Privacy Notice

1. DATA PROTECTION

1.1 Leroy & Goldbach, a société à responsabilité limitée incorporated under the laws of the Grand Duchy of Luxembourg, having its registered office at 28 Avenue Marie-Thérèse, 2132 Luxembourg, Grand Duchy of Luxembourg, and registered with the Luxembourg Trade and Companies Register (Registre de Commerce et des Sociétés) under number B 303.240 (“Leroy & Goldbach”, “we”, “us” or “our”), is the controller for the purposes of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”), the Luxembourg law of 1 August 2018 on the organisation of the National Data Protection Commission and the general data protection framework, and other applicable data protection legislation. We shall process any personal data you provide to us or which we obtain in connection with providing our services to you in accordance with our obligations under these laws and regulations. “Personal data” means any information relating to an identified or identifiable natural person (a “data subject”).

1.2 If you are an entity, you agree that (i) personal data relating to any individual (including personal data relating to your or your affiliates’ employees, representatives, authorised signatories, directors, shareholders, beneficial owners and own clients) (hereafter “your personal data”) has been obtained and processed, and is disclosed by you to us, in compliance with applicable data protection laws, and (ii) you have informed the relevant data subjects of the processing of personal data relating to them as described in this Privacy Notice

(which is available on our website at www.leroygoldbach.com under “Privacy Notice”) and (iii) you have obtained any necessary consents to such processing, where required.

1.3 We use your personal data primarily to provide legal services to you, but also for related purposes as described in this Privacy Notice, which include:

1. incurring expenses for your account;
2. engaging other law firms and/or engaging other professional advisors;
3. conducting checks to identify you, verify your identity and screen for financial or other sanctions, including in compliance with our anti-money laundering and counter-terrorist financing obligations under the amended Luxembourg law of 12 November 2004 on the fight against money laundering and terrorist financing;
4. confirming there is no conflict of interest prohibiting/restricting us from advising you;
5. gathering and providing information required by or relating to audits, enquiries and investigations by regulatory bodies;
6. complying with professional, legal and regulatory obligations that apply to our business;
7. ensuring the confidentiality of commercially sensitive information, e.g., through the maintenance of insider lists, where applicable;
8. internal statistical analysis to help us manage our practice;
9. updating client records;
10. as part of our know-how bank;
11. marketing our services, including event invitations, updates, etc.; and
12. maintaining and managing our website.

1.4 We will only process your personal data if we have a lawful basis for doing so, in accordance with Article 6 of the GDPR. Generally, we process your personal data:

1. to comply with our legal and regulatory obligations (Article 6(1)(c) of the GDPR);
2. for the performance of our contract with you or to take steps at your request before entering into a contract (Article 6(1)(b) of the GDPR);
3. for our legitimate interests or those of a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the relevant data subject (Article 6(1)(f) of the GDPR); or
4. where you have given your consent (Article 6(1)(a) of the GDPR), which you may withdraw at any time without affecting the lawfulness of processing carried out before its withdrawal (Article 7(3) of the GDPR).

1.5 If we need to process special categories of personal data, including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, data concerning health or a person’s sex life or sexual orientation, then we may need your explicit consent to do so, which can be withdrawn at any time, and we will process such data as permitted by law. Your consent is not needed if one of the other conditions in Article 9(2) of the GDPR applies, for example if we need to process such data as necessary for the establishment, exercise or defence of legal claims (Article 9(2)(f) of the GDPR).

1.6 If we are processing personal data relating to criminal convictions and offences or related security measures within the meaning of Article 10 of the GDPR, then we do so only to the extent legally permitted and necessary in connection with legal proceedings, legal advice or legal rights.

1.7 We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected and processed, in accordance with our retention policies, and in accordance with applicable laws or until you withdraw your consent (where applicable), which in most cases will be five years after the completion of our mandate or the end of our business relationship with you (Article 2276 of the Luxembourg Civil Code and Article 3(6) of the amended Luxembourg law of 12 November 2004 on the fight against money laundering and terrorist financing) and, for accounting documents, ten years from the end of the financial year to which they relate, unless a longer retention period is required or permitted by law or is necessary for the establishment, exercise or defence of legal claims.

1.8 For the purposes described in this Privacy Notice, we may transfer your personal data to third parties, including to recipients located outside the European Economic Area (EU Member States plus Iceland, Liechtenstein and Norway) (the “EEA”), for example to our IT and software service providers, other counsel, accountants and other third parties involved in your matters. Where we transfer your personal data outside the EEA, we do so only (i) to countries or recipients in respect of which the European Commission has adopted an adequacy decision pursuant to Article 45 of the GDPR (including, for the United States, organisations certified under the EU-U.S. Data Privacy Framework), (ii) on the basis of standard contractual clauses adopted by the European Commission pursuant to Article 46(2)(c) of the GDPR, or (iii) where a derogation under Article 49 of the GDPR applies, for example where the transfer is necessary for the establishment, exercise or defence of legal claims. If you wish to obtain details of the safeguards, please contact us at dataprivacy@leroygoldbach.legal.

1.9 You have the right to obtain information about the processing of your personal data, to access your data, to obtain rectification or erasure of your data, to restrict and port your data, and to object to the processing of your data (Articles 15 to 21 of the GDPR), according to the provisions of applicable data protection legislation and subject to certain exceptions therein, including restrictions resulting from our professional secrecy obligations as lawyers. To exercise these rights, you can contact us at Leroy & Goldbach, 28 Avenue Marie-Thérèse, 2132 Luxembourg, Grand Duchy of Luxembourg, or by email on dataprivacy@leroygoldbach.legal. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement (Article 77 of the GDPR). In Luxembourg, the competent supervisory authority is the Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, Grand Duchy of Luxembourg (cnpd.public.lu).

1.10 We use your personal data to send you communications relevant to us and our services on the basis of our legitimate interest in developing our relationship with you (Article 6(1)(f) of the GDPR), including but not limited to updates (by email, post or social media) about legal developments that might be of interest to you and/or information about our services and invitations to events. Where required by applicable law (in particular the amended Luxembourg law of 30 May 2005 on the specific provisions for the protection of individuals with regard to the processing of personal data in the electronic communications sector), we will send such communications only with your prior consent. You have the right to object to, or opt out of, receiving promotional communications at any time (Article 21(2) and (3) of the GDPR), by:

• contacting us at Leroy & Goldbach, 28 Avenue Marie-Thérèse, 2132 Luxembourg, Grand Duchy of Luxembourg or on dataprivacy@leroygoldbach.legal; or
• using the “unsubscribe” link in emails.

1.11 By using our services, you acknowledge and agree that we may have recourse to digital or other services, our own or offered by third parties, such as, but not limited to, telecommunication services, applications allowing for digital sharing or storage of information, cloud services, internet, e-discovery, automated due diligence, as well as other applications which allow for the search, analysis, storage, processing and translation of data, whether automatically or otherwise, or by having recourse to artificial intelligence or other software programs. As a result, data may be transferred to servers or to a cloud managed by third parties. Leroy & Goldbach will exercise due care in its selection of such third parties and services. Where such third parties process personal data on our behalf, they act as our processors under a written agreement complying with Article 28 of the GDPR and are bound by appropriate confidentiality obligations consistent with our professional secrecy. Any transfer of personal data outside the EEA in this context takes place in accordance with section 1.8.