NOVALAW-GJP DATA PROTECTION POLICY

CONTACT INFORMATION

NOVALAW-GJP (“NOVALAW”)
10, Boulevard Royal
L-2449 Luxembourg
Luxembourg

Phone: (+352) 26 26 43 -1
Fax: (+352) 27 85 87 82

Should you have any question or queries related to the treatment of your personal data or should you require amendments concerning your personal data, please contact us via email under

contact@novalaw-gjp.lu

or by regular mail under the address mentioned above.

COLLECTION OF PERSONAL DATA

NOVALAW collects first of all information related to our business clients as to fulfill the legal services requested by its clients. Such information concern in first instance the identity, address, telephone and fax number, email address, country of residency, function or employment and all other information relating thereto. Such information may be collected, in whatever form directly from the clients or indirectly through a processor.

All information gathered within the framework of legal services rendered are in accordance with the provisions of the General Data Protection Regulation UE 2016/679 (“GDPR”) in force since May 25, 2018. Such information is also held by NOVALAW for internal use such as accounting purpose and related to national and European legal obligations such as Know Your Customer requirements.

Personal data may be gathered in writing by any means or orally or may be indirectly gathered via a third party with the consent of the client. The personal date is notably collected at the time of entering into a business relationship with NOVALAW. NOVALAW may however also obtain personal data through official registers, data bases, social networks or websites.

By providing NOVALAW with a mandate to represent their interests, the clients consent to the storage of their personal data as mentioned above.

NOVALAW collects the following information*:

For general use in view to fulfill the legal services requested

  • Name, Surname
  • Postal address
  • Phone and fax numbers
  • Email address

For internal use only:

  • VAT number
  • Bank account information
  • ID or passport
  • *Non exhaustive list

LEGAL BASIS AND REASONS OF TREATMENT OF PERSONAL DATA

NOVALAW may collect and process your personal data in accordance with the GDPR for the following operations:

  • for the execution of contractual obligations (article 6 §1 b) of the GDPR)

NOVALAW collects and processes your personal data in order to render you the legal services required in accordance with the relevant agreement concluded with you or in order to provide you with a fee quote for the services required.

NOVALAW shall also collect and process personal information for administrative, accounting or contractual purposes in order to ensure the follow up of the relevant files.

Finally personal data may also be collected and processed not only for invoicing purposes but also to ensure the settlement of fees relating to supply agreements concluded by NOVALAW with its providers.

  • further to your explicit consent (article 6 §1 a) of the GDPR)

NOVALAW may proceed to the sending of newletters, information messages about conferences organized by NOVALAW but also to marketing campaigns, market surveys or opinion polls for which it may process its clients’ personal data. The process of the data is legal as long as the clients have given their express consent to that end. Clients may at all times revoke their consent by contacting NOVALAW. Such rule also applies to consents given before the entering into force of the GDPR on 25 May 2018. Revoking the consent does not affect the lawfulness of the process of the data operated before the consent was revoked.

  • to comply with legal provisions (article 6 §1 c) of the GDPR)

As law firm, NOVALAW is submitted to certain legal obligations (notably, but not limited to accounting, tax and social security obligations, but also obligations relating to applicable anti-money laundering legislation and in respect of the supervision that the president of the Luxembourg bar exercises over its members. The process of the personal data has in such case as aim the prevention of fraud and of money laundering, the compliance with obligations imposed by Luxembourg bar association and the compliance with control and declaratory obligations imposed by accounting, tax and social security law.

NOVALAW may collect and process medical data that the client agreed to provide within the framework of the legal services to be rendered to the client and while NOVALAW may have the legal obligation to collect and maintain personal data and information relating to medical data, such information is not used or processed by NOVALAW in any manner other than for the strict purpose of complying with applicable laws and regulations. Medical data are collected, maintained and processed in compliance with GDPR only, and notably :

  • if the client has given explicit consent to the processing of those medical personal data for one or more specified purposes;
  • if the collection and processing of said medical personal data is necessary for reasons of substantial public interest, on the basis of applicable law which shall be proportionate to the aim pursued, especially with the applicable laws and regulations;
  • if the said processing is necessary for the establishment, exercise or defense of legal claims involving NOVALAW or whenever courts are acting in their judicial capacity ;
  • if the said processing is necessary in respect of employment and social security and social protection laws and regulations, in accordance applicable laws and regulations.

NOVALAW may collect and process personal data relating to criminal conviction and offenses within the framework of the legal services to be rendered to the client.

While NOVALAW may have the legal obligation to collect and maintain personal data and information relating to criminal offenses, such information is not used or processed in any manner other than for the strict purpose of complying with applicable laws and regulations.

