• ← Back

The Milk Exchange
Privacy Policy

Privacy Notice
Last updated: 5 August 20261. Who we areThe Milk Exchange Ltd (“MX”, “we”, “us” or “our”) provides practical family-support services, communication-management services, court-support and document-support services, educational resources and online community services.Our company details are:THE MILK EXCHANGE LTD
Registered in England and Wales
Company number: 14546324
Registered office: 167–169 Great Portland Street, Great Portland Street, 5th Floor, London, England, W1W 5PF
Email: [email protected]For the personal information described in this notice, The Milk Exchange Ltd generally acts as the data controller. This means that we decide why and how personal information is used.Our services are intended for clients in the United Kingdom. We comply with the UK General Data Protection Regulation, the Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations 2003.MX is not a firm of solicitors. We do not conduct litigation, provide reserved legal services or accept formal service of court documents unless this has been expressly and lawfully agreed in writing.2. Scope of this noticeThis notice explains how we collect, use, store and share personal information in connection with:• enquiries and client onboarding;
• paid support, coaching and consultancy services;
• managed communication mailboxes;
• assistance with correspondence, statements and practical documents;
• family-court and dispute-support services;
• our online community, events and educational resources;
• website forms, email and telephone communications;
• payments, invoices and accounting;
• complaints and data-protection requests; and
• our legal, safeguarding, security and business obligations.It applies to information about clients, prospective and former clients, children and family members, opposing parties, professional representatives, witnesses, supporters, schools, healthcare professionals, childcare providers, suppliers, community members, website users and people who contact a managed MX mailbox.3. Personal information we may collectDepending on the service and the circumstances, we may process the following categories of information.Identity and contact information
• names, titles, postal addresses, email addresses and telephone numbers;
• dates of birth and relationship to a client or child;
• contact details for solicitors, barristers and other professionals; and
• identification information where reasonably necessary.Family and children’s information
• children’s names, ages and dates of birth;
• family relationships and parental responsibility;
• living, care and contact arrangements;
• school, childcare, activity, routine and handover information;
• wishes and feelings attributed to children;
• information about behaviour, emotional welfare and development; and
• safeguarding concerns.Case and communication information
• emails, letters, messages, call notes and meeting notes;
• information sent to or from a managed mailbox;
• court applications, orders, reports, statements and hearing information;
• allegations, responses and supporting material;
• correspondence with solicitors and other professionals;
• records of instructions, approvals and decisions; and
• records showing when correspondence was received, reviewed and answered.Health and other sensitive information
• physical and mental-health information;
• disability and accessibility information;
• dental, developmental, educational, therapeutic, medication and treatment information;
• information relating to domestic abuse, trauma or vulnerability; and
• other special-category information included in documents or correspondence where it is relevant and necessary.Police, bail and alleged-offence information
• police reports, crime-reference numbers and investigations;
• bail conditions and protective measures;
• information about alleged harassment, stalking, coercive control or other unlawful conduct;
• arrests, charges, convictions or related proceedings; and
• information needed to understand communication restrictions, risk or safeguarding concerns.Financial information
• invoices, payment records and limited transaction information;
• maintenance, household expenses and children’s costs;
• financial arrangements contained in correspondence or court orders; and
• payment contributions connected with an MX service.Website, technical and community information
• IP address, browser, device, security and access-log information;
• cookie preferences and website-interaction information;
• information submitted through website forms;
• community account, profile, post, comment and participation information; and
• reports about community conduct.4. Where information comes fromWe may receive personal information directly from the person concerned or from:• our client or prospective client;
• the other party to a family or financial dispute;
• solicitors, barristers and other professional representatives;
• courts, tribunals, Cafcass, social services, police or other public bodies;
• schools, childcare providers, healthcare professionals and therapists;
• family members, supporters and witnesses;
• publicly available registers and records;
• documents provided in connection with proceedings or negotiations;
• our website, email, community and payment platforms; and
• other people who are authorised or entitled to provide the information.Where we obtain information about a person from another source, we will provide or make this notice available within the period required by data-protection law, unless a lawful exception applies.5. Managed communication servicesWhere a client gives MX written authority to manage communications, we may:• receive, organise and record correspondence;
• identify the subject and apparent urgency of a message;
• review correspondence with our client;
• prepare and send administrative responses on the client’s instructions;
• request missing documents or practical information;
• maintain a communication log;
• identify messages that should be redirected to solicitors or another professional;
• manage agreed review times and communication boundaries; and
• assist with routine children’s, household and payment matters.Unless expressly agreed otherwise in writing, the managed communication service does not authorise MX to:• act as a solicitor or legal representative;
• accept formal service of court documents;
• conduct court proceedings;
• agree to vary a court order;
• settle a legal dispute without the client’s express approval; or
• make parental or financial decisions independently of the client.People using a managed mailbox should provide only information that is relevant and reasonably necessary. The same information should not be sent repeatedly or through several channels without a genuine reason.6. Why we use personal informationWe may use personal information to:• respond to enquiries and assess whether we can provide a service;
• enter into and perform a client agreement;
• provide practical, communication and court-support services;
• review, organise and respond to correspondence;
• prepare drafts, summaries and practical documents;
• administer appointments, community services and events;
• manage payments, invoices and accounting;
• protect the safety and welfare of children and adults at risk;
• understand and comply with court orders, bail conditions and communication restrictions;
• maintain accurate client, case and communication records;
• establish, exercise or defend legal rights;
• prevent or investigate fraud, misuse, security incidents or unlawful conduct;
• handle complaints and data-protection requests;
• secure our systems and services;
• meet tax, accounting, company-law and other legal obligations;
• improve our services using appropriately limited information; and
• send marketing where the law permits us to do so.We do not sell personal information.7. Lawful bases for processingWe only process personal information where a lawful basis applies. The basis depends on the information, the person concerned and the purpose of the processing.Contract
