Last updated: 12 November 2026
1. Who we are
Olga Pivovarova & Associates LLC ("we", "us", "our") is a law firm incorporated in the Republic of Cyprus under registration number HE 436373 and registered with the Cyprus Bar Association under number 1003. Our registered office is at Promitheos 14, Maristo House, 3rd Floor, Office 302, 1065 Nicosia, Cyprus and our office is at 14 Prometheos Street, Maristo House, 3rd Floor, Office 301, 1065 Nicosia, Cyprus.
We are the controller of the personal data described in this Privacy Notice. If you have any question about how we process your personal data, or wish to exercise your rights, please contact us at
2. Scope of this Privacy Notice
This Privacy Notice explains how we process personal data when you:
- visit our website at www.pivovarovalaw.com (the "Website");
- contact us with an enquiry by email, telephone or otherwise;
- engage us as a client, or are connected with a client (for example, as a director, shareholder, beneficial owner, authorised representative or employee of a client); or
- are a counterparty, adviser or other person whose personal data we receive in the course of a matter.
It is provided in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR") and Law 125(I)/2018 on the protection of natural persons with regard to the processing of personal data. Where we act for a client, this Privacy Notice should be read together with our engagement letter and terms of business.
3. Personal data we process
Depending on our relationship with you, we may process the following categories of personal data:
- Website technical data: IP address, browser type, date and time of access and pages requested, as recorded in server logs by our hosting provider. We do not use analytics or advertising cookies (see our Cookie Policy).
- Enquiry data: your name, contact details, the content of your message, the jurisdictions involved, any deadline and any documents you choose to send to us.
- Identification and due diligence data: full name, date of birth, nationality, copies of passport or identity card, residential address and proof of address, tax residence and tax identification number, information on source of funds and source of wealth, politically exposed person and sanctions screening results, and details of corporate roles and shareholdings.
- Matter data: information contained in documents and correspondence relating to the matter on which we are instructed, including corporate, contractual, tax, banking, residence and immigration information.
- Billing data: invoicing details and payment records.
We do not ask for special categories of personal data or data relating to criminal convictions unless this is necessary for the matter (for example, a medical certificate or criminal record certificate required for a residence permit application). Where we process such data, we do so only to the extent necessary and on the basis of Article 9(2) or Article 10 of the GDPR, as applicable, including where processing is necessary for the establishment, exercise or defence of legal claims or where you have given your explicit consent.
4. Where we obtain personal data
We obtain personal data directly from you; from our clients (for example, about their directors, shareholders, beneficial owners and representatives); from public registers and sources, such as the Department of Registrar of Companies and Intellectual Property and official sanctions lists; and from counterparties, other advisers and public authorities in the course of a matter.
5. Purposes and lawful bases
| Purpose | Lawful basis (GDPR) |
|---|---|
| Responding to your enquiry, checking for conflicts of interest and assessing whether we can act | Article 6(1)(b) — steps taken at your request before entering into a contract; Article 6(1)(f) — our legitimate interest in responding to enquiries made on behalf of a business |
| Providing legal and corporate services, including coordination with independent professionals and advisers in other jurisdictions | Article 6(1)(b) — performance of a contract; Article 6(1)(f) — our and our client's legitimate interest, for persons connected with a client |
| Customer due diligence, anti-money laundering and sanctions checks, and record-keeping | Article 6(1)(c) — compliance with legal obligations, including under the Prevention and Suppression of Money Laundering and Terrorist Financing Law 188(I)/2007 and the directives of the Cyprus Bar Association |
| Accounting, invoicing and tax obligations | Article 6(1)(c) — compliance with legal obligations |
| Establishing, exercising or defending legal claims, dealing with complaints and our professional indemnity insurers | Article 6(1)(f) — our legitimate interest in protecting our legal position |
| Operating and securing the Website | Article 6(1)(f) — our legitimate interest in a secure and functioning website |
We do not send marketing communications without your prior consent, and we do not sell personal data.
6. Professional secrecy
As advocates, we are subject to duties of confidentiality and professional secrecy under Cypriot law and the rules of the Cyprus Bar Association. Personal data received in the course of a matter is treated in accordance with those duties. Certain of your rights described in section 10 may be restricted where their exercise would breach legal professional privilege or professional secrecy, to the extent permitted by Article 23 of the GDPR and Law 125(I)/2018.
