Norrbom Vinding's notice of processing of personal data
Introduction
At Norrbom Vinding, we protect the personal data we hold. Below we will provide further information on how we generally process personal data.
Regardless of the context in which Norrbom Vinding processes personal data, we wish to ensure that we hold correct and adequate information.
Data controller
Norrbom Vinding processes personal data in accordance with the relevant rules of the data protection legislation, including in particular the rules of the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679 of 27 April 2016) and the Danish Data Protection Act (Act No. 502 of 23 May 2018).
Norrbom Vinding is controller of the data we process, and we are thus responsible for ensuring that personal data is processed in accordance with the data protection legislation, cf. however the notice concerning whistleblower systems which can be accessed via the link below.
Norrbom Vinding’s contact information is as follows:
Norrbom Vinding
Tromsøgade 2
2100 Copenhagen Ø
CVR no.: 20 49 14 77
Telephone: +45 35 25 39 40
Email: info@norrbomvinding.com
Purposes of and legal bases for processing of personal data
Provision of our legal services
The overarching purpose of Norrbom Vinding’s processing of personal data is to enable us to provide our core services – i.e., legal assistance – to our clients.
Our legal assistance can be divided into four main types:
- Legal investigations and inquiries as well as investigation processes of a similar nature
- Whistleblower systems
- Litigation as well as legal and arbitration proceedings
- Legal assistance in general (typically covers all other situations)
For each main type, we have described how we process personal data in the different contexts in separate policies. We therefore ask you to read further information by clicking the links below, depending on your relations with us:
- Legal investigations and inquiries as well as investigation processes of a similar nature
- Whistleblower systems
- Legal proceedings
- Legal assistance in general (typically covers all other situations than those mentioned above)
Job applicants
The purpose of processing applicants’ personal data is to fill any vacant positions at Norrbom Vinding.
Recipients of newsletters and participants in events
The purpose of the processing of personal data is to be able to provide the information that recipients of newsletters and participants in events request and need in these contexts as well as to generally manage Norrbom Vinding’s services related to newsletters and events.
In general, the categories of personal data processed are as follows: information identifying individuals such as name, job title, telephone number, email, employer as well as information on attendance of events and certificates of attendance, if any.
Our processing of personal data is based on point (b) of Article 6(1) regarding the performance or conclusion of contracts or point (f) of Article 6(1) regarding legitimate interests of the GDPR. In this regard, Norrbom Vinding’s legitimate interest is to manage our newsletters and events.
The personal data that we process is generally provided by the relevant individuals (i.e., the data subjects) themselves.
Visitors to Norrbom Vinding’s website
The purpose of our processing of personal data is to provide the best possible experience when visiting Norrbom Vinding’s website.
In general, the following category of personal information is processed: IP address.
Further information about how we use cookies on our website can be found here
To the extent that we use consent as legal basis for the processing of personal data, such consent may always be withdrawn. Personal data that is processed on another legal basis than consent may, however, continue to be processed by us.
Assignment and disclosure of information
Norrbom Vinding uses processors and suppliers to carry out work on our behalf, such as work relating to IT maintenance, backup and email accounts. Processors and suppliers may be granted access to the data necessary for such work but will be under a contractual obligation to treat such data as confidential. In pursuance of the data protection legislation, Norrbom Vinding has entered into data processor agreements with our processors.
When providing legal assistance, Norrbom Vinding is subject to an obligation of professional secrecy under the Code of Conduct of the Danish Bar and Law Society. Regardless of their job function, all employees at Norrbom Vinding are bound by professional secrecy. Thus, as a general rule, we are neither entitled nor obligated to assign or disclose information – including personal data which comes to our knowledge as part of a client relationship – to third parties. However, we may disclose information to public authorities or courts, opposing parties in legal proceedings as well as clients if we are obligated to do so, or if it is necessary in order to perform assignments for clients.
Generally, we do not transfer personal data to countries outside the EU/EEA, but if we do make such transfer, for example to a court in a third country, it will be based on points (b)-(g) of Article 49(1) of the GDPR.
Security
To ensure that the personal data we hold does not come to the knowledge of third parties, we have internal rules regarding handling of personal data, IT security and confidentiality, etc. which contribute to ensuring our compliance with the data protection legislation.
