Last updated: 8 October 2026 

1. Who we are 

Umami Law S.r.l. (“Umami Law”, “we”, “us” or “our”) is a Luxembourg law firm with its registered office at 8 rue de Beggen, L-1220 Luxembourg, Luxembourg, registered with the Luxembourg Trade and Companies Register under number B303755. 

We are the controller of the personal data described in this policy, unless we explain otherwise in a specific notice. 

For privacy enquiries or to exercise your data protection rights, please contact us: 

• Email: office@umami.law 
• Post: Umami Law S.r.l., Privacy enquiries, 8 rue de Beggen, L-1220 Luxembourg, Luxembourg. 

2. Scope of this policy

This policy explains how we process personal data in connection with our website, legal services and professional activities. 

It applies to website visitors, clients and prospective clients, their representatives and contacts, individuals involved in legal matters, professional contacts, suppliers, newsletter recipients, event participants and job applicants. 

Personal data is information relating to an identified or identifiable individual. Information about a company may also include personal data about its directors, employees, representatives or beneficial owners. 

Where necessary, we provide additional information about particular processing activities.

3. Personal data we process 

Depending on our relationship with you and the relevant activity, we may process:

• Identification and contact information, including names, professional titles, addresses, email addresses, telephone numbers and organisational affiliations. 

• Client-verification information, including identity-document details and copies, dates of birth, nationality, authority to act, beneficial ownership and control information, and information relevant to applicable compliance checks. 

• Matter information, including instructions, correspondence, documents, evidence and information concerning intellectual property rights, transactions, disputes or other legal matters. 

• Financial and administrative information, including billing details, bank details, payment records, fees and expenses. 

• Communication information, including enquiries, meeting records, subscriptions, event registrations and communication preferences. 

• Recruitment information, including CVs, qualifications, employment history, references and correspondence. 

• Technical information, including IP addresses, browser and device information, access times, website requests and language preferences. 

Where relevant to a legal matter, we may also process special categories of personal data, such as health information, or information concerning criminal allegations, convictions and offences. We do so only where the applicable legal requirements are satisfied. 

Please do not send personal data that is unnecessary for your enquiry or matter.

4. How we obtain personal data 

We may obtain personal data directly from you when you contact us, use our website, instruct us, provide documents, subscribe to communications, attend an event or apply for a position. 

We may also obtain information from: 

• clients and their representatives; 

• other lawyers, experts, translators and professional advisers; 

• counterparties, witnesses and other participants in a matter; 

• courts, authorities and intellectual property offices; 

• company, beneficial ownership, intellectual property and other registers; 

• publicly available websites and professional sources; 

• compliance-check providers or referees, where relevant and lawful. 

We use these sources where necessary for the purposes described below. 

5. Purposes and legal bases 

We process personal data for the following purposes. 

Enquiries and prospective engagements 

We use personal data to respond to enquiries and discuss potential instructions. 

Where you would personally enter into a contract with us, the legal basis is taking steps at your request before entering into that contract. Otherwise, we rely on our legitimate interests in responding to enquiries and developing professional relationships. 

Legal services and client relationships 

We process personal data to advise clients, conduct matters, communicate with relevant individuals and administer engagements. 

Where you are personally our client, we rely on the performance of our contract with you. For corporate-client contacts and other individuals involved in matters, we generally rely on our legitimate interests and those of our clients in obtaining and providing legal services and establishing, exercising or defending legal rights. 

Applicable legal and professional obligations may also require particular processing. 

Conflict checks and compliance 

We process information to check conflicts, assess whether we can accept or continue instructions, and fulfil applicable client due-diligence, anti-money laundering and sanctions obligations. 

We rely on applicable legal obligations and, where appropriate, our legitimate interests in managing conflicts, preventing misuse of our services and operating a responsible legal practice. 

Billing and administration 

We process information for invoicing, payments, accounting, tax compliance and the recovery of fees. 

The applicable bases are contractual necessity where you are personally the contracting client, legal obligations and our legitimate interests in administering the practice and receiving payment. 

Security, complaints and legal claims 

We process information to protect our systems and records, prevent fraud, maintain business continuity, handle complaints and establish, exercise or defend legal claims. 

