Last updated: 19 September 2026
Who is responsible for your data
The data controller is Charalampos Dimitriou, advocate, Vasileos Konstantinou 12, Ria Court 7, Office 101, 6030 Larnaca, Cyprus. Email: charalampos@dimitrioulegal.com. Telephone: +357 97 890698.
What I collect and why
When you submit an enquiry: your name, email address, telephone number, the service you selected, the type of matter, the name of the other party involved, your deadline, and your description of what you need.
The name of the other party is collected specifically so that I can carry out a conflict of interest check. This is a professional obligation, and I cannot accept a matter without it.
When I accept you as a client: identification documents, proof of address, and where applicable information about the source of your funds, as required by anti-money-laundering law; together with everything contained in the documents and correspondence relating to your matter.
When you visit this website: see the Cookie Policy.
Legal basis for processing
| Purpose | Legal basis |
|---|---|
| Responding to your enquiry | Steps at your request prior to entering a contract (Art. 6(1)(b) GDPR) |
| Conflict of interest checks | Legal obligation and legitimate interests (Art. 6(1)(c) and (f)) |
| Client due diligence and AML checks | Legal obligation (Art. 6(1)(c)) |
| Providing legal services | Performance of a contract (Art. 6(1)(b)) |
| Establishing, exercising or defending legal claims | Legitimate interests (Art. 6(1)(f)) |
| Records required by law and Bar rules | Legal obligation (Art. 6(1)(c)) |
The tick box on the enquiry form confirms that you have read this policy. It is not the legal basis for anything I do with your information — that is set out in the table above. Withdrawing it would not oblige me to delete records I am required to keep.
Where your matter involves special category data, or data relating to criminal convictions, I process it because it is necessary for the establishment, exercise or defence of legal claims (Art. 9(2)(f) GDPR).
Who I share it with
I do not sell your data and I do not use it for marketing.
I may share it with courts, tribunals and public registries where your matter requires it; counsel or experts instructed on your matter, with your knowledge; the authorities where I am obliged to report under anti-money-laundering law; my professional indemnity insurers and my own legal advisers where necessary; and the service providers listed below, who process data on my behalf under contract.
- Automattic Inc. (WordPress.com and Jetpack) — website hosting and enquiry form submissions
- Google Ireland Limited (Google Workspace) — email, calendar and file storage
- CookieYes Limited — cookie consent banner and record of consent choices
The other party’s information
When you submit an enquiry, I ask for the name of the other party involved. I need it to check that I am not already acting for them or against them.
That person has not given me their information and, in most cases, will not know I hold it. Data protection law normally requires me to tell them. It also recognises an exception where the information is covered by an obligation of professional secrecy, which is the case here: telling them would reveal that you have sought legal advice, which I am bound to keep confidential. I therefore rely on Article 14(5)(d) of the GDPR and do not notify them.
I keep the name only for the conflict check. If the matter does not proceed, it is deleted with the rest of the enquiry after 12 months.
International transfers
Some service providers are located outside the European Economic Area. Where data is transferred outside the EEA, it is protected by an adequacy decision of the European Commission or by Standard Contractual Clauses approved by the Commission.
How long I keep it
- Enquiries that do not become matters: 12 months, then deleted.
- Client matter files and correspondence: 6 years from the end of the matter.
- Identification and due diligence records: 5 years from the end of our business relationship, as required by the anti-money-laundering law.
- Accounting records: 6 years, as required by tax law.
Where the law prescribes a minimum retention period, I keep records for at least that period. I do not keep personal data for longer than is necessary for the purposes described above.
Your rights
You have the right to access your data; to have inaccurate data corrected; to have data erased; to restrict or object to processing; to data portability; and to withdraw consent where processing is based on consent.
These rights are limited where I am under a professional or statutory duty. I cannot erase records I am obliged to keep, and I cannot disclose information that would breach my duty of confidentiality to another client or prejudice an anti-money-laundering report.
To exercise any right, email charalampos@dimitrioulegal.com. I will respond within one month.
Complaints
If you believe your data has been mishandled, please tell me first. You also have the right to complain to the Office of the Commissioner for Personal Data Protection, the supervisory authority for data protection in the Republic of Cyprus.
Automated decision-making
I do not use automated decision-making or profiling.