1. Introduction

This Privacy Notice (the “Notice”) describes how InariLaw (the “Firm”, “we,” “us,” or “our”) collects, uses, shares and otherwise processes Personal Data (as defined below). The Firm is committed to respecting and safeguarding your privacy. We recognize the importance of privacy and data protection and adhere to the highest standards of compliance and security in accordance with applicable laws.

This Notice applies to the Personal Data which we process in respect of:

1. Clients and/or prospective clients of the Firm who approach and/or engage us to provide legal services;
2. Persons who make use of our website https://inarilaw.com/ (“Website”), including any sub-website, associated domain and/or sub-domains of the Website;
3. Persons who access our social media platforms, including Meta Platforms, Inc. (Facebook) and LinkedIn (“Social Media Platforms”); and
4. Any other individual in respect of whom the Firm obtains Personal Data. 

The term “processing” shall mean any action or set of actions taken on your Personal Data, automatically or manually, including but not limited to, collection, use, organisation, storage, restriction, erasure and destruction. 

The Firm processes Personal Data in accordance with the General Data Protection Regulation (“GDPR”), the Data Protection Act (Chapter 586 of the Laws of Malta) and other relevant subsidiary legislation (“Data Protection Laws”). The processing of Personal Data is inevitable in order to be able to provide you with the best services and/or experience on our Website, and that is why we shall do our utmost to protect your Personal Data by ensuring confidentiality, accuracy and excellent means of security of all the Personal Data which we process.

We highly encourage you to read this Notice carefully and should you need any further information or clarification, or have any enquiries in relation to this Notice, kindly contact us on info@inarilaw.com. 

2. Data Controller

Under the GDPR, the Firm is the controller of the Personal Data we process as we determine the purpose and means of the processing of your Personal Data.

3. The Collection and Use of Your Personal Data

The term “Personal Data” shall have the same meaning as that found in Data Protection Laws; any information which relates to you, as an identified individual or as someone who can be directly or indirectly identified. Data Protection Laws further stipulate that the processing of Personal Data must be done in a lawful, fair and transparent manner, and we do our utmost to ensure that we process your Personal Data in line with these principles. 

Your Personal Data is only collected with your consent and/or when necessary:

1. for our legitimate interest;
2. to carry out contractual agreements;
3. to comply with a legal obligation.

The following is a non-exhaustive list of Personal Data which we may collect from data subjects: 

1. Contact details (e.g. email address, phone number, residential address);
2. Identification information (e.g. name, ID number, passport number);
3. Education and Employment history;
4. Financial information (e.g. bank account details);
5. Due diligence information (AML/CFT and KYC) (e,g. professional reference, a copy of an issued utility bill and other documentation required in accordance with  the Prevention of Money Laundering Act (Chapter 373 of the Laws of Malta) (“PMLA”), the Prevention of Money Laundering and Funding of Terrorism Regulations (“PMLFTR”), the Financial Intelligence Analysis Unit (“FIAU”) and/or other related legislation/regulation);
6. Technical information (e.g. Internet Protocol (“IP”) address, browser type, device information);
7. Any other information which you may choose to voluntarily provide us.

We may also collect what the GDPR refers to as “Special Categories of Personal Data” which is Personal Data that is sensitive in nature. We do not normally collect this type of information but if we truly require such data, it is only collected with your explicit consent, if by law we are obliged to collect it and/or if you provide it to us voluntarily.  

The Firm may collect or access your Personal Data:

1. Directly from you with your consent in writing or verbally;
2. From a correspondence with us;
3. From publicly accessible sources (e.g. Malta Business Registry (“MBR”), Malta Financial Services Authority (“MFSA”), Public Registry, Planning Authority, Court Registry);
4. Directly from a third party (e.g. due diligence providers, credit reference agencies);
5. From a third party with your consent (e.g. your bank or other financial institutions);
6. When you use our Website;
7. When you engage with us on any of our Social Media Platforms;
8. Through the use of cookies on our Website.

We try our utmost to only collect the Personal Data which we need from you in order to be able to provide you with our services and uphold the principle of data minimisation. This principle requires us, as the Data Controller to limit our collection of your Personal Data and only collect the information which is directly applicable and necessary to be able to fulfil the specific purpose for which it is needed. 

