Privacy Policy

1. Introduction

At Sarhan Data Law ("we," "us," or "our"), we prioritize your privacy and the security of your personal information. This Privacy Policy explains how we collect, use, and protect your information when you visit our website, interact with our marketing content, subscribe to our newsletter, or submit inquiries through our contact form, intake forms, or booking system.

This policy applies to website visitors and prospective clients. Our handling of personal information is governed primarily by British Columbia's Personal Information Protection Act, and where applicable by the federal Personal Information Protection of Electronic Documents Act, Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25), and comparable laws. If you engage our legal services, your relationship with us will be governed by an engagement letter and our Client Engagement Terms, which address confidentiality, solicitor-client privilege, and the handling of client information in detail.

Accountability. Laith Sarhan is the individual accountable for our compliance with applicable privacy laws and for handling access, correction, and deletion requests. You can reach him using the contact information in Section 10.

2. Information We Collect

Website Analytics

We use privacy-focused analytics to understand how visitors interact with our website. Our analytics:

• Do not use cookies or similar tracking technologies
• Do not collect names, email addresses, or other identifying details
• Cannot identify individual visitors or track you across sessions or websites
• Provides only aggregate, non-identifying usage insights
• Is self-hosted on our own Canadian infrastructure

We do not place cookies on your device and do not collect identifying information. As such, no consent banner will be presented.

Newsletter Subscriptions

When you subscribe to our newsletter, we collect your email address and, if offered, your name. By subscribing, you consent to receive commercial electronic messages from us. Every message identifies Sarhan Data Law and includes our contact information, including our mailing address, and you can unsubscribe at any time using the link provided in every email.

Consultation Bookings

When you book a consultation through our website, we collect your name, email address, and any notes about your inquiry. We may use this information to prepare for your consultation.

Contact and Intake Form Submissions

When you submit a message through our contact form or one of our intake forms, we collect your name, email address, phone number (if provided), your organization, and the content of your message, which may include descriptions of your business needs or legal issues. We use this information to respond to your inquiry and assess how we can assist you.

E-Signature and Client Portal

Where we exchange documents for signature or provide you with access to our secure client portal, we collect the personal information required to operate those services — such as your name, email address, signature, and the content of documents you send us.

Third-Party and Publicly-Available Sources

We may collect personal information from third-party sources and publicly-available sources, such as professional networking sites, public records, news sources, and industry databases. This information may be used to better understand your business needs, conduct conflict checks, or verify information you have provided to us. In some cases, we use AI-powered research tools to assist in analyzing publicly available business information; before you become a client, the information processed by such tools is limited to business contact information, information you directly provide to us to determine our ability to act for you, and publicly available information.

3. How We Use Your Information

We use the information we collect to:

• Respond to your inquiries and schedule consultations
• Send newsletter content you have subscribed to
• Conduct conflict checks and assess potential engagements
• Improve our website based on aggregated usage patterns
• Comply with legal and professional obligations

We do not sell or rent your personal information, nor do we disclose it to third parties for their own marketing or advertising purposes. We do not use your personal information for automated decision-making that produces legal effects about you.

4. Data Storage and Security

We implement appropriate technical and organizational security measures to protect your personal information, including:

• Encryption of data in transit using TLS/HTTPS
• Encryption of data at rest using industry-standard encryption algorithms
• Role-based access controls and multi-factor authentication requirements
• Regular security assessments and vulnerability monitoring
• Secure backup procedures with encrypted storage
• Incident response procedures for potential data breaches

Where a breach of security safeguards creates a real risk of significant harm to you, we will notify you and the relevant regulators as required by applicable law.

5. Service Providers and Data Location

Our core systems — including our website content management, client relationship management, scheduling, client portal, and analytics — are self-hosted on infrastructure located in Canada. We also use a limited number of service providers to help operate our practice, including:

• Email and productivity tools, for email communications and document management
• Network and content delivery services, which process technical request data (such as IP addresses) to deliver and secure the website
• AI inference providers, which we use to assist with research and analysis of publicly available business information

Some of these service providers process personal information outside of Canada, including in the United States. Where information is processed outside Canada, it is subject to the laws of that jurisdiction and the contractual safeguards we have put in place. Where possible, we use self-hosted solutions on Canadian infrastructure to maintain data residency.

A current list of the service providers we use is available to you upon request.

Once you become a client, the security, data residency, and AI-use commitments that apply to your client information are set out in our Client Engagement Terms.

6. Your Rights

Depending on your location, you may have certain rights regarding your personal information, including:

• Access to your personal information
• Correction of inaccurate information
• Deletion of your personal information, subject to our legal and professional retention obligations
• Withdrawal of consent, subject to legal and contractual restrictions
• Unsubscribing from marketing communications at any time

To exercise these rights, please contact us using the information provided below. We will respond within 30 business days, or as otherwise required by applicable law.

Complaints. If you have a concern about our handling of your personal information, please contact us first so we can resolve it directly. You also have the right to complain to the Office of the Information and Privacy Commissioner for British Columbia, or, if you are a Quebec resident, the Commission d'accès à l'information du Québec.

7. Data Retention

We retain your information only as long as necessary for the purposes described in this policy and to meet our legal and professional obligations:

• Newsletter subscribers: Until you unsubscribe
• Contact, intake, and booking information: 6 years, in accordance with our professional obligations and conflict-check requirements
• Analytics data: Retained only in aggregate, non-identifying form for a limited period
• Client records: Retained in accordance with our Client Engagement Terms

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised policy on our website with an updated revision date. We encourage you to review this policy periodically.

9. Contact Us

If you have any questions about this Privacy Policy, or to exercise your rights, please contact us: