PERSONAL DATA PROCESSING POLICY

1. About Us 

Stylianos N. Christoforou & Associates LLC (hereinafter referred to as “SNC” or “Firm” or “we” or “us”) having its registered office at Evagorou 27, Irene Tower, Nicosia. We are a prominent Cyprus-based law firm (Registration Number: ΗΕ235029). Our firm is known for offering comprehensive commercial legal services, covering a wide spectrum of legal, financial, and taxation matters. Our operations are structured into various departments, each specializing in specific areas of expertise. 
This text aims at providing you with intelligible, transparent and direct information about the processing of your personal data that are collected and processed by us in the context of fulfilling our obligations to you, as our Firm is bound by the applicable legislation to secure and safeguard your right to protection against the illegal processing of personal data and your right to privacy, as well as to protect the personal data maintained by us and are of concern to you.        
This Policy is addressed to natural persons, who are current or potential clients of the Firm, employees, third persons and associates. By providing your personal information, you understand that we will use such information in the manner analytically explained in this Policy. 

When we say that your personal data are subject to “processing”, this term includes every action undertaken in relation to these data, such as the collection, registration, organization, structure, storage, adaptation, variation, recovery, search for information, usage, transmission, diffusion, disposal, correlation, combination, limitation, erasure and destruction.  

In case you require more information on how we process your personal data, you may apply to the Data Protection Officer of the Firm at the address of our registered office, by emailing at info@snclaw.eu

2. Personal Data Processing Principles 

In collecting personal data we are bound by the General Data Protection Regulation and, applying the necessary organizational and technical measures, we process your personal data, following the based on the following the principles provided by the GDPR as follows: 
•    they shall be subjected to legitimate and lawful processing in a transparent manner, 
•    they shall be collected for specified, express and legitimate purposes and shall not be subjected to further processing in any way incompatible with the purposes for which these data are collected by the Firm, 
•    only the appropriate and relevant data shall be collected, limited to the necessary purpose for which they have been collected, 
•    they shall be accurate and updated as necessary, 
•    they shall be retained only for as long as required and for the purposes for which they have been collected,
•    they shall be subjected to processing in a manner guaranteeing their required security against non-authorised or unlawful processing and accidental loss, destruction or wear, among other things, through the use of suitable techniques and or organizational measures,    
•    when we transmit your personal data whether to another country or to a person who carries out the processing on behalf of the Firm, the necessary measures shall be taken by us for the protection of your personal data, as for example through the conclusion of specialized contracts for data processing.

3. How we Collect your Personal Data 

The Firm will be acting as the Data Controller responsible of the personal data collected. More often the collection of personal data is performed directly by you during the provision of our business.

More analytically, personal data may be collected: 

 (a) Straight from you (directly or indirectly): 
•    In the context of requesting to receive our services 
•    Via a hand-written curriculum vitae
•    In the context of submitting an inquiry or claim on your part
•    On line by the client or through our website 
•    On line by the client when he chooses to make a payment online 
•    Personal details submission form  
•    By personal contact directly with the natural persons 

(b) From various other/ “third” sources (indicatively): 
•    Through the provision of our services and during the course of our business for cases you are a party in.
•    Through databases and/or sources that are publicly accessible, such as the Land Registry, the Registrar of Companies and the Official Receiver.
•    Through public sources i.e. the press and the Media.
•    Through public authorities.
•    Through banks and credit management companies.
•    Through your previous employers you have as reference in your CV/Reference Letter.
•    Through specialists and experts.
•    Through companies that introduce you to us.
•    By telephone, through the Police, fax, websites, Photographs.
•    Through an electronic email message. 
•    Cookies
•    Through our business partners. We do not control, supervise, or respond for how the third parties providing your information process your personal data, and any information request regarding the disclosure of your personal information to us should be directed to such third parties.

4. What kinds of Personal Data are Processed by us?  

For all of the aforementioned reasons, our Firm collects and processes personal data depending on the service that will be provided for you as follows: 

•    Contact and Biographical details (such as full name, date of birth, identity/passport number, home address, email address, utility bill, telephone, occupation, Social Insurance Number, nationality and country if residence etc.) 
•    Bank account, details, income, penal record, financial standing, social insurance number, IBAN, source of income, proof of funds, bank reference.
•    Academic Certificates, degree or/and post degree certificates, seminar attendance certificates, performance, grading, previous salaries, CV, profession.
•    Shareholders statement, information about your marital status (including marriage certificate), information about your kids (including their birth certificates), your family tree, heirs, criminal record.
•    Leaves and absence certificates, employment agreements.
•    Title deeds, third party signatures, guarantors’ data.

5. How we use your Personal Data 

After they have been collected by us, your personal data may be subject to processing in our Firm, as previously mentioned, by our employees, associates, in order to provide you with our service. 
We use your personal data for the following purposes:
•    To communicate with you
•    For the provision of services. 
•    To improve the quality of products and of our services 

•    For promotional marketing and advertising activities. We may undertake the conduct of promotional activities in accordance with your preferences and if required, upon your consent. 
•    For the compliance of our Firm with the applicable laws and statutory obligations, European Union directives and guidelines, court decisions and other legal processes, and in order to respond to requests by public and state authorities, as stipulated in Cypriot and European legislation. 
•    For the prevention, detection and investigation of crimes, including fraud and the legalisation of the proceeds from illegal activities, as well as the appraisal and management of other trading risks. 

