Privacy Policy

M. Anastasopoulou & Co LLC is a private international law firm established in Nicosia, Cyprus. For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR") and the Cypriot Law providing for the Protection of Natural Persons with regard to the Processing of Personal Data (Law 125(I)/2018), the firm acts as controller of the personal data described in this policy.

Questions concerning this policy, or any request concerning your data, may be addressed to the firm through the enquiry page of this website or by writing to our Nicosia office.

We collect only what the work, or your request, requires:

• Enquiry details: your name, contact details, and whatever you choose to tell us about your matter when you write to us through the enquiry page or otherwise.
• Newsletter details: the email address you provide when joining our letters.
• Client and matter data: where an engagement follows, the information necessary to conduct it: identification documents required by law, correspondence, and the documents of the matter itself.
• Technical data: limited server logs (IP address, browser type, pages requested) generated in the ordinary operation of the website.
• Assistant exchanges: if you use the site’s assistant, the questions you put to it and the replies it gives, together with a temporary browser session reference. These are read only by the firm, to understand what visitors ask of the site, and are deleted automatically after ninety days. The assistant is not a channel for confidential matters, and nothing shared with it creates a lawyer-client relationship.

Each use of personal data rests on a legal basis under Article 6 of the GDPR:

• To respond to your enquiry and assess whether we may act: our legitimate interest in conducting a professional practice, and steps taken at your request before a contract.
• To perform an engagement: the performance of our contract with you, and our legal obligations as advocates.
• To satisfy law and regulation, including anti-money-laundering and know-your-client obligations under Cypriot and European law.
• To send our newsletter: your consent, which you may withdraw at any time by following the note in any letter or writing to us.
• To keep the website secure and functioning: our legitimate interest in protecting our systems.

Your data is not sold, rented, or traded. It is disclosed only where the work or the law requires: to members and staff of the firm bound by professional secrecy; to foreign counsel and experts instructed on your matter, under our direction; to carefully chosen service providers who host our systems and deliver our correspondence, bound by contract to confidentiality; and to courts, regulators, and authorities where the law compels it.

Where a matter is protected by legal professional privilege, that protection is not diminished by anything in this policy.

Our systems are hosted within reputable infrastructure providers. Where personal data is transferred outside the European Economic Area, for instance, to foreign counsel on a cross-border matter, we rely on an adequacy decision of the European Commission, standard contractual clauses, or another safeguard recognised by Chapter V of the GDPR.

We keep personal data no longer than its purpose requires. Enquiries that do not lead to an engagement are retained briefly and then removed. Client files are retained for the period required by our professional and statutory obligations in Cyprus, ordinarily six years from the close of a matter, and longer only where the law or the nature of the matter demands it. Newsletter details are kept until you withdraw.

Under the GDPR you may, at any time and without charge:

• Ask what data we hold about you, and receive a copy (access).
• Have inaccurate data corrected (rectification).
• Have data erased where no lawful reason remains to keep it (erasure).
• Restrict or object to certain uses, including direct marketing (restriction and objection).
• Receive data you provided in a portable form (portability).
• Withdraw consent, where consent is the basis, without affecting what was done before.

We would ask that any concern be raised with the firm first; it will be answered with care. You are entitled, in any event, to lodge a complaint with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus, or with the supervisory authority of your habitual residence.

Essential browser storage supports functions such as authentication. Separately, with your permission, we collect first-party website analytics: public page paths, entry referring domains, device and browser categories, and counts of successful enquiries, newsletter subscriptions and assistant interactions. We do not include form answers, message contents, names, email addresses, full referring URLs, query strings or IP addresses in these analytics records.

Optional analytics uses randomly generated browser identifiers, not advertising cookies. The visitor identifier expires after 30 days; visits expire after 30 minutes of inactivity. Event records are scheduled for deletion after 91 days, at the next analytics refresh. Your allow or decline preference is remembered for 180 days. Reports are restricted to authorised CRM users, refreshed daily, and do not track private CRM pages. Technical server logs are separate from these analytics records.

You can decline without affecting use of the website, or withdraw permission using Website analytics preferences below. Withdrawing stops future analytics and removes the identifiers from this browser; it does not automatically remove previously collected records. We respect browser Do Not Track and Global Privacy Control signals. These figures cover consenting visitors only and are not a complete count of everyone visiting the site.

This policy may be revised as the law or the practice evolves. The date of the current version appears at its head; material changes will be reflected on this page.