PROCESSING OF PERSONAL DATA: CLIENTS AND OTHER CONTACTS
In accordance with Lindahl law firm’s responsibilities, we respect your integrity and ensure that your personal data is processed with the confidentiality and respect that is required. This policy is addressed to you who we have a relationship with by our business, or to you, who represent an organization (existing, previous or potential client, supplier, or partner); has attended an event; has visited our web page; or in other ways has been in contact with us, e.g. as an employee at an authority.
Further information on how we process personal data is found below.
1. WHO IS THE PERSONAL DATA CONTROLLER?
Advokatfirman Lindahl KB, 916629-0834, Box 1065, 101 39 Stockholm, is the controller for the personal data that is processed in accordance with this policy.
2. TO WHOM DO YOU DIRECT YOUR QUESTIONS?
If you have any questions regarding how we process your personal data, please contact us at [email protected].
3. DOES LINDAHL LAW FIRM HAVE A DATA PROTECTION OFFICER?
We have designated a data protection officer. The data protection officer’s role is to monitor that we are compliant with current data protection legislation by for example collecting information about how Lindahl law firm processes personal data, performing controls, providing information and advice, and issuing recommendations. You can contact our data protection officer at [email protected] or by mail: Data protection officer, Advokatfirman Lindahl KB, Box 1065, 101 39 Stockholm.
4. WHICH PERSONAL DATA DO WE COLLECT?
We collect and process all personal data that you share with us, for example when you send us an e-mail or sign up for an event. The sources from which we collect personal data are stated below, under “From where do we collect your personal data”.
Personal data that we process:
- Basic information such as your name, workplace and
- Contact information such as address, email address and phone
- Payment
- Technical information such as information about your visit at our web page or behavioral data relating to digital
- Information that you share relating to meetings or events, such as availability demands to our facilities or
- Identity documentation or background information that we have received from you or collected as a part of our client intake
- Personal data that has been provided to us from our clients, on behalf of our clients, or that has been prepared as a part of a matter, which can include sensitive personal data or personal data relating to criminal convictions and offences
- Pictures taken at our seminars, events or similar
5. FROM WHERE DO WE COLLECT YOUR PERSONAL DATA?
We collect personal data about you and others:
- When we initiate a business relation or when we handle matters on behalf of our client
- Through internal reporting channels and other procedures for reporting and follow-up in connection with misconduct and breaches in a workplace (whistleblowing)
- Through our website,
- Via e-mail sent to and from Lindahl,
- When you share information with us by contact with us at meetings, conversations, social media, events or by filling in online-forms
- Suppliers engaged by your employer of internal reporting channels and other procedures for reporting and following-up misconduct or other whistleblowing issues.
We might also collect or receive information about you from other sources, such as:
- Public registers (i.e. SPAR)
- Bisnode Infotorg
- UC
- Bolagsverket (Swedish Companies Registration Office)
6. WHY DO WE PROCESS YOUR PERSONAL DATA?
We collect your personal data through different sources and for several purposes. Mainly, we collect your personal data by contacts with you, by our web page or regarding the matters we engage in. We process your personal data for the following purposes:
Purpose: To analyze the use of our web page.
Lawfulness: Processing is necessary for the purposes of the legitimate interests
Lindahl law firm’s legitimate interest to provide and develop the web page https://www.lindahl.se/
Purpose: To defend our client´s legal interests.
Lawfulness: Processing is necessary for the purposes of the legitimate interests
Lindahl law firm’s legitimate interest to engage in matters relating to the legal services that we provide, and your, or the client’s, legitimate interests in the matter in which Lindahl law firm is engaged.
Purpose: To provide personal data at your request.
Lawfulness: Processing is necessary for the purposes of the legitimate interests
Your and Lindahl law firms legitimate interest of accommodating your request.
Purpose: Marketing of our services e.g. by newsletters, social media, publications and events.
