries or our professional obligations.
• With intellectual property offices and registries (such as the UK Intellectual Property Office, European Patent Office, European Union Intellectual Property Office, World Intellectual Property Organization, and other national and regional IP offices) as necessary to file, prosecute, maintain and enforce your intellectual property rights.
• With foreign associates, correspondent attorneys and agents in other jurisdictions where necessary to file, prosecute or maintain your intellectual property rights outside the UK and the EEA.
• Where we are working with other professional advisors.
• With third parties with whom we co-host events, including event organisers, venues and other parties involved in running those events, where necessary to facilitate your attendance and participation.
• To protect our rights, property, or safety, or enforce agreements.
• Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. We may also seek to acquire other businesses or merge with them. If our business changes ownership, the new owners may use your personal data in the same way as we describe in this privacy policy.

We require all third parties to respect the security of your personal data and to treat it lawfully. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and as we instruct.

International Transfers

We share your personal data within Boult Wade Tennant and its related entities. This will involve transferring your data between the UK and our offices in Spain and Germany, and vice versa.

Whenever we transfer your personal data between the UK and the EEA, or to countries outside both the UK and the EEA that do not have equivalent data protection laws, we make sure your data receives a similar level of protection. For transfers from the UK, we use the International Data Transfer Addendum to the European Commission's standard contractual clauses. For transfers from the EEA, we use the European Commission's standard contractual clauses for international data transfers. The respective adequacy decisions currently in place permit transfers between the UK and the EEA.

We may transfer your personal data to service providers that carry out certain functions on our behalf. This may involve transferring personal data outside the UK or the EEA to countries that do not have equivalent data protection laws. We require these third-party vendors to follow applicable privacy laws, use proper security measures, and only process information as instructed.

• We may use specific standard contractual terms approved for use in the UK or the EU (as applicable) which give the transferred personal data the same protection as it has in the UK or the EEA. Where service providers are certified under the EU-U.S. Data Privacy Framework, this certification applies additionally. To obtain a copy of these contractual safeguards, please contact us using the details in section 10 below.

Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, or from anyone using, accessing, changing or disclosing it without authorisation. We also limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and we require them to maintain confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach if the law requires us to do so.

As patent and trade mark attorneys, legal professional privilege may protect communications between us and our clients. We take our obligations of confidentiality seriously and will not disclose privileged or confidential information unless the law requires us to do so, you consent, or our professional duties permit.

We may need to retain intellectual property case files, including patent and trade mark applications, prosecution histories and related correspondence, for extended periods (potentially the lifetime of the rights plus additional years) due to the nature of intellectual property rights and the possibility of future disputes, renewals or enforcement actions.

Data Retention

How long will you use my personal data for?

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes for which we collected it, including to satisfy any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period if there is a complaint or if we reasonably believe there is a prospect of litigation relating to our relationship with you.

Our engagement letters outline client file retention periods. We may retain some information for longer periods to protect legal rights or for historical purposes.

When deciding how long to keep personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from someone using or disclosing your personal data without authorisation, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

By law we have to keep basic information about our clients (including Contact, Identity, Financial and Transaction Data) for six years after they cease being clients for tax purposes. However, we may retain Intellectual Property Data and related case files for longer periods as described above. As a matter of principle, we only store your personal data for as long as we need it to achieve its original purpose of collection. If this original purpose of collection no longer applies, we erase your personal data, unless statutory retention periods or the ongoing management of your intellectual property rights oblige us to retain it beyond this period.

In some circumstances you can ask us to delete your data: see section 9 ('Your Legal Rights') for further information.

In some circumstances we will anonymise your personal data (so that no one can associate it with you) for research or statistical purposes. If we do this, we may use this information indefinitely without telling you.

Right to be forgotten – individuals have the right to request the deletion or removal of their personal data. Upon receipt of a valid request, the CRM administrator will review the personal data held within the CRM system, including contact details, communication history, interaction notes and any associated records. Where applicable, personal data will be permanently deleted from the CRM or anonymised where full deletion is not feasible due to reporting, analytics or legitimate business requirements. Any such requests should be sent to boult@boult.com with the subject title being: Right to be forgotten.

