Privacy Policy

ANDREAS V. ZACHARIOU & CO LLC is committed to protecting your privacy and handling your data in an open and transparent manner. This Privacy Notice (the Notice) aims to inform and assure you that we handle your personal information with respect to your rights and in accordance with Regulation (2016/679 (EU) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the Regulation).

This Notice is addressed to all natural persons who already maintain a business relationship with our Company or wish to contract with us or to establish a business relationship i.e. Clients of the Company, Directors, Shareholders and Secretaries of legal entities, authorised signatories, management committee and/or members of another legal entity and/or natural persons who have a business relationship with the Company.

Personal data means any information about you that could identify you directly or indirectly, such as but not limited to your name, ID number, phone number, address or email address.

Processing means any operation or collective steps of operations that is performed on personal data, by automated means or otherwise, including collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

You are kindly requested to study this Privacy Notice carefully as it contains important information on who we are, how and why we collect, store, use and share your personal information, your rights in relation to your personal information and on how to contact us and the supervisory authorities, should the need arise.

1. Who we are:

ANDREAS V. ZACHARIOU & CO LLC is one of the leading law firms in Cyprus, having its seat in the town of Larnaca (Reg. Number: HE224050). As a full-service law firm, we have been assisting clients in litigation, commercial, corporate, conveyance, immigration, banking matters and many other legal fields. We co-operate with third party legal and natural entities/service providers, when necessary, for consultancy, translation, administrative and other services.

ANDREAS V. ZACHARIOU & CO LLC will be acting as the data controller responsible for your personal information processed. We will be responsible and we will act Controllers in relation to all of our affiliated entities and third-party service providers.

You can contact us via one the following methods:
Address: 9 Arch. Makarios Avenue, Lazaros Center, Block A, 1st Floor, Office 105, Larnaca 6017, Cyprus
Telephone No.: +35724818655
Fax No.: +35724626585
Electronic mail: [email protected]

If you have any questions, or want more details about how we collect, process and use your personal data, you can contact the person responsible for compliance with the Regulation at:
9 Arch. Makarios Avenue, Lazaros Center, Block A, 1st Floor, Office 105, Larnaca 6017, Cyprus
Telephone No.: +35724818655
Fax No.: +35724626585
Electronic mail: [email protected]

2. How and when do we collect your personal information:

We may collect personal information from you in the course of our business in one of the following ways:
i. by using our website,
ii. In case you contact us or request information from us
iii. through e-mail correspondence
iv. through direct contact
v. when you engage our legal or other services
vi. as a result of your relationship with one or more of our staff or clients.
vii. from organisation or persons associated with you and your affairs.
viii. from employees of entities companies affiliated with us.
ix. from our associates.
x. from databases and/or sources that are publicly accessible, such as the Land Registry, the Registrar of Companies and the Official Receiver, the press and the Media and companies that introduce you to us.

The collection and processing of your information is made lawfully and in accordance with the obligations placed and stipulations made by the relevant European Regulations and national legislation in force from time to time.

3. What type of information do we collect and why:

The personal data we collect from our clients and/or prospective clients, vary depending on the type of co-operation with the client and the services to be offered and include but without being limited to the following: Name, Surname, Date of birth, City and Country of birth, Identity/Passport Number, address (including proof of address, such as utility bill), Contact Details, such as Phone number and Email address, Bank account details, income, source of income, proof of funds, bank reference, shareholders statement, information about your marital status (including marriage certificate), information about your kids (including their birth certificates), your family tree, criminal record, CV, profession information, nationality and country of residence.

For existing and/or prospective clients of ANDREAS V. ZACHARIOU & CO LLC: We may collect details for the purpose of contacting and corresponding with you, as well as contact details for any organisation that you represent. We may also hold confidential details about any matter on which you choose to instruct us, as well as your bank account, and/or other payment details for the purpose of paying our fees or remitting any payments to or from our client accounts

For suppliers and/or prospective suppliers of ANDREAS V. ZACHARIOU & CO LLC: We may collect, store and use your personal and/or professional contact details for the purpose of contacting and corresponding with you, as well as contact details for any organisation that you represent. We may also hold confidential details about any services that you may supply to us, as well as your bank account and/or other payment details for the purpose of paying your fees.

For contacts of ANDREAS V. ZACHARIOU & CO LLC: We may collect, store, and use your contact details, copies of any e-mail, postal or other correspondence between you and us, and recordings of any voicemails that you choose to leave. We and other members of our firm may also hold details of any contact preferences that you specify, such as requests to subscribe to legal updates that we may circulate from time to time, to receive news about any events we are organizing or participating in, or to receive information about us and the services we provide.

For job applicants at ANDREAS V. ZACHARIOU & CO LLC: We may collect, store and use your contact details, copies of your job application, curriculum vitae and covering letter, as well as any references provided or obtained, for the purposes of processing your application and for general recruitment and selection purposes.

