Privacy Statement
(Version 1 March 2021)
This privacy statement contains information about how our law firm processes your personal data.
Wintertaling B.V. (hereinafter: Wintertaling) respects your personal data and ensures that the personal data that you provide us with or that we obtain otherwise will be handled with care. This concerns all information related to persons. By means of the following Wintertaling implements its obligations arising from the General Data Protection Regulation (GDPR) concerning the obligation to provide information to the data subject(s) whose data Wintertaling processes.
Applicability
This privacy statement is applicable to everybody who visits our website, to those whose personal data Wintertaling receives in the context of the services that Wintertaling provides and to the employees or other people providing services for Wintertaling. For example: (potential) clients, professional relations, those who receive our newsletters, visitors of our website, those who contact Wintertaling, employees or people in service of Wintertaling.
Which data will be processed?
Depending on the type of dossier that we process for you or the way in which you contact us, we will process all or some of the following personal data concerning you:
- • Your name, address, date- and place of birth, your personal identity number and a copy of your identity card, your e-mail address and your phone number;
- Information concerning your education and professional background, and potentially other information that you have provided us with in application letters and CV’s;
- Information about your status as UBO (Ultimate Beneficial Owner) or Politically Exposed Person or your connection as family member or close associate of aforementioned persons (within the meaning of Dutch compliance obligations: de Wet ter voorkoming van witwassen en financieren van terrorisme (Wwft));
- Information about the composition and origin of your assets;
- Information about you as a part of your case file;
- Information about your browsing behaviour and interest in marketing products.
How do we acquire your data?
- You have provided us with your data. For example when you are our client, or when you sign up for news letters or events, via contact- or online forms or if you respond to advertisements or vacancies on other platforms.
- We have acquired your data because you have accepted cookies or because you have made use of our website or mailings in another way.
- We have acquired or requested information from other sources. For example, personal data that has been acquired from the Trading Register of the Chamber of Commerce or from the land register, or personal data available on public corporate websites and social media (LinkedIn).
Purposes
Wintertaling collects personal information about individuals for the following purposes:
- Carrying out legal assignments, legal assistance in procedures or transactions or any other legal services performed by us or by third parties engaged by you or us;
- To comply with our legal obligations;
- To develop and improve our services to you, such as conducting our events and activities, extending and processing invitations to attend or participate in our events and activities;
- To inform you about legal developments;
- To invoice services which are provided to you;
- To secure and improve our website;
- Employer’s administration;
- Financial administration;
- Recruitment; or
- Purposes for which you explicitly gave us your permission.
Your personal data will not be processed for any other purpose without your permission.
The legal basis for the processing of personal data
Wintertaling will only process your data if this is allowed for processing based on the General Data Protection Regulation. The legal bases for processing are:
- The processing of your personal data is necessary for the execution of an agreement to which you are a party;
- Based on your permission; or
- Based on a statutory duty, the processing is necessary for compliance with a legal obligation.
Wintertaling may process your personal data if we have a legitimate interest and do not constitute a disproportionate invasion of your privacy. For example we use personal data to get in touch with you, when you approach us yourself, or when we reorganize our practice or merge into or transfer to another organization. If Wintertaling obtains your e-mail address by providing services, we can offer you similar services.
The storage period of your personal data
On the basis of the General Data Protection Regulation we may not keep your data longer than necessary for the purpose of processing.
- For data provided to the lawyers, your data is kept for at least 7 years and in some cases 20 years. The basis for this is, the minimum legal standard and the maximum legal or contractual liability period that follows from your file (liability of you towards third parties) and from our services (liability of us towards you or third parties).
- With regard to the personnel administration, the following applies: 2 years after the end of the calendar year in which the employment ended, unless longer-term reimbursement scheme in relation to study costs. If there is a legal dispute, this period is 2 years after the decision has become irrevocable. For identification and payroll tax declaration this term is 5 years after the end of the calendar year after the end of the employment.
- The collection and use of data for the financial administration has a storage period of 7 years.
- The collection and use of information by means of forwarding, concerning payroll administration has a storage period of 7 years.
- The collection of application data has a storage period of: in case of non-employment Wintertaling Corporate M&A will store this data for a maximum of 4 weeks after it has become clear that the position has been fulfilled. After permission from the person concerned, this data can be kept longer. For example for a future appropriate function.
- For all other purposes, your data will not be stored longer than it is necessary for the purpose of the processing.
Who have access to your personal data?