Your Legal Rights

You have a number of rights under data protection laws in relation to your personal data.

You have the right to:

• Request access to your personal data (commonly known as a "subject access request"). This means you can receive a copy of the personal data we hold about you and check that we are processing it lawfully.
• Request correction of the personal data that we hold about you. This means you can have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal data in certain circumstances. This enables you to ask us to delete or remove personal data where we have no good reason to continue processing it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we must erase your personal data to comply with local law. However, we may not always be able to comply with your erasure request for specific legal reasons, and we will tell you about these at the time of your request.
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) as the legal basis for that particular use of your data (including carrying out profiling based on our legitimate interests). In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object.
• You also have the absolute right to object at any time to the processing of your personal data for direct marketing purposes (see 'Opting out of marketing' in section 3 for details of how to object to receiving direct marketing communications).
• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. This right only applies to automated information for which you initially provided consent for us to use or which we used to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will tell you if this is the case when you withdraw your consent.
• Request restriction of processing of your personal data. This means you can ask us to suspend the processing of your personal data in one of the following scenarios:
• If you want us to establish the data's accuracy;
• Where our use of the data is unlawful but you do not want us to erase it;
• Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
• Where you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and make sure you have the right to access your personal data (or to exercise any of your other rights). This helps us make sure we do not disclose personal data to anyone who does not have the right to receive it. We may also contact you to ask for more information about your request to speed up our response.

Time limit to respond

We aim to respond to all valid requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made several requests. If this happens, we will let you know and keep you updated.

Contact Details

If you wish to exercise any of the rights set out above, or have any questions about this privacy policy, please contact us using the information below:

• Email address: alittle@boult.com
• Postal address: Boult Wade Tennant LLP, 8 Salisbury Square House, London, EC4Y 8AP, United Kingdom

Complaints

You have the right to make a complaint to us if you consider that, in connection with your personal data, there has been an infringement of UK data protection law (the UK GDPR and the Data Protection Act 2018) or, where applicable, EU data protection law (the EU GDPR). This includes complaints about how we have collected, used, stored or handled your personal data, or how we have responded to a request you have made to exercise your data protection rights.

You may make a complaint by email to alittle@boult.com or by post to Boult Wade Tennant LLP, 8 Salisbury Square House, London, EC4Y 8AP, United Kingdom.

We will acknowledge receipt of your complaint within 30 days of receiving it. We will then take appropriate steps to respond to your complaint without undue delay, including making enquiries into the subject matter of your complaint to the extent appropriate and keeping you informed about the progress of our investigation.

Once our investigation is complete, we will inform you of the outcome of your complaint without undue delay, including the steps we have taken to address your concerns and the reasons for our conclusions.

Complaints to a supervisory authority

If you are not satisfied with our response, or if you think we have not properly dealt with your complaint, you have the right to complain to a supervisory authority.

In the UK, the relevant supervisory authority is the Information Commissioner’s Office (ICO). The ICO is the UK’s independent body that oversees how organisations use personal data. You can contact the ICO at www.ico.org.uk or by telephone on 0303 123 1113. The ICO’s postal address is: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

In the EEA, you may complain to the data protection authority in the member state where you live, work, or where the alleged breach occurred. For example, in Spain, the relevant supervisory authority is the Agencia Española de Protección de Datos (AEPD), which can be contacted at www.aepd.es or by telephone on 900 293 183 (the AEPD’s postal address is: C/ Jorge Juan, 6, 28001-Madrid). In Germany, data protection supervision is carried out by the data protection authorities of the German federal states (Landesdatenschutzbehörden); further information and contact details can be found at www.bfdi.bund.de.

However, before complaining to a supervisory authority, please make sure you have first raised your concern with us or asked us for clarification if there is something you do not understand. The supervisory authority will expect you to have done this before it reviews your complaint.

Changes to the Privacy Policy and Your Duty to Inform Us of Changes

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us, for example a new address or email address.

Third-party Links

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy policies. When you leave our website, we encourage you to read the privacy policy of every website you visit.

Boult Wade Tennant

May 2026.