1. Who We Are
Y. Habari & Co. LLC is a law firm registered in Cyprus (the "Firm", "we", "us"). Our registered office is at 31 Christodoulou Sozou Street, Hermes Tower, 4th Floor, Office 401, 1095 Nicosia, Cyprus.
We are the data controller in respect of the personal data described in this policy. This policy applies to all personal data collected through our website at www.yhabarillc.com and through enquiries made to the Firm.
2. Data We Collect
We collect personal data in the following circumstances:
- Contact form submissions — when you submit an enquiry via our website, we collect your name, email address, telephone number, and the content of your message.
- Direct communications — when you contact us by email, telephone, or WhatsApp, we collect the information you provide in that communication.
- Client engagements — when you instruct us as a client, we collect additional personal and financial information as required by law (including KYC and AML obligations).
We do not use cookies for tracking or advertising purposes. Our website fonts are served from our own server. Our contact map (Google Maps) is only loaded when you choose to activate it, at which point Google's own privacy policy applies.
3. How We Use Your Data
We use the personal data we collect for the following purposes:
- To respond to your enquiry and communicate with you about your matter
- To provide legal services to you as a client
- To comply with our legal and regulatory obligations, including AML, KYC, and Cyprus Bar Association requirements
- To maintain records of our professional engagements as required by law
- To send you relevant legal updates or publications, where you have consented to receive them
We do not sell, rent, or trade your personal data to third parties for marketing purposes.
4. Legal Basis for Processing
We process your personal data on the following legal bases under GDPR:
- Contract — processing is necessary to perform our legal services agreement with you or to take steps at your request prior to entering into such an agreement.
- Legal obligation — processing is necessary to comply with our obligations under Cyprus law, EU law, and professional regulations including AML and KYC requirements.
- Legitimate interests — processing is necessary for our legitimate interest in responding to enquiries and managing our business, where those interests are not overridden by your rights.
- Consent — where we send you legal publications or updates, we do so on the basis of your consent, which you may withdraw at any time.
5. Third Parties
Your personal data may be shared with the following categories of third parties:
- Web3Forms — our contact form submissions are processed by Web3Forms (web3forms.com), which transmits form data to our email. Web3Forms processes data in accordance with its own privacy policy.
- Professional counterparties — in the course of providing legal services, we may share relevant information with courts, government authorities, registries, banks, or counterparties as required by your matter.
- Regulatory authorities — we may be required to disclose information to the Cyprus Bar Association, the Unit for Combating Money Laundering (MOKAS), or other competent authorities as required by law.
- Google Maps — if you choose to activate the map on our Contact page, your browser will connect to Google's servers. Google's privacy policy applies to that interaction.
We do not transfer your personal data outside the European Economic Area except as required for the provision of our services and subject to appropriate safeguards.
6. Data Retention
We retain personal data for as long as necessary for the purposes set out in this policy, and in any event for no longer than required by applicable law.
- Enquiries that do not result in an engagement — up to 12 months
- Client matter files — a minimum of 7 years from the close of the matter, in accordance with Cyprus Bar Association guidelines and AML regulations
- Financial and accounting records — 7 years as required by Cyprus tax law
7. Your Rights
Under GDPR, you have the following rights in relation to your personal data:
- Right of access — to obtain a copy of the personal data we hold about you
- Right to rectification — to correct inaccurate or incomplete data
- Right to erasure — to request deletion of your data, subject to our legal obligations
- Right to restriction — to restrict processing of your data in certain circumstances
- Right to portability — to receive your data in a structured, machine-readable format
- Right to object — to object to processing based on legitimate interests
- Right to withdraw consent — where processing is based on consent, to withdraw that consent at any time
To exercise any of these rights, please contact us at info@yhabarillc.com. We will respond within 30 days. You also have the right to lodge a complaint with the Cyprus Commissioner for Personal Data Protection at www.dataprotection.gov.cy.
8. Security
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction. All data transmitted via our contact form is encrypted in transit. Access to client files is restricted to authorised personnel only.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, you directly, in accordance with our obligations under GDPR.