Privacy Policy
THIS is the PRIVACY POLICY of Nicoletta Kouvara & Partners LLC using the brand and logo of APTUS LEGAL, on how it collects, processes and shares the personal information you provide to us and/or which we otherwise collect in the course of our business, including via our websites www.aptuslegal.com or www.kouvarapartners.com (each the "Website"), email communications, digital platforms and any other applications (jointly referred to as the “Technology Tools”).
This Privacy Policy is effective from 3rd November 2021. We may change this Privacy Policy at any time, and if we do so, we will post the changes to this page, as well as, the date on which such changes come into effect.
Our Privacy Policy below sets out in detail how we process your personal data, and we encourage and recommend that you read it in full. Below we will also provide you with a brief overview of how and why we process your personal data.
1. Introduction
1.1. This Privacy Policy sets out the way in which Nicoletta Kouvara & Partners LLC, a lawyers legal liability company incorporated and registered in Cyprus with registration number HE427458, using the brand and logo of APTUS LEGAL, and any of its affiliated entities through which it carries out its business ("we" or "us" or “our”), collects and processes Personal Information (as defined in paragraph 2.1 below). We are authorized and regulated in Cyprus by the Cyprus Legal Council. Any reference in this Privacy Policy or Website to a “partner” means a partner, member, consultant or employee with equivalent standing and qualifications in Nicoletta Kouvara & Partners LLC.
1.2. As an independent law firm, which determines the purposes for which we process personal information, we will usually be the data controller in relation to that processing.
1.3. Should you have any questions about this privacy policy or our processing of your personal information, please contact privacy@aptuslegal.com . Our postal address is P.O.Box 25237, Nicosia, 1403, Cyprus.
1.4. By using our Services, you acknowledge that both we, as well as any of our partners or subcontractors will process your Personal Information in accordance with this Privacy Policy, including for the purposes set out in paragraph 5 below. If you do not wish to provide your Personal Information on the basis set out in this Privacy Policy, you should not enter the relevant information on the Website, or otherwise provide us with your Personal Information. However, if you do not provide your Personal Information, you may not be able to use our Services.
1.5. As a law firm, our intended audience is adults, and so we do not knowingly collect data about children.
2. The Personal Information we collect, or you provide to us
2.1. As part of operating the Technological Tools, we collect your Personal Information. We may collect, use and process the following personal information (the “Personal Information”):
2.1.1 identity, contact and background information such as your full name, address, title, telephone number, email address, gender, business and personal, biographical and background information, information about your employer or business and/or information about your employees and officers, as relevant and copies of documents evidencing such information;
2.1.2. financial information, including source of and net wealth, assets held, source of funds and bank account details;
2.1.3. technical information, such as the number and frequency of visits you make to our website, your geographic location, internet protocol (IP) address, your operating system and browser type and the search terms you use, which we receive via our technology tools (the “Technical Data”);
2.1.4. profile data which includes your username, passwords, interests, preferences and feedback;
2.1.5. usage data which includes information about how you use our website and services; and
2.1.6. communication and marketing data, which includes information such as your marketing; preferences and your communication preferences.
2.2. We may collect, or you provide, your personal information to us:
2.2.1. when signing up for services and/or to receive information via our technology tools;
2.2.2. when you give us your identity and contact data by filing in forms or by corresponding with us by email or otherwise, including personal data you provide when you (a) request our Services; (b) subscribe to our Services or publications; (c) request marketing to be sent to you, (d) give us your feedback; or (e) apply for a position with the firm;
2.2.3. in connection with our provision of legal services:
(a) if you are our client, you or your intermediary may provide us with personal information about you and others and we may collect information about you and others, including your personnel, from other public and non-public sources, as necessary for our provision of legal services including carrying out our client/matter onboarding procedures;
(b) if you are not a client, we may collect or be provided with your personal information because you are involved with one or more of our clients’ matters
2.2.4. in connection with your provision of services to us if you are our supplier;
2.2.5. in connection with a recruitment application.
2.2.6. As you interact with our Website, we may automatically collect Technical Data about your device, browsing actions, and patterns. We collect this personal data by using cookies and other similar technologies. Our Website is hosted on the Squarespace platform. Squarespace may use cookies which are necessary for the proper operation of their system and to track the usage of this Website in order to help us understand how the site is being used – and ultimately provide an improved user experience. Please refer to our Cookies Policy. You can read the Squarespace privacy policy here.
2.2.7. We may receive personal data about you from various third parties and public sources such as Technical Data from the following parties:
(a) analytics providers; and
(b) social media pages such as our Firm’s LinkedIn account (https://www.linkedin.com/company/aptuslegal/) or Aptus Legal Twitter account (https://twitter.com/AptusLegal ).