For website visitors of ANDREAS V. ZACHARIOU & CO LLC: We may collect, store and use certain, limited information relating to your use of our website for the purposes of better understanding the types of visitors, who browse our website and improving our website offering. The information we collect about website visitors does not enable any visitor to be individually identified, is processed only in anonymized, aggregated form, and will only be used for website analytics purposes

4. How do we use/process your personal information:

We collect and process personal data in full compliance with the provisions of the European Regulation protecting personal data and the national law implementing the said Regulation.
In general, we might use your personal information, depending on the business relation we have with you for the following purposes:

  • For contact and communication purposes
  • To provide our services to our clients
  • To receive services from our suppliers
  • To collect our fees or costs in connection with other legal enforcement
  • To make payments to our suppliers
  • For recruitment and selection purposes
  • For website analytics purposes

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

4.1 For the performance of a contract (Article 6 (1) (b))

The processing of personal data is necessary in order for us to be able to provide our services to you in accordance with our contract and/or to fulfill your orders and/or to provide you with related services. Moreover, we might need to process your personal data when examining your case or during the negotiations before signing an engagement letter.

The purposes of the processing are adjusted according to the nature of the service provided. (See above)

4.2 For the purposes of the legitimate interests pursued by us or by a third party (Article 6 (1) (f))

Except from the case above, either we or third parties, process your personal data when necessary, unless your fundamental rights and freedoms override the above interests. Please find below some examples:

4.2.1 in the public and/or market research in general, if you have not exercised the right to object;

4.2.2 in court proceedings and/or to claim our legal claims;

4.2.3 in the context of the operation and security of the IT sector of the company;

4.2.4 in the context of preventing and clarifying criminal offences;

4.2.5 for the purpose of improving our services;

4.2.6 to notify you of changes to this policy and changes to any applicable terms and conditions we have a legitimate interest in doing so to maintain our relationship;

4.2.7 to keep our records updated.


4.3 Because you have expressly consented to it (Article 6 (1) (a))

If you expressly consent to a particular way of processing of your personal data, the process will take place under the specific instructions and contents of the consent when given.
Please note that you may at any time withdraw your consent and such revocation thereof will affect. The validity of this revocation will concern the future. Furthermore, it should be noted that the above also applies if you gave us your consent before 25 May 2018.

4.4 For compliance with a legal obligation (Article 6 (1) (e))

We have to comply with various obligations imposed by European and national legislation, such as the obligations arising from the Prevention and Suppression of money Laundering and terrorist financing Law of 2007 (Law 188(I)/2007), the Income Tax Law 2002 (Law 118(I)/2002) and the tax legislation in general under which, in certain cases, we might have to disclose our personal data to the designated authorities.
The legal obligations vary according to the services we provide to you or your status.

5. Who we share your data with:

• Within the Company:

In the course of the Company’s operation, the employees responsible for the performance of our contractual and legal obligations receive the necessary data.
Moreover, we might share your personal data with our affiliated entities and/or third-party service providers, in order to fulfill and execute the services to be offered to you such as translations, for service of documents and other services.

• Outside the Company:

Under Article 28 of the Regulation, we have the right to designate a processor. In such a case, it is likely that the processor will receive your personal data for the above purposes. For example, we might designate as processors IT companies and Cloud Providers, consultancy companies such as accountants, as well as companies providing organisation and filing services.

Furthermore, we are legally obliged, on certain occasions and under certain conditions, to transfer your personal data to various government authorities and/or services, such as the District Office, the Tax Office and VAT Services, the Department of Lands and Surveys, auditors, the Registrar of Companies, Town Halls or City Halls, the Department of Civil Registry and Migration, the Unit for Combating Money Laundering, Banks or Courts of the Republic of Cyprus and arbitrators.

It is possible that we share your personal data with other people/companies/organizations after you have provided us with your express consent for such transfer.

6. How long will your personal data be kept for:

For existing clients

We will hold your personal data during our contractual relationship, including the pre-contractual negotiations stage. All information which relates to one of your matters will be stored in a file dedicated to that matter. We take reasonable steps to ensure that any papers are scanned and stored in the electronic file, then where appropriate they are shredded and disposed of securely or otherwise, they are kept locked. After the termination of our contractual relationship, we will hold your personal data for up to 6 years, or the period required by the applicable Taxation law, or according to the relevant directive of the Commissioner of Personal Data.

Personal data we have obtained solely for the purpose of complying with money-laundering and terrorism-financing laws will be kept in accordance with those laws.
After the expiry of the retention period, we may dispose of your matter files (including your Personal Information) without further notice to you, except for any documents or deeds that we have agreed in writing to hold for safe keeping. Please note that the above period might be extended if for legal or technical reasons we cannot delete the above information.

For prospective clients

We will hold your Personal Data during our negotiations prior to the conclusion of the contract, to the extent that it is necessary. In the event that we will not enter into a contractual or business relationship with you, we will hold your Personal Data for 6 months, or according to the relevant Directive of the Commissioner of Personal Data and/or other applicable law.

