Last updated: 14 June 2026
This policy explains how Engprax Ltd ("we", "us", "our") handles personal data. We are a digital forensics and expert witness practice registered in Scotland (Company No. SC782529), with our registered office at 5 South Charlotte Street, Edinburgh, EH2 4AN. We are the data controller for the website and business contacts described in section 1; our role for forensic casework is set out in section 2.
We are registered with the Information Commissioner's Office (registration no. ZB620730). For any data protection question, or to exercise your rights, contact us at contact@engprax.com or by post at the registered office above.
When you use our website or contact us, we may process your name, email address, telephone number, postal address, the content of your enquiry, and technical usage data (such as IP address, browser type and pages visited). We use this to respond to enquiries, to provide and secure the website, to perform our contracts, and to meet our legal and accounting obligations. Our lawful bases are our legitimate interests in operating and securing the practice, the performance of a contract, and compliance with legal obligations. We keep this data only as long as needed for those purposes and our professional record-keeping duties.
Our website uses cookies and similar technologies (including Google Tag Manager) for essential functions and for analytics. You can manage cookies through your browser settings.
When we are instructed on a case (or are contacted in relation to an anticipated instruction), we examine devices, accounts and data sources (for example mobile phones and computers) and the material they contain. This often includes data about people who are not our clients — complainers, accused persons, witnesses and unconnected third parties — and frequently includes special category data (such as health, sexual life, religious belief or biometric data) and data relating to criminal offences and proceedings.
Because we extract data from devices and accounts, we frequently process personal data belonging to third parties who are not our clients. We do not contact these individuals to provide privacy information, as doing so would involve disproportionate effort, could prejudice legal or criminal proceedings, and is protected by legal professional privilege.
Our role. Our status depends on who instructs us and (if applicable) the agreement or Memorandum of Understanding which data is subject to.
Lawful basis. Depending on the engagement we rely on our legitimate interests, the performance of our contract, our legal obligations, and (where instructed by a public authority) the exercise of official authority. For special category data we rely on the condition for the establishment, exercise or defence of legal claims and, where applicable, the substantial public interest conditions in Schedule 1 to the Data Protection Act 2018. We process data relating to criminal offences and proceedings (UK GDPR Article 10) under the relevant Schedule 1 conditions.
Children's data. Casework, particularly in serious cases, may involve data about and images of children. We handle such material under the same legal framework and under the additional controls the law requires for sensitive material of this kind.
Retention. We keep casework material only as long as needed, and we do not rely on being told a case has ended: we treat a matter as concluded a set period after the notified trial date, the delivery of our report, or our last instruction (as set out in our engagement correspondence), or once the material is no longer deemed necessary. At that point, the source material we examine (such as device images and extractions) is returned to the instructing party or securely destroyed, unless a longer period is required. We keep a limited working record — for example our methodology, chain-of-custody and integrity records, instructions, report and correspondence — for longer, to establish the reliability of our work and to defend legal claims, in line with the relevant limitation periods and the possibility of later review (for example an appeal or a referral by the Scottish Criminal Cases Review Commission). When retention is no longer justified, material is destroyed.
We share personal data only as necessary to carry out our work: with the instructing party and their legal team (including expert witnesses agencies where involved in the case), law enforcement bodies and prosecution legal teams, with courts and tribunals, with service providers (including IT, data science and forensic tooling providers), and where we are required to do so by law. We do not sell personal data.
We store and process personal data in the United Kingdom. Where a transfer outside the UK is necessary (for example where a service provider processes data outside the UK), we make it only where the destination is covered by UK adequacy regulations or protected by an appropriate safeguard such as the UK International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses).
We protect personal data with measures appropriate to its sensitivity, including encryption in transit and (where appropriate) at rest, access controls and logging, vetting of personnel, secure and segregated forensic workstations and storage, and documented chain-of-custody procedures.
You have rights under data protection law, including to access your data and to ask us to correct, erase, restrict or object to its processing, and to data portability. To exercise them, contact us using the details above.
These rights are not absolute. Where we hold material for legal proceedings, for the prevention or detection of crime, or that is subject to legal professional privilege, the law (including the exemptions in Schedule 2 to the Data Protection Act 2018) may restrict the rights that apply — for example, we cannot allow a person to alter or delete evidence. We will tell you where an exemption applies.
If you are concerned about how we handle your data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).
We may update this policy from time to time. The current version is always published on this page with the date it took effect.
Engprax Ltd, 5 South Charlotte Street, Edinburgh, EH2 4AN. Email: contact@engprax.com.