Basnet Law Pte. Ltd. (the "Firm", "we", "us") is a law firm incorporated in the Gelephu Mindfulness City Special Administrative Region ("GMC"), Kingdom of Bhutan. This Privacy Policy explains what personal data we collect through basnetgmc.com and in the course of providing legal services, how we use and protect it, and the rights you have in relation to it.
Effective date: 2 February 2025. Revised: 19 September 2026.
1. The law that governs this Policy
Under the Application of Laws Act 2024, the applied Personal Data Protection Act 2012 applies in GMC as amended from time to time, with the modifications that Act provides. The Spam Control Act 2007 governs commercial electronic messages, and the Electronic Transactions Act 2010 governs electronic records, signatures and contracts. The GMC Authority administers and enforces these Acts in GMC. This Policy is written to meet the obligations of the Personal Data Protection Act as so applied: consent, purpose limitation, notification, access and correction, accuracy, protection, retention limitation, transfer limitation and data breach notification.
Where we act for clients, we are also a Designated Non-Financial Business or Profession for the purposes of the Financial Services Act 2025 and the AML and Sanctions Rulebook, and some of the personal data we collect is collected because those rules require us to identify and verify our clients and the persons who own or control them.
2. Personal data we collect
Information you give us. When you contact us, subscribe to our updates, book a consultation or engage us, we collect the details you provide: name, organisation, role, email address, telephone number, postal address, and the content of your enquiry or instructions.
Client due diligence information. Before we act for a client, we collect identity documents (passport or national identity card), proof of address, corporate constitutional documents, registers of directors and controllers, information on beneficial owners holding or controlling more than 25 percent of a client entity, and where relevant information on source of funds and source of wealth, together with screening results for politically exposed person status and sanctions.
Information collected automatically. Our website records technical information including IP address, browser type and version, device type, the pages you visit, the time and date of your visit, referring and exit pages and click behaviour. We use cookies and similar technologies as described in section 6.
3. Purposes for which we use personal data
- To respond to enquiries and provide, manage and improve our legal services.
- To carry out customer due diligence, ongoing monitoring, sanctions screening and record keeping required by the Financial Services Act 2025 and the AML and Sanctions Rulebook.
- To comply with other legal and regulatory obligations, including requests from the GMC Authority, the Gelephu Financial Services Office, the Registrar of Companies, the Comptroller of Income Tax and courts of competent jurisdiction.
- To send legal updates, publications and event invitations where you have consented or where the Spam Control Act 2007 otherwise permits, always with a working unsubscribe mechanism.
- To operate, secure and analyse our website, prevent fraud and enforce our terms.
We collect personal data only for purposes that a reasonable person would consider appropriate in the circumstances, and we tell you the purpose at or before the time of collection.
4. Consent and withdrawal
By providing personal data to us, or by continuing to use our website after being notified of this Policy, you consent to the collection, use and disclosure of your personal data for the purposes described here. You may withdraw consent at any time by writing to office@basnetgmc.com. We will explain the likely consequences of withdrawal, which may include our inability to continue acting for you where the data is required by law, and we will stop using the data within a reasonable time unless retention is required by law.
5. Log files
Like most websites, basnetgmc.com keeps server log files. They record IP addresses, browser type, time stamps, referring and exit pages and click behaviour. This information is used to analyse trends, administer the site, diagnose problems and improve security. It is not linked to identifiable individuals except where required to investigate a security incident.
6. Cookies and similar technologies
We use cookies to remember your preferences, keep the website functioning, and understand how visitors use it. You can refuse or delete cookies through your browser settings. Doing so may affect some website functions. We do not use cookies to serve third-party advertising.
7. Disclosure of personal data
We do not sell personal data. We disclose personal data only:
- to our staff and consultants who need it to provide our services, all of whom are bound by confidentiality;
- to service providers who host our website, email and document systems, or who provide identity verification and sanctions screening, under contracts that require them to protect the data;
- to regulators, registries, courts, tax authorities and law enforcement where the law requires or permits, including suspicious transaction reports that we are prohibited from disclosing to you;
- to counterparties, counsel, experts and courts as necessary to conduct your matter on your instructions;
- to a successor firm if our practice is transferred, subject to the same protections.
8. Transfers outside GMC
Our service providers and the counterparties in cross-border matters may be located outside GMC and outside Bhutan. Where we transfer personal data outside GMC we take steps to ensure that the recipient provides a standard of protection comparable to that required by the Personal Data Protection Act as applied in GMC, by contract or by reliance on the recipient's own binding obligations.
9. Retention
We keep personal data only as long as it is needed for the purpose for which it was collected or as the law requires. Client due diligence and transaction records are kept for at least five years from the end of the client relationship or completion of the transaction, as the AML and Sanctions Rulebook requires. Legal files are kept for as long as is needed to protect the client's and the Firm's legal position. Website log data is kept for a short period for security purposes and then deleted or anonymised.
10. Security
We apply administrative, technical and physical safeguards appropriate to the sensitivity of the data, including access controls, encrypted transmission, secure document storage and staff confidentiality obligations. No system is completely secure, and we cannot guarantee the security of information you send to us by email or through the website before it reaches us.
11. Data breach notification
If a data breach occurs that is likely to result in significant harm to affected individuals, or that is of a significant scale, we will notify the GMC Authority as the authority administering the Personal Data Protection Act in GMC, and the affected individuals, within the time the Act requires, and we will take steps to contain the breach and prevent recurrence.
12. Your rights
Under the Personal Data Protection Act as applied in GMC you may:
- ask us what personal data we hold about you and how we have used or disclosed it in the past year;
- ask us to correct an error or omission in your personal data;
- withdraw consent to our continued collection, use or disclosure of your data;
- ask us to stop sending you marketing messages.
We may refuse a request where the Act permits, for example where it would reveal personal data about another individual, where the data is subject to legal privilege, or where disclosure would reveal that a suspicious transaction report has been made. We will respond to requests within thirty days and tell you if we need longer.
Visitors from the European Economic Area or the United Kingdom may also have rights under the General Data Protection Regulation, including rights of access, rectification, erasure, restriction, objection and portability. Visitors from California may have rights under the California Consumer Privacy Act to know what data is collected, to request deletion, and to opt out of sales of personal data, which we do not make. Contact us to exercise any of these rights and we will respond in accordance with the applicable law.
13. Children
Our website and services are not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us and we will delete it.
14. Third-party websites
Our website may link to external websites. We do not control their content or data practices and this Policy does not apply to them. Read their privacy policies before providing personal data.
15. Changes to this Policy
We may revise this Policy to reflect changes in the law as applied in GMC, regulatory guidance or our practices. The current version is always published on this page with its revision date.
16. Contact and data protection officer
Requests, complaints and questions about this Policy or our handling of personal data should be addressed to the Firm's data protection officer:
Basnet Law Pte. Ltd., Suite 413, Level 4, Choego Building, Gelephu, Bhutan 31101. Email: office@basnetgmc.com. Telephone: +975 77 961648.
You may contact Basnet Law at basnet@basnetgmc.com or office@basnetgmc.com for any legal queries related to GMC.