7. Transfer of your personal data outside the EEA or to an international organisation:

We do not transfer your personal data outside the EEA or to any international organisation.

8. Your personal data is safe with us:

We have been implementing all appropriate security measures to prevent personal information from being accidentally lost or used or accessed in an unauthorized way.

We limit access to your personal information to those who have a genuine business need to have access to it.

Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality. We enter into strict confidentiality agreements (including data protection obligations) with our third party service providers.

Please inform us if your personal data changes during our relationship.

Our matter files are backed-up to a secure central server.

We take reasonable precautions to reduce the risk of hackers gaining access to our computers.

Our offices are kept locked whenever they are unattended.

Our staff receive regular data protection training.

You and any applicable regulator will be promptly notified of a suspected data security breach where we are legally required to do so.

9. Your rights

Your main rights under the Regulation are the following:

9.1 right to access your personal data (Article 15): meaning you might receive information and /or copy of the personal information we hold free of charge.

9.2 right to rectification (Article 16): you might ask us to correct any mistakes in your information which we hold.

9.3 right to erasure (“right to be forgotten”) (Article 17): you might ask us to erase the personal information concerning you.

However, we reserve the right to deny the erasure, if the processing is necessary for compliance with a legal obligation, for reasons of public interests or for the establishment, exercise or defense of legal claims.

9.4 right to restriction of processing (Article 18): you might require us to restrict our processing of your personal data if you contest the accuracy of your personal data, the lawfulness of the processing, or you have objected to processing (according to article 21, see below) and you wait for our reply whether we have legitimate grounds which override yours.

9.5 right to data portability (Article 20): you have the right to request and receive the personal information concerning you which you have provided to us, in a structured, commonly used and machine-readable format and you have the right to transmit this data to a third party under certain circumstances.

9.6 right to object (Article 21): you have the right to object at any time to processing of personal data concerning you which is based on performance of a task carried out in the public interest or for the purposes of the legitimate interest pursued by us or third parties (article 6 (1) (e) and (f) of the Regulation).

You also have the right to object, at any time, to the processing of personal information for direct marketing or decisions being taken by automated means, which cause legal effects concerning you or similarly significantly affect you.

In case you exercise this right, we shall no longer process your personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claim.

9.7 right to withdraw your consent: you reserve the right to withdraw your consent at any time. However, the withdrawal of the consent does not affect the lawfulness of the processing based on consent before its withdrawal.

If you wish to exercise any of the above rights or to ask any questions or clarifications, please do not hesitate to contact the person responsible for compliance with the Regulation at:

9 Arch. Makarios Avenue, Lazaros Center, Block A, 1st Floor, Office 105, Larnaca 6017, Cyprus
Telephone No.: +35724818655
Fax No.: +35724626585
Electronic mail: [email protected]

If you like to exercise any of those rights, please:

  • Email or write to us
  • Provide us with sufficient information to identify you
  • Indicate clearly the information to which your request relates to.


10. How to complain

We will make every possible effort to resolve any query or concern you raise about our use of your information.
However, the Regulation also gives you right to file a complaint with the supervisory authority, the Commissioner of Personal Data Protection. For more information concerning the process of filing a complaint please visit the website or contact the commissioner via e-mail at [email protected].

11. Are you obliged to provide us with your personal data?

You are required to provide your personal data to the extent that it is necessary to conclude, perform or terminate the contract between us and to fulfill your instructions.

Furthermore, under the applicable Anti-Money Laundering legislation, we are obliged to collect and hold satisfactory evidence of the identity of our clients and sometimes of related persons (including shareholders, beneficial owners, management, directors and officers) such as passport/ID, proof of address and sources of wealth. Sometimes we will need to: (a) see original documents; (b) check the information you provide; (c) use your personal information to check your identity and background through electronic data sources; and (d) ask you for up-to-date evidence of identity.

If you do not provide us with this personal information, or if it is not satisfactory, we may not be able to act, or to continue to act, for you.

We are also under an obligation to report to the regulatory authorities suspicions of money laundering and terrorist financing. This will involve the processing of sensitive information, where applicable, such as details of criminal allegations and/or findings, regulatory action, and related proceedings which are reported in the press and electronic/other data sources.

In case you refuse to give us your personal data, we might not be able to provide our services to you.

12. Automated individual decision-making

As a rule, we do not make automated decisions. If we make use of automated decision-making, you will be properly informed if this is necessary on the basis of the relevant legislation.

13. Is your data used for profiling?

‘Profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, personal preferences, interests, reliability, behaviour, location or movements.

Your personal data shall not be used for profiling.

14. Changes in this privacy notice

This Privacy Notice was published on 1.3.2019.

We may modify or amend this privacy statement from time to time. We will notify you appropriately when we make changes to this privacy statement and we will amend the revision date at the top of this page. We do however encourage you to review this statement periodically so as to be always informed about how we are processing and protecting your personal information.
Please contact us, if you have any questions about this privacy notice or the information, we hold about you at [email protected].