1. Introduction
This privacy policy describes the principles for the processing of personal data carried out by Knop & Co Advokater I/S, including the purpose of the processing, the types of data and the legal basis for the processing.
We also describe our security measures and how we ensure compliance with the General Data Protection Regulation.
The following abbreviations are used below:
- GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
- DPA: Danish Act no. 502 of 23 May 2018 on supplementary provisions to the regulation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the Danish Data Protection Act).
2. We take the protection of your personal data seriously
As part of our legal advice, Knop & Co Advokater processes personal data and has therefore adopted this privacy policy, which tells you how we process your data.
When you become a client of ours, you at the same time consent to the processing of the personal data you provide to us for the purpose of handling your matter, cf. section 3.
The legal entity responsible for processing your personal data is: Knop & Co Advokater I/S, CVR no.: 32 75 69 05.
If you have any questions, you are always welcome to contact us:
Knop & Co Advokater I/S
Pilestræde 45, 5th floor
DK-1112 Copenhagen K
Phone: +45 33 11 26 26
Email: info@advokatknop.dk
3. The types of data we process about you
We collect, use and store data about you in connection with you being a client, party, witness, expert, heir, employee of our client / parties etc. This includes personal data that we are required by law to process, but also personal data that is necessary for the work we carry out as attorneys.
The data we process include:
- General personal data, for example name, address, telephone number (landline and/or mobile) and contact email address, when we enter into an agreement on legal assistance and for the purpose of pursuing our legitimate interests in existing client relationships, cf. GDPR Article 6(1)(b) and (f).
- Danish CPR number (civil registration number), where necessary to carry out the task we have undertaken and for anti-money laundering checks, cf. GDPR Article 6(1)(c) and section 11(2)(i) of the DPA.
- Other information necessary for handling your matter.
As a rule, we do not process sensitive personal data about you unless the client relationship and our engagement require it, cf. GDPR Article 9(2)(f). This may be health information in connection with personal injury, employment matters, estates, wills and contract drafting. The list is not exhaustive. The engagement is described in our letter of engagement to you (the engagement).
Under the rules, it is a lawful purpose to process your personal data in order to carry out the engagement for you as attorneys. When you have engaged us, you have thereby consented to the processing of all personal data that is relevant and necessary to carry out the engagement. If we do not have a lawful basis for collecting your personal data, we will obtain your consent before processing your personal data for the purposes imposed on us in connection with the task for the client.
If we need your consent, your consent is voluntary and you may withdraw it at any time by contacting us. Please use the contact details above if you would like further information.
4. Our processing principles
The purpose of the processing
We collect and store your data for specific purposes or other lawful purposes related to our work as attorneys.
This is done for:
- Our legal work, including as part of our legal advice and the preparation of legal documents
- Communication with you
- Establishing a legal claim or defending against a legal claim
- Compliance with legal requirements, e.g. collecting information under the Anti-Money Laundering Act, cf. GDPR Article 6(1)(c) and section 11(2)(i) of the DPA.
We only store your information to the extent and for the period necessary to fulfil the purpose of the processing.
However, some information is stored for a subsequent period of 5 years as required under anti-money laundering and bookkeeping legislation.
We only process relevant personal data
We only process data about you that is relevant and adequate in relation to the purposes defined above and/or in our agreement with you. The purpose determines which types of data about you are relevant to us. The same applies to the extent of the personal data we use. For example, we do not use more data than we need for the specific purpose.
We only process necessary personal data
We only collect, process and store the personal data necessary to fulfil our stated purposes. In addition, legislation may determine which types of data are necessary to collect and store for our work. The type and extent of the personal data we process are necessary to fulfil an agreement or another legal obligation.
We check and update your personal data
We check that the personal data we process about you is not incorrect or misleading. We also make sure to update personal data on an ongoing basis.
As our work depends on your data being correct and up to date, we ask you to inform us of relevant changes to your data after you have received the letter of engagement. You can use the contact details above to notify us of any changes.
To ensure the quality of your data, we have adopted internal rules and established procedures for checking and updating your personal data.
We delete your personal data when it is no longer needed
We delete your personal data when it is no longer necessary for the purpose for which it was collected, processed and stored. We have defined deletion routines and controls to ensure this.
We do not disclose your personal data unless we are permitted to do so
We only disclose your personal data to third parties if we have a legal basis for doing so. This may be because we are legally obliged to disclose your personal data, e.g. in connection with court proceedings, land registration, registrations or reports to an authority, or if we have a legitimate interest that does not override your interests. This may, for example, be the case when we conduct litigation, appeal administrative decisions or handle insurance matters.
We do not disclose personal data for marketing purposes.
We do not disclose your personal data to parties outside the EU/EEA, and we do not share your personal data with parties in countries outside the EU/EEA.
5. Cookies, purpose and relevance on our website
We only place technical and necessary cookies that ensure that our website functions. Such cookies are exempt from the consent requirement.
6. Your rights
Under Chapter 3 of the General Data Protection Regulation you have a number of rights that you can invoke when we process information about you in connection with our legal advice.
You can exercise your rights by contacting us. Our contact details can be found above in section 2.
If you wish to access your data, have it rectified, erased or restricted, or object to our processing, we will examine whether this is possible and reply to your request as quickly as possible and no later than one month after we have received your request.
You have the right to access your personal data (GDPR Article 15)
You have the right at any time to be informed of which data we process about you, where it comes from and what we use it for. You can also be informed of how long we store your personal data and who receives data about you, to the extent we disclose data.
However, access may be limited out of consideration for the privacy of other persons, including our duty of confidentiality as attorneys under the Danish Administration of Justice Act, or out of consideration for client confidentiality.
You have the right to have inaccurate personal data rectified or erased (GDPR Articles 16 and 17)
If you believe that the personal data we process about you is inaccurate, you have the right to have it rectified. You must contact us and inform us of the inaccuracies and how they can be corrected.
If you believe that your data is no longer necessary for the purpose for which we collected it, you can ask for it to be erased. You can also contact us if you believe that your personal data is being processed in breach of legislation or other legal obligations.
In some cases we will be obliged to erase your personal data, e.g. if the data is no longer correct.
When you contact us with a request to have your personal data rectified or erased, we will examine whether your request is justified and, if so, make the changes or erasure as quickly as possible.
You have the right to restriction of processing (GDPR Article 18)
In certain circumstances you have the right to have the processing restricted. If processing is restricted, we may – apart from storage – only process the information with your consent, for the establishment, exercise or defence of legal claims, or for the protection of a person or important public interests.
You have the right to object to our processing of your personal data (GDPR Article 21)
You have the right to object to our processing of your personal data. If your objection is justified, we will stop processing your personal data.
7. We protect your personal data and have internal rules on information security
We have adopted internal rules on information security containing instructions and measures that protect your personal data against being destroyed, lost or altered, against unauthorised disclosure, and against unauthorised persons gaining access to or knowledge of them.
We have established procedures for granting access rights to those of our attorneys and other staff who process sensitive personal data and data revealing personal interests. We monitor their actual access through supervision. To avoid data loss, we make regular backups of our data.
In the event of a security breach resulting in a high risk of discrimination, identity theft, financial loss, loss of reputation or other significant disadvantage to you, we will notify you of the security breach as quickly as possible in accordance with GDPR Article 34.
8. Complaints
You have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet) if you are dissatisfied with the way we process your personal data. You can find the Danish Data Protection Agency's contact details at www.datatilsynet.dk.