The following table presents Personal Data which we may collect and use together with the corresponding activity and the legal basis for doing so:

Activity	Personal Data we may process	Legal basis and Reasons for using Personal Data
Making a general enquiry on the Website	The information that you provide to us when you make an inquiry, comment, claim and/or complaint on the Contact Us section on our Website. This includes your full name, email address, phone number and any other information that you choose to provide us with.	For our legitimate interest:  This information is required to be able to get back to you by acknowledging, responding and/or finding a solution to your enquiry, comment, claim and/or complaint accordingly.  To keep our contact list up to date.
When you communicate with us by telephone, email or through any of our Social Media Platforms	Any Personal Data that you provide us when you make a request for information about our services, give us feedback and/or make a complaint.	For our legitimate interest: The information you provide us gives us the opportunity to get to know the person with whom we are communicating with, helps us manage business communications and to be able to respond to your communications with us.
Onboarding and making use of our services	We need to collect your identification details, contact details, compliance information and financial details for the provision of our services which may include:  Your full name; Place of residence; Email address; Place of birth; Date of birth; Passport/ID details; Place of citizenship;  Payment details;  Source of wealth information; Any other information provided voluntarily by the data subject.  The required information depends on the person with whom we are engaging with and we may not require all the information listed hereabove.	To carry out contractual obligations: This Personal Data is required to sustain our contractual obligations and be able to provide you with an adequate service and to be able to communicate with throughout the duration of the provision of our services.  Consent:  When signing the letter of engagement, you will be granting us consent to process personal data and carry out the necessary background checks required.  To comply with legal and regulatory obligations: By law, we are obliged to collect the Personal Data to be able to provide you with our services and do the necessary background checks, including KYC checks and checks to uphold with AML/CFT compliance in accordance with the PMLA and the PMLFTR.
When you provide us with your CV to apply for a job at the Firm	All the Personal Data that you provide us when you send us an email to apply for a job with us, including the information contained in the Curriculum Vitae and/or covering letter which you send us.  Such information may include but is not limited to: Your full name; Your qualifications and references; Email address; Phone number; Background checks (social media and criminal background checks to the extent permitted by law). Throughout the application process we may also request that you provide us with a copy of your Police Conduct Certificate issued at a recent date.  The Personal Data which you provide us with may also include special conditions, including health information relating to disability, medical conditions, specific learning difficulties and/or any other health concern that you let us know of throughout the application process.	For our legitimate interest: The Personal Data that you provide us with throughout the application process when applying for a job with us enables us to get to know our employees or potential employees, and gives us a better understanding of your qualifications and whether or not you satisfy our staffing requirements.  Consent: By providing us with your Personal Data, you are consenting that we may process your Personal Data for the purposes of the job application, including conducting the necessary checks to satisfy our legitimate interest.  To comply with legal and regulatory obligations: To confirm whether a candidate has the right to work with the Firm.
General use of our Website	Automatic processing of certain technical information without any human intervention may take place. The Personal Data which may be automatically processed may include your IP address, browsing type and device information.  We may automatically collect and process certain technical information, including but not limited to, your IP address, browsing type and device information.	For our legitimate interests: The automatic processing of your Personal Data when you visit our Website may help us trace your device back to you in case of any misappropriation of our Website.  This type of processing also helps us improve our Website and ensure that it is secured.

4. Cookies

Cookies are small text files which are copied on your hard disk or stored on your browser and contain certain information (such as the website’s name and the unique user ID) and are then downloaded and stored on your device when visiting that same website. We collect this already identified information from users through cookies in order to improve the functionality of our Website and our services. When You continue to browse the Website, You are agreeing to our use of cookies.

Cookies are harmless and the information which we are provided with through cookies cannot directly identify you, but it provides us with valuable statistics allowing us to control, administer and improve our technological services. Furthermore, it also benefits you as a data subject as the Website will remember certain details about your previous visit and give you a more user-friendly experience if you decide to revisit our Website. You can manage or block cookies at any time by adjusting your browser settings to refuse the use of all or specific types of cookies.