PROCESS OF DATA AND DATA TRANSMISSION TO A THIRD PARTY

Within NOVALAW, all departments which will need to have access to the clients’ personal data will have access to it. This access is however restricted to the administrative staff to fulfill administrative, accounting or invoicing purposes and to the lawyers of the firm for the rendering of the legal services.

It is in this respect important that all the employees of NOVALAWGJP are informed about the importance of the confidentiality of personal data. This is the reason why they have received a specific training regarding such subject and signed a confidentiality undertaking.
Any personal data may be transmitted to a third party without prior consent of the client despite the following exceptions.

NOVALAW may be forced to transmit personal data within the framework of legal proceedings. Such data transmission would be preceded in accordance with the applicable Luxembourg law.

Personal information is also transmitted to third parties for accounting, tax, employment or other purposes. Such third party accountants ensure the same confidentiality and data protection regulations as NOVALAW. Such data transmission is operated in a very restrictive manner in compliance with the applicable laws and will only be operated within the territory of the Grand-Duchy of Luxembourg. NOVALAW will ensure that third party service providers chosen comply with the same confidentiality undertaking regarding the process of personal data as imposed by the GDPR.

NOVALAW may furthermore transmit your personal data to third parties for the execution of the legal services rendered to you, in such case however only with your prior consent for such transmission.

Given the above, recipients of your personal data may be:

  • entities and institutions of public law (e.g. courts, tax or criminal authorities on the basis of legal or official obligations),
  • entities and institutions of private law (e.g. bailiffs, accountants, tax advisors etc.. on the basis of contractual obligations,
  • other recipients for which you have given your consent for the transfer of personal data or for which you have released NOVALAW from its confidentiality obligations

In no case, information will be communicated to a party residing outside of the European Union, without the consent of the client or being necessary in view of the accomplishment of legal services to be rendered to the client. NOVALAW will further more not transfer your personal data to an international organization of a third country.

By providing NOVALAW with a mandate to represent their interests, the clients consent to the transmission of their personal data as mentioned above.

STORAGE AND CONFIDENTIALITY

Personal information is exclusively kept safe in the premises of NOVALAW.

Personal information being kept electronically is backed up on a regular basis, encrypted and protected against intentional and non-intentional divulgation.

Access to such information may only be granted to the lawyers being bound to the professional secrecy rules or NOVALAW employees or third party contractors being bound to a confidentiality clause.

NOVALAW shall not sell nor use personal data for a commercial use without the consent of the client.

The client may consent for NOVALAW using personal data for marketing purposes.

The personal data shall be kept for the time required by law. In this relation, it is important to stress out that the relationship that may be instituted between NOVALAW and its clients may last for years.

If the data is not required for the execution of NOVALAW’s contractual or legal obligations, such data will be deleted, unless their use shall be required, for a limited duration, in order to comply notably with the safekeeping obligations imposed by tax and commercial legislation for a maximal duration of 10 years in accordance with the rules set out with the Code of commerce, the general tax law and the law of 12 February 1979 on value added tax.

PERSONAL RIGHTS

Each client is entitled to:

The competent data protection authority is:

the National Commission for Data Protection of the Grand-Duchy of Luxembourg, which has its office at:

1, Avenue du Rock N’Roll
L-4361 Esch-sur-Alzette

Phone: (+352) 26 10 60 -1
Fax: (+352) 26 10 60 -29

www.cnpd.public.lu

Requests related to the list above and the update of personal information may be addressed to NOVALAW via contact@novalaw-gjp.lu

PROCESS OF PERSONAL DATA BY AUTOMATED MEANS

When establishing a business relationship, NOVALAW does not apply the process of personal data by automated means for the purpose of the decision-making in accordance with article 22 of the GDPR.

PROFILING

NOVALAW does not use personal data to evaluate certain personal aspects relating to its clients, in particular to analyze or predict aspects the client's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements (profiling).

SECURITY

Further to the entering into force of the GDPR, NOVALAW has set up the technical and administrative means in order to protect its clients’ personal data.

Once transmitted, the personal data are safe kept using the following means:

All NOVALAW’s employees and lawyers have been duly trained in order to comply with the provisions of the GDPR.

All paper files are kept in secured cabinets the access to which is limited to staff which understands and applies the confidentiality rules.

Electronic files are protected by firewalls and stored on a server located in NOVALAW’s office which access is duly secured. Only limited access is granted to NOVALAW’s IT server.

NOVALAW has also put in place technical securities for the access of the stored personal data.

Given the above described measures, NOVALAW can in due time identify any incidents and process them in accordance with the GDPR.

NOVALAW takes its best efforts to organize the internal process and to limit the number of processors.

LINKS TO OTHER WEB SITES

NOVALAW’s web site may include links to other websites. NOVALAW has no power and no means to control the contents of such websites and the information collected on such websites. NOVALAW may consequently not be held responsible for any data collection that takes place on such web sites. Please refer to the relevant data protection declaration featured on such web sites.