Asianajotoimisto Sivenius, Suvanto & Co Oy
We are engaged to process your personal data and other data relating to you reliably, securely, and in a transparent manner. In this Privacy Notice, we describe how we collect and process personal data of our clients, potential clients, and other business contacts.
The controller of your personal data, as described herein, is Sivenius, Suvanto & Co Attorneys Ltd and its offices both in Helsinki and Turku. Should you have any questions relating to the processing of your personal data, or should you wish to use your rights as a data subject, please contact us at info(at)sisulaw.fi.
1. How we collect Personal Data
“Personal data” are data that can be used to identify you or data that can otherwise be linked to you. As a law firm, we regularly receive and process various types of personal data in connection with our business operations, for example in connection with our business intake process and when performing and managing assignments from our clients.
We mainly process personal data we obtain from you directly, for example when you send emails to us or communicate with us through other channels or when you attend an event organised by us. Where applicable, we also process your personal data obtained from publicly available sources, such as your employer’s website, and personal data that we can receive from your use of our website.
We mainly process the following types of your personal data:
- basic information, such as your name, your contact information (email, address, phone number, your employer, your title or position;
- information you provide to us for the purposes of attending meetings and events;
- identification and background information provided by you or collected by us as part of our business acceptance processes in accordance with the applicable Finnish Bar Association rules and other applicable laws (such as anti-money laundering regulations);
- personal data provided to us by or on behalf of our clients, partners, and employees or generated by us in the course or providing services; and
- any other information relating to you which you may provide to us.
2. How we use Your Personal Data
We use the personal data we collect for the following purposes:
- the management and administration of our business relationship with you and/or your organisation, such as the management of client assignments and provision of services, including the processing of payments, accounting, billing, and collection as well as related support services;
- business development and marketing, such as (i) communicating with you with respect to legal developments, events, training, and our other services which may be of interest to you; (ii) maintaining our contact lists, and (iii) compiling statistics and improving our services and communications, for example by gathering information regarding your preferences through website analytics; and
- compliance with our legal obligations, including obligations with respect to anti-money laundering and sanctions checks as well as other legal and regulatory requirements;
- in case you have sent us or submitted through our website a job application we process your personal data in our normal recruitment procedure
3. Legal basis for processing Your Personal Data
When processing your personal data for the purposes described in this Privacy Notice, we process your data based on either your consent or our legitimate interest in maintaining the business relationship between us. Certain processing is based on our legal obligations as a law firm, such as anti-money laundering as well as sanctions checks.
4. How We May Share and Transfer Your Data
Please note that we are bound by the attorney-client privilege as set out in applicable legislation and the professional code of conduct (Finnish Bar Association rules) applied to practicing attorneys. We consider your personal data to be strictly confidential and do not make your personal data available to any third party unless necessary for taking care of our assignments and/or providing you with legal advice. However, we may share information with our suppliers when they perform services on our behalf, mainly to maintain and support our IT systems. However, such suppliers are obliged to process the data on our behalf for the above mentioned purposes only and they have entered into a non-disclosure agreement with us.
We may also need to transfer personal data to third parties, such as other counsels, advisors, and third parties involved in your matters, including third parties based outside the European Union (the “EU”) and the European Economic Area (the “EEA”).
The personal data we process are not regularly transferred outside the EU or the EEA. However, if we transfer your personal data outside the EU or the EEA, such transfer will be performed subject to appropriate safeguards required by applicable data protection laws.
We take appropriate technical and organisational measures against unauthorized or unlawful processing of your personal data and against accidental loss or destruction of, or damage to, your personal data in accordance with our internal security procedures relating to personal data processing. We regularly check our security policies and procedures to ensure our systems are secure and protected. Only the personnel who need to process your personal data for the purposes mentioned above have access to your personal data.
5. How long will we store Your Personal Data
Your personal data will be stored for the purposes mentioned above for as long as we have a business contact or other contact or as may otherwise be required by law. When the processing of your personal data is no longer necessary for the purposes they were collected, we will delete or anonymise the personal data relating to you in a secure manner. We may retain your personal data for a longer period to the extent required by our automated disaster recovery backup systems or to the extent we deem the data necessary to assert or defend legal claims during any relevant retention period.
Any job application submitted to us is stored as long as the relevant recruitment procedure lasts. Job applications submitted to us by your own initiative will be stored for six (6) months.
6. Your rights and how to exercise them
You have the right to:
- request a copy of the personal data we process relating to you;
- request the correction of incorrect personal data relating to you and in some cases the deletion of your personal data;
- request the restriction of processing of your personal data or to object to processing; and
- receive, under certain preconditions, your personal data in a structured, commonly used, and machine-readable format, and the right to transmit those data to another controller.
In addition, you have an express right to ask us not to send you any marketing-related material.
Please note that if we restrict or delete your personal data, this may result in us not being able to provide to you the communications and invitations described above.
If you consider that your rights under the applicable data protection laws have been infringed, you may lodge a complaint with the competent supervisory authority (in Finland the Office of Data Protection Ombudsman / Tietosuojavaltuutetun toimisto).
7. Updates
This Privacy Notice has been updated in May 2023. We reserve the right to amend this Privacy Notice from time to time to reflect changing legal requirements or our processing practices.