In this privacy notice CFH Advokatbyrå AB describes how we process your personal data, the purpose of our processing of the data and the rights you have as a data subject. CFH Advokatbyrå AB, org. nr 559294-1875, P.O. Box 3122, 103 62 Stockholm, is the controller of the personal data processing as described below. This means that we are responsible for ensuring that the personal data are processed correctly and in accordance with applicable data protection laws.
Process of data from our clients
We will process the personal data we receive from our clients in connection with the assignment given to us or otherwise gathered during the performance of the assignment. You are not obligated to provide us with any personal data but without such information we cannot represent you as we require personal data to perform conflict of interest and anti-money laundering controls in accordance with the regulations of the Swedish Bar Association.
Personal data that we process
We collect the personal data provided to us in connection with our assignments or that are otherwise processed during the preparation or administration of an assignment. Personal data are collected directly from the individual concerned but we may also receive information about individuals involved without the information being provided directly from them. We may also supplement the personal data provided to us by obtaining information from private and public records and sources.
The personal data we process may for example consist of contact details, identification details and invoicing information.
The purposes of our processing of personal data
The purpose of obtaining personal data in connection with assignments is to fulfil our obligations, for administration in connection with assignments and for fulfilling our obligations which follow from law or the rules issued by the Swedish Bar Association, such as conflict of interest and money laundering controls. We may also use personal data as a basis for market purposes and business development.
The legal basis for processing the personal data
The legal basis for processing personal data from individuals is performance of the assignment that the client has given us. We may also process data in relation to other individuals such as clients’ representatives, consultants, counsels of counterparties, etc., if we deem that our processing of such data is necessary for the purposes that concern our client’s or, where applicable, our legitimate interests and that these outweigh any opposing interests or fundamental rights and freedoms.
The processing of personal data in connection with the conflict of interest and money laundering controls and archiving of documents after an assignment has been concluded are based on our duty to comply with our legal obligations such as accounting and anti-money laundering legislation and the Swedish Bar Association Code of Conduct.
Processing of personal data relating to suppliers and other external parties is based on our legitimate interest in administrating the relationship and performing our contractual obligations.
We may send out newsletters, invitations and marketing materials to the email address that you have registered with us as a former client, a professional or personal contact to our employees or to you that have shown interest in our business The legal basis for processing personal data in such cases is our legitimate interest in communicating with you. If you wish to unsubscribe from receiving such marketing materials you are welcome to contact us.
Transfer of personal data
We employ appropriate security measures to help protect the personal data we process from loss and to guard against access from unauthorized persons. Transfers of data outside the EU/EEA are made in line with applicable data protection laws and for the purposes specified above. Transfers of this type are normally based on the EU Commission’s standard contractual clauses. Transfers to countries outside the EU/EEA may also occur within the scope of a given assignment insofar as is necessary to establish, exercise or defend our client’s legal claims.
We will not disclose personal data to anyone outside Eklund Advokat AB unless a) it has been agreed between us and the person whose personal data we process b) it is necessary within the scope of a given assignment to safeguard our clients’ rights and interests c) it is necessary to fulfil a statutory obligation, comply with a decision of a public authority or a court of law, or the rules issued by the Swedish Bar Association d) if we engage an external service provider or business partner who performs services on our behalf. Such service providers and business partners may only process personal data in accordance with our instructions and may not use personal data for their own purposes; or e) it is otherwise permitted by law.
Storing of personal data
We do not store the personal data longer than necessary given the purpose of the processing, unless otherwise required or permitted by law.
The personal data that may be processed before and during the performance of an assignment are subsequently stored in accordance with our obligations under the Swedish Bar Association Code of Conduct after the assignment has been concluded. The personal data are therefore stored for at least ten years from effective the date the assignment was concluded, or for a longer period if it is required by the nature of the assignment.
The rights of the data subject
Data subjects have the right to know what personal data we process about them. A data subject also has the right to a) request that we rectify or erase inaccurate or incomplete personal data about them (e.g. if the personal data are no longer needed for the purpose or if the consent is withdrawn) b) object to specific processing of personal data and request that processing of personal data be restricted and c) receive personal data provided by themselves in machine-readable format and have the data transferred to another party responsible for data processing.
These rights may be limited by the duty of confidentiality and archiving obligation applying to members of the Swedish Bar Association.
Anyone who is dissatisfied with how we process their personal data is entitled to report this to the Swedish Authority for Privacy Protection (Sw. Integritetsskyddsmyndigheten), which is the supervisory authority for our processing of personal data.
If you have any questions or complaints about how we process your personal data or wish to exercise any of your rights set out above, you are welcome to contact us by email or by post to the address above.