2.3. We may engage third party service providers such as anti-money laundering or criminal financing compliance and data check companies, use information:
2.3.1. to comply with our anti-money laundering regulatory obligations and in application of recognized Sanction list, PEPs lists and specifically designated nationals (SDN); and
2.3.2. to verify your identity by registering and remembering your device information (such as the model, operating system, browser version and IP address), which is used to confirm device identification; and
2.3.3. to verify your identity and the background information you share with us.
3. How we use your Personal Information
In accordance with data protection laws, we will only process your Personal Information where we have a lawful basis for doing so. In respect of your Personal Information, these bases are: (a) where it is necessary to provide services to you under the performance of the contract we have with you; (b) where we are required to do so in accordance with legal or regulatory obligations; (c) where you have given your consent; and, (d) where it is in our legitimate interests to process your Personal Information, provided that none of these prejudice your own rights, freedoms and interests, (e) where it is necessary for Protecting the Vital Interests of a natural person, (vi) where it is necessary to perform a task carried out in the Public Interest or exercise of official authority of the organization.
4. Why we process your Personal Information and legal grounds for processing your Personal Information
4.1. We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:
4.1.1. Where we need to perform the contract we are about to enter into or have entered into with you, but the contract may alternatively involve your provision of services to us if you are a supplier;
4.1.2. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests;
4.1.3. Where we need to comply with a legal or regulatory obligation.
4.2. Generally, we do not rely on consent as a legal basis for processing your personal data other than in relation to sending third party direct marketing communications to you via email or text message. You have the right to withdraw consent to marketing at any time by contacting us.
4.3. Please find below a list of the "Purposes/Activities" for which we (including any of our partners, agents, sub-contractors and/or employees) process your Personal Information, and the lawful basis on which we carry out such processing:
o Purpose/Activity: To set-up, administer and manage your dossier and records
Lawful Basis for Processing: Necessary for the performance of a contract
o Purpose/Activity: To notify you about updates to our Website and Services;
Lawful Basis for Processing: Necessary for the performance of a contract
o Purpose/Activity: To provide legal, trustee and trust administration services to our relevant clients, which, if you are not a client, may involve our handling your personal information on behalf of our clients; we may disclose personal information to third parties if reasonably necessary in connection with our provision of legal and other services;
Lawful Basis for Processing: Necessary for the performance of a contract and necessary to comply with a legal obligation
o Purpose/Activity: To comply with our legal, regulatory and risk management (including anti-money laundering crimes, data protection, conflicts, security and information security, complaints handling and insurer notification) obligations; our client/matter inception procedures may involve our processing copies of your or your personnel’s identity documents (e.g. passport copies) and other background information
Lawful Basis for Processing: Necessary for the performance of a contract and necessary to comply with a legal obligation
o Purpose/Activity: To manage and administer our relationships with our clients, their personnel and intermediaries and our other business, supplier and professional contacts;
Lawful Basis for Processing: Necessary for the performance of a contract
o Purpose/Activity: To establish, exercise or defend our legal rights and/or for the purpose of legal proceedings;
Lawful Basis for Processing: Necessary for the performance of a contract
o Purpose/Activity: To receive and respond to your communications and requests
Lawful Basis for Processing: Necessary for the performance of a contract where such communication relates specifically to our Services, otherwise consent
o Purpose/Activity: To prepare statistics relating to the use of our Website and Services by you and other customers
Lawful Basis for Processing: Legitimate interests so we can understand the use of, and therefore improve, our Website, other Technology Tools and Services
o Purpose/Activity: To provide you with information about, and support for, our Services, including changes to our Services, technical updates for the Technology Tools and changes to the terms & conditions of our contract (including this Privacy Policy)
Lawful Basis for Processing: Necessary for the performance of a contact and necessary to comply with a legal or regulatory obligation
o Purpose/Activity: For recruitment purposes
Lawful Basis for Processing: Necessary for the performance of a contract or in the absence of that consent
o Purpose/Activity: To keep you informed of our Firm’s news and offers, relating to our Services, including sending you and your personnel newsletters, legal updates, marketing communications and other information that may be of interest and inviting you to events provided that you don't "opt-out" from this option
Lawful Basis for Processing: Explicit Consent
o Purpose/Activity: To support any other purpose necessary for performance of our contractual obligations or specifically stated at the time at which you provided your Personal Information
Lawful Basis for Processing: Necessary for the performance of a contract
We note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data.
Please contact us if you need details about the specific legal ground we are relying on to process your personal data, where more than one ground has been set out in the list above.
5. Disclosure of your Personal Information
5.1. We may, for the Purposes, disclose your Personal Information to any of the following recipients:
5.1.1. our partners or any third party which assists us in providing our Services or which otherwise has a lawful basis to know such information;
5.1.2. our bank and pooled client account provider;
5.1.3. our suppliers to whom we outsource certain support services such as word processing, translation, photocopying, e-disclosure, data room provision and document review;
5.1.4. our other suppliers of good and services to our firm (including IT services, Technology Tools providers);
5.1.5. our auditors, insurers, brokers and other advisers;
5.1.6. any third parties involved with the services we provide to clients such as counterparties and their solicitors, accountants, surveyors, family offices and other intermediaries and courts, tribunals, public registrars and stock exchanges; and
5.1.6. any third parties involved in organising events or seminars.
