Andy Ellul & Associates — Legal & Advisory Back to Home

Privacy Policy

Last updated: 12th September 2026

We are committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains how Andy Ellul & Associates (Legal & Advisory), of 25 St. Ubaldessca Street, Paola PLA 1403, Malta (“we”, “us”, “our”) collects, uses, and protects personal data submitted through this website, in accordance with Regulation (EU) 2016/679 (the “GDPR”) and the Maltese Data Protection Act (Cap. 586 of the Laws of Malta).

1. Who We Are

Andy Ellul & Associates is the controller responsible for the personal data you share with us through this website. If you have any questions about this policy or how we handle your data, you can contact us at:

2. What Information We Collect

When you use the contact form on this website, we may collect:

  • Your name
  • Your email address
  • Your phone number (if provided)
  • Any message or information you choose to include

We only collect the information you voluntarily provide. This website does not use cookies or analytics tools.

3. Why We Process Your Information

We process your personal data on the following legal bases:

  • Consent — when you submit the contact form, you consent to us using your details to respond to your enquiry.
  • Legitimate interest — to respond to enquiries, manage our client relationships, and improve our services.
  • Legal obligation — where required to comply with applicable law, professional conduct rules, or regulatory obligations (including anti-money laundering requirements applicable to the legal profession).

We do not use your data for automated decision-making or profiling.

4. How Long We Keep Your Information

We retain personal data submitted through the contact form for one month. Where a professional relationship follows your enquiry, your data will instead be retained for as long as required by our regulatory and legal obligations as a law firm, in line with our client file retention requirements.

5. Who We Share Your Information With

We do not sell or rent your personal data. We may share it with:

  • Trusted service providers who support our website or business operations, bound by confidentiality obligations
  • Lex Group Advisory, where a matter would benefit from business development, training, or governance advisory support — you will always be advised beforehand and given the opportunity to raise any concerns before any such sharing takes place
  • Regulators, courts, or authorities, where required by law

Any third party processing your data on our behalf does so under a data processing agreement consistent with GDPR requirements. All information shared with us remains subject to professional secrecy and legal privilege where applicable.

6. Your Rights

Under the GDPR, you have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request erasure of your data (“right to be forgotten”)
  • Restrict or object to processing
  • Request data portability
  • Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal

To exercise any of these rights, contact us at info@andyellul.com.

7. Data Security

We take appropriate technical and organisational measures to protect the personal data you share with us against unauthorised access, loss, or misuse.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated “Last updated” date.