Privacy Policy

The types of personal data we collect depend on the nature of your relationship with us (e.g., client, prospective client, job applicant, website visitor).

1.1. Data Collected from Clients and Prospective Clients

This data is often highly sensitive and typically includes:

a. Identity Data: Names, titles, dates of birth, marital status, passport or national ID details, and professional background information.

b. Contact Data: Postal address, email address, telephone numbers, and professional contact details.

c. Financial Data: Bank account and payment details for invoicing and payments, source of wealth information required for regulatory AML/KYC compliance checks, and financial history relevant to your legal matter.

d. Case Data: Information related to the legal matter for which you retain us, which may include confidential communications, opposing party information, evidence, court filings, and highly sensitive Special Category Data (such as health, political opinions, religious beliefs, or trade union membership) if strictly necessary for the provision of legal advice or representation, acknowledging our professional ethical duty of confidentiality.

e. Technical Data: Information collected from your visits to our website, including Internet Protocol (IP) address, browser type and version, time zone setting and location, operating system, and other technology on the devices you use to access this website.

f. Compliance Data: Information required for regulatory purposes, including anti-money laundering (AML), know-your-client (KYC) checks, conflict checks, and sanctions screening.

1.2. Data Collected from Other Sources

We may also lawfully collect data from third parties, including:

• Publicly accessible sources (e.g., commercial registers, company websites, public social media profiles).

• Credit and background check agencies for compliance and KYC purposes.

• Courts, opposing counsel, and third parties directly involved in your legal matter or necessary for due diligence.

We use your personal data for specific, legitimate purposes that are essential to the operation of a professional Law Firm in Nepal.

Processing Purpose Description of Use

We will only process your personal data when we have a valid legal basis, thereby upholding applicable data protection laws.

1. Contractual Necessity: Processing is necessary for the performance of a contract with you, or to take steps, at your request, before entering into such a contract (e.g., preparing a formal retainer agreement).

2. Legal Obligation: Processing is necessary for compliance with a legal or regulatory obligation to which Lawin and Partners (Law Firm) is subject (e.g., fulfilling KYC obligations or responding to a court order).

3. Legitimate Interests: Processing is necessary for our legitimate interests (or those of a third party), provided your interests and fundamental rights do not override those interests (e.g., maintaining the security of our IT systems, improving our services, or conducting standard administrative tasks required by the professional practice).

4. Consent: We rely on your clear, explicit consent for specific activities, such as sending direct marketing communications where required, or processing Special Category Data outside the mandatory scope of our legal services. Where we rely on consent, you have the right to withdraw that consent at any time.

We only share your personal data with third parties when necessary and lawful, and always in accordance with our duty of professional secrecy and client confidentiality.

International Transfers: Given the global nature of legal practice, it may be necessary to transfer your personal data outside of your country of residence (including outside the European Economic Area or other jurisdictions). When we do so, we ensure that the transfer is protected by appropriate safeguards, such as standard contractual clauses or similar legal mechanisms, to ensure your data receives a level of protection consistent with this Privacy Policy. 

5.1. Security Measures

Lawin and Partners (Law Firm in Nepal) has implemented appropriate organizational and technical security measures to prevent your personal data from being accidentally lost, used, accessed in an unauthorized way, altered, or disclosed. These measures reflect the sensitive nature of the information we handle as a law firm and include:

• Encryption of data both in transit and at rest.

• Strict access controls and authorization limits based on the principle of least privilege, ensuring only necessary personnel can access client files.

• Regular security audits and mandatory staff training on data protection and cybersecurity best practices.

5.2. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements.

The retention period for client files and associated personal data is typically governed by:

• The duration of our professional relationship.

• Mandatory retention periods stipulated by our professional regulatory bodies (e.g., Nepal Bar Council or similar professional associations).

• The statute of limitations for potential legal claims. Once the retention period expires, we securely destroy or anonymize the data.

Depending on your location and the legal basis for processing your data, you may have the following rights regarding your personal data:

• Right to Access: You have the right to request a copy of the personal data we hold about you.

• Right to Rectification: You have the right to request that we correct any inaccurate or incomplete personal data we hold.

• Right to Erasure (“Right to be Forgotten”): You have the right to request that we delete or remove your personal data where there is no compelling reason for its continued processing. Note: This right is subject to exceptions, particularly our legal and regulatory requirements (e.g., AML laws, professional retention rules).

• Right to Object: You have the right to object to the processing of your personal data where we are relying on a legitimate interest as the legal basis, or for direct marketing purposes.

• Right to Restrict Processing: You may request that we suspend the processing of your personal data, for example, if you want us to establish its accuracy or the reason for processing it.

• Right to Data Portability: You have the right to request the transfer of your personal data to you or a third party in a structured, commonly used, machine-readable format.

• Right to Withdraw Consent: Where we rely on consent to process your personal data, you have the right to withdraw that consent at any time.

To exercise any of these rights, please contact the Data Protection Officer using the details provided below. We may need to verify your identity before responding to your request.

7.1. Policy Changes

Our Law Firm in Nepal may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated version will be posted on our website with a revised “Effective Date.” We encourage you to review this policy periodically.

7.2. Data Protection Officer (DPO)

If you have any questions about this Privacy Policy or our data protection practices, or if you wish to exercise any of your rights, please contact our Data Protection Officer: Lawin and Partners (Law Firm in Nepal) Attention: Data Protection Officer

Email: [email protected]

Postal Address: 44066

Telephone: +9779841933745

We are committed to resolving complaints and concerns regarding your privacy. If, however, you believe that we have not been able to assist with your complaint, you have the right to lodge a complaint with the relevant data protection supervisory authority.

This Privacy Policy is designed to provide comprehensive transparency regarding the Firm’s data processing activities and reflects our unwavering commitment to the confidentiality that is the cornerstone of the solicitor-client relationship.