Lawfulness: Processing is necessary for the purposes of the legitimate interests
Lindahl law firm’s legitimate interests in the marketing of our services.
Purpose: To avoid conflicts of interest.
Lawfulness: Processing is necessary for the purposes of the legitimate interests
Lindahl law firm’s legitimate interest of avoiding conflicts of interest in accordance with the Swedish Bar Association Code of Conduct.
Purpose: To manage our relationship with you and our clients, and maintaining our contact lists.
Lawfulness: The processing is necessary for the performance of a contract with you
If there is a contract between you and Lindahl law firm.
Lawfulness: Processing is necessary for the purposes of the legitimate interests
Lindahl law firm’s legitimate interest of manage the relationship with you or the organization that you represent.
Purpose: To comply with legal obligations.
Lawfulness: Fullgöra våra rättsliga förpliktelser
Exempelvis våra förpliktelser enligt penningtvättslagen, bokföringslagen, visselblåsarlagen m.m.
Purpose: För att fastställa, göra gällande eller försvara rättsliga anspråk.
Lawfulness: Compliance with legal obligations
E.g. to perform our responsibilities in accordance with the Anti-Money Laundering Act, the Accounting Act, the Whistleblowing Act etc.
Purpose: To determine, claim or defend legal demands.
Lawfulness: Processing is necessary for the purposes of the legitimate interests
Lindahl law firm’s legitimate interest of the establishment, exercise or defense of legal claims.
Purpose: To process information in a follow-up matter in connection with required or optional internal reporting channels in accordance with the Whistleblowing Act.
Lawfulness: Processing is necessary for the performance of a task carried out in the public interest
The purpose of the Whistleblower Act is to protect individuals reporting on workplace misconduct where there is a public interest in that the misconduct is discovered. To achieve these purposes, personal data must be processed in matters following-up the report.
Client matters
We process personal data regarding and in connection to assignments that we perform on behalf of our clients. We process identity documentation and background information as a part of our client intake process, administration and marketing. Such processing includes taking measures to prevent moneylaundering, avoid conflicts of interest, carry out honour and conduct trials and process credit data. We also process personal data that is shared with us by our clients throughout our performance of the client matter. Furthermore, personal data is shared with third parties to the extent such sharing is necessary for the performance of our assignments.
Marketing
If you want our mailings to you to cease, you can contact us at [email protected], or, when applicable, directly contact the office that sent the mailing. Please find contact information here: https://www.lindahl.se/se/kontor
The web page
We use different tools to review and keep statistics of visits and uses of the web page. This is carried out through cookies. You may at any time deny the use of cookies by changing your browser settings. However, this may affect your user experience. You can read more about our use of cookies here.
When you use some parts of the web page, you might be asked to submit personal data, for example when signing up for an event. The purpose of the processing of personal data will in these situations be clear from the context and we use personal data that you submit only for that purpose.
7. FOR HOW LONG DO WE STORE YOUR PERSONAL DATA?
Client matters
Data processed as part of our performance of a client matter is stored for ten years or for such longer period required by the Swedish Bar Association Code of Conduct with regards to the nature of the client matter.
Marketing
We store your personal data to contact you for marketing purposes during a year from the date we collected your data or the date when we last used your data to contact you. You may at any time unsubscribe from our mailings. If you unsubscribe, you will no longer receive mailings.
In connection with following-up reports in accordance with the Whistleblowing Act
When we process personal data in connection with following-up a report made through an internal reporting channel according to the Whistleblowing Act, we store your personal data for two years after the follow-up matter is concluded, unless storage for a longer period of time is required in the individual case. Such longer storage may be necessary due to, for example, legal obligations incumbent on us.
Other
When we process personal data in other situations than the ones mentioned above, we store your personal data for as long as is necessary with regards to the context. For example, it can be situations when we are in contact with you via e-mail, when you participate in an event, when we provide information at your demand, when we process information from cookies, or due to a legal obligation.
