Legal
Privacy Notice and Policy
Effective date: September 25, 2026
Introduction
By Law Firm PLLC, doing business as ByLaw (“Firm,” “we,” “us,” or “our”) respects the privacy of individuals whose personal information we handle. This Privacy Notice and Policy explains how we collect, use, disclose, retain, and protect personal information in connection with our website, communications, recruiting, and legal services.
Our practice areas include trusts and estates; immigration, including non-immigrant and immigrant visas; corporate law; intellectual property; dispute resolution & litigation; and data, technology, privacy, and cybersecurity.
This notice applies to prospective and current clients, individuals involved in client matters, website visitors, business contacts, job applicants, and others whose information we process. Our role may differ by activity: we generally determine how information is processed to provide our legal services, but we may process some information under a client’s instructions.
Privacy requests: Contact info@thebylaw.org. You may also write to us at By Law Firm PLLC, 517 Cascada Ln, Round Rock, TX 78681.
This notice supplements, and does not replace, any matter-specific notice or engagement agreement. Nothing in it requires us to disclose privileged information, violate a professional obligation, or retain or delete information contrary to applicable law.
Personal Information We Collect About You
We collect information directly from you; from clients, their representatives, employers, family members, and other participants in a matter; from government agencies, courts, registries, and publicly available sources; from professional advisers and service providers; and, where applicable, through our website.
The information depends on the service requested:
| Category | Examples |
|---|---|
| Identifiers and contact details | Name, address, email address, telephone number, date of birth, and client or matter identifiers. |
| Government and identity information | Passport and visa details, immigration records, identity-document numbers, tax identification numbers, and documents needed for a legal matter. |
| Professional, employment, and education information | Employment history, compensation or job information, qualifications, licenses, education, references, and organizational affiliations. |
| Financial and transaction information | Billing details, payment information, financial records, ownership interests, assets, and information relevant to corporate, estate, or dispute matters. |
| Family and personal circumstances | Marital and family relationships, dependent information, beneficiary details, and other circumstances relevant to a matter. |
| Legal and case information | Instructions, correspondence, contracts, evidence, court or agency filings, claims, settlement information, and communications with us. |
| Sensitive information | Information described in “Sensitive Personal Information” below, when relevant and permitted. |
| Internet and device information | IP address, device and browser information, pages visited, and information collected through cookies or similar technologies, where used. |
| Communications and inferences | Messages, meeting or call information, and conclusions reasonably drawn from information supplied for a legal matter or business relationship. |
Some information is necessary to evaluate or perform an engagement, comply with law, verify identity, or make a filing. If it is not provided, we may be unable to respond to a request, accept or continue a matter, or complete a particular service. We will identify optional information where reasonably practicable.
Client Services
We use personal information to assess prospective matters; identify and communicate with clients; conduct conflict checks; provide legal advice and representation; prepare, review, and file documents; manage deadlines and records; bill and collect fees; and meet legal and professional obligations.
The information needed varies by practice area:
- Trusts and estates: We may process information about family members, beneficiaries, fiduciaries, assets, health or capacity where relevant, and estate-planning instructions.
- Immigration: We may process identity, nationality, travel, employment, education, family, immigration-history, and supporting-evidence information for non-immigrant and immigrant matters.
- Corporate law: We may process information about owners, officers, employees, counterparties, transactions, and compliance requirements.
- Intellectual property: We may process information concerning creators, inventors, applicants, owners, assignments, registrations, licensing, and disputes.
- Dispute resolution: We may process information about parties, witnesses, claims, evidence, proceedings, and settlement.
- Data, technology, privacy, and cybersecurity: We may process information about systems, personnel, data practices, incidents, affected individuals, and regulatory or contractual requirements.
We may receive information about people who are not our clients, including employees, relatives, witnesses, beneficiaries, and counterparties. Providing us with their information does not itself make them our clients.
Pre-Employment Verification
If you apply to work with the Firm, we may process your application, résumé, qualifications, professional history, references, interview information, and information needed to assess suitability and eligibility to work. Where permitted and appropriate for the role, we may conduct background or professional-licensing checks after providing any required notice or obtaining any required authorization. We use applicant information to evaluate applications, communicate with candidates, administer hiring, and meet applicable legal obligations.
Information Requests
When you contact us, subscribe to a communication, attend an event, or request information, we use the details you provide to respond, provide requested materials, manage our relationship, and maintain appropriate records. Contacting us does not, by itself, establish an attorney-client relationship. Please do not send highly sensitive information through an unsolicited message unless we have agreed on a suitable method for receiving it.
