We respect your privacy and ensure that all personal data provided to our office or otherwise obtained by us are treated confidentially. In part to comply with the information obligation laid down in the General Data Protection Regulation (“GDPR”), we use this privacy statement to inform data subjects about the manner in which our office processes their personal data.
For what purposes do we process personal data?
We process personal data in order to be able to offer and provide services, to improve our services and to be able to communicate personally with you as a data subject. We do this exclusively for the purposes stated below:
- providing legal services in order to execute assignments given to us, including providing advice on Dutch law and conducting (legal) proceedings, and everything that is necessary or useful for this;
- referring to others those who turn to us for any form of (legal) assistance;
- drawing up, sending and collecting invoices;
- to comply with our contractual and legal obligations, including those under the Money Laundering and Terrorist Financing (Prevention) Act (Wet ter voorkoming van witwassen enfinanciering van terrorisme (“WWFT”));
- to carry out marketing activities, including organising events and providing information about our services;
- to recruit and select new employees (including assessing applications).
What personal data do we process?
We process the following (types or categories of) personal data for the purposes of our business activities:
- contact details such as name, address, e-mail address, telephone number (and in the case of (officials of) our clients, usually also a copy of their identity document);
- other personal data that are relevant to the files we handle, including confidential personal data that we collect for the purpose of handling any case.
We derive these personal data from information that is provided to us by our clients or third parties (including advisors and counterparties of our clients) or that can be found in public sources (such as the Trade Register, the Land Registry and social media platforms).
On what grounds do we process personal data?
We process the above-mentioned personal data exclusively on the grounds mentioned below (as intended and further described in article 6 of the GDPR):
- the execution of an agreement;
- the giving of consent by a data subject;
- compliance with a legal obligation;
- serving any interest as referred to in section d), e) or f) of article 6 paragraph 1 of the GDPR.
With whom do we share the personal data processed by us?
We only share your personal data with third parties to the extent that this is necessary for our activities and always in compliance with the purposes mentioned above. This includes observation of the practice by another lawyer, the (commissioning of) an expert investigation or the engagement of another third party, such as an IT supplier, but also the provision of your personal data in connection with (legal) proceedings or correspondence with any client or counterparty. In addition, we may provide personal data to a third party, such as a supervisory authority or another body vested with public authority, to the extent that there is a legal obligation to do so.
A processing agreement is concluded with each third party that processes your personal data on behalf of our office to ensure that the third party also complies with the GDPR. Third parties engaged by us, who provide services as independent controllers, are directly responsible for compliance with the GDPR for the (further) processing of your personal data. This includes an accountant, notary or a third party engaged for a second opinion or expert report.
We do not keep track of any data (such as IP addresses) from visits to our website and do not place cookies with visitors. Our website does contain links to third-party websites (including LinkedIn). We do not monitor and are not responsible for the processing of your personal data by and via such third parties. The use of these websites is therefore at your own risk. Before using the services of such third parties, it is advisable to first take note of the policy of those third parties with regard to the processing of personal data.
How are the personal data processed by us secured?
With a view to protecting your personal data, we have taken appropriate technical and organisational measures, taking into account the state of the art, the implementation costs, as well as the nature, scope, context and purposes of processing and the varying likelihood and severity of the risks to the rights and freedoms of individuals, to ensure a level of security appropriate to the risk. The processing agreements concluded by us with third parties contain agreements on the security measures to be taken by those third parties.
How long do we store the personal data processed by us?
We do not store the personal data processed by us for longer than is necessary for the aforementioned purposes of data processing or is required by applicable laws and regulations.
What are your rights in connection with the processing of personal data by us?
For your rights in relation to the processing of your personal data by us, we refer to the provisions of Articles 15 to 20 of the GDPR. Questions about our processing of personal data, requests for access, rectification, erasure, issuance, transfer or restriction of the processing of personal data, and notifications aimed at withdrawing previously given consent or objecting to the processing, can be sent to us via the contact details at the bottom of this privacy statement. You will then receive a message from us within four weeks of receipt of your question, request or notification.
Circumstances may arise that prevent us from responding to your question, request or notification. This includes the rejection of a request for access due to the statutory confidentiality obligation incumbent on us and the rejection of a request for erasure due to the statutory retention periods applicable to our office.
In order to ensure that we provide the personal data collected by us to the correct person in response to your request, we may ask you to submit a copy of a valid identity document for verification purposes. In principle, we will only process a question, request or notification from you if that question, request or notification relates to your own personal data.
If you do not agree with our processing of your personal data or the way in which we process your personal data, you can also file a complaint with the Dutch Data Protection Authority.
Changes to this privacy statement
We reserve the right to change the content of this privacy statement at any time without prior or subsequent notice, for example due to a change in the applicable laws and regulations or an extension of the categories of personal data that we process. Changes to our privacy statement will be published on our website. Therefore, consult our website regularly.
Contact details
Griffiths Lawyers
Sarphatistraat 370
1018 GW Amsterdam
PO Box 94794
1090 GT Amsterdam
020 – 462 23 00
info@griffiths advocaten.nl
www.griffiths advocaten.nl
Chamber of Commerce 50577190
Version April 2019