The following is a list of certain information which may be collected from your browser through cookies when you access and/or make use of our Website:

1. The date, time and length of your visit.
2. IP address and/or domain name;
3. Device specifications;
4. Search history and resources which you accessed;

5. Personal Data in Relation to Third Parties

Should you provide us with the Personal Data of anyone other than yourself, you should always ensure that you have their consent to share their Personal Data with us. If we receive such data from you, we presume that you have the authorisation of the individual in question. Hence, we shall not be held liable for the information which we may have processed if you did not have their consent. 

6. Recipients of your Personal Data

We do not normally transfer any Personal Data outside the European Economic Area (EEA) or to international organisations. However, we may need to do so in order to be able to provide you with a service if:

1. Your or our service providers are located outside the EEA; or
2. If you are based outside the EEA. 

Additionally, we may only share your Personal Data with:

1. Our relevant staff;
2. Third-party service providers, including cloud storage providers, website hosting providers consultants, accountants, tax advisors and other law firms involved in the provision of services; 
3. Other third parties when this is necessary to carry out our instructions (e.g. Malta Business Registry, Malta Financial Services Authority, Public Registry); 
4. Our bank when this is required in relation to the provision of a service;
5. Law enforcement agencies, government entities or public authorities, to comply with court orders, to obtain legal remedies and/or limit our damages, to protect your rights as well as our rights and the rights of our employees and where we deem necessary or appropriate under applicable laws and regulations.

In order to prevent any unauthorised access and/or use of Personal Data, we promise take the appropriate security, maintain confidentiality and use the proper equipment for processing to prevent any illicit access to your Personal Data. This also applies to any third-party website which may be visibly marked on our Website. However, since we are not responsible for the content of such website/s, we highly encourage you to go through the Privacy Notices of these websites. 

7. Storage and Retention of Personal Data

Your Personal Data is stored and retained by us on our cloud-based software and/or in paper format at our premises located at 239, Psaila Street, Birkirkara, BKR 9078, Malta. 

The Personal Data that we collect is stored and retained by us for as long as necessary, even after the completion of our service to you. What is considered as ‘necessary’ depends on several factors, including but not limited to, the purpose for which the information was collected, the type and duration of your relationship with us and the Personal Data under consideration. We need to keep your Personal Data after finishing advising and/or providing you with our legal assistance in order to comply with the recordkeeping requirements in terms of law, and to be able to respond to any questions, complaints and claims made by you or on your behalf. 

We retain your Personal Data for a period of up to ten (10) years following the conclusion of our relationship, unless a longer retention period is required by law or necessary to establish, exercise, or defend legal claims. This retention period ensures compliance with statutory obligations and the safeguarding of our legitimate interests.

8. Your Rights as a Data Subject

Data Protection Laws entitle you with certain rights with respect to your Personal Data which are set forth hereunder in this Section 8.  In order to be able to make use of your rights, we would first need to verify your identity and you may contact us using the contact information provided in Section 1 above. 

8.1. Transparency 

We strive to maintain the highest level of transparency in how we process your Personal Data. We are committed to ensuring that all information we provide regarding your Personal Data—whether through email, our Website, or this Privacy Notice—is concise, easily accessible, and presented in clear and plain language. If you find any information unclear or require further clarification, please do not hesitate to contact us. We are here to address your concerns and provide additional guidance as needed.

8.2. Access

As a data subject, you have the right to know what data we are processing which concerns you. You may contact us to make such request which is free of charge (unless it is deemed as manifestly unfounded or excessive in nature). A reasonable fee may be charged for administrative costs if you request for any further copies.

8.3. Rectification 

You have the right to request the rectification (amendment/revision) of any inaccurate Personal Data which we may hold of you. Additionally, you have the right to provide us with supplementary information to any incomplete Personal Data which we may hold if such information is necessary for the purposes of processing. Where appropriate, this shall also be communicated with any recipients to whom your Personal Data has been disclosed. 

