OBJECTIVES AND CONTENT

This privacy policy applies to the individual Luxembourg law firm VENKATAPEN BOUTIQUE LAWYERS (hereinafter “VBL”).

As a Luxembourg legal advisor, VBL must collect and subsequently process personal data on its former/existing clients, prospects, lawyers, opposing parties, service providers, suppliers, public authorities, etc., and if the latter are legal entities, the collected and
processed data may relate to their legal representatives, their employees, their agents, etc.

VBL accords significant importance to the confidentiality of its contacts and is firmly committed to the protection of their personal data.

The processing of personal data by VBL is carried out in accordance with the General Data Protection Regulation (“GDPR”), which aims to protect the privacy of individuals when processing personal data.

The purpose of this policy is to provide relevant information on how VBL collects, processes and shares personal data relating to its contact persons. This document also provides information on the rights of contact persons regarding the processing of their personal data.

1. HOW WE ACQUIRE INFORMATION ABOUT YOU

Personal data can be collected in different ways:

1) Data transmitted directly to VBL

As part of its professional activities as a Luxembourg law firm, VBL collects and processes data directly from clients, prospective clients, business partners, economic beneficiaries, service providers, co-contractors, potential candidates and intermediaries.

2) Data received from third parties

VBL also collects and processes publicly accessible data (Internet, social networks, public registers). VBL may also collect and process data received from third parties as part of its services or in connection with any legal and/or regulatory obligations.

2. WHY AND HOW WE PROCESS YOUR DATA

This section details the data processing carried out by VBL as data controller, i.e. in cases where VBL determines the purposes and means of processing and is not acting on behalf of another data controller.

The processing of data by VBL is necessary for the provision of the Services¹ and to comply with its legal and/or regulatory obligations.

¹  the term “Services” means legal assistance, advice and services rendered by VBL to the Client as
part of VBL’s professional relationship with the Client and includes any representation of the Client in legal proceedings and any special mandate given to VBL for the purpose of representing the Client in a specific situation.

Where data processing is necessary for the legitimate business interests pursued by VBL, VBL will consider the extent of the potential impact on the data subject and the rights available to the data subject in accordance with applicable personal data protection legislation. Where VBL processes data for its legitimate business interests, the data subject has the right, where appropriate, to object to the processing of data relating to him or her.

Where processing is based on the consent of the data subject, the data subject has the right to withdraw consent at any time. In this case, VBL will cease all processing (except where legal and/or regulatory obligations require VBL to carry out limited processing, such as the
retention of data). Withdrawal of consent will not affect any processing carried out in the past.

The following non-exhaustive list provides an overview of the data processed by VBL:

• full name (including initials), address, e-mail address, telephone number, mobile number and other contact details;
• date and place of birth;
• nationality;
• gender;
• professional activities (job title and description, employer);
• centre of interest;
• civil status;
• copies of identity documents (passport, identity card, driving licence, social security
  number);
• sources of income;
• invoices, bank statements.

VBL may also collect and process other data if this is necessary for the provision of services.

In the event of the performance of a mandate entrusted by a client, VBL may be required to process data as a subcontractor. In such cases, the processing of data by VBL will be governed by VBL’s general terms and conditions and/or a specific contract considering the
requirements prescribed by article 28 of the GDPR.

3. RETENTION PERIOD

VBL usually processes and retains data for the duration of the services or professional relationship with the customer. VBL may also retain data for as long as (i) it is necessary or required to fulfil its legal, contractual or regulatory obligations, (ii) for the establishment, exercise or defence of legal claims and (iii) generally in all cases where VBL has a legitimate interest.

In view of the five-year statute of limitations introduced by article 2276 of the Luxembourg Civil Code, VBL has the right, but not the obligation, to retain data for a period of five (5) years after the end of the services or professional relationship with the customer.

4. YOUR RIGHTS

As a data subject, you have the following rights:

(i) Access to your personal data: you have the right to request information about how your personal data is processed and about your personal data.
(ii) Portability of your personal data: you have the right to request VBL to provide you with a copy of your personal data used by VBL.
(iii) Rectification of data concerning you: you have the right to request VBL to rectify any data concerning you that is inaccurate, incorrect or incomplete.
(iv) Right to erasure: subject to article 2276 of the Luxembourg Civil Code and subject to legal and/or regulatory obligations requiring the retention of data, you have the right to request VBL to erase any data concerning you.
(v) Limiting the processing of your personal data: you have the right to request VBL to limit the processing of your personal data in the following cases:

a. you dispute the accuracy of the data concerning you used by VBL;
b. the processing of data concerning you is unlawful, but you object to their deletion and demand instead that their use be restricted;
c. VBL no longer needs your data for processing purposes, but it is still necessary for the establishment, exercise and defence of your legal
rights;
d. you have objected to the processing of data concerning you and VBL verifies whether the legitimate reasons pursued by VBL prevail
over your objection.

(vi) Automated decision-making: in principle, VBL does not use automated decision-making, but if it does, you have the right to object.
(vii) Right to object: you have the right to object at any time to the processing of data concerning you used for canvassing purposes (including profiling linked to such canvassing).
(viii) Right to lodge a complaint with the supervisory authority: you also have the right to lodge a complaint with the supervisory authority, the Commission Nationale pour la Protection des Données (the “CNPD“), regarding the way in which VBL processes data concerning you or your rights.

If you wish to exercise any of your rights above, you may contact VBL in accordance with section 9 below.

5. INFORMATION ABOUT YOU AND THIRD PARTIES

VBL has the right to disclose and transfer data collected by VBL to other companies/entities or to subcontractors located inside or outside the European Economic Area when this is necessary for the provision of services. VBL thus has the right to disclose and transfer data, without this list being exhaustive, to bailiffs and notaries, but also to providers of administrative, IT, payment, data processing, debt collection and translation services. To guarantee that your data is processed with the same level of security and confidentiality as that implemented by VBL, a specific contract will be concluded with each sub-contractor. VBL also has the right to disclose and transfer your data if you have given your consent. In addition, VBL has the right to disclose and transfer data in connection with its KYC/AML (Know-Your-Customer/Anti-Money Laundering) obligations and/or to protect its rights and those of its customers and/or to prevent fraud. VBL may be required to disclose or transfer data to authorities to comply with its legal and/or regulatory obligations.

Except as described in this section 5, VBL will not disclose, transfer or sell your personal data to a third party unless you have given your consent.

6. PROTECTION OF YOUR PERSONAL DATA

VBL has implemented appropriate technical and organisational measures to prevent the loss or unlawful processing of your data.

7. BREACH NOTIFICATION

VBL will notify the CNPD of any personal data breach no later than 72 hours after the breach is detected.

In accordance with the provisions of the GDPR, customers and contacts will be notified of a personal data breach, without undue delay, only where the personal data breach is likely to result in a high risk to their rights and freedoms.

8. MODIFICATION OF THIS POLICY

VBL reserves the right to modify this policy at any time and for any reason, to ensure that it remains complete and up to date.

To stay informed about how VBL protects your personal data, we recommend that you periodically consult the policy on the VBL website: https://www.venkatapenlawyers.lu.

VBL offices are located at 10A Boulevard de la Foire, L-1528 Luxembourg.

If you have a question, comment or complaint in relation to this policy or the processing of your data by VBL, or if you wish to exercise any of your rights, you can contact our Data Protection Officer by sending an e-mail to the following address: data@venkatapenlawyers.lu.