What is this notice for ?
This privacy notice (the Notice) sets out the conditions under which /c law – Avocats à la Cour, located at 24 rue Jean l’Aveugle, L-1148 Luxembourg, operated by Maître Cyril Pierre-Beausse, Maître Claire Leonelli, Maître Elisabeth Guissart, and Maître Katia Manhaeve (acting on behalf of KAMAN S.à r.l., registered on List V of the « Tableau de l’Ordre des Avocats » of the Luxembourg Bar and listed with the Luxembourg Trade and Companies Register under number B 177878) (we or /c law), processes and protects the personal data of its current, potential or former clients and providers (or their contact persons or representatives), as well as any other individuals, as detailed below, with whom /c law interacts (together referred to as “you”), including when visiting the /c law website (the Website).
All such data processing is carried out by /c law in accordance with Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), the Luxembourg law of 1 August 2018 implementing the GDPR, and any other applicable legislation (together, the Applicable Legislation).
More specifically, this Notice explains when and why we need your personal data, what data we collect, how and for how long we process it, to whom we may disclose it, what your rights are regarding such processing, and how you may exercise them.
This Notice may be amended from time to time to reflect changes in applicable legislation or our data processing practices. The date of the last update is indicated at the top of the Notice. In case of material changes, you will be informed by appropriate means in due course.
Who is the data controller ?
In relation to the processing activities listed below, /c law acts as a data controller, namely the person who decides why and how your personal data are processed.
/ c law has appointed a person in charge of data protection, who can be contacted:
- by email at: info@claw.lu; or
- by post at: /c law Avocats à la Cour, Attn: Data Protection Manager, 24 rue Jean l’Aveugle, L-1148 Luxembourg.
What personal data do we collect and when ?
Personal Data means any information that relates to an identified or identifiable natural person.
We collect and process Personal Data if:
- you or your company is a current, former or prospective client of /c law or you act as a contact person or representative of a client (a Client);
- you are directly or indirectly implicated in a Client’s matter (a concerned or opposing Party);
- you apply for a job or internship at / c law (a Candidate);
- you enter into a contractual relationship with /c law, or act as a contact person or representative of a current, former or prospective provider (a Provider); or
- you use our Website (a User)
The categories of Personal Data we process include:
- Identification data: first name, last name, title, addresses (home and business), date of birth, gender, nationality, ID document, signature (physical and electronic).
- Contact data: telephone numbers (personal, work), email address.
- Financial data: bank account number, VAT number, financial institution.
- Professional data: job title, company name and address, professional activity.
- Academic background: schools, universities, academic and professional experience, type of courses, intended degrees, exam results, other diplomas, academic evaluations.
- Other data: any other information you voluntarily provide (e.g. in the context of a dispute requiring specific data).
- Cookies : language selected when using our Website.
Please note that we do not necessarily process all the Personal Data described above. To find out which Personal Data is processed for which purposes, please refer to the next section.
You are only required to provide Personal Data that is necessary for us to enter into or perform a contract, or that we are legally required to collect and process. Refusal to provide such data may impact our ability to conclude or perform a contract or provide you with certain services.
Why do we process your Personal Data, on what basis, and for how long ?
The table below outlines the purposes for which we process your Personal Data, the legal basis for doing so, and the retention periods:
| Purpose | Legal basis | Categories of Personal Data | Retention period |
|---|---|---|---|
| Assessment of the legal situation, legal advice or assistance in contentious and non-contentious matters and related communication | Performance of a contract (Art. 6.1.b GDPR) | Identification, contact, professional, financial, other data related to a Client | Duration necessary for handling the matter + legal limitation periods (generally 10 years from file closure) |
| Legitimate interest (Art. 6.1.f GDPR) | Identification, contact, professional, other data related to a Party | ||
| AML/KYC checks | Legal obligation (Art. 6.1.c GDPR) Law of 12 November 2004 on the fight against money laundering and terrorist financing |
Identification, financial data | As required by law (up to 10 years from the end of the Client relationship) |
| Application for employment or internship | Performance of pre-contractual measures or a contract (Art. 6.1.b GDPR) | Identification, contact, academic data, other data related to a Candidate | If not hired: Destruction after each recruitment process. With the Candidate’s consent, the CV may be kept for up to 2 years after the last contact.
