GDPR Policy

This GDPR Policy sets out how Ellinas Law (“we”, “us”, “our”) complies with the EU General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”) and the Cyprus Law Providing for the Protection of Natural Persons with regard to the Processing of Personal Data (Law 125(I)/2018). It applies to all personal data we process about website visitors, enquirers, clients, and other individuals, and complements our Privacy Policy, which focuses on data collected through this website.

Ellinas Law is the data controller responsible for the personal data described in this policy. We are a law firm based in Nicosia, Cyprus, regulated by the Cyprus Bar Association (Law Office Registry Number 1143). Our contact details are at the end of this policy.

We process personal data in accordance with the principles in Article 5 of the GDPR. Personal data must be:

• processed lawfully, fairly, and transparently;
• collected for specified, explicit, and legitimate purposes;
• adequate, relevant, and limited to what is necessary;
• accurate and, where necessary, kept up to date;
• kept no longer than necessary for the purposes for which it is processed;
• processed securely, with protection against unauthorised access, loss, or damage.

As controller, we are accountable for, and able to demonstrate compliance with, these principles.

Depending on your relationship with us, we may process:

• identity and contact details (name, email, phone, address);
• the subject and details of your enquiry or matter;
• onboarding and due-diligence information required under anti-money-laundering rules (such as identity documents and source-of-funds information);
• correspondence and records relating to the services we provide;
• limited technical data (such as browser type and general usage data) when you visit the Site.

Where we handle special categories of data or information relating to criminal matters in the course of a legal engagement, we do so under the additional safeguards permitted for the establishment, exercise, or defence of legal claims and the provision of legal services.

We rely on one or more of the following lawful bases under Article 6 of the GDPR:

• Consent — where you submit an enquiry through our website and ask to be contacted. You may withdraw consent at any time.
• Performance of a contract — where we act for you and process data to deliver our legal services.
• Legal obligation — to comply with anti-money-laundering, tax, accounting, and professional-conduct requirements.
• Legitimate interests — to respond to enquiries, administer and promote our practice, and keep our records and systems secure, where these interests are not overridden by your rights.

We process personal data to:

• respond to enquiries and arrange consultations;
• carry out client onboarding, conflict, and regulatory checks;
• provide and administer the legal services you engage us for;
• meet our legal, regulatory, and professional obligations;
• maintain our records and operate and secure this website.

We do not sell personal data. We share it only with trusted service providers (“processors”) who help us run our practice and this website — for example, our cloud hosting and database providers — each engaged under a written agreement that requires them to protect the data and process it only on our instructions. We also disclose data to courts, regulators, or authorities where required by law or professional regulation.

Where personal data is transferred outside the European Economic Area, we ensure an adequate level of protection through appropriate safeguards under Chapter V of the GDPR — such as an adequacy decision of the European Commission or the Commission’s standard contractual clauses — and we make information about those safeguards available on request.

We keep personal data only for as long as necessary for the purposes for which it was collected. Enquiry data from individuals who do not become clients is deleted or anonymised once it is no longer needed. Client files are retained for the period required by law and our professional obligations — including anti-money-laundering record-keeping — after which they are securely destroyed.

Subject to the conditions and exemptions in the GDPR, you have the right to:

• be informed about how we use your personal data;
• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data erased (the “right to be forgotten”);
• restrict or object to our processing of your data;
• data portability, where the processing is based on consent or contract and carried out by automated means;
• withdraw consent at any time, without affecting the lawfulness of earlier processing.

To exercise any of these rights, contact us using the details below. We will respond without undue delay and within one month of your request, as required by the GDPR. There is normally no charge, although we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive.

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing, and we do not carry out profiling of that kind.

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss, or destruction, and enquiries submitted through this Site are transmitted over an encrypted connection. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Office of the Commissioner for Personal Data Protection within 72 hours where feasible, and will inform affected individuals where the breach is likely to result in a high risk to them.

If you have concerns about how we handle your personal data, please contact us first so we can try to resolve them. You also have the right to lodge a complaint with the supervisory authority in Cyprus — the Office of the Commissioner for Personal Data Protection (Iasonos 1, 1082 Nicosia, commissioner@dataprotection.gov.cy).

We may update this GDPR Policy from time to time to reflect changes in law or our practices. The date below shows when it was last revised; please check back periodically for the current version.