Wintertaling only provides personal information to third parties if this is legally required, we have received your permission or if this ensues from the contract of engagement that we conclude with you in order to carry out our services. We also engage third parties that process personal data in our assignment. For example, a party that takes care of our customer mailings and prints your name and address on envelops. Another example is the provider of IT services and -products that we use in the execution of our work. We can only engage third parties if this fits the purpose for which we have processed your personal data. In addition, third parties can only receive our order if they have taken appropriate security measures and guarantees confidentiality.
In the context of your assignment, in the interests of compliance with our legal obligations and in the interests of our organization, Wintertaling may provide personal information to, among others, the following recipients:
- Our staff; lawyers, support and student trainees;
- Providers of software, IT services and products, SaaS products or similar applications to support our practice. We work with: Xinno B.V., Teamleader N.V., Legalsense B.V., vBoxx B.V., JN Projects, Inc. acting under the name of HelloSign;
- Dutch Bar Association;
- Belastingdienst (Tax and Customs Administration);
- Registrars, such as the land register;
- Banks;
- Lawyers;
- Notaries;
- Bailiffs;
- Couriers;
- Brokers;
- Mortgage Advisors;
- Judicial authorities;
- Accountants or other advisors;
- Associations of owners and administrators;
- Your reciprocal or contracting party(ies).
Personal data will not be transferred by our office outside the European Economic Area, to third countries or to an international organization without an adequacy resolution being in place or without otherwise complying with chapter V of the General Data Protection Regulation, or in other circumstances without your prior permission, where the legal safeguards will always be observed and any necessary measures will be taken.
The security of personal data
Wintertaling will make every effort to take appropriate technical and organizational security measures to prevent the loss, misuse and alteration of your personal data.
Your rights
If your personal data are processed by our office, you can invoke the following rights based on the General Data Protection Regulation.
You can do this by making a (preferably written, including per e-mail) request via the contact details in this privacy statement. Before we grant your request, we will first identify you on the basis of a valid proof of identity. Wintertaling will only process requests that relate to your own personal data.
Right of information and notification
In order to ensure the transparency of the processing of personal data, you may request access to the personal data we process of you. You will be informed of any rectification or erasure of your personal data or limitation of the processing, unless this proves impossible or requires a disproportionate effort.
Right of objection
You have the right to object to our data processing.
Right of recall of approval
If you have been asked for permission for a particular processing operation, you are entitled to revoke this permission at any time.
Right of access of the used data
You can ask which personal data our office processes, for what purpose and for how long they are stored. There may be a legal basis that prevents us from responding to your request. We will assess this and inform you accordingly.
Right of rectification
If you believe that certain data has not been processed correctly, you have the right to request rectification of this data.
Right of data erasure (right to ‘oblivion’)
If you would like your personal data to be deleted, you can submit a request. We will process this request and inform you of our decision. If the data are contained in a procedural document, a notarial deed or any other existing document, the notary may not remove them.
Right of restriction of the processing
If you wish to limit the processing of personal data by our office (pending rectification of your personal data requested by you, objection to processing or because you do not wish data to be deleted despite the fact that the processing is unlawful), you can submit a request.
Right of transferability of data
If your personal data are not processed for a notarial deed and you wish to transfer the personal data to another service provider, you can submit a request. Such a transfer is not always possible, as legal or other obligations may object.
Right not to be subjected by automated individual decision making, including profiling
Unless it is necessary for the conclusion or execution of a contract or if you have given your consent, you have the right not to be subject to a decision based solely on automated processing, including profiling, which has legal consequences for you.
Possible restrictions on the exercise of your rights under the General Data Protection Regulation
Our office makes every effort to comply with your rights on the basis of the General Data Protection Regulation. However, these rights may conflict with other legal provisions or there may be an exception from the General Data Protection Regulation applicable. If, for this reason, we are unable to comply with one of the aforementioned requests, you will be informed of this in writing.
Contact details
Name office: Wintertaling
Address: Antonio Vivaldistraat 66
Zip code/City: 1083 HP Amsterdam
Contact Person: Marein Smits
E-mail address: marein.smits@wintertaling.com
Complaints about the processing of your personal data by our office
If you have any complaints about the processing of personal data by our office, please let us know via aforementioned e-mail address. You also have the right to submit a complaint to the supervisor, the Dutch Data Protection Authority. You can do this on the website: www.autoriteitpersoonsgegevens.nl/en.
Amendments to the privacy statement
This privacy statement may be changed at any time by us without further notice. A modified privacy statement will be provided with a ‘version date’ and then published on our website.
