Privacy policy

01

Personal data we process

The personal data we process includes:

• —basic details, such as name, the company a person works for, title or position,
• —contact details, such as postal address, email address and telephone numbers,
• —information about payments to or from the controller,
• —information provided to us for the purposes of meetings and events,
• —personal data provided to us by our clients or by someone on their behalf, or created by us in the course of providing our services, which may also include special categories of data,
• —any other data any person may provide to us in connection with the provision of our services.

02

How we collect data

We may collect personal data in the course of business (including during the matter intake process), through use of our website and other electronic tools (including email correspondence), when a person contacts us or requests information from us, while providing legal services, within an individual’s relationship with one or more of our employees and clients, from public sources for the purpose of updating data we already hold, or when we receive data by other means.

Where we are required to collect personal data by law or under the terms of a contract, or in order to take steps prior to entering into a contract with an individual, and the individual does not provide that data on request, we may be unable to perform the contract we have entered into or are seeking to enter into (for example, to provide the requested services). In that case we may have to cease providing our services, though we will inform the individual concerned.

03

How we use data

We use personal data:

• —to provide and improve legal services for our clients,
• —for legitimate business purposes, such as ensuring network and information technology security or providing information about our services (including sending legal updates, publications and event details),
• —for the purposes of establishing, exercising or defending legal claims,
• —for recruitment purposes.

04

The basis on which we use personal data

We use personal data on the following bases:

• —to perform a contract or to take steps prior to entering into a contract;
• —to comply with legal and regulatory obligations,
• —for legitimate interests (for example, ensuring network and information technology security, establishing, exercising or defending legal claims or proceedings, or providing information about our services),
• —on the basis of the individual’s consent.

05

How long we retain personal data

We retain personal data in accordance with our internal data retention rules and the legislation in force in Slovenia. Retention periods are based on the requirements of applicable data protection law and the purpose for which the data is collected and used, taking into account legal and regulatory requirements to retain data for a minimum period, limitation periods for bringing legal proceedings, and the controller’s business purposes.

06

With whom we share personal data

Data we obtain may be passed to other attorneys or law firms and may be processed by them solely where a valid legal basis for such processing exists and subject to appropriate safeguards.

We may also share personal data with certain trusted third parties under applicable contracts, including our information technology service providers and suppliers such as translation providers, subject to appropriate safeguards.

Where necessary or where provided for in this privacy policy, personal data may also be shared with regulatory bodies, courts, tribunals, state authorities and law enforcement authorities. Although unlikely, we may be required to disclose personal data in accordance with legal or regulatory requirements. We will seek to notify the individual concerned beforehand, unless we are restricted from doing so by law.

07

Countries to which we transfer personal data

Where data is transferred from a location within the EU to a location outside the EEA, the transfer will be based on the relevant provisions of the General Data Protection Regulation (EU) 2016/679, which include in particular standard contractual clauses on data protection concluded between the data exporter and the data importer, the explicit consent of the data subject to the transfer, and the need to establish, exercise or defend legal claims.

08

Rights of data subjects

We guarantee data subjects at least the following rights.

A data subject has the right to request information about the data we process concerning them and about the processing of their personal data. An individual’s rights include the rectification or erasure of that data, restriction of processing, prevention of unauthorised transfer of personal data to a third party, and in certain circumstances the transfer of personal data to another organisation. Data subjects also have the right to lodge a complaint concerning the controller’s processing of personal data with the local supervisory authority (Informacijski pooblaščenec, Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si).

If an individual objects to the processing of their personal data, or has given consent to processing and later decides to withdraw it, we will respect that decision in accordance with our legal obligations.

Please note that even after consent is withdrawn we may continue to process an individual’s personal data to the extent required or otherwise permitted by law, in particular in connection with establishing and defending our legal rights or fulfilling our legal and regulatory obligations.

09

Contact

For the identification of the relevant controller of personal data, please refer to the introduction to this privacy policy.

If you have questions about our privacy policies, wish to exercise your right to a copy of the data we process about you, or believe that the data we process about you should be corrected, please write to us at info@orazemlaw.com marking the subject “varstvo osebnih podatkov”.