Privacy policy

1. Who we are

Faisal Al Rashdi Advocates & Legal Consultants ("FALC", "we", "us") is a law firm registered in the Sultanate of Oman. [VERIFY: licence number and registering authority under Royal Decree 41/2024.]

For the purposes of the Personal Data Protection Law issued by Royal Decree 6/2022 and its Executive Regulation issued by Ministerial Decision 34/2024, FALC is the controller of the personal data described in this policy.

Our contact details

Office 505, Dar Al Noor, 5th Floor
Madinat Sultan Qaboos, Muscat
Sultanate of Oman
+968 246 00 443
info@falc.om

Data Protection Officer

[VERIFY: name or role title, and a direct email address. The PDPL requires these details to be publicly available. The regulator prefers the DPO to be located in Oman.]

2. What this policy covers

This policy explains how we handle personal data collected through this website, and personal data we receive when you contact us or engage us.

Personal data that we process while acting for a client is also subject to our professional duties of confidentiality and to our terms of engagement. Where this policy and a signed engagement letter differ, the engagement letter governs the matter it relates to.

3. The personal data we collect

When you use the enquiry form

• Your name
• Your email address
• Your telephone number, if you provide one
• Your company or fund, if you provide one
• The type of enquiry you select
• The practice area you select, if any
• The content of your message
• The date and time of submission

When you email or call us

Whatever you choose to tell us, including your contact details and the substance of your enquiry.

When you apply for a role

Your CV and any accompanying information, including employment history, qualifications and references.

Automatically, when you visit the website

• Your IP address
• Browser type and version
• Device type and operating system
• Pages visited and time spent
• The referring page

[VERIFY: this list must match what the site's analytics actually collect. If no analytics are installed at launch, this section shrinks accordingly. Do not describe collection that does not occur, and do not omit collection that does.]

Sensitive personal data

We do not ask for sensitive personal data through this website. Processing sensitive personal data in Oman requires a permit from MTCIT under the Executive Regulation. Please do not send sensitive information through the enquiry form.

4. Where the data comes from

Most personal data we hold about you comes directly from you. In the course of legal work we may also receive personal data about you from a client who has instructed us, from a counterparty, from a public register, or from a court or regulator.

5. Why we process personal data, and on what basis

We do not use your personal data for marketing unless you have asked us to, and we do not sell personal data to anyone.

6. Consent, and how to withdraw it

Where we rely on your consent, that consent is explicit, informed and freely given, and you may withdraw it at any time by writing to [DPO email].

Withdrawing consent does not affect processing that already took place, and it does not affect data we are required to keep by law or by our professional obligations.

7. Who we share personal data with

We share personal data only where it is necessary:

• With service providers who host the website, deliver our email, or provide IT support, and only on terms that require them to protect the data
• With courts, arbitral tribunals, regulators or opposing parties, where a matter requires it
• With authorities where we are required to disclose by Omani law
• With professional advisers and insurers where necessary

We do not share personal data for any other purpose.

[VERIFY: list the actual processors once hosting, email and any analytics provider are chosen. The PDPL expects the disclosure to be real, not generic.]

8. Transfers outside Oman

Some of our service providers may store or process personal data outside the Sultanate of Oman.

Where personal data is transferred outside Oman, we do so on the basis of your consent and only where the recipient provides a level of protection not less than that required by Omani law. We do not transfer personal data where doing so would prejudice national security or the higher interests of the Sultanate.

[VERIFY: identify the destination countries once the hosting and email providers are chosen.]

9. How long we keep personal data

We delete or anonymise personal data when the period ends, unless we are required to keep it.

10. Your rights

Under the Personal Data Protection Law you have the right to:

• Be informed about how your personal data is processed
• Obtain a copy of the personal data we hold about you
• Correct personal data that is inaccurate or incomplete
• Request deletion of your personal data
• Request transfer of your personal data
• Withdraw consent where our processing relies on it

How to exercise them. Write to [DPO email] or to the postal address above. We will respond in writing within 45 days.

When we may refuse. We may decline a request that is unjustifiably repetitive, or that would require extraordinary effort. We may also be unable to delete data we are required to keep by law or by our professional obligations. If we refuse, we will tell you why.

If you are not satisfied. You may complain to the Ministry of Transport, Communications and Information Technology within 60 days. If the Ministry does not respond within the period set by the Executive Regulation, the complaint is treated as rejected, and you may escalate as that regulation provides.

11. Security

We apply technical and organisational measures appropriate to the risk, including access controls, encryption of data in transit, and confidentiality obligations on everyone at the firm.

If a personal data breach occurs that poses a risk to your rights, we will notify the regulator within 72 hours and will notify you within the same period where the breach is likely to cause serious harm.

12. Cookies and third-party content

Cookies on this site

This site uses only the cookies it needs to function, such as remembering your language preference. These do not identify you and are not used for tracking or advertising.

The contact page displays a map provided by Google. When you visit that page, Google receives your IP address and may set cookies, under Google's own privacy terms. [VERIFY: the map now loads automatically, by client instruction of 30 August 2026, replacing the click-to-load pattern. A FALC reviewer must confirm this disclosure and the PDPL position before publication.]

13. Children

This website is not directed at children and we do not knowingly collect personal data from them.

14. Changes to this policy

We may update this policy. The date at the top shows when it last changed. Where a change is significant we will say so on this page.