MLegal ("MLegal", "we", "us", or "our") is an international law firm providing legal, tax, immigration, and cross-border advisory services. Our principal place of business is in the United Kingdom, with offices in England, the United Arab Emirates, and India.

This Privacy Policy explains how we collect, use, disclose, store, and protect personal data when you visit www.mlegalfirm.com (the "Website"), contact us, or engage our legal services. It applies to all visitors, prospective clients, clients, and other individuals whose personal data we process.

MLegal is the data controller for personal data processed through this Website and in connection with our legal services in the United Kingdom. Mohit Suri, Managing Partner, bears overall responsibility for data protection compliance.

Applicable Jurisdictions

Our activities span multiple jurisdictions. We comply with the data protection laws applicable to our processing activities, including:

We collect personal data from you directly, automatically, and (where applicable) from third parties. The categories we may collect include:

We use personal data only for specified, legitimate purposes. Our processing activities and the lawful basis for each are set out below:

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law or professional regulatory obligations. Our principal retention periods are:

• Client matter files: 7 years from the conclusion of the matter (in line with SRA guidelines and Limitation Act 1980), or longer where required by statute or regulatory obligation.
• AML / KYC records: 5 years from the end of the business relationship (Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017).
• General enquiry / contact form data: 24 months from last contact unless a client relationship is established.
• Website analytics data: Up to 26 months (aggregated / anonymised after that point).
• Marketing consent records: Until consent is withdrawn plus 1 year as an audit trail.

After the applicable retention period, personal data is securely deleted or anonymised.

We do not sell, rent, or trade your personal data. We may share it only in the following circumstances:

Service Providers & Processors

We engage trusted third parties to provide services on our behalf (e.g. IT infrastructure, document management, email platforms, payment processing, identity verification). These parties are bound by data processing agreements and may only process your data on our documented instructions.

Professional Advisors & Counsel

Where necessary for your matter, we may share relevant data with barristers, expert witnesses, mediators, or other professional advisors under obligations of confidentiality.

Courts, Tribunals & Regulatory Bodies

We may disclose personal data to courts, tribunals, the Solicitors Regulation Authority, HMRC, immigration authorities, the Bar Council, or other competent authorities where required by law or court order.

Anti-Money Laundering Obligations

In circumstances required by the Proceeds of Crime Act 2002, the Money Laundering Regulations 2017, or equivalent legislation in the UAE or India, we may be legally compelled to disclose information to the National Crime Agency (NCA) or other financial intelligence units without being able to notify you of such disclosure ("tipping-off" provisions).

Business Transfers

In the event of a merger, acquisition, restructuring, or sale of the firm, personal data may be transferred to the successor entity, subject to equivalent data protection safeguards.

Affiliates & Cross-Office Working

Our UK, UAE and India offices work collaboratively. Personal data may be shared between these offices to deliver the services you have requested, subject to the international transfer safeguards described in Section 6 below.

MLegal operates across multiple jurisdictions. Personal data collected in the UK may be transferred to, stored in, or processed in the UAE or India. In each case:

• Transfers to the UAE are conducted under appropriate safeguards including standard contractual clauses (SCCs) adopted or approved by the UK ICO, or equivalent contractual protections.
• Transfers to India are conducted in accordance with the UK's International Data Transfer Agreement (IDTA) framework or binding contractual protections, pending any adequacy decision.
• Where we rely on Standard Contractual Clauses, copies are available on request by contacting us at info@mlegalfirm.com.

Subject to applicable law and relevant exemptions (including legal professional privilege and AML obligations), you have the following rights in respect of your personal data:

To exercise any of these rights, please contact us at info@mlegalfirm.com. We will respond within one calendar month of receipt (extendable by a further two months for complex requests, with notice). There is no charge for exercising your rights unless requests are manifestly unfounded or excessive.

Our Website uses cookies and similar technologies to provide functionality, improve performance, and (where consented) to support analytics and marketing.

You may manage or withdraw cookie consent at any time by clicking the "Cookie Preferences" link in our website footer, or by adjusting your browser settings. Note that disabling certain cookies may affect the functionality of the Website.

For full details of cookies in use on this Website, including third-party cookie providers, please refer to our Cookie Policy.

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. These include:

• TLS/SSL encryption for data in transit and encryption at rest for sensitive data stores
• Role-based access controls and least-privilege principles for staff
• Multi-factor authentication for internal systems
• Regular security assessments and vulnerability reviews
• Staff training on data protection and information security
• Incident response procedures, including breach notification protocols under Article 33 UK GDPR (72-hour notification to the ICO where applicable)

Despite these measures, no data transmission over the internet or electronic storage system is completely secure. If you believe your data has been compromised, please contact us immediately at info@mlegalfirm.com.

Our Website may contain links to third-party websites, portals (including court filing systems, government portals, or professional body websites), and social media platforms. These sites operate independently and are governed by their own privacy policies.

We are not responsible for the privacy practices or content of any third-party site. We encourage you to review the privacy policies of any third-party sites you visit.

Our Website and legal services are not directed at children under the age of 18. We do not knowingly collect personal data from children under 18 without verifiable parental consent. If you believe we have inadvertently collected such data, please contact us at info@mlegalfirm.com and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes to our practices, legal requirements, or regulatory guidance. The current version will always be available at www.mlegalfirm.com/privacy-policy.

Where changes are material, we will notify you by email (if you are a client or have subscribed to our communications) or by posting a prominent notice on our Website. The "Effective Date" at the top of this policy indicates when this version came into force.

Continued use of our Website or services after the updated policy has been published constitutes acceptance of those changes.