Privacy Policy for Business Relationships

What is the purpose and legal basis for processing your data?

We may process your data where:

• you are our prospective or actual client, supplier or contractor;
• you are interested in our activities (e.g. as a member of the media);
• you act on behalf of any of the above entities, including as their employee or co-operator.

Your Personal Data may therefore be processed in connection with a number of situations:

• if you have provided us with your personal data directly through various communication channels (e.g. by sending an enquiry / offer by email or by telephone);
• as part of our co-operation when entering into or performing a contract, including where your personal data has been disclosed to us as contact details for the purpose of performing contracts;
• where we have obtained your personal data from other sources (e.g. from the company you work with which is our contractor / client, or from publicly available industry portals).

The scope of personal data we process depends on what information is necessary in connection with our relationship – it includes, in particular, the content of documents, correspondence/communications and, where applicable, other information which we have obtained from publicly available professional sources (e.g. industry portals). In particular, this includes:

• first name and surname;
• information regarding professional activity, including place of work, position or department, professional authorisations;
• contact details, including correspondence address, telephone number, email address or other contact details.

We therefore obtain the above personal data either directly from you or from other persons, e.g. your employers / principals, or from publicly available sources. If we process your data in connection with a contract entered into with you, the purpose of the processing is to take steps towards entering into that contract and to perform it. The legal basis for such processing will be Article 6(1)(b) GDPR (necessity for the performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract). If you contact us on your own behalf, including, for example, where you have given us your business card and asked us to send you specific information, we process your data in order to respond to your enquiry or to carry out other activities to which you have consented. The legal basis for processing the data for the above purpose will be your consent (Article 6(1)(a) GDPR). Where data is processed on the basis of consent, we remind you that you may withdraw the consent previously given at any time, without affecting the lawfulness of processing carried out on that basis before such withdrawal. If you act on behalf of our client or supplier or another entity, we process your data for the purpose of maintaining contact in the context in which you act on behalf of that third party, as well as for the purpose of entering into or performing a contract with that third party or carrying out a joint undertaking. The basis for processing your personal data for this purpose will be our legitimate interest (Article 6(1)(f) GDPR) – establishing and maintaining relations with the third party on whose behalf you act, including entering into and performing relevant contracts with that party, as well as the intention to build our positive image. Irrespective of the above, your personal data, i.e. in particular your first name and surname and correspondence address, email address or telephone number, may be used by us to send you occasional correspondence (e.g. thank-you notes or seasonal greetings) or to assess your satisfaction, including by engaging external entities organising professional law firm rankings. The basis for processing your personal data for this purpose will be our legitimate interest (Article 6(1)(f) GDPR) – the intention of maintaining our relationship and building a positive image. In addition, where your personal data is processed for the purpose of:

• defending against potential claims, as well as pursuing claims where applicable, the basis for processing your personal data for this purpose will be our legitimate interest (Article 6(1)(f) GDPR);
• complying with the controller’s legal obligations (e.g. tax, accounting obligations), the basis for processing your personal data for this purpose will be compliance with legal obligations imposed on the controller (Article 6(1)(c) GDPR).

The provision of your personal data is voluntary; however, in some cases it may be necessary for purposes connected with our co-operation, e.g. it may be necessary to enter into or perform a contract, to respond to an enquiry submitted to us or to conduct correspondence. This means that failure to provide such data may in some cases constitute grounds for refusing to commence co-operation or for us to take legal steps in order to terminate any contract.

Retention period for your personal data

We process your personal data only for as long as is necessary for the purposes for which it was originally collected. After that period, it will be deleted, except where we are required to continue processing such data in order to comply with legal obligations. If you are our current or prospective client or their employee/co-operator, we will retain your personal data at least for the duration of the contract or for the period necessary to enter into it, and thereafter for a maximum period of:

• for current clients: 10 years, counted from the end of the year in which we ceased providing services to you;
• for prospective clients: 2 years from the last contact / end of negotiations.

Personal data processed on the basis of your consent is processed until such consent is withdrawn or until the purpose for which it was given has been achieved. The above periods may be appropriately extended where necessary in the event of potential claims and court proceedings – for the duration of such proceedings and their settlement – as well as where the law requires us in specific cases to process such data for a longer period. Please also see the Privacy Policy tab, where you will find the data identifying the data controller, as well as information on the categories of recipients of your data and the rights to which you are entitled.