Who controls your data, and what we do with it
-
Who we are
Kleanthous & Platis LLC is a Cyprus law firm and the controller of the personal data described in this notice.
Company registration number: HE 441973
Address: Florinis 7, Greg Tower, 2nd Floor, Office 202, 1065 Nicosia, Cyprus
General email: office@kleanthousplatis.com
Privacy enquiries: office@kleanthousplatis.com -
What this notice covers
This notice explains how we collect and use personal data when you visit our website, contact us, ask us to consider a matter, become a client, deal with us in connection with a client's matter, apply for work or otherwise interact with the firm.
Legal professional privilege and our professional duties may restrict what information we can disclose in response to a request.
-
Personal data we collect
Depending on the circumstances, we may collect:
- Identity and contact details, including name, address, email address and telephone number.
- Information about a proposed or existing legal matter, including the parties, facts, documents, correspondence, deadlines and financial value.
- Identification, source of funds and other information required for conflict, client due diligence, anti-money laundering and sanctions checks.
- Financial information, including billing and payment details.
- Employment, family, property, corporate or other information relevant to the work we are asked to undertake.
- Special category data, criminal offence data and information about children where it is relevant and lawful to process it for a legal matter.
- Recruitment information, including a curriculum vitae, qualifications, work history and references.
- Website and device information, including IP address, browser type and pages viewed.
- Records of communications with us.
Please do not send extensive confidential or highly sensitive documents before we confirm that we are able to consider the matter.
-
How we obtain personal data
We may receive personal data directly from you; from a client, employer, company, authorised representative or another person involved in a matter; from courts, public authorities, counterparties, witnesses, experts and professional advisers; from public registers and other lawful sources; through our website and communications; and from service providers that assist with identity checks, technology, security, billing or administration.
-
Why we use personal data
We use personal data where necessary to take steps at your request before entering into a contract, to perform our contract with a client, to comply with legal and regulatory duties, for the establishment, exercise or defence of legal claims, and for our legitimate interests in operating and protecting the firm, managing matters, preventing fraud, maintaining records and responding to enquiries.
We may process information to protect vital interests where necessary. We rely on consent where consent is the appropriate legal basis. Consent may be withdrawn at any time without affecting earlier lawful processing.
-
Enquiries and conflict checks
Sending an enquiry does not create a lawyer-client relationship. We use the information provided to consider the enquiry, identify relevant parties, conduct conflict and regulatory checks and decide whether we can accept instructions.
We may retain a limited record of an enquiry and the parties involved even if we do not accept the matter. This helps us comply with professional duties and identify future conflicts.
-
Who may receive personal data
Where necessary and lawful, personal data may be provided to courts, tribunals, regulators, law enforcement bodies and public authorities; counterparties and their lawyers; barristers, foreign lawyers, experts, translators, process servers, notaries and other professional advisers; banks, insurers, auditors, accountants and payment providers; technology, hosting, cybersecurity, communications and administrative providers; identity verification and screening providers; a successor to all or part of the firm's practice; and other recipients where you instruct us or the law permits or requires disclosure.
The website is hosted by Vercel Inc. and enquiries submitted through the contact form are delivered by Resend, an email delivery provider. Both act as processors on the firm's instructions, and both may process personal data in the United States.
If you subscribe to our updates, the email address you enter and your language preference are stored with Resend and used only to send you the updates you asked for. Every message carries an unsubscribe link, and unsubscribing removes you from the list. Nothing else is collected through the subscription form.
We do not sell personal data.
-
International transfers
Some recipients or technology providers may process personal data outside the European Economic Area. Where this occurs, we use a lawful transfer mechanism, such as an adequacy decision, approved contractual safeguards or another mechanism permitted by the GDPR. Information about an applicable safeguard may be requested using the contact details above, subject to confidentiality and legal restrictions.
-
Retention
We keep personal data only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, regulatory, professional, accounting and insurance requirements.
Retention periods vary according to the type of record and matter. Client files are normally retained for the period stated in the engagement arrangements or the firm's retention policy. Records connected with conflicts, anti-money laundering checks, complaints, claims or legal holds may be retained for longer where necessary.
-
Security
We use technical and organisational measures intended to protect personal data against accidental or unlawful loss, misuse, alteration, disclosure or access. Access is limited to people who need the information for their work and who are subject to confidentiality obligations.
