Privacy Policy

1. Introduction and scope

Moza Al Raqmi Law Firm (the “Firm”, “we” or “us”) respects the privacy of website visitors, people who contact us, clients and representatives of organisations with which we deal. This policy explains how we collect, use, retain, disclose and protect personal data through the website, enquiries and consultation requests, connected communications, and any client portal or digital assistant made available through it. It should be read with any service-specific notice and engagement agreement. If a service requires further data or processing, we will explain that at collection. Merely using the website or sending an enquiry does not establish a lawyer–client relationship or mean that the Firm has accepted a mandate. This policy concerns information about natural persons, including company representatives; mentioning a feature does not mean that it is active at all times.

2. Controller and contact details

The controller for the purposes described here is Moza Al Raqmi Law Firm, Office 18, First Floor, Al Dar Building, Al Athaiba South, Bousher, Muscat, Sultanate of Oman. For general enquiries and privacy requests, email info@mra-lf.com with “Personal Data Request” in the subject line. The Firm’s designated personal data protection officer may also be contacted through that address, clearly marking the privacy matter. We verify a requester’s identity and authority before disclosing or changing data and may seek proportionate verification. The approved officer’s name and direct contact route must be inserted on this page before final publication: [officer name and contact route].

3. Personal data we collect

Depending on your interaction with us, data may include: (a) name and contact details such as email and telephone number; (b) company, role and representative details; (c) requested service, a matter summary, dates, correspondence and documents you choose to provide; (d) identity, authority, billing, payment and professional relationship records when needed for an engagement; (e) client-portal account and access logs if the portal is enabled; (f) technical information such as IP address, browser type, time, security logs and cookies actually used by the site; and (g) information entered into a digital assistant if one is available. Please do not send health or criminal data, children’s information or highly sensitive documents through a general enquiry form. If a legal matter requires them, the Firm will identify a secure channel, purpose, safeguards and any required permit before processing.

4. Sources and collection methods

We receive information when you complete a form, request a consultation, email or call us, visit the office or use the client portal. We may also receive it from an authorised representative, matter records, official bodies or lawfully accessible records, or a related party where necessary and lawful for the service. Where appropriate, we identify the source and type of indirectly obtained data and limit collection to the stated purpose. Public availability does not make information free for every use; law, professional confidentiality and the needs of the matter still apply.

5. Purposes and legal basis

We process data to respond to enquiries, identify an appropriate service and arrange consultations; verify identity, authority and conflicts of interest; prepare proposals, accept engagements, provide legal services and manage matters, deadlines and communications; operate a client portal and protect accounts; issue invoices and meet professional, accounting and legal duties; secure the website and prevent misuse; and send marketing only with the required separate express consent. Where required, we rely on demonstrable express consent, or a specific exception under the amended law, including compliance with a legal obligation or performance of a contract to which the individual is a party where that contract explains the processing, as applicable. We explain the purpose and nature of processing when seeking consent and obtain any new consent required for a changed purpose. This policy alone is not your consent.

6. Enquiries and conflict checks

For an enquiry or consultation request, we normally receive the name, email address, telephone number, company if any, service type and a matter summary, as shown in the site interface. We use them to respond, assess and organise the request in a client relationship management system with restricted access. We may ask for names of relevant parties to check conflicts before receiving confidential details or documents. At the initial stage, provide a brief description rather than trade secrets or sensitive case files until the Firm identifies an appropriate channel and confirms that it can consider the mandate. Declining an engagement does not permit unlawful use or disclosure of the information.

7. Client files and online portal

Once an engagement is accepted, the matter file may contain information about the client, other parties, witnesses, employees and experts as necessary to provide the service and protect rights. Access follows work needs, approved permissions and professional confidentiality. If a client login portal is available, account, authentication and activity records are used to grant authorised access, secure the file and support service delivery. Users must protect credentials and promptly report unauthorised access. The engagement terms or a specific notice will describe any further portal functions, upload categories and authorised roles. A document in the portal is not necessarily visible to every user within a client organisation.

8. Digital assistant and automated processing

If an AI assistant is available on the site, questions, messages and technical data necessary to answer and secure the service will be processed under a notice presented when it is used, identifying the provider and any different storage or sharing arrangements. Do not enter case facts, confidential information or sensitive data before a conflict check and secure channel are established. Automated replies are general information, not tailored legal advice or acceptance of an engagement. We will not make a decision with significant legal effect on an individual solely through automated processing without safeguards and human review required by law. An individual may object to a decision arising from automated processing and request human review under the applicable procedure. Before enabling an external tool, we review processor and transfer arrangements and update the relevant notice.

