OUR POLICIES

2E Law (the “Firm”) is committed to protecting privacy and making sure that any personal data it collects are processed in accordance with the EU General Data Protection Regulation (the “GDPR”) and applicable Cyprus laws and regulations. This Privacy Policy describes how the Firm may collect, use, store and/or otherwise process personal data of clients, applicants for employment with the Firm, suppliers or other service providers and website visitors. References in this policy to “we”, “us” and “our” are references to the Firm. References to “you” and “your” are to the individual/s who is/are providing personal data to us. We may amend or update this Privacy Policy from time to time. All amendments or updates will be posted on the Firm’s website at: www.2e-law.com (the “Website”) and/or in our standard terms of business and/or in any other appropriate communication or document exchanged between us. We encourage you to periodically review our Privacy Policy to be informed of how we are committed to protecting personal data. When we Collect Personal Data Personal data may be collected by the Firm in a number of circumstances, including: • when you contact us to seek legal advice or services from us; • when you make an enquiry via the Website or by email; • when you apply for employment (job applicants); • when you offer to provide or provide goods or services to us; • information collected, via the Website, using cookies, unless you have disabled cookies (see our Cookies Policy). If you choose to withhold any personal data requested by us on any of the above-mentioned circumstances, it may not be possible for us to respond to your legal or other query, process your application for employment, offer the legal services requested, or in the case of cookies, use certain functionalities of the Website. In some circumstances, we may collect personal data about you from a third-party source. For example, we may collect personal data from your organisation, other organisations with whom you have dealings, to include banks and other professional service providers or other organisations in the context of the provision of our services to you or generally in the context of any other dealings we may have with you. In any case, such collection from third parties is always carried out in line with our legal obligations. Types of Personal Data We Collect Depending on the reason why you communicate with us, we may collect the following data: •Personal details such as name, country of residence, date of birth, gender etc. •Contact information such as email address, postal address, telephone number etc. •Account details such as user name, unique user ID, password, etc. •Payment information such as credit card details, bank account details, etc. Legal bases for processing your personal data: We have the following legal bases to process your personal data, which are in conformity with the GDPR: • the processing is necessary for the performance on our part of the contract concerning the provision of legal services to you or to take steps at your request prior to entering into such contract, or the processing is necessary for the performance of any other contract or generally in the context of any other dealings we may have with you; • the processing is necessary for us to comply with a legal obligation (for example under applicable Anti-Money Laundering laws); • the processing is in our legitimate interests and our interests are not overridden by your interests, fundamental rights or freedoms; Our legal bases for the processing of special categories of personal data (sensitive data) are the following: • you have provided your explicit consent to the processing of such sensitive personal data for specified purposes; • processing of such data may be necessary for the establishment, exercise or defence of legal claims. Sharing Your Personal Data We will not disclose your personal data, except: • to third parties who provide services on our behalf, e.g. third parties providing document management services or software developers; • to collaborators, to include instructing counsel, banks, accountants and auditors; • where we are required to do so by law or where it is necessary for the purpose of, or in connection with, legal proceedings or in order to exercise or defend legal rights; • upon your instructions or your express consent. We may also share your personal data with any third party to whom we assign or novate any of our rights or obligations. Transfer of Personal data The data that we collect from you is stored in Cyprus. If there is a need to be transferred to and processed in a country outside of the European Economic Area (“EEA”) for carrying out certain tasks, achieve certain goals etc, any cross-border transfer of your personal data will be carried out in compliance with GDPR and applicable laws. Whenever applicable, for transfers of personal data from a country within the EEA to a country outside of the EEA which has not been qualified for an adequacy decision by the European commission, we use standard contractual Cclauses as well as other permitted safeguard measures to protect your privacy and other rights during and after the cross-border transfer. Personal data about other individuals which you provide to us If you provide us with personal data about another individual, you must ensure that you are entitled to disclose such personal data to us and that you have provided the relevant data subjects of all mandatory data privacy notifications and information under the GDPR and applicable legislation and regulations, to include a notification as to their legal rights as data subjects. For that purpose, you must also ensure that the individual concerned is aware of the contents of the present Privacy Policy, as those matters relate to that individual, to include our identity, how to contact us, the purposes of collection of the data, how we may use