Business Visa and Immigration Planning
For employer-sponsored and other business immigration matters, we may process information about a sponsoring organization, its personnel, a foreign national, and relevant family members. This can include job duties, work locations, compensation, corporate records, immigration status, travel plans, and supporting documents. We use it to assess eligibility, advise on options, prepare submissions, communicate with authorized parties and agencies, and maintain the matter file.
Remote-Work and Cross-Border Immigration
Where we advise on remote work, mobility, or cross-border immigration questions, we may process information about an individual’s residence, citizenship, work arrangements, travel, employer, dependents, and intended destinations. We use this information only as relevant to the requested legal work and related administration.
Other Uses of Information
We may also use information to:
- protect confidential information and secure our systems;
- prevent fraud and investigate suspected misuse;
- establish, exercise, or defend legal claims;
- comply with court orders, professional duties, and other applicable requirements;
- administer our business and service-provider relationships; and
- send professional updates or event invitations where permitted, subject to applicable choices and opt-outs.
We do not use information collected for one purpose for a materially different, incompatible purpose without taking any steps required by applicable law, including providing a further notice or obtaining consent when necessary.
Sensitive Personal Information
Legal matters may require information concerning health, disability, racial or ethnic origin, religious belief, citizenship or immigration status, family relationships, sex life or sexual orientation, criminal history, genetic or biometric characteristics, financial-account access, or a child. We request and use such information only when relevant to the matter or another legitimate purpose, subject to applicable legal requirements.
Where consent is required to process sensitive information, we seek the required consent. For information governed by European data-protection law, we also identify an applicable condition for processing special-category information and, where relevant, comply with the rules governing criminal-conviction and offence data. We do not treat a general request for legal services as consent for every use of sensitive information.
We do not use sensitive personal information for advertising or to infer characteristics unrelated to the purpose for which it was provided.
Legal Basis
Where the GDPR applies, our legal bases depend on the particular processing:
| Activity | Potential legal basis |
|---|---|
| Taking steps requested by an individual before an engagement or performing an agreement with that individual | Necessity for pre-contractual steps or performance of a contract. |
| Providing services to an organizational client; communicating with its personnel or other matter participants; conducting conflict checks; protecting our systems; and administering our practice | Our legitimate interests or those of a client or another party, assessed against the individual’s rights and interests. |
| Meeting applicable recordkeeping, tax, reporting, or other legal requirements | Compliance with a legal obligation. |
| Sending optional communications or carrying out other activities for which consent is required | Consent, which may be withdrawn for future processing. |
| Establishing, exercising, or defending legal claims | The applicable legal basis and, for special-category information where relevant, the legal-claims condition. |
Depending on the information and jurisdiction, another specific legal basis or special-category condition may apply. We assess that basis for the activity in question rather than assuming that an engagement agreement with a client covers every person whose information appears in the matter.
Information We Collect by Automated Means
When you use our website, our systems may receive technical information such as your IP address, browser type, device information, referring page, and pages requested. We use cookies and similar technologies to operate and secure the site, including Google reCAPTCHA to protect our forms from spam and Cal.com for the booking calendar. We also use Google Analytics to understand how visitors use the site, but we turn it on only if you accept analytics cookies in our cookie banner.
You can manage cookies through available website controls and your browser settings. Blocking essential technologies may affect website functionality.
Advertising and sale of data: This notice is drafted on the basis that the Firm does not sell personal information, share it for cross-context behavioral advertising, or process it for targeted advertising. We therefore do not offer an opt-out for those activities. If these practices change, we will update this notice and provide any required disclosure and choice before undertaking them.
Information We Share
We may disclose information, only as relevant to the purpose and subject to applicable confidentiality and professional duties, to:
- Persons involved in a matter: Clients and their authorized representatives, counterparties, co-counsel, experts, translators, witnesses, and other participants where appropriate.
- Courts, agencies, and registries: For example, immigration authorities, courts, intellectual-property offices, and corporate registries when a matter calls for disclosure.
- Service providers: Providers of hosting, email, secure document exchange, practice-management, payment, accounting, security, and other business services.
- Professional advisers and insurers: Where needed for accounting, insurance, risk management, or legal advice to the Firm.
- Authorities or other recipients: Where disclosure is required by law or is reasonably necessary to protect rights, address misconduct, or respond to a lawful process.
- Successors: In connection with a lawful restructuring or transfer of business, subject to appropriate confidentiality protections.
For California residents, the categories of information described above may be disclosed for these business purposes to the corresponding categories of recipients, depending on the matter. On the basis stated in the preceding section, we have not sold or shared personal information, including sensitive personal information, for cross-context behavioral advertising during the preceding 12 months.