In our work, we always focus on protecting the personal data we hold in the best possible way.
To prevent data loss, we carry out daily backup of the data processed in our IT systems – including, of course, personal data.
In case of a personal data breach resulting in a high risk that personal data may be accessed by a third party, we will communicate the breach to the affected data subjects without undue delay, as prescribed by the data protection legislation.
If you become aware that a personal data breach may have occurred, or that personal data may have been accessed by a third party – e.g., in your capacity as an IT supplier to Norrbom Vinding, or because you become aware of such breach in another context – please send an email as quickly as possible to breach@norrbomvinding.com.
Retention
Norrbom Vinding does not store personal data longer than necessary and, in accordance with the data protection legislation, we delete the personal data we no longer need to store.
For example, data processed as a result of Norrbom Vinding providing legal advice and assistance will generally not be stored longer than 10 years after finalising the relevant matter or case.
Data subject rights
Right to receive a copy of data (right of access)
Data subjects have a right to know what information Norrbom Vinding holds about them. Likewise, data subjects are entitled to see such information, provided the right of access does not conflict with the rules on professional secrecy applicable to law firms and is not covered by other exceptions in the data protection legislation.
Right to rectification
Data subjects are entitled to request Norrbom Vinding to rectify personal data if they believe that the data is incorrect, gives the wrong impression, etc., and we are obligated to assess such a request.
Right to erasure
In certain situations, data subjects are entitled to have their personal data erased before the usual time of erasure.
Right to restriction of processing
Data subjects are in some situations entitled to obtain restriction of processing of their personal data. In such case, Norrbom Vinding may only process – except for retention – such information subject to consent or in order to establish, raise or defend legal claims, or in order to protect another natural or legal person, or for reasons of important public interest.
Right to object
In some situations, data subjects are entitled to object to Norrbom Vinding’s lawful processing of their personal data.
Right to transmit (data portability)
In some situations, data subjects have a right to receive their personal data, which they have provided to Norrbom Vinding, in a structured, commonly used and machine-readable format and to have such data transmitted from Norrbom Vinding to another data controller without hindrance.
Right to withdraw consent
To the extent that Norrbom Vinding uses consent as legal basis for processing personal data, the relevant data subject can always withdraw their consent. Personal data that is processed on another legal basis than consent may, however, continue to be processed by us.
Duty to provide information
As a starting point, Norrbom Vinding must inform any data subject about the processing of personal data that Norrbom Vinding carries out about the data subject, regardless of whether the personal data is processed on the basis of an unsolicited request from the data subject themselves, or a direct inquiry to the data subject from Norrbom Vinding, or whether the personal data on the data subject has not been collected from the data subject.
However, the duty to provide information is restricted by the rules of the Danish Administration of Justice Act as well as the obligation of professional secrecy under the Code of Conduct of the Danish Bar and Law Society, which means that Norrbom Vinding cannot provide information on the processing of personal data if this would be contrary to the obligation of professional secrecy.
In accordance with the data protection legislation, Norrbom Vinding may omit to comply with the duty to provide information vis-à-vis a data subject on the grounds of overriding private interests, including the data subject’s interests, or on the grounds of overriding private or public interests if these interests are deemed to outweigh the data subject’s interests in receiving the information. This exception is relevant if the duty to provide information is deemed to have a negative impact on the protection of our clients’ interests, for example in connection with the prosecution and enforcement of civil claims or criminal offences, control or supervisory functions and similar situations.
Finally, Norrbom Vinding may omit to comply with the duty to provide information if the data subject must be assumed to be aware of the information, or if providing the information to the data subject is impossible or would involve a disproportionate effort or would hinder the achievement of the purposes of the processing.
Further information
If you have any questions concerning this notice or your legal rights under the applicable legislation, please contact us. Our contact details are listed above under “Data controller”.
You can find further information about the data protection legislation and your legal rights on the website of the Danish Data Protection Agency: https://www.datatilsynet.dk/english. The Agency is the authority which ultimately can decide if data has been processed lawfully, for instance as part of a complaint process. All data subjects may file a complaint to the Danish Data Protection Agency.
Version
Document version: October 2022