7. Who we share personal data with
We share personal data only where necessary for the purposes described above, and only with:
- independent accountants, auditors, tax advisers and other licensed professionals involved in your matter;
- legal advisers and service providers in other jurisdictions, where your matter is cross-border;
- public authorities and registers, such as the Department of Registrar of Companies and Intellectual Property, the Tax Department, the Civil Registry and Migration Department and the courts, where required for your matter;
- banks and other financial institutions, where you instruct us to liaise with them on your behalf;
- the Cyprus Bar Association and the Unit for Combating Money Laundering (MOKAS), where we are required to do so by law;
- our service providers acting as processors, including our hosting provider HostGator, email provider Microsoft 365 and cloud storage provider Google Drive, under written agreements in accordance with Article 28 of the GDPR; and
- our professional indemnity insurers and professional advisers.
8. International transfers
Where your matter involves other jurisdictions, or where one of our service providers is located outside the European Economic Area, personal data may be transferred outside the EEA. We do so only where the European Commission has issued an adequacy decision, where appropriate safeguards are in place (such as the European Commission's Standard Contractual Clauses), or where a derogation under Article 49 of the GDPR applies, for example where the transfer is necessary for the performance of a contract with you or for the establishment, exercise or defence of legal claims.
Our hosting, email and cloud storage providers (HostGator, Microsoft 365 and Google Drive) belong to groups established in the United States, and personal data may therefore be transferred to the United States. Where the relevant provider is certified under the EU–U.S. Data Privacy Framework, such transfers rely on the European Commission's adequacy decision for that Framework; otherwise, they rely on the Standard Contractual Clauses incorporated in the provider's data processing terms.
You may request further information on these safeguards by contacting us.
9. How long we keep personal data
- Enquiries that do not lead to an engagement: twelve (12) months from our last contact with you.
- Client files and due diligence records: five (5) years after the end of our business relationship or the completion of the occasional transaction, as required by Law 188(I)/2007, or longer where a competent authority so requires or where necessary in connection with actual or potential legal claims.
- Accounting and invoicing records: six (6) years.
- Server logs: raw access logs are processed by our hosting provider for statistical purposes and are deleted within 24 hours; we do not archive them. Our hosting provider may retain security records and backups for a limited period in accordance with its own retention policy.
At the end of the relevant period, personal data is securely deleted or anonymised.
10. Your rights
Subject to the conditions and exceptions in the GDPR and Law 125(I)/2018, you have the right to:
- request access to your personal data;
- request rectification of inaccurate or incomplete personal data;
- request erasure of your personal data;
- request restriction of processing;
- receive your personal data in a portable format, where processing is based on contract or consent and carried out by automated means;
- object to processing based on our legitimate interests; and
- withdraw your consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
These rights may be limited where we are required by law to retain the personal data (for example, under anti-money laundering legislation), where professional secrecy applies, or where the personal data is needed for legal claims. We are also prohibited by law from disclosing certain information relating to anti-money laundering reporting.
To exercise your rights, please contact us at
You also have the right to lodge a complaint with the Commissioner for Personal Data Protection of the Republic of Cyprus (www.dataprotection.gov.cy). We would, however, appreciate the opportunity to address your concerns first.
11. Whether you are required to provide personal data
Providing identification and due diligence data is a legal requirement before we can act for a client. If this information is not provided, we will be unable to accept or continue the engagement. Providing other personal data is voluntary, but without it we may be unable to respond to your enquiry or provide our services.
12. Automated decision-making
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
13. Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss or disclosure. Please do not send sensitive documents with an initial enquiry; we will agree a secure method for exchanging documents once an engagement has been agreed.
14. Third-party websites
The Website contains links to third-party websites, such as Google Maps and Waze. We are not responsible for the privacy practices of those websites, and we recommend that you read their privacy notices.
15. Changes to this Privacy Notice
We may update this Privacy Notice from time to time. The current version will always be available on the Website, with the date of the last update shown at the top.
16. Language
This Privacy Notice is also available in Russian and Ukrainian. In the event of any inconsistency, the English version shall prevail.