•    To enforce and defend our legitimate rights and to protect our business activities, including those of our business associates, and to safeguard our rights, individual privacy, security or property assets, as well as the rights of our business associates, yours and those of other persons’ or third persons’; for the purpose of imposing our terms and conditions and pursuing all available recovery measures and containing our damages. 

6. Sharing Your Personal Data 

In each case arising from our relationship, the employee responsible for the service to be provided receives the necessary data. 

It might be necessary to share your personal data with our associates so that we could provide for you the required service, among others with IT companies, cloud providers, evaluator, government authorities, lawyers, banks, insurance companies, the Registrar of Companies and Official Receiver, the Social Insurance Department, Tax Department, Human Resources Development Authority, seminar/training centers organizers, debt collection companies, credit management companies. auditors, damage evaluators – experts, authorized representatives, Courts of the Republic of Cyprus, arbitrators, mediators. 
In no case, however, are we going to share your personal data for processing for purposes contrary to those described in this Policy without your prior notification. 
In each transmission to third parties every measure shall be taken beforehand so that only the necessary data shall be transmitted for the implementation of the contract, along with the effective requirements for their legitimate and lawful processing; moreover, the organizations to which the data are being transmitted shall undertake a written commitment that they shall on their part comply with the provisions of the General Data Protection Regulation. Exempts are those cases in which the communication of the data is effected due to some legal or statutory obligation.   

In cases where it is necessary to communicate your personal data to countries outside the European Union, which do not offer adequate guarantees for the protection of your personal data, our Firm shall be obliged and hereby undertakes the responsibility to conclude contractual clauses between our Firm and the Firm to which the data are communicated, in order to safeguard the information transmitted. 

Business Transfers
If we undertake or are involved in any merger, acquisition, reorganization, sale of assets, bankruptcy or insolvency event, then we may transfer or share some or all our assets, including your personal information. In this event, we will notify you before your personal information is transferred and becomes subject to a different privacy policy.

7. Retention Period for your Personal Data 

Our Firm shall retain your personal data in its records only for the duration required for the fulfillment of our service to you, unless legal or statutory obligations provide otherwise. This also applies to those cases where our agreement has for any reason been interrupted. 
Due to harmonization with the Regulation, we have determined the time periods for the retention of your personal data, depending on the processing to which they are being subjected. The parameters that have been taken into consideration for the determination of the time periods are your better service, our operational needs, our legal obligations and the safeguarding of our legal interests. 
In order to be accurately informed on the retention periods, please contact the Data Protection Officer of our Firm info@snclaw.eu

8. What are your rights? 

The General Data Protection Regulation defines your rights in regard to your personal data. On account of this, our Firm has developed a mechanism for the satisfaction of requests concerning your personal data, as follows:  

I.    Right to access: You have a right to access your data maintained by us and you may at any time obtain a copy thereof provided we possess them in electronic form. 

II.    Right to rectification: You have a right to access and rectify your personal details. You may at any stage of our relationship check and update your personal data, always presenting the necessary documentation and requesting the rectification or completion of inaccurate information.

III.    Right to be forgotten: You have the right to ask for the erasure of the whole or part of the data that concern you. We would like to underline however that our Firm shall be obliged to erase only those personal data which can be erased as per our data erasure policy. 

IV.    Right to restriction: You hold the right to ask for the processing of your personal data to be restricted, even when the accuracy of the data is disputed or furthermore when the data are no longer useful to our Firm but you request their retention due to legal claims.  

V.    Right to object: You may at any time whatsoever raise objections about the processing of your personal data. In case you make use of this right, the processing shall immediately cease, unless the Firm can prove the existence of legal interest or the need to use the data in support of a legal/judicial case.  

VI.    Right to data portability: You have the right to portability, that is, to transfer your personal data to another organization in a legible and commonly used form. The said data shall be erased as specified in our erasure policy. 
VII.    Right to recall consent: You have the right any time to withdraw your consent to the processing of your personal data, without however affecting the legality on which our policy was based prior to your withdrawal. We would like to inform you that the recall of your consent may possibly lead to the termination of the relevant services.
VIII.    Right to launch complaint: You have the right to launch a complaint with the Commissioner for the Protection of Personal Data, regarding the processing of your personal data. 

If in filing your complaint you feel that you have been wronged by us or if you have any doubts about the outcome of your request, you may submit it in writing to the Commissioner for the Protection of Personal Data at the below address:  

Office of the Commissioner for the Protection of Personal Data
Iasonos 1, 2nd Floor 
1082 Nicosia 
P.O. Box 23378 
1682 Nicosia 
Τel.: 22818456 Fax No.: 22304565 
email: commissioner@dataprotection.gov.cy 

In order to exercise your rights as above or in the case where you require more information concerning your rights, you may communicate with the Data Protection Officer of our Firm, through the email address info@snclaw.eu

9. Changes to our Policy 

Changes in the Legislation or technological developments impose corresponding modifications on our part. 
You are kindly asked to keep apace with our Policy, which may at any time change in order to adapt to new developments and facts.  
Our reviewed policy shall be posted on our website at the address www.snclaw.eu
Finally, you may ask to be supplied with a copy of the most recent version of the Policy in printed form.
Nicosia, November 2023