We rely on applicable legal obligations and our legitimate interests in protecting the practice, its clients and relevant information. 

Newsletters and events 

We send newsletters, legal updates and event invitations to existing client contacts who have agreed to receive them, relying on their consent. 

We use registration and contact information to organise events and communicate with participants, relying on contractual necessity where applicable or our legitimate interests in organising professional events. 

Recruitment 

We process applications to assess suitability, communicate with applicants and manage recruitment. 

We rely on taking steps at the applicant’s request before entering into an employment contract, applicable legal obligations and our legitimate interests in selecting suitable candidates and managing recruitment. 

Website operation 

We process technical information to deliver website content, maintain security and functionality, and respond to website enquiries. 

We rely on our legitimate interests in operating a functional and secure website. Consent is used where required for cookies or similar technologies. 

Additional conditions for sensitive information 

Where special categories of personal data are involved, we also rely on an applicable condition under Article 9 GDPR, including processing necessary for the establishment, exercise or defence of legal claims where appropriate. 

Information concerning criminal convictions and offences is processed only where authorised by applicable law and subject to the required safeguards. 

When relying on legitimate interests, we consider the necessity of the processing and its effect on individuals’ rights and interests.

6. Information you need to provide 

Certain information is necessary to respond to an enquiry, assess whether we can act, provide legal services, process an application or comply with legal obligations. 

If necessary information is not provided, we may be unable to accept instructions, proceed with a matter, consider an application or continue the relationship. 

Where information is optional, we indicate this where appropriate.

7. Confidentiality and recipients 

We handle information obtained through our legal practice in accordance with applicable professional secrecy and confidentiality obligations. 

Subject to those obligations, personal data may be disclosed where necessary and lawful to: 

• authorised members of our team; 

• local counsel, experts, translators and other advisers involved in a matter; 

• courts, intellectual property offices, public authorities and other relevant bodies; 

• counterparties and their advisers where necessary for the conduct of a matter; 

• providers of website hosting, email and cloud services, practice-management and intellectual property docketing software, accounting services and other administrative support; 

• our insurers, auditors and professional advisers; 

• competent professional and regulatory bodies. 

Providers processing personal data on our behalf are subject to appropriate contractual requirements. Other recipients, such as courts, authorities and independent counsel, may act as separate controllers. 

This policy does not waive professional secrecy or permit disclosure where disclosure is otherwise prohibited. 

8. International transfers 

Our use of technology and service providers, and our work with overseas counsel and other recipients in international matters, may involve transfers of personal data outside the European Economic Area (“EEA”). 

Such transfers are subject to the applicable requirements of the GDPR. Depending on the recipient and circumstances, the applicable transfer mechanism may be: 

• a European Commission adequacy decision covering the destination or recipient; 

• appropriate safeguards, such as European Commission standard contractual clauses, together with any necessary supplementary measures; or 

• a specific statutory derogation, such as a transfer necessary for legal claims, where its conditions are satisfied. 

You may contact office@umami.law for information about the transfer arrangements applicable to your personal data and, where relevant, a copy of the applicable safeguards, subject to lawful redactions.

9. Retention 

We retain personal data for as long as necessary for the purposes for which it is processed, taking account of applicable Luxembourg legal requirements, professional obligations and the establishment, exercise or defence of legal claims. 

Accounting records 

Accounting records and supporting documents, including invoices, are generally retained for ten years in accordance with applicable Luxembourg accounting requirements. 

Client due-diligence records 

Where Luxembourg anti-money laundering legislation applies, the relevant identification, verification and other records are generally retained for five years after the end of the business relationship or the relevant occasional transaction, subject to applicable provisions allowing or requiring further retention. 

Client and matter files 

Client and matter information is retained throughout our engagement and any continuing responsibilities, including agreed intellectual property portfolio management. 

Following completion or termination, we retain the information necessary to comply with professional obligations and address complaints or legal claims. We take account of the nature of the matter, relevant limitation periods and any interruption or suspension of those periods. There is no single retention period applicable to all matter information. 

Unsuccessful enquiries 

Information about enquiries that do not result in an engagement is retained for the time necessary to respond and address related issues. Where justified, limited information may be retained separately for conflict-checking purposes. 