• We may process information where this is necessary to take steps at a prospective client’s request, enter into a client agreement or provide the agreed service.Legitimate interests
• We may process information where this is necessary for our legitimate interests, or those of our client or another person, and those interests are not overridden by the individual’s rights. These interests may include operating a safe and effective support service, managing authorised correspondence, keeping accurate records, reducing duplicated communication, protecting clients and children, maintaining security, preventing misuse and establishing or defending rights.Legal obligation
• We may process information where this is necessary to comply with tax, accounting, company-law, court, regulatory, data-protection or other legal obligations.Consent
• We may rely on consent for optional direct marketing, optional non-essential cookies, clearly optional disclosures or other processing where consent is appropriate. Consent may be withdrawn at any time. Withdrawal does not affect processing already carried out lawfully.Vital interests
• In exceptional circumstances, we may process or share information where this is necessary to protect someone’s life or physical safety.We do not rely on consent where a person has no genuine choice or where another lawful basis is more appropriate.8. Special-category informationHealth information and certain other sensitive information receive additional legal protection.Where we process special-category information, we identify both an ordinary lawful basis and an additional condition under data-protection law. Depending on the circumstances, this may include processing necessary for:• the establishment, exercise or defence of legal claims;
• safeguarding children or individuals at risk;
• protecting vital interests where the person is physically or legally incapable of giving consent;
• reasons of substantial public interest recognised by UK law; or
• explicit consent, where this is genuinely appropriate.We limit this processing to what is relevant and reasonably necessary, apply additional access controls and maintain any additional records or policy documents required by law.9. Criminal-offence informationPersonal information about alleged offences, criminal proceedings, convictions, bail conditions or related security measures receives additional legal protection.We process this information only where an ordinary lawful basis applies and where we have official authority or meet an applicable condition under the Data Protection Act 2018. Depending on the circumstances, the condition may relate to legal claims, preventing or detecting unlawful acts, safeguarding children or people at risk, or another condition authorised by law.We do not maintain a general register of criminal convictions or allegations.10. Children’s informationOur family-support work may require us to process information about children. We will:• treat the child’s interests and welfare as an important consideration;
• collect only information reasonably needed for the service or issue;
• avoid using children’s information for unrelated purposes;
• limit access to authorised people;
• avoid direct marketing to children;
• take particular care with health, welfare, educational and safeguarding information; and
• provide age-appropriate privacy information where it is appropriate to communicate directly with a child.Our services are generally commissioned by adults. Children should not submit sensitive case information directly without appropriate adult or professional support unless this is necessary for their protection or legal rights.11. Sharing personal informationWe may share personal information where it is necessary and proportionate with:• our client;
• authorised members of the MX Team;
• contractors working under confidentiality and data-protection obligations;
• the other party or their professional representative where authorised or necessary;
• our solicitors, accountants, insurers and other professional advisers;
• courts, tribunals, Cafcass, social services, schools and healthcare professionals;
• police, safeguarding organisations or another competent authority;
• payment processors, community platforms, website hosts, email providers, cloud-storage providers, security providers and other IT suppliers;
• regulators, including the Information Commissioner; and
• an organisation involved in a genuine business restructure, subject to appropriate safeguards.We do not disclose information merely because someone asks for it. We consider authority, necessity, proportionality, confidentiality, safeguarding, legal restrictions and the rights of other people before sharing. Information may be redacted or limited where appropriate.12. Confidentiality and legal privilegeWe treat client information as confidential, subject to the client agreement, safeguarding responsibilities and legal obligations.Communications with MX are not automatically protected by legal-advice privilege because MX is not a firm of solicitors. Where legal privilege is important, the individual should communicate with a qualified solicitor or barrister.13. Service providers and international transfersWe use third-party service providers for functions such as email, website hosting, community services, payments, cloud storage, security, administration and accounting.Some providers may process or permit access to personal information outside the United Kingdom. Where this amounts to a restricted international transfer, we use a lawful transfer mechanism where required. This may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the European Commission Standard Contractual Clauses or another approved safeguard.Where required, we assess whether the information receives an appropriate level of protection in practice.14. SecurityWe use technical and organisational measures proportionate to the sensitivity of the information we hold. These may include:• controlled access and individual user accounts;
• strong authentication and multifactor authentication where available;
• confidentiality requirements for team members and contractors;
• secure email, cloud-storage and account settings;
• encryption provided by relevant service providers;
• device and account security controls;
• regular access reviews;
• secure backups and data minimisation;
• staff guidance and training; and
• incident and breach-management procedures.No electronic system can be guaranteed to be completely secure. People communicating with MX should avoid using insecure or shared accounts for sensitive information.15. RetentionWe retain personal information only for as long as reasonably necessary for the relevant purpose.Our usual retention periods are:• Enquiries that do not become clients: up to 12 months after the final contact.
• Client and managed-communication files: normally six years after the service ends or the file closes.
• Court, safeguarding and dispute records: while the matter remains active and afterwards for the period reasonably required to protect legal rights or meet legal or safeguarding obligations.
• Financial and tax records: normally six years after the relevant accounting period.
• Community accounts and participation records: while active and normally up to 12 months after closure or inactivity, subject to legitimate recordkeeping needs.
• Complaints and data-rights records: normally six years after closure.
• Marketing records: until consent is withdrawn, an objection is made or the information is no longer useful. We may retain limited suppression information so that a person who has opted out is not contacted again.We may retain information for longer where proceedings or a complaint remain active, a court order requires it, safeguarding concerns remain relevant, litigation is reasonably anticipated, law requires longer retention or deletion would materially prejudice another person’s legal rights. Information may be deleted sooner where