8. TO WHOM MAY YOUR PERSONAL DATA BE DISCLOSED?
We might share your personal data with trusted recipients with whom we have an agreement ensuring that your personal data is processed in accordance with this policy. Personal data is shared with the following parties:
- Lindahl law firm’s offices at their respective locations for exchange of information and knowledge, resource allocation and the purposes that are stated under “How we use your personal data”.
- Other professional
- Suppliers of services such as support, word processing, translation or document
- IT-suppliers.
- Third parties as part of our performance of client matters, such as; courts, authorities, counterparties, counterparty counselors or suppliers of data rooms
- Third parties involved in the organization of events, such as hotels, organizers or lecturers.
- Third parties, when necessary due to a legal obligation. If we are obliged to disclose your personal data because of an injunction or such, we will inform you to the extent that we are not legally prevented from doing
- Social media, such as Instagram, Facebook, LinkedIn and Youtube. We kindly refer you to the policy of each provider for information on how they process personal
We do not transfer your personal data by selling your personal data or else make your personal data available for commercial purposes without your consent.
9. HOW DO WE PROTECT YOUR PERSONAL DATA?
We take several technical and organizational measures to protect your personal data from unauthorized access, use, disclosure, change or erasure in accordance with the applicable data protection legislation. Such measures include, but are not limited to, shell protection, encryption, eligibility restrictions, policies, etc.
As a law firm we comply with – in addition to the legal requirements set out in the data protection legislation – the Swedish Bar Association Code of Conduct.
10. TO WHICH COUNTRIES DO WE TRANSFER YOUR PERSONAL DATA?
Other than as expressly stated below, we only process your personal data within the EU/EEA.
Some of Lindahl’s IT suppliers are located outside the EU/EEA. Where personal data is shared with these suppliers, Lindahl has ensured that the level of protection is equivalent to that provided within the EU/EEA, by implementing the measures necessary to transfer personal data in a lawful manner to countries outside the EU/EEA, for example by applying standard contractual clauses adopted by the European Commission.
Within the context of the services we provide to our clients, it may be necessary in individual cases for us to transfer personal data to third countries. Where this is the case, we ensure that such transfer takes place in accordance with applicable data protection legislation, either by ensuring that the country to which the data is transferred has an equivalent level of protection for your personal data, that we have implemented appropriate safeguards, that you have consented to this or that the transfer is necessary for any of the purposes stated in Article 49 of the General Data Protection Regulation.
11. WHAT ARE YOUR RIGHTS REGARDING YOUR PERSONAL DATA?
Lindahl law firm is a law firm and our business is subject to confidentiality, which means that we cannot disclose personal data to anyone but the client. The possibility to exercise your rights might therefore be restricted. However, this does not apply to personal data that is processed outside the scope of a client matter, such as processing for marketing purposes or for monitoring visits on the web page.
11.1 The right to withdraw your consent
You have the right to withdraw your consent at any time. Upon such withdrawal, we will cease such processing of your personal data. Please contact us at [email protected] if you want to withdraw your consent.
11.2 The right of access
You have the right to receive a confirmation as to if your personal data are being processed, and, where that is the case, the right to access such personal data. You will then receive inter alia the following information: the purposes for our processing, the categories of personal data, the categories of receivers, the storage times and the sources of the information.
11.3 The right to rectification
You have the right to request that inaccurate personal data are corrected without undue delay. You also have the right to, when appropriate, complete incomplete personal data.
11.4 The right to erasure (“the right to be forgotten”)
Under certain circumstances you have the right to obtain the erasure of your personal data (if: the processing is no longer necessary, you withdraw your consent and there is no other legal ground for the processing, there is a lack of legitimate grounds after your objection, the processing is executed illegally or erasure is demanded by a legal obligation).
As a law firm, we are required to keep client matters archived for ten years, or longer if the matter so requires. During that time, we cannot grant a demand for erasure of personal data that is processed as part of such matters.