Recruitment 

Recruitment information is retained for the recruitment process and any justified period necessary to address related claims. Retention for future opportunities is addressed separately with the applicant. 

Marketing 

Marketing contact information is retained while consent remains valid and the communications remain relevant. Following withdrawal or objection, we may retain limited suppression information to ensure that the individual is not contacted again. 

Technical records 

Website and security records are retained for the period necessary to operate and protect the relevant systems, investigate incidents and meet applicable obligations. Their purpose, sensitivity and the need for continued retention are taken into account. 

Records subject to a dispute, investigation or other legal hold may be retained longer where necessary and lawful. Information is deleted or anonymised when no longer required.

10. Cookies 

Our website uses a cookie to remember your language preference. It remains on your device for approximately one year, unless you delete it sooner. 

You can delete or block cookies through your browser settings, although this may prevent the website from remembering your preferred language. 

Where cookies or similar technologies require consent, that consent must be obtained before they are used. If we introduce additional technologies requiring consent, we will update the relevant information and consent arrangements before activating them. 

 

11. Google Fonts 

Our website uses externally hosted Google Fonts. Loading these fonts sends your IP address and associated technical request information to Google, which may include browser and operating-system information and the referring webpage. 

According to Google, the Fonts service does not set or log cookies and does not use the information collected through the service for user profiling or targeted advertising. 

We use the service to display our website’s typography consistently, relying on our legitimate interests in presenting a readable and functional website. Any applicable international-transfer requirements are addressed as described in section 8. 

12. Marketing preferences 

You may withdraw consent to newsletters, legal updates and event invitations at any time using the unsubscribe mechanism provided or by contacting office@umami.law. 

Withdrawal does not affect the lawfulness of processing before withdrawal. 

You may also object to direct marketing at any time. We will stop using your personal data for that purpose. 

Unsubscribing does not affect communications necessary for an enquiry, engagement or legal obligation. 

113. Security 

We apply technical and organisational measures appropriate to the risks associated with the personal data we process, including appropriate controls over access, storage, communications and service-provider arrangements. 

No system or method of transmission is completely secure. If you need to send particularly sensitive information, please contact us to agree an appropriate method. 

14. Automated decision-making 

We do not make decisions about individuals based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect them. 

This does not exclude the use of software or AI-assisted tools to support our work. Such use remains subject to applicable data protection and professional confidentiality requirements. 

15. Your rights 

Subject to the conditions and exceptions in applicable law, you may request: 

• access to your personal data; 

• correction of inaccurate or incomplete data; 

• erasure of data; 

• restriction of processing; 

• portability of data, where applicable. 

You may object, on grounds relating to your particular situation, to processing based on legitimate interests. We may continue such processing where the law permits, including where necessary for legal claims. 

Your right to object to direct marketing is unconditional. 

Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing. 

Please contact office@umami.law or write to our registered office to exercise your rights. If we have reasonable doubts about your identity, we may request information necessary to verify it. 

We normally respond within one month. Where legally permitted, this may be extended by up to two further months, in which case we will explain the extension within the initial month. 

Rights are not absolute. Legal retention requirements, professional secrecy, legal claims and other individuals’ rights may affect what we can provide or delete. We will explain any applicable restriction to the extent legally permitted.

16. Complaints 

You may contact us with any privacy concern, but you do not have to contact us before lodging a complaint with a supervisory authority. 

The Luxembourg supervisory authority is: 

Commission Nationale pour la Protection des Données (CNPD) 
15, Boulevard du Jazz 
L-4370 Belvaux, Luxembourg 
Website: cnpd.public.lu 

You may also complain to the competent supervisory authority in the country of your habitual residence, place of work or the alleged infringement. 

17. External websites 

Our website may contain links to external websites. Their operators have their own privacy practices and notices. 

Following a link does not mean that this policy governs the processing carried out by the external website. 

18. Changes to this policy 

We may update this policy to reflect changes in our activities or legal requirements. The latest version will be published on our website with its revision date. 

Where required, we will provide additional information about material changes or new processing purposes. Updating this policy does not replace any consent or other legal requirement applicable to the processing.