Data Protection Notice · Regulation (EU) 2016/679 (GDPR) & Law 125(I)/2018

Privacy Policy & Personal Data Processing Notice

This Policy outlines how LawCy (lawcy.site) collects, processes, stores, and safeguards personal data of users and legal practitioners in the Republic of Cyprus pursuant to Regulation (EU) 2016/679 (GDPR) and Cyprus Law 125(I)/2018.

Last updated: November 2026

1. Data Controller

The data controller for the platform is LawCy (lawcy.site), an independent legal technology and informational directory in the Republic of Cyprus. For all data protection inquiries and requests, contact us at:

[email protected]·Contact page

2. Categories of Data Processed

A. Public Professional Advocate Registry Records:

Advocate and law firm information published in the official public register of the Cyprus Bar Association: English and Greek legal names, district bar association, registration number, court box number, professional telephone, and active licensing status.

B. User Inquiries & Consultation Requests:

The situation description entered by the user, preferred Cyprus city, legal practice area, and contact details (email or phone) voluntarily provided to receive an assessment copy or route an inquiry to matching advocates.

C. Technical & Security Telemetry:

Pseudonymized or truncated IP addresses used strictly for rate-limiting, anti-abuse protection, and infrastructure security; browser user-agent and aggregated non-identifying telemetry metrics.

3. Legal Bases for Processing (GDPR Article 6)

Legitimate Interests (Art. 6(1)(f) GDPR): The processing of public registry records is based on the legitimate interest of ensuring transparency in the legal services market of Cyprus, facilitating public access to justice, and verifying regulatory standing.
Pre-contractual Steps (Art. 6(1)(b) GDPR): Processing user inquiry data and transmitting requests to selected advocates is performed at the explicit request of the user prior to entering into a prospective legal retainer.
Consent (Art. 6(1)(a) GDPR): Sending a copy of an inquiry analysis to the user's email address is carried out strictly upon the user's voluntary consent.

4. AI Assistant Processing & 30-Day Ephemeral Retention

Inquiries submitted to the AI Assistant are processed ephemerally in real time to categorize practice areas, extract document checklists, and match advocates. User inquiries are NOT used to train public foundation artificial intelligence models.

Automatic 30-Day Expiry:Public share links to saved legal assessments are secured with a unique cryptographic token and remain accessible for exactly 30 days. After 30 days, the link automatically expires and redirects to the homepage.

5. Your Rights Under GDPR (Articles 15–22)

Under Regulation (EU) 2016/679, you have the following enforceable rights:

Right of Access (Art. 15)Confirm processing and receive a copy of your personal data.
Right to Rectification (Art. 16)Request prompt correction of inaccurate personal or professional data.
Right to Erasure (Art. 17)Request deletion of data where legal retention grounds no longer apply.
Right to Restriction (Art. 18)Restrict data processing while accuracy or objections are reviewed.
Data Portability (Art. 20)Receive personal data provided to us in a structured, standard format.
Right to Object (Art. 21)Object at any time to processing based on legitimate interests.

The competent supervisory authority in the Republic of Cyprus is the Office of the Commissioner for Personal Data Protection:

Office of the Commissioner for Personal Data Protection (Cyprus)

1 Iasonos Street, 1082 Nicosia, Cyprus · P.O. Box 24788, 1303 Nicosia

Tel: +357 22818456 · Email: [email protected]

www.dataprotection.gov.cy

For advocate profile verification or data inquiries: [email protected]View Terms of Use & Disclaimer →