11.5 The right to object to some types of processing (e.g. direct marketing)
If your personal data is processed based on general or legitimate interests, you have the right to object to the processing. For example, you have the right to object to processing for marketing purposes.
If you object to the processing, we will cease the processing if we cannot either demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defense of legal claims.
11.6 The right to restriction
You have the right to obtain the restriction of the processing of your personal data (if: you object to the accuracy of the personal data, the processing is illegal and you request a restriction instead of erasure, you need the data for legal claims or you have objected to the processing and await verification).
11.7 The right to data portability
You have the right to receive personal data that you have submitted to us in a machine-readable format. The right regards such data that is processed automatically and based on an agreement (with you) or your consent. You also have the right to demand that this data is transmitted directly to another personal data controller, where technically feasible.
11.8 The right to complain to the regulatory authority
If you are not satisfied with our processing of your personal data, you have the right to file a complaint with the Swedish Data Protection Authority for Privacy Protection (IMY), which is the Swedish supervisory authority. You also have the right to turn to the supervisory authority in the country where you reside or work.
12. DOES THIS POLICY APPLY TO LINKS TO OTHER PAGES?
No, Lindahl law firm’s policy only applies to such processing that is executed in accordance with this policy. We are not responsible for personal data that is processed when you visit a web page via any of our links. Please visit the respective web pages to find information on how they process your personal data.
13. BANKRUPCY ADMINISTRATION
Introduction
Advokatfirman Lindahl KB (“Lindahl”) has lawyers who undertake work as bankruptcy trustees. In that practice, the lawyers consider the rules regarding the processing of personal data. The bankruptcy trustee differentiates the processing of personal data which occur within the scope of the normal practice at the law firm and the processing of personal data which occur within the scope of the bankruptcy estate. Consequently, there can be two different controllers in bankruptcy matters.
This part of the policy describes how Lindahl and the bankruptcy estate process your personal data in bankruptcy matters. The bankruptcy estate and Lindahl will always make sure that the personal data is processed correctly and in accordance with law.
The law firm’s normal practice in bankruptcy matters
Lindahl is liable for your personal data which the bankruptcy trustee processes in its role as a trustee, i.e. within the scope of Lindahl’s normal law practice. Lindahl is responsible to ensure that such processing is in accordance with applicable data protection regulations.
In bankruptcy matters, Lindahl collects and processes your personal data in order to perform the assignments given to the bankruptcy trustee at Lindahl. The processing is necessary to perform the assignment of a general interest or in part of the exercise of authority which the management of a bankruptcy matter may include (e.g. decision about wage guarantee regarding the employees of a company in bankruptcy).
The business of the bankruptcy estate
The bankruptcy estate is responsible for your personal data which the bankruptcy trustee processes within the scope of the business of the bankruptcy estate and in the capacity as its representative. The bankruptcy estate is responsible to ensure that such processing is in accordance with applicable data protection regulations.
Who do we process personal data about?
We process personal data about the following categories of persons:
- Agents (representatives), the natural persons who represents the bankrupt company.
- Bankruptcy debtors, i.e., the natural persons who has gone bankrupt.
- Creditors, i.e. the natural persons who is representatives for legal persons or natural persons who are creditors.
- Debtors, i.e. the natural persons who is representatives for legal persons or natural persons who have debts to the bankrupt company.
- Shareholders, i.e. natural persons who own shares in the bankrupt company.
- Employees, i.e. natural persons who are employed by the bankrupt company.
- Guarantors, i.e. natural persons who has made a guarantee for the bankrupt company’s obligations, or had a guarantee made by the bankrupt company for their obligations.
- Customers (clients), i.e. natural persons who are or represent the bankrupt company’s or the bankruptcy estate’s customers.
- Suppliers, i.e. natural persons who are or represent the bankrupt company’s or the bankruptcy estate’s suppliers of various services, e.g. auction services.
