Privacy Notice

Last updated: November 2026

Who is responsible

Corpus Law Firm is the controller of the personal data described here. Questions and requests about your data go to info@corpus.expert. We answer within 30 days, and sooner for simple requests.

What we collect and why

Enquiries. When you write to us through the contact form or by email, we process your name, email address, phone number if you give it, the company you mention and the content of your message. We use this to answer you and, where you instruct us, to open a matter. Legal basis: steps at your request before a contract (GDPR Art. 6(1)(b)) and our legitimate interest in responding to enquiries (Art. 6(1)(f)).

Client matters. When we act for you, we process the data needed to do the work: identity and address documents, corporate records, ownership and source-of-funds information, correspondence, and the documents of the matter. Legal basis: performance of the engagement (Art. 6(1)(b)) and our legal obligations under anti-money-laundering law (Art. 6(1)(c)). Some of this data is special-category or relates to criminal records checks; we process it only where the law requires it for client due diligence.

Website use. Our hosting provider records server logs (IP address, time, pages requested, browser) for security and to keep the site running. We keep these for a short period. Legal basis: legitimate interest (Art. 6(1)(f)).

We do not buy personal data and we do not sell it.

Cookies

This site uses only strictly necessary cookies: those set by the hosting platform for security and caching, and a session cookie if you log in to an account. They do not track you across other sites and do not require consent.

We do not currently run analytics or advertising cookies. If we introduce analytics in future, we will either use a cookieless method or ask for your consent through a banner before any non-essential cookie is set, and this section will be updated. You can delete or block cookies in your browser settings; the site will still work.

Who we share data with

We share personal data only where the work or the law requires it: with banks, registries, regulators, notaries and local counsel in the jurisdictions of your matter; with our IT providers (hosting, email, document storage) under data-processing terms; and with authorities where we are legally obliged to report. We do not share enquiry data with anyone else.

International transfers

Because our work is cross-border, data may be transferred outside the EEA and Ukraine — for example to a bank in the UAE or a registry in the United States — as necessary for your matter (Art. 49(1)(b)-(c)). Transfers to our own service providers are covered by adequacy decisions or standard contractual clauses.

How long we keep data

Enquiries that do not become a matter: 12 months. Client files and due-diligence records: 5 years after the matter closes, as anti-money-laundering law requires, or longer where a limitation period or a dispute makes it necessary. Server logs: up to 90 days.

Your rights

You may ask for access to your data, correction, deletion, restriction, portability, and you may object to processing based on legitimate interest. Where processing relies on consent, you may withdraw it at any time. You may complain to a supervisory authority: in Ukraine, the Ukrainian Parliament Commissioner for Human Rights; in the EU, the authority of your country of residence. Write to info@corpus.expert to exercise any right.

Security

Client documents are stored in access-controlled systems with encryption in transit and at rest. Email is the least secure channel; for sensitive documents we offer a secure upload link on request.

Changes

We update this notice when our processing changes. The date at the top of the page shows the current version.

This document is provided as general information and may be updated from time to time.