Privacy Policy

Last updated: 1 September 2026

This policy explains how we collect and use personal data through the website uaresidency.com and in the course of providing legal services. It is written to meet the Law of Ukraine "On Personal Data Protection" and, for clients and visitors in the European Economic Area and the United Kingdom, the General Data Protection Regulation (GDPR).

1. Who is responsible for your data

We have not appointed a Data Protection Officer, as we are not required to do so. Privacy enquiries are handled by the attorney personally at the address above.

2. Whose data we process

• Website visitors, including people who submit an enquiry form or book a consultation.
• Clients, being individuals who engage us for legal services.
• Family members and ancestors of clients, in citizenship by descent and family reunification matters. This is unavoidable in this area of law, because eligibility depends on the identity and place of birth of parents, grandparents and great grandparents.

3. What we collect and why

Category	Examples	Why we process it	Legal basis
Contact data	Name, email, telephone, country of residence, message text	To answer your enquiry and assess whether we can assist	GDPR Art. 6(1)(b) steps prior to a contract; Art. 6(1)(f) legitimate interest in responding to enquiries
Identity data	Passport scan, date and place of birth, nationality, photograph, marital status	To identify you, to prepare and submit applications, and to comply with our statutory identification duties	GDPR Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation
Family and ancestry data	Names, dates and places of birth, marriage and death of ancestors; archival records; family trees	To establish eligibility for citizenship by territorial origin or by descent, and to make lawyer's requests to archives	GDPR Art. 6(1)(b) contract; Art. 6(1)(f) legitimate interest of the client in establishing their descent
Special category data	Religious or ethnic origin appearing in historical records, for example Jewish or Greek Catholic parish and rabbinate registers; health data where relevant to an application	Because eligibility and archival searches in these matters depend on which denominational register holds the record	GDPR Art. 9(2)(f) establishment, exercise or defence of legal claims; Art. 9(2)(a) your explicit consent where required
Financial data	Invoice details, payment confirmations, proof of investment funds	To take payment, to issue accounting documents and to meet tax obligations	GDPR Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation
Technical data	IP address, device and browser type, pages viewed, referring source	To operate and secure the website and to understand how it is used	GDPR Art. 6(1)(f) legitimate interest; consent for non essential cookies

We do not sell personal data, and we do not use it for automated decision making that produces legal effects.

4. Attorney client privilege

Information you provide to us in connection with legal assistance is also protected by attorney client privilege under Article 22 of the Law of Ukraine "On Advocacy and Advocate's Activity". This protection is stricter than data protection law alone. It means we may not disclose your information even to a public authority, except in the narrow circumstances where the law requires it.

5. Who we share data with

We share only what is necessary, and only with:

• Ukrainian state authorities, where this is required to advance your matter, for example the State Migration Service of Ukraine, state regional archives, the Ministry of Justice and civil registration offices. Lawyer's requests to archives concerning a named person require your written consent, which we obtain separately;
• notaries, sworn translators and apostille services, for the preparation of documents;
• consulates and embassies, where a visa application requires it;
• our accountant, for invoicing and tax reporting;
• our IT and communication providers, being the website host, email provider and payment provider, acting as processors under contract;
• courts, where a matter requires litigation.

We do not disclose data to advertising networks or data brokers.

6. International transfers

We are based in Ukraine. Ukraine is not the subject of a European Commission adequacy decision. Where personal data is transferred from the EEA or the United Kingdom to us, the transfer is made under Article 49(1)(b) of the GDPR, because it is necessary for the performance of the contract with you, and under Article 49(1)(e) where necessary for legal claims. Some of our service providers are located outside Ukraine, including in the European Union and the United States, and we rely on Standard Contractual Clauses where applicable.

7. How long we keep it

• Enquiries that do not result in an engagement: 12 months, then deleted.
• Client files: 5 years from the end of the engagement, which reflects the general limitation period and the need to defend potential claims, unless a longer period is required by law.
• Accounting records: 3 years, or longer where Ukrainian tax law requires.
• Website analytics: up to 14 months.

8. Security

We apply technical and organisational measures appropriate to the sensitivity of the data, including encrypted transmission (HTTPS), access controls, encrypted storage of client files, and confidentiality obligations for everyone working with us. No system is completely secure, and we cannot guarantee absolute security of data transmitted over the internet.

9. Cookies and analytics

This website uses:

• Essential cookies, required for the website and its forms to function. These do not require consent.
• Analytics cookies, to understand how visitors use the site.
• Advertising cookies, where we run advertising campaigns, to measure their effectiveness.
• Third party embedded content, including a Google Reviews widget which loads content from Google.

Non essential cookies are set only with your consent, which you may withdraw at any time through the cookie settings on this website or through your browser settings. Google's own handling of data is described in the Google Privacy Policy.

10. Your rights

Subject to the limits set by attorney client privilege and by Ukrainian law, you have the right to:

• be informed about how your data is used;
• obtain a copy of your data;
• have inaccurate data corrected;
• have data erased, where we no longer need it and no legal duty requires us to keep it;
• restrict or object to processing based on legitimate interest;
• receive data you provided in a portable format;
• withdraw consent at any time, without affecting processing already carried out;
• lodge a complaint.

To exercise a right, write to us at the email address in section 1. We respond within 30 calendar days. We may ask you to confirm your identity before acting, so that we do not disclose data to the wrong person.

Requests concerning deceased ancestors

Data protection rights under the GDPR apply to living individuals. Records about deceased ancestors are handled under Ukrainian archival law and the rules of the relevant archive. Where a record concerns a living relative, that relative's own consent may be required before an archive will release it.

11. Complaints

If you are not satisfied with how we have handled your data, please contact us first. You may also complain to:

• Ukraine: the Ukrainian Parliament Commissioner for Human Rights, ombudsman.gov.ua;
• European Economic Area: the supervisory authority of your country of residence;
• United Kingdom: the Information Commissioner's Office, ico.org.uk.

12. Children

Our services are directed at adults. Where an application concerns a child, we process the child's data on the instructions of a parent or legal guardian.

13. Changes to this policy

We may update this policy. The version in force is the one published on this page, with the date of last update shown at the top. Where a change is material, we will notify current clients by email.