If hired: Retention of documents in the employee’s or collaborator’s personal file for the entire duration of the working relationship + 10 years after termination (or, in the event of a dispute, until full settlement) |
| Informing you about events, publications, or updates of interest | Legitimate interest (Art. 6.1.f GDPR) | Contact data related to a Client | 3 years from the end of the relationship or the last contact |
| Contractual relationship management | Performance of pre-contractual measures or a contract (Art. 6.1.b GDPR) | Identification, contact, professional, financial data related to a Provider | Duration of the contract + legal limitation periods for accountancy purposes (generally 10 years from the end of the contract) |
| Management of GDPR rights requests | Legal obligation (Art. 6.1.c GDPR) Articles 15 and following of the GDPR |
All data required to process the request | Processing time and proof of processing |
| Website functioning (strictly necessary cookies) | Legitimate interest (Art. 6.1.f GDPR) | Language preference of User | 1 year from the moment cookies are stored |
Who may access your Personal Data ?
Your Personal Data is processed internally by authorised personnel on a need-to-know basis.
We may also share your Personal Data with third parties when strictly necessary to achieve the purposes listed above, including:
- the Luxembourg Bar Council in case of disputes;
- competent administrative or judicial authorities as required or authorised by law;
- our service providers (e.g. fiduciaries, IT service providers), subject to appropriate technical or contractual safeguards ensuring confidentiality and security.
Do we transfer your Personal Data outside the EU ?
We do not, in principle, transfer your Personal Data outside the European Union or to countries that do not offer an adequate level of protection as recognized by the European Commission. Any such transfer will only take place subject to appropriate safeguards or, failing that, if:
- you have given us your explicit consent for the intended transfer after being informed of the risks this may entail due to the absence of an adequacy decision and appropriate safeguards;
- required by law;
- strictly necessary for the performance pre-contractual measures or contractual obligations; or
- necessary for the establishment, exercise, or defence of legal claims.
What are your rights and how can you exercise them ?
In accordance with the Applicable Legislation, you have the following rights:
- Right of access: You may request confirmation as to whether we process your Personal Data, and obtain access to your Personal Data and relevant processing details.
- Right to rectification: You may request correction of inaccurate or incomplete Personal Data.
- Right to data portability: You may receive your Personal Data in a structured, machine-readable format if the processing is based on your consent or a contract and carried out by automated means.
- Right to erasure: You may request that your Personal Data be deleted in the cases provided under Article 17 of the GDPR (e.g. when the Personal Data is no longer needed, when consent is withdrawn, when processing is unlawful).
- Right to restriction: You may request restriction of processing under certain circumstances (e.g. while a dispute is being resolved, or if the Personal Data is no longer needed but must be retained for legal claims).
- Right to object: You may object to processing based on our legitimate interest, provided you explain your specific reasons. We may reject your request if we demonstrate compelling legitimate grounds that override your interests.
- Right to withdraw consent: If processing is based on your consent, you may withdraw it at any time. Such withdrawal will not affect processing carried out prior to withdrawal.
Who can you contact with questions or complaints ?
If you have any questions, comments or complaints regarding the processing of your Personal Data, or if you wish to exercise your rights, please contact us:
- by email at: info@claw.lu, or
- by post at: /c law Avocats à la Cour, Attn: Data Protection Manager, 24 rue Jean l’Aveugle, L-1148 Luxembourg.
We may ask you to provide additional information to confirm your identity (e.g. a scan or copy of your ID), in case of reasonable doubts.
If you are not satisfied with our response, or if it proves difficult or impossible to file a complaint with us, you may also file a complaint with the Luxembourg Commission nationale pour la protection des données (CNPD), Service des réclamations, 15, Boulevard du Jazz L-4370 Belvaux. It is recommended to use the CNPD’s online complaint form.