Privacy notices for a law firm

This notice explains how [to complete] processes your personal data when you entrust a matter to the firm (art. 13 GDPR). You receive it with the engagement letter, before the mandate starts.

Notice on the prevention of money laundering For some matters, the firm is subject to the Law of 18 September 2017 on the prevention of money laundering. It must then identify you, verify your identity and that of your beneficial owners, keep these data for 10 years and, in the cases the law provides, inform the bâtonnier. These data are used for no other purpose (art. 64 §2 and §3).

1. Who processes your data?

[to complete], [to complete], enterprise number [to complete], is the controller. For any question about your data: our privacy contact, [to complete].

2. Why, and on what basis?

• Handling your matter: advice, negotiation, proceedings and correspondence. Basis: performance of the mandate (art. 6(1)(b) GDPR) and, for some steps, a legal obligation (art. 6(1)(c) GDPR).
• Accepting the matter: identifying you and checking for conflicts of interest, as professional rules require. Basis: pre-contractual steps and the firm's obligations (art. 6(1)(b), (c) and (f) GDPR).
• Complying with the Law of 18 September 2017 on the prevention of money laundering: verifying your identity and that of your beneficial owners, assessing the risks and, where the law requires it, informing the bâtonnier. Basis: a legal obligation and a task in the public interest (Law of 18 September 2017, art. 64 §1; art. 6(1)(c) and (e) GDPR). These data serve no other purpose.
• Invoicing and recovering fees, keeping the accounts. Basis: the contract and accounting and tax obligations (art. 6(1)(b) and (c) GDPR).

3. Which data?

Your identification and contact details, the information in your file and your billing details. Data on health or offences are processed only where your defence requires it (art. 9(2)(f) GDPR; Law of 30 July 2018, art. 10 §1 2°), by persons bound by confidentiality.

For the prevention of money laundering: a copy of your identity document, information on your beneficial owners and the other information the law requires the firm to collect.

4. Professional secrecy

Your data are covered by the lawyer's professional secrecy (Penal Code art. 352, formerly art. 458). The firm discloses them only as far as your matter requires or the law imposes.

5. Who receives your data?

Depending on the matter: courts and their registries, bailiffs, notaries, experts, counsel for the other parties, mediators, translators, your legal-expenses insurer if you ask, the firm's accountant and the tax authorities for billing. The firm's providers (practice software, e-mail, hosting, IT) act as processors under contract (art. 28 GDPR).

For the prevention of money laundering: the bâtonnier, who passes information on to the Financial Intelligence Processing Unit (CTIF/CFI) where required.

6. Transfers outside the European Economic Area

Your data are not transferred outside the European Economic Area.

7. How long?

Your file: 5 years after the end of the mandate, the period during which the lawyer remains liable and keeps the documents (former Civil Code art. 2276bis), or longer if a claim is pending. Accounting data: 7 years (Code of Economic Law arts. III.86 and III.88).

Anti-money laundering data: 10 years after the end of the business relationship, then erased (Law of 18 September 2017, arts. 60 and 62).

8. Your rights

You may ask for access to your data, their rectification, erasure or the restriction of their processing, object to processing based on legitimate interest and ask for the portability of the data you provided (arts. 15 to 21 GDPR). Send your request to [to complete]. The firm answers within one month, which may be extended by two months for a complex request; it then tells you so within the first month (art. 12(3) GDPR). The first copy of your data is free of charge. Some data must be kept despite a request for erasure, to meet a legal obligation or for legal claims (art. 17(3) GDPR).

For data processed under the anti-money laundering law, the law restricts your rights (Law of 18 September 2017, art. 65); you may turn to the Belgian Data Protection Authority.

9. Complaints

You may lodge a complaint with the Belgian Data Protection Authority (www.autoriteprotectiondonnees.be) or go to court. You may also first contact the firm, which will look into your request.

10. Required data and automated decisions

The data needed to identify you and handle your matter are required: without them, the firm can neither accept nor continue the mandate. No decision based solely on automated processing is taken about you.

11. Updates

This notice may be updated. The version in force and its date appear at the top of the document.

Clause for the engagement letter

Data protection. [to complete] processes the client's personal data to perform this mandate, to meet its legal obligations and to manage its fees. These obligations include those of the Law of 18 September 2017 on the prevention of money laundering. The attached privacy notice (Version 1 of [to complete]) sets out the purposes, the recipients, the retention periods, the client's rights and the right to lodge a complaint with the Belgian Data Protection Authority. The client acknowledges having received it.