5.2. On occasions we may need to share your personal information with regulatory authorities, government agencies and law enforcement agencies, which may have reasonable legal requirement to access your Personal Information not protected to the legal professional privileged. If so, we will use reasonable endeavours to notify you before we do this, unless we are legally restricted from doing so.
6. Transfer of your Personal Information outside of the EEA
Within our global operations and use Technology Tools, Personal Information may be processed or shared with third parties outside the EEA, for legitimate business activities in accordance with applicable data protection laws. In addition, to the extent permissible by applicable law, we may store and/ or process Personal Data in facilities or on servers or cloud operated by Third Parties on our behalf outside the country in which the Personal Data was collected and/ or processed. Where personal data of any the European Economic Area (“EEA”) is transferred to other countries in which applicable laws do not offer the same level of data privacy protection as the EEA states, we take measures to provide an appropriate level of data privacy protection. For example, our written agreement with them will include appropriate contractual clauses approved by the European Commission which give personal data the same protection it has in Europe, ensuring that your personal information remains protected and secure in accordance with applicable data protection laws.
7. Data Retention
7.1. We will only retain your Personal Information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
7.2. When determining relevant retention periods, we take into account various factors, including:
7.2.1. our contractual and business relationships with you and the purpose for which we hold your personal information;
7.2.2. legal obligations to retain data for a certain period of time, including for the purposes of satisfying any legal, accounting, or reporting requirements.;
7.2.3. relevant statutes of limitations;
7.2.4. potential disputes;
7.2.5. best practice; and
7.2.6. guidelines issued by our regulator and relevant supervisory authorities.
7.3. Accordingly, your Personal Information will be retained for up to seven years following the completion or termination of our engagement or the last contact with us emanating from you. Where it is no longer necessary for us to process your Personal Information, we will delete it. Please note, however, that we may be subject to legal and regulatory requirements to keep personal data for a longer period, in particular pursuant to any applicable statutory limitation period.
7.4. In some circumstances we may anonymise your Personal Information (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.
8. Your rights
8.1. Under certain circumstances, you have rights under data protection laws in relation to your personal data. You have the right to:
8.1.1. request access to your personal information and information about how we process it (known as a "subject access request"); should you wish to make a subject access request, then please contact us at privacy@aptuslegal.com; we may need to refuse your request for your personal information, if it is the subject of legal professional privilege belonging to one or more of our clients
8.1.2. receive certain Personal Information in machine-readable format, noting that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you;
8.1.3. object to processing where the lawful basis is that it is in our legitimate interests, but please note that we may still process your Personal Information where there are other relevant lawful bases or where we have compelling grounds to continue processing your Personal Information in our interests which are not overridden by your rights, interests or freedoms;
8.1.4. have inaccurate Personal Information rectified;
8.1.5. have certain Personal Information erased (a) where it is no longer necessary for us to process it, (b) where you have withdrawn your consent pursuant to paragraph 8.1.8, (c) where you have objected pursuant to paragraph 8.1.3, (d) where your Personal Information has been unlawfully processed, or (e) where erasing your Personal Information is required in accordance with a legal obligation;
8.1.6. request an explanation of the logic involved where we make decisions about you solely through automated means;
8.1.7. complain to the Data Protection Commission, the Cyprus supervisory authority for data protection issues; we would, however, appreciate the chance to deal with your concerns before you approach the regulator and please contact us in the first instance;
8.1.8. withdraw your consent, where we have specifically requested your consent to process your Personal Information and have no other lawful conditions to rely on.
8.2. If you have any questions about this Privacy Policy or our processing of your Personal Information, please contact us at privacy@aptuslegal.com
8.3. If you would like to exercise any of your rights, then you can do so by contacting us as described above. Please be aware that while we will try to accommodate any request you make in respect of your rights, they are not absolute rights. This means that we may have to refuse your request or may only be able to comply with it in part. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive.
8.4. Where you make a request in respect of your rights, we will require proof of identification. We may also ask that you clarify your request. If we receive repeated requests or have reason to believe requests are being made unreasonably, we reserve the right not to respond.
9. Your duty to inform us of changes to the Personal Information
It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your business relationship with us.
10. Changes to this privacy policy
We may update this Privacy Policy at any time without notice; any changes will be notified to you using the email address you have given us and/or by an announcement on this website. Your continued use of this Website and our Services, following the posting of changes to these terms, will mean you accept these changes.
11. Information Security
We ensure that the Personal Information we hold is secured by appropriate technical and organisational security measures. We have put in place and trained all our personnel on procedures to deal with data breaches. We will notify you and any applicable regulator of a breach where we are legally required to do so.