9. Special categories and children

Legal files may include health, biometric or criminal information, children’s data or other categories requiring special protection or a permit. We process such information only when necessary and lawful and after meeting applicable consent, permit and safeguard requirements; voluntary submission does not remove those requirements. The site is not directed at children for independent use. A parent or legal representative should contact us about a child’s matter. We restrict access and avoid displaying this information in a public channel, marketing form or open chat.

10. Cookies and similar technologies

Cookies or similar technologies may be necessary to operate the site or login, protect a session and remember language choice. If non-essential analytics or advertising tools are used, we identify their names, purposes, duration and providers in a preference panel or updated notice and seek consent before enabling them where required. You may block or delete cookies in your browser, although some functions may be affected. Continued browsing does not replace express consent where required.

11. Marketing and professional updates

We do not use an enquiry to send targeted advertising or marketing merely because someone requested a consultation. If a person wishes to receive newsletters, invitations or promotional professional content, we seek separate express consent, retain evidence of it and provide an unsubscribe method in relevant messages. Consent may be withdrawn and marketing stopped free of charge through the unsubscribe link or the email above; we stop such communications as the law requires. Messages necessary to answer an existing request, perform an engagement or comply with a legal duty are separate from marketing.

12. Disclosure and recipients

We do not sell personal data. We may share what is necessary with authorised Firm personnel; hosting, technical support, client management, messaging and payment providers acting under appropriate instructions and safeguards; and lawyers, experts, translators or professional partners where the service requires it, subject to client authority or another applicable basis. Data may be presented to courts, competent bodies, public authorities or opposing parties to the extent required by a procedure, law or defence of rights. We assess confidentiality and permissions and restrict a service provider from using data for unrelated independent purposes. We update relevant disclosures when a new provider or material change in recipient categories requires it.

13. Processing and transfer outside Oman

Cross-border legal services or technology may require disclosure to an entity outside Oman. We assess the need for transfer, the recipient and country, protection level, risks and contractual and technical safeguards. We obtain the individual’s consent where required and verify any additional approvals for special categories, subject to specific statutory exceptions. If a service involves an actual transfer, we explain its material particulars in its notice or agreement before transfer as required.

14. Retention and erasure

We retain data while its specified processing purpose continues, then erase or irreversibly de-identify it as the law requires. If there is an existing dispute with the individual or a legal duty, judgment or court order requiring retention, we retain only what is necessary under appropriate access controls. In practice, an unconverted enquiry, client file, financial record and security log may have different periods. Internal retention schedules identify the reason, start, end, review and deletion method for each category. We do not promise one universal or indefinite period. On expiry we arrange secure deletion or anonymisation, including relevant processor copies under the applicable arrangements.

15. Security and incidents

We apply organisational and technical measures proportionate to the data and risks, including restricted access, user authentication, staff account management, protection of channels, copies and systems, staff training and provider review. No electronic channel is completely risk-free; please do not send secrets or sensitive records through an unapproved channel. Suspected unauthorised access can be reported promptly to info@mra-lf.com. We investigate, contain and remediate incidents, notify the Ministry within 72 hours of awareness if a breach threatens individuals’ rights, and notify affected individuals within the same period if it causes serious harm or high risk, in accordance with the legal conditions.

16. Your rights

Subject to statutory conditions and exceptions, you may request information about what we process and why, access and a copy, correction or update, portability where applicable, and erasure when the purpose ends or another legal ground arises. You may withdraw consent without affecting prior lawful processing, stop direct marketing, and object to a decision arising from automated processing and request human review. A request may be limited where it conflicts with another person’s rights, confidentiality of their file, a legal duty or an existing dispute; we will explain an applicable limitation as far as the law permits. Exercising a right does not require more information than is needed to verify identity and authority.

17. Rights requests and complaints

Send a written request to info@mra-lf.com specifying the right and preferred reply channel. The data protection officer or authorised team will verify and respond without a charge for exercising the right within no more than 45 days under the regulation; we may ask for clarification if the request is unclear. If dissatisfied, you may complain to the Ministry of Transport, Communications and Information Technology under its channels and rules, noting the regulation’s 30-day period from definite knowledge of the violation. We welcome an opportunity to resolve the concern directly without limiting your right to complain. Do not send an entire case file where a reference and limited verification details will suffice.

18. External links and changes

The site may link to judicial or government platforms, partners and external services. Once you leave our site, those organisations process information under their own policies; read them before providing data. We review this policy when law, features, providers or processing change. We publish a last-updated date, communicate material changes appropriately and obtain new consent where required. General policy wording does not replace a specific notice for a new service or processing activity.

19. Applicable law and effective date

This policy is governed by the Oman Personal Data Protection Law issued by Royal Decree 6/2022 as amended by Royal Decree 68/2026, its Executive Regulation issued by Ministerial Decision 34/2024, and other applicable Omani law. Nothing here limits professional confidentiality or individuals’ statutory rights. Publication approval date: 13 October 2026. Last editorial review: 29 September 2026.