Privacy Policy

This Policy explains how we collect, use, store and protect personal data when you visit our website or engage our mediation services. It is provided in compliance with the UK General Data Protection Regulation ('UK GDPR'), the Data Protection Act 2018 and other applicable data protection legislation in force in England and Wales.

 

Who we are

 

We are Concibrium Limited (Company No. 16043891) of Unit 82a, James Carter Road, Mildenhall, England, IP28 7DE ('Concibrium', 'we', 'us' or 'our'). We trade as Vestia Mediation ('Vestia Mediation').

 

We are the data controller in respect of all personal data collected through our website (www.vestiamediation.co.uk) and in the course of providing our mediation services.

 

Any references in this Policy to 'you' and 'your' are to the individual whose personal data we hold or process, including parties to a mediation, their representatives, persons completing the contact form on our website and other visitors to our website.

 

Personal data we collect

 

We may collect and process the following categories of personal data:

​

• identification and contact details, including name, postal address, email address and telephone number;

• information relating to your dispute, including legal documents, correspondence, position statements and supporting evidence;

• financial information, including invoicing details, payment records and bank details, where applicable;

• records of communications between you and us, including emails, telephone notes and meeting notes;

• information collected automatically through your use of our website, including IP address, browser type, device type, pages viewed and similar technical data; and

• any other information you choose to share with us in connection with the Mediation or your enquiry.

 

Special category data

 

Mediation may involve information that falls within the special categories of personal data under Article 9 of the UK GDPR, including data revealing racial or ethnic origin, religious or philosophical beliefs, health, sexual orientation, or alleged criminal conduct.

 

Where we process special category data, we do so on one or more of the following lawful bases:

​

• your explicit consent;

• the establishment, exercise or defence of legal claims (Article 9(2)(f) of the UK GDPR); or

• reasons of substantial public interest, where applicable.

 

How we collect personal data

 

We collect personal data:

 

• directly from you, including through completion of our website contact form, by email, telephone or post, and during the course of the Mediation;

• from other parties to the Mediation, including their legal representatives or advisers;

• from publicly available sources, where relevant; and

• automatically through your use of our website, by means of cookies and similar technologies (please see the section on cookies below).

 

Why we use personal data and our lawful basis for doing so

 

We process personal data for the following purposes and on the following lawful bases:

 

• To deliver our mediation services: performance of a contract with you, or steps taken at your request prior to entering into a contract.

• To respond to enquiries received through our website or by other means: our legitimate interests in responding to a request for information about our services.

• To administer fees, invoicing and payment: performance of a contract and compliance with legal obligations (including under tax legislation).

• To comply with our legal and regulatory obligations: compliance with a legal obligation to which we are subject.

• To maintain the safety and security of our website and IT systems: our legitimate interests in protecting our infrastructure and the data we hold.

• To send occasional updates about our services, where you have agreed to receive them: consent, which you may withdraw at any time.

 

Who we share personal data with

 

We may share personal data with:

 

• co-mediators or other mediators, where they are involved in the Mediation;

• other parties to the Mediation and their legal representatives, in accordance with the Mediation Agreement and only as necessary for the conduct of the Mediation;

• our professional advisers, including accountants, insurers and legal advisers;

• HM Revenue & Customs and other regulatory authorities, where required by law;

• IT and software service providers who host or otherwise support our website, email and document storage; and

• any third party to whom we are required to disclose personal data by law or by order of a court or regulatory authority.

 

We do not sell personal data to any third party.

 

International transfers

 

Some of the service providers we use may be based outside the United Kingdom. Where personal data is transferred outside the UK, we take steps to ensure that an adequate level of protection is in place, including reliance on UK adequacy regulations, the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, as appropriate.

 

How long we keep personal data

 

We will keep personal data only for as long as is necessary for the purposes for which it was collected and to comply with our legal, regulatory and accounting obligations.