Where required, we use agreements that restrict service providers’ processing and require appropriate protection of information. Disclosures in legal matters may also be governed by an engagement, client instructions, procedural requirements, privilege, or a court order.
How We Protect Personal Information
We maintain administrative, technical, and physical measures designed to protect information in light of its nature and the risks involved. These may include access controls, authentication, staff training, secure storage and transmission practices, vendor oversight, and procedures for responding to suspected security incidents. No transmission or storage method is completely secure.
We restrict access to those with a legitimate need to know and address suspected incidents in accordance with applicable law and professional obligations.
Information We Transfer
The Firm is based in the United States. Depending on the matter and the service providers involved, personal information may be accessed, stored, or otherwise processed in the United States or other countries, including countries whose privacy laws differ from those of the country where the information was collected. Cross-border processing may be necessary to provide legal services, communicate with clients and matter participants, operate our systems, or meet legal and professional obligations. Information may also be disclosed to public authorities where lawfully required, subject to applicable confidentiality and professional obligations.
Your Choices and Rights
Your rights depend on your location, our role in processing the information, and applicable exceptions. You may submit a request to info@thebylaw.org or by mail to By Law Firm PLLC, 517 Cascada Ln, Round Rock, TX 78681. Please describe your request and provide enough information for us to locate the relevant records. We may reasonably verify your identity and an authorized agent’s authority before responding. We will respond within the time required by applicable law and explain any permissible refusal or extension.
Where applicable, you may have the right to:
- request access to or a copy of personal information, and information about how it is used or disclosed;
- request correction or deletion;
- request a portable copy of information;
- object to or request restriction of certain processing;
- opt out of a sale of personal information, sharing for cross-context behavioral advertising, targeted advertising, or certain qualifying profiling, if such processing occurs;
- limit certain uses or disclosures of sensitive personal information where that right applies;
- withdraw consent, without affecting processing already lawfully carried out;
- appeal a refusal of a privacy request where state law provides an appeal; and
- exercise applicable rights without unlawful discrimination or retaliation.
If the GDPR applies, you may also have the right to lodge a complaint with the data-protection supervisory authority in the EU or EEA country concerned. You may object at any time to processing for direct marketing. We do not make decisions about individuals solely by automated means that produce legal or similarly significant effects.
To stop receiving optional marketing communications, use the unsubscribe method in the message or email info@thebylaw.org. This does not stop communications necessary for an existing matter or required by law.
Privacy rights are not absolute. For example, we may need to preserve records to meet legal obligations, protect privileged or confidential information, or establish, exercise, or defend legal claims. If we decline a request, we will provide an explanation to the extent required and permitted. To appeal a decision where an appeal right applies, email info@thebylaw.org with “Privacy Request Appeal” in the subject line.
How Long Do We Retain Your Information
We retain information only for as long as reasonably necessary and proportionate for the purposes described in this notice, taking account of the type of information and the obligations associated with it. Because legal matters, filing requirements, professional duties, and potential claims differ, no single fixed period accurately describes every record. We apply the following criteria by category:
| Information | Retention criteria |
|---|---|
| Client and matter files, including identity and sensitive supporting documents | The duration of the matter and the applicable file-retention period determined by professional duties, client arrangements, relevant law, and reasonably anticipated claims or proceedings. We may retain particular documents longer where required by a hold or continuing obligation. |
| Billing, payment, and business records | The period required for accounting, tax, audit, dispute, and other applicable obligations. |
| Prospective-client and conflict-check records | The period reasonably needed to respond to the inquiry, document decisions, identify and manage conflicts, and protect legal rights. |
| Applicant and recruitment information | The hiring process and the period reasonably needed to meet employment-related obligations or address claims, unless a longer period is agreed or required. |
| Website and technical records | The period reasonably needed for site operation, security, troubleshooting, and any applicable legal obligation, according to the relevant system or provider’s settings. |
When retention is no longer justified, we delete, destroy, or de-identify information as appropriate, subject to feasible backup-cycle and legal-hold requirements. If a particular retention period can be identified for information collected from you, we will provide it in a relevant supplementary notice where required.
Updates to Our Privacy Notice
We may update this notice to reflect changes in our practices or applicable requirements. We will post the revised notice with a new effective date and provide additional notice or seek consent when required. A change to this notice does not, by itself, authorize an otherwise unlawful new use of information.
How to Contact Us
By Law Firm PLLC (ByLaw) 517 Cascada Ln, Round Rock, TX 78681 United States
Privacy and data-subject rights requests: info@thebylaw.org
General firm email: info@thebylaw.org
Please direct privacy requests, including requests to exercise rights or appeals, to info@thebylaw.org.