8.4. Erasure/Deletion (“the right to be forgotten”)

You may request that we do not continue retaining your Personal Data and, in such event, we would be obliged to delete your Personal Data without undue delay if:

1. We no longer require your Personal Data for the initial purpose for which it was collected or processed;
2. We processed your Personal Data as we had legitimate interest to do so and, in accordance with Section 8.6. of this Notice, you objected to the processing of your Personal Data and we have no other lawful ground to continue processing;
3. The processing of your Personal Data was done unlawfully;
4. As the Data Controller, we are required by European Union (EU) Law or Maltese Law to erase your Personal Data;
5. There are certain special conditions in relation to children’s rights as stipulated by the GDPR. 

In such case, if possible, we shall inform third parties with whom your Personal Data has been shared with that we have erased your Personal Data and hence, cannot be further processed by us or them.

Although you may want us to delete your Personal Data, we may not be able to do so as further retention would be required. Reasons for retention include but are not limited to: 

1. Exercise the right of freedom of expression and information;
2. Comply with a legal obligation;
3. Perform a task which is carried out in the interest of the public or in the exercise of an official authority vested in us as the Data Controller;
4. Archiving purposes in the interest of the public;
5. The establishment, exercise or defence of any legal claims. 

8.5. Restriction

As a data subject, you have the right to request from us that we restrict the processing of your Personal Data if:

1. You believe that we have collected and/or processed inaccurate Personal Data which concerns you and we shall not continue processing the Personal Data in question until we verify the accuracy of the information;
2. We have unlawfully processed your Personal Data but you request the restriction of its use instead of erasure in accordance with Section 8.4. of this Notice;
3. We do not need your Personal Data anymore but it is required by the Data Subject to be able to establish, exercise or defend any legal claims;
4. You have objected to the processing of your Personal Data in accordance with Section 8.6. of this Notice while verification is pending as to whether we have legitimate grounds to process which override yours.

8.6. Objection 

A data subject also has the right to object to the processing of their Personal Data on grounds regarding their particular situation. You may object at any time if we are processing your data for the performance of a task in the interest of the public or in the exercise of an official authority, if we are processing your Personal Data for our legitimate interest or the legitimate interest of a third party, or in the case of profiling. However, we may not be able to uphold your request if we demonstrate compelling legitimate grounds for processing which override your interests, right or freedoms, or if processing is necessary to establish, exercise or defence of legal claims. 

8.7. Data Portability 

You have the right to receive any of your Personal Data which you have provided to us. If you decide to make such request, we shall make available this information in a structured, commonly used and machine-readable format. After receiving such data from us, you have the right to transmit it to another controller (if technically feasible) without any hindrance from us if the Personal Data is:

1. Processed only with your consent, or for the performance of a contract which you are a party of or to take the necessary steps at your request before entering into a contact;
2. Processed by automated means.

Nonetheless, this right shall not prejudice your right to be forgotten, as set forth in Section 8.4. of this Notice and shall not adversely affect any of the rights and freedoms of others. 

8.8. Complaints

Together with the rights mentioned hereabove, and without prejudice to alternative administrative and judicial remedies, you may lodge a complaint against us with the Maltese supervisory authority responsible for data protection matters: The Information and Data Protection Commissioner (IDPC).

You may file your complaint online through the following link (subject to change):
https://idpc.org.mt/file-a-complaint/ 

Nevertheless, we would appreciate the opportunity to communicate with us before lodging a complaint against us to see if we can acknowledge your complaint to your satisfaction without involving the IDPC. 

9. Data Security

The Firm processes Personal Data daily as part of its regular operations, including data related to clients, prospective clients, and visitors to its Website. To ensure the confidentiality, integrity, and availability of the Personal Data entrusted to us, we have implemented robust technical and organizational measures. These measures include the establishment of comprehensive procedures and policies, secure data storage solutions, and strict access controls to prevent unauthorized access. Our commitment to data security reflects our dedication to safeguarding the Personal Data we process in compliance with applicable laws and industry best practices.

10. CHANGES TO THIS NOTICE

The Firm reserves the right to amend this Privacy Notice from time to time to reflect changes in legal or regulatory requirements, our data processing practices, or for any other legitimate purpose. Any updates or modifications to this Notice will be published on our Website at https://inarilaw.com, and where appropriate, we may notify you through other means, such as email or notices on the Website. We encourage you to review this Notice periodically to stay informed about how we process and protect your Personal Data.

Last updated: December 2024