 

In particular, save as otherwise agreed by the parties:

 

• In accordance with the Mediation Agreement, all documents received from the Parties, mediation notes and confidential information arising from the Mediation (including the settlement agreement and any electronic communications) will be returned to the Parties or permanently destroyed after the conclusion of the Mediation and any post-Mediation work;

• the signed Mediation Agreement will be retained for a period of six (6) years from the conclusion of the Mediation, in line with limitation periods under the Limitation Act 1980 and the requirements of our professional indemnity insurers;

• basic records confirming that a Mediation took place (including the date and the identity of the Parties) will be retained for the same period, for the purposes of conflict-checking and regulatory compliance;

• financial and accounting records will be retained for the periods required by HM Revenue & Customs and other applicable legislation, ordinarily six (6) years; and

• marketing data will be retained until you withdraw your consent or otherwise object to receiving further communications from us.

 

Security

 

We take appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. These measures include access controls, encryption in transit, secure storage and confidentiality obligations binding on all those who have access to personal data on our behalf.

 

No system can be guaranteed to be entirely secure, and we cannot warrant the security of personal data transmitted to or from us over the internet. Any such transmission is at your own risk.

 

Your rights

 

Subject to the conditions and exceptions set out in the UK GDPR, you have the following rights in relation to your personal data:

 

• the right to be informed about how we process your personal data;

• the right of access to a copy of the personal data we hold about you;

• the right to rectification of inaccurate or incomplete personal data;

• the right to erasure of personal data in certain circumstances;

• the right to restrict our processing of your personal data;

• the right to object to processing carried out on the basis of our legitimate interests;

• the right to data portability in respect of personal data you have provided to us; and

• where we rely on consent, the right to withdraw that consent at any time.

 

To exercise any of these rights, please contact us using the details set out below. We will respond within the timescales required by law, ordinarily within one month of receipt of a valid request.

​

The above rights are subject to the exemptions, restrictions and other provisions of the UK GDPR and the Data Protection Act 2018. In particular, where the exercise of a right would adversely affect the rights and freedoms of others (including another Party to the Mediation), or where information is subject to legal professional privilege, the without prejudice rule, or another statutory exemption, we may be required or entitled to withhold some or all of the personal data requested.

Interaction with the Mediation

Mediation is a confidential process. We are bound by strict confidentiality and without prejudice obligations, both at common law and under the Mediation Agreement, and the other Parties to the Mediation are entitled to corresponding rights and protections. Where you ask us to exercise a right under this Policy in respect of personal data arising from or in connection with the Mediation:

​

• we will not disclose personal data of, or information shared in confidence by, another Party to the Mediation without that Party's consent or as required by law;

• we will not disclose without prejudice communications, settlement proposals, position statements or similar materials that would not be admissible in legal proceedings;

• we may rely on applicable exemptions under the Data Protection Act 2018, including those relating to legal proceedings, legal professional privilege and information about third parties; and

• where a request is made during the course of an ongoing Mediation, we may defer our substantive response until the Mediation has concluded, to the extent permitted by law.

​

Cookies

 

Our website uses cookies and similar technologies. A cookie is a small text file placed on your device that enables certain functionality. We use cookies for the purposes of enabling essential website functionality, analysing how visitors use our website, and, where you have agreed, providing relevant content.

 

You may control or delete cookies through your browser settings. Disabling certain cookies may affect the functionality of our website.

 

Changes to this Policy

 

We may update this Policy from time to time to reflect changes in our practices, legal requirements or service offerings. The current version will always be available on our website, with the date of the most recent update shown below.

 

Complaints

​

If you have any concerns about how we have handled your personal data, we would encourage you to contact us in the first instance using the details set out below so that we may try to resolve the matter.

 

You also have the right to lodge a complaint with the Information Commissioner's Office ('ICO'), the UK's data protection regulator. The ICO can be contacted at www.ico.org.uk or by telephone on 0303 123 1113.

 

Contact us

​

Questions about this Policy or about how we process personal data should be addressed to:

 

Email: enquiries@vestiamediation.co.uk

Telephone: 0330 133 5199

​​

Last updated: 19 May 2026