The purpose of this personal data (the “Data”) protection notice is to inform the clients of Lebray & Associés (the “Law Firm”) and third parties of the commitments made and the measures that have been adopted by the Law Firm in order to ensure respect for personal Data, pursuant to the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “Regulation”)
1. Scope of the Data that is collected and processed
The Law Firm collects and processes only the Data that is necessary for its work, in order to offer clients and prospective clients personalised, high quality services.
The Law Firm may have to collect various categories of Data from clients and prospective clients (individuals or, for legal entities, from their legal representatives, corporate officers or employees), in particular:
– identification and contact information (for example: surname, first name, place and date of birth, identity card number, passport number, postal and email addresses, telephone number, signature, etc.);
– family status (for example: marital status, matrimonial regime, parentage, etc.);
– information concerning training and employment (for example: level of studies, employment, name of the employer, remuneration, etc.);
– banking, accounting or tax information, or information on the client’s assets.
Only the Data that is strictly necessary for the fulfilment of the mandates entrusted to the Law Firm is collected and processed, the scope of which is determined by mutual agreement with the client, on a case-by-case basis. The Law Firm undertakes to collect and process only the Data that is strictly necessary with regard to the objective and purpose of the mandates that are entrusted to it (Data minimisation).
2. Objectives and purposes of the Data processing
The Law Firm will collect and process Data:
– in order to comply with its legal and regulatory obligations, and in particular the provisions of the French National Bar’s Rules and Regulations;
– in order to fulfil the mandates that are entrusted to it by clients;
– for the purposes of the legitimate interest pursued by the Law Firm.
The Law Firm will process and use the Data that is entrusted to it by clients and prospective clients:
– for direct marketing and business development;
– for managing the Law Firm’s relationship with its clients and prospective clients;
– for fulfilling the mandates that are entrusted to it by clients, in particular
- Pre-litigation and litigation matters;
- Contractual matters;
- In order to assist legal entity clients, as regards information on the corporate officers and their employees;
– for preparing service offers or fee proposals;
– to facilitate billing, accounting and collection;
– to serve the legitimate interests of the Law Firm, within the meaning of the Regulation.
The Law Firm uses the Data in order to optimise risk management and to defend its interests, including, in order:
– to provide proof of contacts with clients and prospective clients;
– to prevent acts of money laundering and terrorism financing and in order to combat corruption;
– to collect the Law Firm’s fees.
3. Users and recipients of the Data
The Data is intended to be used by the Law Firm’s partners, associates and employees in order to fulfil the mandates that are entrusted to them, all of whom work under a strict obligation to ensure confidentiality and not to disclose Data for any purposes other than the fulfilling of the mandates that are entrusted to the Law Firm by clients.
In order to attain the objectives and conform to the purposes set out in Article 2 of this notice, the Law Firm may be required to disclose the Data with the clients’ agreement:
– to the service providers and sub-contractors who perform services for the Law Firm;
– to independent trustees;
– to court bailiffs;
– to the courts (first instance, appeal and supreme courts), arbitrators and mediators;
– to the lawyers, notaires, accountants, auditors, intellectual property consultants and other service providers who are members of a regulated profession and who work on a case at the request of a client.
The Law Firm does not transfer Data to any other persons or organisations, unless expressly instructed to do so by the client.
4. Data storage and transfer
The Data is stored on French territory, either in computer files and servers located within the Law Firm, or on the servers of the Law Firm’s IT service providers, which have a contractual obligation with regard to the Law Firm to store the data in France.
The Law Firm does not transfer Data outside French territory and, in particular, outside the European Economic Area, unless the client or persons who work on the case with the Client’s agreement are located outside France or outside the European Economic Area.
5. Data storage duration
The Law Firm undertakes to store the Data for the duration that is necessary in order to comply with the provisions of the law and regulations that are applicable to it.
In this respect, Client Data is kept for the duration of the contractual relationship, plus three (3) years for business development and direct marketing purposes, without prejudice to storage obligations or statutes of limitations. For the prevention of money laundering and the financing of terrorism, the Data is stored for five (5) years after the end of the relationship with the Law Firm. For accounting purposes, the Data is stored for ten (10) years as from the close of the accounting period that followed the end of the relationship with the Client.
Data on prospective clients is stored for three (3) years if no participation in or registration for Law Firm events is recorded.
6. Rights of clients and prospective clients
In accordance with the applicable regulations and provided that they have legitimate reasons, clients and prospective clients have the following rights with regard to the Law Firm:
– Right of access: you can obtain information concerning the processing of your Data, as well as a copy of said Data that was collected;
– Right of rectification: if you believe that your Data is inaccurate or incomplete, you can demand for said Data to be modified accordingly;
– Right of erasure: you can ask for your Data to be erased within the limit of what is permitted by the regulations;
– Right to restrict processing: you can ask for the processing of your Data to be restricted;
– Right to object: you can object to the processing of your Data, for reasons linked to your specific situation, in compliance with the applicable regulations;
– Right to the portability of your Data: when this right is applicable, you have the right to ask for the Data that you provided to be returned to you or, when this is possible technically, for it to be transferred to a third party;
– Right to issue instructions concerning the storage, the erasure or the disclosure of your Data, which are applicable after your death;
– Right to withdraw your consent, if you consented to the processing of your Data, you have the right to withdraw your consent at any time.
You can exercise the rights identified above by sending a letter to Lebray & Associés, 34 boulevard Haussmann, 75009 Paris, France or an e-mail to lebray.associes@lebray.fr.
In accordance with the applicable regulations, you have the right to make a complaint to the relevant supervisory authority, such as the CNIL (Commission Nationale de l’Informatique et des Libertés) in France.
7. Other provisions
The Law Firm reserves the right to update this information notice regularly.
The data controller is Lebray & Associés, 34 boulevard Haussmann, 75009 Paris, France, the partners of which are members of the Paris Bar (France).