No method of electronic transmission or storage is completely secure. Please contact us before sending particularly sensitive material so that an appropriate method can be agreed.
-
Your rights
The applicable law is the General Data Protection Regulation (EU) 2016/679, given effect in Cyprus by the Protection of Natural Persons with regard to the Processing of Personal Data Law 125(I)/2018. Subject to the conditions and exemptions in that law, you may have the right to request access to your personal data under Article 15, correction under Article 16, deletion under Article 17, restriction of processing under Article 18, portability of the data you provided under Article 20, and to object under Article 21 to processing based on legitimate interests. Where processing rests on consent, Article 7(3) lets you withdraw it at any time without affecting the lawfulness of what was done before. Article 77 gives you the right to lodge a complaint with a supervisory authority, which in Cyprus is the Office of the Commissioner for Personal Data Protection.
To exercise a right, contact office@kleanthousplatis.com. We may request information needed to confirm identity and understand the request. Rights may be limited where disclosure would affect another person's rights, legal professional privilege, confidentiality, legal claims or a legal or professional obligation.
-
Cookies and similar technologies
This website does not use cookies for analytics, advertising or tracking, and it does not build a profile of any visitor. For that reason no cookie banner is shown and there are no cookie settings to manage.
No content on this website is loaded from a third party. Typefaces, stylesheets, scripts and images are all served from the website itself, so opening a page does not disclose a visitor's IP address to anyone other than the host named above. There are no embedded maps, videos, social media widgets or advertising networks.
The website uses a privacy-preserving analytics service provided by Vercel Inc., which is also the firm's website host. It records the pages viewed, the page or search a visitor arrived from, and general information about the device, browser, operating system and country. It does not set cookies and does not create a lasting identifier. Visitors are counted using a value derived from the request that is reset each day, so the same visitor cannot be recognised on a later day or on any other website. The firm does not attempt to link that information to any individual, and it is not capable of identifying anyone.
The existing Vercel measurement also counts a few things a visitor does on a page: that a page was read to a quarter, a half or the end; that a telephone, email or WhatsApp link was tapped; that the contact form or a calculator was started; that an enquiry or a subscription was sent; that a visitor arrived from an AI assistant; and which starting point was chosen on the where to start page. Each count carries the page address and nothing the visitor typed. For the length of a visit the browser also keeps, in session storage that is cleared when the tab is closed, the page a visitor arrived on and the site or search that sent them. If an enquiry is sent, that is included in it so the office can tell which page produced the enquiry.
We also use PostHog to count page views, contact-link clicks, form starts, successful enquiry submissions, calculator use and reading depth. Our server sends only the published page path, a broad referral category, screen-size category and permitted event details to PostHog's EU collection endpoint. A random identifier exists only in the memory of the open page and changes on navigation or reload; it is not saved in cookies or browser storage. This measurement does not send names, contact details, form text, search terms, URL parameters or visitor IP addresses to PostHog. It does not create person profiles or record screens, and it respects browser Do Not Track and Global Privacy Control signals.
We also count whether an enquiry link was visible or selected, whether a calculator or enquiry was started, and whether submission failed. The server separately records acceptance of the office email by the email provider; this does not mean that a lawyer has read it or accepted instructions. A coarse source category and published entry-page path may be kept in session storage for attribution; no visitor identifier is stored there. Only pre-approved campaign labels are included. An optional browser preference excludes office testing from measurement and remains in local storage until removed. Names, contact details, enquiry references, messages and calculator answers are not sent to PostHog.
Where a strictly necessary technology is used for the security or the basic operation of a page, it is used for that purpose alone and requires no consent.
-
Other websites and services
The website may link to third-party websites or services. Their privacy practices are governed by their own notices. We are not responsible for third-party content or privacy practices.
-
Changes to this notice
We may update this notice to reflect changes in the law, our work or the website. The version published on this page is the version that applies.
-
Contact and complaints
For questions or requests about personal data, contact Kleanthous & Platis LLC at office@kleanthousplatis.com or at Florinis 7, Greg Tower, 2nd Floor, Office 202, 1065 Nicosia, Cyprus.
You may also complain to the Office of the Commissioner for Personal Data Protection in Cyprus. We would appreciate the opportunity to consider your concern first.