1. Who We Are

Horizon Law Firm («we», «us», «our») is a law firm registered and operating in Iraq, with offices at Arrasat Al Hindyea, Baghdad, Iraq. We operate the website thehorizonlaw.com (the «Site»).

We are committed to protecting your personal data and respecting your privacy in accordance with Iraqi law and, where applicable, the EU General Data Protection Regulation (GDPR) for clients and contacts based in the European Economic Area.

For GDPR purposes, Horizon Law Firm is the data controller of personal data collected through this Site.

2. Data We Collect

We collect personal data in the following circumstances:

When you contact us or submit an enquiry

• Full name
• Email address
• Phone number (if provided)
• Company name and role (if provided)
• The content of your message or enquiry

When you visit our website

• IP address and browser type (via analytics tools)
• Pages visited, time on site, and referral source
• Cookie data (see Section 8)

3. How We Use Your Data

We use your personal data for the following purposes:

• To respond to your enquiry and provide legal services
• To assess whether we can assist with your legal matter
• To communicate with you about your matter or our services
• To comply with our legal and regulatory obligations as a law firm
• To improve the performance and content of our website
• To send relevant legal updates or insights (only where you have consented)

We do not use your data for automated decision-making or profiling.

4. Legal Basis for Processing (GDPR)

For individuals located in the European Economic Area, our legal bases for processing personal data are:

• Legitimate interests — responding to enquiries and managing client relationships
• Contract performance — where we are engaged to provide legal services
• Legal obligation — compliance with applicable laws and professional regulations
• Consent — for any marketing communications (which you may withdraw at any time)

5. Sharing Your Data

We do not sell, rent, or trade your personal data. We may share your data only in the following limited circumstances:

• With professional advisors or co-counsel where required for your matter, under confidentiality obligations
• With IT and website service providers who process data on our behalf (under data processing agreements)
• With regulatory or government authorities where required by Iraqi law or court order
• With your explicit consent

Where data is transferred outside Iraq or the EEA, we ensure appropriate safeguards are in place in accordance with applicable data protection law.

6. Data Retention

We retain personal data for as long as necessary for the purposes for which it was collected, and in accordance with our professional obligations as a law firm.

• Enquiry data (where no engagement follows): up to 12 months
• Client matter data: in accordance with Iraqi legal and professional retention requirements (typically 7 years following matter closure)
• Website analytics data: as configured by the analytics provider, typically 26 months

After the applicable retention period, data is securely deleted or anonymised.

7. Your Rights

Depending on your location and applicable law, you may have the following rights regarding your personal data:

• Access — to request a copy of the personal data we hold about you
• Rectification — to request correction of inaccurate data
• Erasure — to request deletion of your data (subject to legal retention obligations)
• Restriction — to request that we limit processing of your data
• Portability — to receive your data in a structured, machine-readable format (GDPR)
• Objection — to object to processing based on legitimate interests
• Withdraw consent — at any time, where processing is based on consent

To exercise any of these rights, please contact us using the details in Section 11. EU residents also have the right to lodge a complaint with their national data protection authority.

8. Cookies

Our website uses cookies to improve your browsing experience and analyse site traffic. Cookies are small text files stored on your device.

• Essential cookies — required for the website to function
• Analytics cookies — to understand how visitors use our site (e.g. Google Analytics)
• Preference cookies — to remember your settings

You can control cookies through your browser settings. Disabling certain cookies may affect website functionality. Where required by law, we obtain your consent before placing non-essential cookies.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include secure server infrastructure, encrypted communications, and restricted internal access to personal data.

As a law firm, we are also bound by professional confidentiality obligations that reinforce the protection of all client information.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, our practices, or our services. The date at the top of this page indicates when the policy was last revised. We encourage you to review this page periodically.

11. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us: