Privacy statement
General
Labré advocaten, hereinafter referred to as Labré, respects your personal data and ensures that the personal information provided to us or otherwise obtained by us will be treated confidentially. Personal data concern all information about a person. Also data that say something about someone indirectly are personal data. With the following statement (hereinafter: “the Privacy Statement”), Labré complies with the obligation laid down in the GDPR to provide information to the data subject(s) whose personal data are processed by Labré. This Privacy Statement applies to all parties whose personal data we process (including but not limited to clients, other parties, website visitors, suppliers, and job applicants), with the exception of employees, contracted parties and/or other data subjects who perform work for Labré. A separate privacy statement applies to the last-named data subjects.
Controller
Office name: Labré advocaten
Address: De Lairessestraat 180C, 1075 HM Amsterdam, The Netherlands
Contact person: R.C.M. Andriessen
Telephone number: +31 (0)20 305 2030
E-mail: ln.erbal@ofni
Ch. of Comm. no.: 34375394
Purpose of processing personal data
Labré processes the personal data listed below for the purposes mentioned below:
- to provide legal services, including the execution of an agreement and the conduct of proceedings (court proceedings or out-of-court proceedings);
- to identify our clients in view of our statutory obligation to this end;
- to conduct our accounts;
- to collect invoices;
- consultancy, mediation and reference;
- to comply with our legal and statutory obligations;
- marketing and communication activities (including sending our newsletter);
- to analyse website use;
- recruitment and selection (job applications);
- communication with suppliers and other third parties;
- to protect our systems (IT systems and otherwise);
- to defend legal and other claims;
- other legitimate interests (business interests and otherwise).
Which personal data are processed?
Labré may process the following (types or categories of) personal data to provide its services:
- name, address, and residence data and other personal data required to be able to handle our cases or to be able to do business with you;
- your identity document (in view of our statutory obligation to this end);
- bank account number;
- IP addresses;
- to a limited extent: medical data (for instance in cases about incapacity for work);
- to a limited extent: criminal records (for instance in cases in which this is relevant);
- in the case of job applicants: data as included in the CV, including data about education and job experience and other data for the performance of the job;
- other information required for any of the purposes mentioned above.
Labré processes the personal data mentioned above because you provided them as a data subject on your own initiative, because they were obtained for the provision of services, because they were made known to us by third parties, including other parties, or because they have become known to us through public sources.
Lawfulness of processing personal data
Labré processes the above-mentioned personal data only on the basis of one or more of the grounds referred to in article 6 of the GDPR:
- legal obligation;
- performance of a contract;
- consent from the data subject(s);
- legitimate interest.
Sharing personal data with third parties
Labré will only share your personal data with third parties to the extent necessary for the provision of services, with due consideration for the purposes listed above. Examples are deputizing the practice by a different lawyer, performing a court-ordered expert examination (or having such an examination performed) or contracting a third party on Labré’s instructions (such as an IT supplier, website manager and/or translator), but also the provision of your personal data in connection with court proceedings and out-of-court proceedings (e.g. judicial authorities and/or the bailiff), or correspondence with the other party.
Labré may furthermore provide personal data to a third party, such as a supervising authority or other body with public authority, to the extent that a statutory obligation exists to this end.
Labré will enter into a processing agreement with the third party that processes your personal data on Labré’s behalf or instructions, as a result of which said third party is also obliged to comply with the GDPR. The third parties contracted by Labré, who provide services as controllers, are themselves responsible for compliance with the GDPR in respect of processing your personal data. These parties include accountants, civil-law notaries, or other third parties contracted for the purpose of a providing a second opinion or an expert report.
Protection of personal data
Labré attaches great importance to the security and protection of your personal data and, taking account of the state of the art, it ensures that appropriate technical and organizational measures are in place to guarantee a security level that is proportional to the risk. In the event that Labré uses third-party service providers (such as an IT supplier), Labré will lay down agreements on adequate security measures in a processing agreement for the purposes of the protection of personal data.
Retention period of personal data
Labré will keep your personal data in respect of the different situations or subjects during the periods specified below:
- case files: physical (paper) case files during a period of 7 years and digital case files (including the personal data related thereto) during a period of 10 years from the end of the financial year in which the file was closed;
- newsletter: up to and including the time at which you unsubscribe;
- complaints: during a period of 1 year from complete settlement of the complaint concerned;
- website visit: the IP addresses collected during a website visit are kept by Google during a period of 50 months (or a different period as set by Google). If and to the extent that data are forwarded to Google (or to Google’s servers) in the United States, Google has been certified on the basis of the EU-US Privacy Shield and provides an appropriate level of protection on that basis;
- job applications: during a period of 3 months from the completion of the application procedure concerned;
- supplier data: during a period of 7 years from the end of the financial year in which we used the supplier’s services or products for the last time;
- any other situations: during a period not longer than necessary for the purposes specified in this Privacy Statement or during a period required by laws and regulations.
The above-mentioned periods apply, unless there are compelling reasons for keeping the personal data longer (e.g. in pending or expected legal disputes), or unless the data are still needed for purposes other than those mentioned in this Privacy Statement.
Privacy rights of the data subjects
Please send a request for access to, rectification of, restriction of, objection to, or portability of data, removal of your personal data or withdrawal of any consent given previously to the contact details below. You will receive further information from us within four weeks after receipt of your request.
In the event that the processing of your personal data is based on your consent, you will have the right to withdraw your consent at all times (without prejudicing the legitimacy of the processing on the basis of the consent prior to your withdrawal). However, it is possible that the processing of your personal data is also based on a different ground, and in that case Labré will continue to process your personal data.
Circumstances may arise in which Labré cannot comply with your request as a data subject in full or in part, which include a lawyer’s obligation of confidentiality and statutory retention periods.
You can direct the requests referred to above to Ron Andriessen at the postal address or at ln.erbal@ofni. To know for certain that we provide the personal data concerned at your request to the right person, we kindly ask you for verification purposes to submit a copy of a valid passport, driving licence or identity document with the photo and BSN covered. Labré will only handle requests that relate to your own personal data.
You also have the right to submit a complaint to the Dutch Data Protection Authority (Dutch DPA). For this purpose, we refer to the website www.autoriteitpersonal data.nl.
Use of social media
In addition to our website, Labré is also a member of social media networks, such as LinkedIn. Labré does not monitor and is not responsible for the processing of your personal data by and through such third parties. Consequently, the use of such media is at your own risk. We recommend that you read the privacy statements of those third parties before using them.
Cookies and Google Analytics
Labré uses analytical and functional cookies. Analytical cookies are, for instance, used to keep statistics on the number of visitors to gain better insight into the functioning of the website and to be able to improve it. Functional cookies are used to ensure that our website functions properly. Finally, we use Google Analytics to analyse our website use.
No provision of personal data
What happens if you do not want to provide your personal data to Labré? As the provision of personal data is a contractual obligation if you want to use Labré’s services, as we are statutorily obliged to identify you in some cases, and as the provision of personal data is also necessary if you want to apply for a job, the refusal to provide specific personal data may prevent us from doing business with you, contacting you and/or continuing with an application procedure.
Adjustment to Privacy Statement
Labré has the right to amend the content of this Privacy Statement at any time desired without prior notification. Any adjustments to the Privacy Statement will be published on our website.
Questions & Contact
If you have any questions or comments about the processing of your personal data and this Privacy Statement, please contact Ron Andriessen at our postal address or at ln.erbal@ofni.