Last updated: 15th January 2026.
1. Who we are
Nicholas A. Theodorou & Co LLC (“Theodorou Law”, “we”, “us”, “our”) is a Lawyers’ Limited Liability Company registered in the Republic of Cyprus (Reg. No. HE 399713). Its registered office is at Zinas Kanther 16, 5th Floor, Offcie 14, 1065, Nicosia, Cyprus.
We are the controller of the personal data described in this policy. This policy explains how we collect, use and protect personal data when you visit ntlaw.com.cy, contact us, or instruct us. We process personal data in accordance with Regulation (EU) 2016/679 (the “GDPR”) and Cyprus Law 125(I)/2018.
If you are a client, this policy should be read together with our engagement letter and terms of business.
2. Personal data we collect
The data we collect depends on how you interact with us:
- Information you provide to us: your name, job title and employer, contact details, the content of your enquiries and correspondence, and any documents you send us.
- Client and matter information: identification and verification documents (such as passport or ID card and proof of address), information relating to your legal matter (which may include information about other people), and billing and payment details. Where a matter requires it, this may include special categories of data, such as health information, or information about criminal proceedings.
- Website usage information: your IP address, browser and device type, pages visited, date and time of access, and the referring website. This is collected through server logs and, where you have consented, analytics cookies.
- Information from third parties: information from other parties to a matter and their lawyers, courts, public registers (such as the Department of Registrar of Companies and the Department of Lands and Surveys), identity verification and screening providers, and people who refer you to us.
3. How we use your personal data and our lawful bases
- Responding to enquiries and conducting conflict checks: to take steps at your request before entering into an engagement, and for our legitimate interests in managing enquiries and complying with professional conduct rules.
- Providing legal services: to perform our contract with you, to comply with our legal and professional obligations, and for our legitimate interests in conducting matters properly. Where special category data is involved, we process it where necessary for the establishment, exercise or defence of legal claims, or on another basis permitted by Article 9 GDPR.
- Client identification and anti-money laundering checks: to comply with our legal obligations under the Prevention and Suppression of Money Laundering and Terrorist Financing Law (Law 188(I)/2007) and the directives of the Cyprus Bar Association.
- Billing, accounting and tax: to perform our contract with you and comply with legal obligations.
- Operating, securing and improving our website: for our legitimate interests. We set non-essential cookies only with your consent.
- Sending legal updates and firm news: with your consent, or, for existing clients, for our legitimate interests in relation to similar services. You can unsubscribe at any time.
- Complying with legal and regulatory requirements: including court orders and requests from competent authorities.
We do not make decisions about you based solely on automated processing.
4. Cookies
Cookies are small text files placed on your device when you visit a website. We use the following categories:
- Strictly necessary cookies: these are essential for the website to function, for example to remember your cookie preferences and keep the site secure. They do not require your consent, and you cannot switch them off through our cookie banner.
- Analytics cookies: with your consent, we use Google Analytics to understand how visitors use our website, such as which pages are visited and how long visitors stay. This helps us improve the site. Google Analytics collects information including a truncated IP address, device and browser type, and pages viewed. This information is provided by Google Ireland Limited and may be transferred to Google LLC in the United States under the EU-U.S. Data Privacy Framework. Analytics data is kept for 14 months.
We set analytics cookies only if you click “Accept” on our cookie banner. If you reject them, or close the banner without choosing, only strictly necessary cookies will be used.
You can change your choice at any time by clicking [Cookie Settings] at the bottom of any page. You can also delete or block cookies through your browser settings. If you block strictly necessary cookies, some parts of the website may not work properly.
5. Who we share your personal data with
We do not sell your personal data. Where necessary, we may share it with:
- courts, tribunals, arbitrators and mediators;
- other parties to a matter and their legal representatives;
- other advocates, experts, translators, process servers and foreign law firms we instruct on your behalf;
- IT, hosting, email and document management providers that act on our instructions under appropriate data processing terms;
- banks, auditors, accountants, insurers and professional advisers;
- regulators and public authorities, including the Cyprus Bar Association, the Unit for Combating Money Laundering (MOKAS) and the tax authorities, where we are required by law to do so.
In some circumstances, the law may prevent us from telling you that we have made a disclosure to an authority.
6. International transfers
Some of our matters and service providers involve countries outside the European Economic Area. Where we transfer personal data outside the EEA, we ensure it is protected. We do this by relying on an adequacy decision of the European Commission, by using Standard Contractual Clauses, or, where applicable, on the basis that the transfer is necessary for the establishment, exercise or defence of legal claims.
7. How long we keep your personal data
We keep personal data only for as long as necessary for the purposes described in this policy, including to meet our legal, regulatory and professional obligations. In general:
- client and matter files are kept for upto 10 years after the matter closes;
- client identification and AML records are kept for at least five years after the end of the business relationship, or longer where an authority requires it;
- enquiries that do not lead to an instruction are kept for 12 months;
- analytics data is kept for 14 months.
At the end of the applicable period, we securely delete or anonymise the data.
8. Security
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse. All our staff are bound by duties of confidentiality and professional secrecy.
9. Your rights
Subject to the conditions and exceptions in the GDPR, you have the right to:
- access the personal data we hold about you;
- have inaccurate or incomplete data corrected;
- have your data erased;
- restrict how we process your data;
- object to processing based on our legitimate interests, and object at any time to direct marketing;
- receive your data in a portable format;
- withdraw your consent at any time, where we rely on consent. This does not affect processing carried out before you withdraw.
Some rights may be limited where we must keep information to comply with a legal obligation, to protect legal professional privilege or professional secrecy, or for the establishment, exercise or defence of legal claims.
To exercise any of these rights, please contact us using the details below. We may need to verify your identity. We will respond within one month, which may be extended where the law allows.
10. Links to other websites
Our website may contain links to third-party websites. We are not responsible for their content or their privacy practices. Please read the privacy policy of any website you visit.
11. Changes to this policy
We may update this policy from time to time. The current version will always be published on this page, with the date of the latest update shown at the top.
12. Contact us
Nicholas A. Theodorou & Co LLC
Zinas Kanther 16, 5th Floor, Offcie 14, 1065, Nicosia, Cyprus
Email: [email protected]
Tel: +357 22271600