and/or share the data and his/her relevant rights. Data breach In the event we become aware that the security of the Website has been compromised or users personal data has been disclosed to unrelated third parties as a result of external activity, including, but not limited to, security attacks or fraud, we reserve the right to take reasonably appropriate measures, including, but not limited to, investigation and reporting, as well as notification to and cooperation with law enforcement authorities. In the event of a data breach, we will make reasonable efforts to notify affected individuals if we believe that there is a reasonable risk of harm to the user as a result of the breach or if notice is otherwise required by law. Changes and amendments We reserve the right to modify this Policy or its terms, from time to time in our discretion. When we do, we will revise the updated date at the bottom of this page. We may also provide notice to you in other ways in our discretion, such as through contact information you have provided. Any updated version of this Policy will be effective immediately upon the posting of the revised Policy unless otherwise specified. Your continued use of the Website and our services after the effective date of the revised Policy (or such other act specified at that time) will constitute your consent to those changes. However, we will not, without your consent, use your personal data in a manner materially different than what was stated at the time your personal data was collected. Retention of Personal Data The Firm will generally retain personal data for the period necessary to fulfil the purposes for which it was originally collected and thereafter as required or permitted by law or as is necessary in order for the Firm to be able to defend, respond to or conduct prospective or actual legal claims or proceedings. In light of the above general rule: • Client data shall generally be retained for the duration of their business relationship with the Firm and thereafter for a further period of 6 years. • With regard to candidates’ data, these shall be kept for the whole of the duration of the recruitment process and where their relevant application has been unsuccessful the data will be deleted immediately, except where the candidate has provided his/her explicit consent for holding the date for a longer period. • Personal data in the context of other contractual relations or dealings with you shall be retained for the duration of our contractual relationship or dealings and thereafter for a further period of 6 years. Security and Confidentiality of your Personal Data The Firm strives to maintains appropriate technical and organisation security measures to protect your personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. Whenever any external service provider handles or processes your data on our behalf, we require them to do the same. Data protection rights under GDPR You have certain data protection rights and we aim to take reasonable steps to allow you to correct, amend, delete, or limit the use of your personal data. If you wish to be informed what Personal Information we hold about you and if you want it to be removed from our systems, please contact us. In certain circumstances, you have the following data protection rights: •Right to access: You have the right to request information about your personal data that we store at any time and have the ability to access your Personal Information. We will provide you with your requested information via appropriate means of communication. •Right to rectification: You have the right to request that we correct any personal data you believe is inaccurate. You also have the right to request us to complete the personal data you believe is incomplete. •Right to erasure: You have the right to request the erase of your personal data under certain conditions of this Policy and when, among other reasons, the data is no longer necessary for the purposes for which they were collected. Your erasure request may be hindered if any of the following situations apply: (a) the legal ground for the process is fulfilment of contract and your personal data is still necessary for the purpose set for the process; (b) the legal ground for the process is legitimate interest and the Firm has overriding interests to continue to use your personal data; (c)the legal ground for the process is a legal obligation and the Firm is by law or statute obliged to continue to use and/or store your personal data for the given purpose and time; (d)for the establishment, exercise or defense of legal claims. •Right to object: You have the right to object to our processing of your personal data that is based on our legitimate interest We will stop processing your personal data and immediately erase it, unless we can demonstrate a legitimate reason for the processing which overrides your interest and rights or due to legal claims. •Right to restriction: You have the right to seek restrictions on the processing of your personal data. When you restrict the processing of your personal data, we may store it but will not process it further, unless this is necessary for the exercise or defence of legal claims •Right to data portability: You have the right to be provided with a copy of the information we have on you in a structured, machine-readable and commonly used format. How to exercise these rights If you wish to exercise any of your abovementioned rights or have any questions or comments with regard to this Privacy Policy, you may contact our Data Protection Officer by email at info@2e-law.com. In addition to the above, you also have the right to lodge a complaint to the Office of the Commissioner for Personal Data Protection in Cyprus, at the following postal and email address: Kypranoros 15, 1061 Nicosia P.O. Box 23378, 1682 Nicosia Tel: +357 22818456 Fax: +357 22304565 Email: commissioner@dataprotection.gov.cy