- Accountants or accounting consultants, i.e. natural persons who are accountants or accounting consultants.
- The government, i.e. natural persons who are representatives for the government, e.g. contact persons on the Swedish Enforcement Authority, the Swedish Tax Agency or regulatory authorities.
- Banks, i.e. natural persons who are representatives for banks.
- Third parties, i.e. natural persons who have property in the bankrupt company’s possession (not separable property), and
- Family members, i.e. natural persons who e.g. are parents, siblings etc. to any party.
Which personal data do we process about you?
We may process the following personal data about you:
- Names,
- Personal numbers,
- Contact details, e.g., addresses, e-mails and phone numbers,
- Real Estate designations,
- Registration numbers for vehicles,
- IP addresses,
- Bank details,
- Wage/salary details,
- Trade union affiliation,
- Health information, and
- Other information that is relevant in the matter in the individual case.
Why and on which legal basis can we process your personal data?
To be able to conclude, process and fulfil agreements for you as a creditor, debtor, supplier, customer, accountant or accounting consultant, employer or bank, we collect and process personal data about you. The legal ground for our processing of your personal data is that it is necessary to fulfil agreements with you or to take actions before concluding such an agreement. If you are a representative or contact person for any of the mentioned above, the legal basis for our processing of your personal data is legitimate interests, i.e. that the processing of your personal data is necessary for a purpose which relates to our legitimate interest to maintain and fulfil obligations in contractual relations. If you do not submit the above-mentioned personal data, we do not have the possibility to fulfil our obligation towards you or the company that you represent.
The personal data may also be processes due to a legal obligation that we must fulfil, i.e. processing of personal data due to the bankrupt company’s accounting obligation or other obligations which are incumbent upon us by law.
To perform our assignment as a bankruptcy trustee – to ensure that the bankruptcy estate is operated in a correct way – and according to the assignment that has been given the bankruptcy trustee, personal data may be processed based on that it is necessary to perform an assignment of general interest. As an example, the bankruptcy trustee, as a representative of the bankruptcy estate, must ensure that creditors of the bankruptcy estate are not treated disadvantageously and that the distribution of the assets (if any) will be done correctly.
How long do we store your personal data?
The bankruptcy estate never store personal data for longer time periods than necessary in light of the purpose of the processing. We therefore carry out regular deletions of stored personal data and erase the information that is no longer needed.
Notwithstanding the foregoing, the bankruptcy estate needs to store the personal data for a long period, among other things to administer any warranties, warranty periods, to comply with legal requirements, authority decisions as well as handling legal requirements that may be directed at the bankrupt company and the bankruptcy estate. We may save personal data for up to 10 years in accordance with The Swedish Bar Association’s guidelines.
Who has access to your personal data?
Your personal data may be left out to or processed by third party. It can be group companies, service providers, other legal consultants, accountants, consultants, authorities etc. For example, your personal data may be transferred to a third party when such action is required due to law, a dispute, a request or a decision from an authority , after your own request or alternatively when it is needed to fulfil one of the bankrupt company’s legitimate interests. In those cases, the bankruptcy estate remains as the controller of the personal data that has been transferred, while the third party, depending on the circumstances, either becomes a separate controller or a joint controller with the bankruptcy estate or the bankruptcy estate’s processor.
Where do we save your personal data?
Lindahl may process your personal data both within and outside of the EU/EEA. Lindahl will and must take actions necessary to ensure that any transfer outside of EU/EEA is done in accordance with law and that the personal data continues to be protected by the receiving parties outside of the EU/EEA.
As a data subject, which rights do you have?
What is specified in section 11 above is also applied to the cases when the bankruptcy estate is the controller of the personal data.
Contact the bankruptcy estate
In case of questions or other requests regarding the personal data in a bankruptcy matter, please contact Lindahl’s data protection officer regarding the processing of personal data, see section 2 and 3 above for contact details.