This notice is available in English.
Last updated: 3 November 2026
This notice explains how P. Panayi & Associates LLC ("we", "us") processes personal data under the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Law 125(I)/2018 of the Republic of Cyprus.
1. Who we are
The data controller is P. Panayi & Associates LLC (Reg. No. HE 496197), a private lawyers’ limited liability company regulated by the Cyprus Legal Council and the Cyprus Bar Association, Orthodoxias 26, Lakatamia 2304, Nicosia, Cyprus. Contact: info@361advisory.com.
2. Personal data we process
- Identification and contact details, such as name, email, telephone, company and position.
- The content of enquiries and correspondence you send us by website form, email, telephone or WhatsApp.
- Client identification and due diligence information required by the Prevention and Suppression of Money Laundering and Terrorist Financing Law of 2007 (Law 188(I)/2007) and the directives of the Cyprus Bar Association.
- Information about your legal matter, which may include information about other people, such as family members, heirs, counterparties, directors or shareholders.
- Where necessary for your matter and permitted by law, special categories of data (for example, health information in immigration matters) and data relating to criminal records (for example, clean criminal record certificates).
- Billing and payment information.
3. Where we get it
Mainly from you or your organisation. We may also obtain data from counterparties and their advisers, courts and public authorities, public registers, sanctions and politically-exposed-person screening databases, and other public sources. If you give us data about other people, please make sure they are aware of this notice.
4. Why we use it, and our legal basis
- To respond to your enquiry and carry out conflict checks: steps taken at your request before entering into a contract, and our legal and professional obligations as advocates.
- To provide legal services: performance of our contract with you or your organisation.
- To meet our legal and regulatory obligations, including under anti-money laundering law, the Advocates Law and the directives of the Cyprus Bar Association, and reporting obligations to the Unit for Combating Money Laundering (MOKAS).
- To establish, exercise or defend legal claims.
Where we need data to meet a legal obligation or to perform a contract and it is not provided, we may be unable to act for you. We do not make decisions about you based solely on automated processing.
5. Professional secrecy
Information you give us in connection with a legal matter is subject to advocates’ professional secrecy and, where applicable, legal professional privilege. After an enquiry has been passed to us, we share your information with 361 Advisory Group Ltd only with your written consent.
6. Who we share it with
Only where needed for your matter: courts and public authorities (such as the Department of Registrar of Companies and Intellectual Property, the Department of Lands and Surveys, the Civil Registry and Migration Department, the Cyprus Securities and Exchange Commission and the Central Bank of Cyprus), counterparties and their advisers, experts, translators, foreign counsel, our IT, email and website hosting providers, and regulators where the law requires it.
7. Website and enquiries
Enquiries sent through this website or to info@361advisory.com arrive in an inbox shared by P. Panayi & Associates LLC and 361 Advisory Group Ltd, and are passed to the firm best placed to respond. For this limited purpose the two firms act as joint controllers. Please do not include confidential details in a first enquiry. Our website host processes technical data, such as IP addresses, to deliver the website securely. This website does not use advertising or tracking cookies. If you contact us by WhatsApp, WhatsApp (Meta) also processes your data under its own terms.
8. Transfers outside the EEA
Where personal data is transferred outside the European Economic Area, we rely on an adequacy decision of the European Commission or on appropriate safeguards such as the Commission’s standard contractual clauses.
9. How long we keep it
- Enquiries that do not lead to an engagement: 12 months from our last contact with you.
- Client files: for the duration of our relationship and 6 years after it ends. This covers the 5-year retention period for customer due diligence and transaction records under the Prevention and Suppression of Money Laundering and Terrorist Financing Law of 2007 (Law 188(I)/2007) and the general 6-year limitation period for claims under the Limitation of Actionable Rights Law of 2012 (Law 66(I)/2012).
- Longer periods: only where a competent authority or the rules of the Cyprus Bar Association require it, or where files are needed for ongoing or reasonably expected legal proceedings or investigations.
10. Security
We use appropriate technical and organisational measures to protect personal data, and limit access to people who need it for their work.
11. Your rights
Subject to the conditions of the GDPR, you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to data portability, and, where processing is based on your consent, to withdraw that consent at any time. Some rights may be limited by professional secrecy or by our legal obligations. To exercise your rights, contact info@361advisory.com. You also have the right to complain to the Commissioner for Personal Data Protection of the Republic of Cyprus (www.dataprotection.gov.cy).
12. Changes
We may update this notice. The current version is always published on this page.