Privacy Policy

Crownstone Advocates ("we", "us", "the firm") respects the privacy of everyone who visits this website or contacts us through it. This policy explains what personal data we collect, why, how long we keep it, and the rights you have over it, in plain terms rather than boilerplate. As a firm regulated in Malta and operating in the UAE, we apply the EU General Data Protection Regulation (GDPR) as our baseline standard across both offices.

What We Collect

We only collect personal data you choose to give us directly. There is no tracking pixel, advertising cookie, or analytics script running on this site collecting data about you passively.

Contact and estimate form: name, email address, phone number, a preferred date, subject, and your message.
Newsletter sign-up: your email address only.
Abuse prevention: your IP address is hashed and stored briefly, purely to cap how many times one visitor can submit a form in a short window. We never see or store your raw IP address.

How We Use It

Contact form submissions are used to respond to your enquiry and, where relevant, to open a matter with the firm — submitting the form does not itself create an attorney-client relationship (see our Terms of Use). Newsletter sign-ups are used only to send you the updates you asked for; we do not sell, rent, or share your email address with any third party for their own marketing. Hashed IP data is used solely to prevent automated abuse of our forms and is never used to identify or profile you.

Who We Share It With

Emails you send us are delivered through our SMTP mailbox provider (PrivateEmail/Namecheap), which processes the message solely to deliver it — it is not used for any secondary purpose. We do not share your data with advertisers, data brokers, or analytics companies, because we do not work with any. If your matter requires it, information may be shared between our Malta and UAE offices, or with an external professional (such as local counsel or a translator) under a signed confidentiality agreement, exactly as described in our Core Values page.

How Long We Keep It

Contact form enquiries are retained as part of our normal business records for as long as reasonably necessary, and in line with our professional recordkeeping obligations if an engagement follows.
Newsletter email addresses are kept until you unsubscribe or ask us to delete them.
Hashed IP data used for rate-limiting is automatically discarded once it ages out of the relevant time window — typically within minutes to hours.

Your Rights

Under the GDPR, you have the right to ask us what personal data we hold about you, to correct it, to have it deleted, to restrict or object to our processing of it, and to receive a copy of it in a portable format. To exercise any of these rights, email privacy@crownstoneadvocates.com. If you are not satisfied with our response, you may complain to Malta's Information and Data Protection Commissioner (IDPC) or the data protection authority in your own country.

International Transfers

Because we operate offices in both Malta (EU) and the UAE, personal data connected to a cross-border matter may be accessed from both locations. Where data moves from the EU to the UAE, we apply appropriate safeguards consistent with GDPR requirements for international transfers.

Cookies

This site does not use tracking or advertising cookies. See our Cookie Policy for full detail on the one small piece of local browser storage we use, and what would change if that ever changes.

Children's Privacy

This website is intended for businesses and adults seeking legal services. We do not knowingly collect personal data from children.

Changes To This Policy

We may update this policy as our data practices change — for example, if we introduce analytics or a client portal in the future. The "last updated" date at the top of this page will always reflect the most recent revision.