Privacy Notice.

Edson Legal BV/SRL.

Edson Legal BV/SRL is a limited liability company (“besloten vennootschap”/”société à responsabilité limitée”, “BV”/SRL”), incorporated under Belgian law and registered with the Crossroads Bank for Enterprises in Brussels under the number 0777.537.251, with its registered office at Tweekerkenstraat 45 Rue des Deux Eglises, 1000 Brussels, Belgium, for the purpose of practicing law (“advocatuur”/”profession d’avocat”).

Edson Legal BV/SRL is hereafter referred to as “Edson”.

Scope and Applicability.

Edson is committed to protecting your personal data in accordance with applicable data protection legislation and more specifically with the General Data Protection Regulation (GDPR).

This Privacy Notice sets out how Edson collects, uses, shares, and otherwise processes personal data that it acquires from data subjects accessing its websites or taking contact with Edson through other means (e.g. by telephone, e-mail, or by exchanging contact data at personal encounters such as trade shows and conferences). This Privacy Notice also describes what rights data subjects may assert in relation to their data.

This Privacy Notice addresses personal data that Edson processes about:

Visitors to our website and our mobile applications (accessible inter alia through www.edsonlegal.eu and www.truediligence.eu), whether those visitors are a (prospective) client, supplier, business partner, job applicant or casual visitor;
Contact persons for our clients and/or prospective clients;
Contact persons for suppliers of goods and services to Edson;
Contact persons for business partners, e.g. correspondent law firms and consultancy firms;
Potential job applicants or individuals that Edson would like to offer employment to;
Other individuals in the course of carrying out our legal services, for instance adversaries in a litigation, court-appointed experts, and witnesses.

This Privacy Notice does not address the processing of personal data of employees and lawyers in the context of their professional relationship with Edson.

Personal Data Controller.

The Controller of your personal data is Edson Legal BV, with registered offices at Tweekerkenstraat 45 Rue des Deux Eglises, 1000 Brussels, Belgium. You can contact us at info@edsonlegal.eu.

What Personal Data We Process.

We collect and otherwise process the following categories of personal data about the Edson Website(s) visitors, clients, prospective clients, suppliers and other third parties:

Basic data: Name, gender, title, organization, job responsibilities, phone number, mailing address, email address, contact details and optionally information about family life (excluding special categories of data). Family life data may include birth date, partner, children, hobbies and interests – but only to the extent you explicitly choose to share this with us.
Special categories of data: in limited circumstances, and only where you have provided us with such information as is necessary for a specific service we are providing to you: religious or other beliefs, racial or ethnic origin, sexual orientation, health data and details of trade union membership.
Registration data: Newsletter requests, event/seminar registrations including possible registration data of your partner/spouse/colleague that is also registered, dietary preferences (excluding special categories of data), subscriptions, downloads, and username/passwords as applicable to access relevant secure login areas.
Client service data: Personal data received from clients in respect of employees, customers or other individuals known to clients, invoicing details and payment history, and client feedback.
Marketing data: Data about individual participation in conferences and in-person seminars, credentials, associations, areas of interest, and preferences.
Transaction data: Personal data contained in documents, correspondence or other materials provided by or relating to transactions conducted by our clients.
Compliance data: Government identifiers, passports or other identification documents, dates of birth, beneficial ownership data, qualification as politically exposed person and due diligence data.
Job applicant data: Data provided by job applicants or others on our Edson websites referenced above, or offline means in connection with employment opportunities, which also may be subject to an additional relevant recruitment privacy policy.
Device data: Computer Internet Protocol (IP) address, unique device identifier (UDID), cookies and other data linked to a device, and data about usage of our Sites (Usage Data).

We collect personal data from a number of sources, either directly from the data subjects, or from clients, colleagues and publicly available sources. Where Edson receives data from its clients about employees, customers or other individuals, the client is responsible for ensuring that any such data is transferred to us in compliance with applicable data protection laws.

Use of Personal Data.

Depending on the relationship you have with Edson, both the purposes and the legal basis (singular or plural) for which we process your personal data may vary:

To provide legal advice and to respond to information requests we use basic data, registration data, client service data, and device data. We need to process your information in this way in order to perform our obligations under our contracts with our clients.
To manage our business operations and our client relationships we use basic data, special categories of data, registration data, marketing data and client service data. This processing is necessary in order to perform our obligations under our contracts with our clients (e.g. issuing and processing invoices) and suppliers (e.g. managing the supply of goods and services to Edson).
To optimize the experience of our Edson websites we use device data. Our legitimate interest is to monitor how our Edson websites are used to help us improve the layout and information available on our Edson websites. In the end this provides a better service to our Edson websites users.
To protect the security and effective functioning of our website and information technology systems we use basic data, registration data, transaction data, and device data. Our legitimate interest is to monitor how our Edson websites are used to detect and prevent fraud, other crimes and the misuse of our websites, and this in turn allows you to use them safely.
To provide relevant marketing information for instance about events, potentially relevant services offerings, legal updates, conferences or networking events, and interest groups. For this purpose we use marketing data, basic data, special categories of data, registration data, client service data, and device data. It is necessary for our legitimate interests to process this information in order to provide you with tailored and relevant marketing, updates and invitations.
To address compliance and legal obligations, such as complying with Edson’s anti-money laundering obligations, and to prevent fraud we use compliance data, basic data, registration data, transaction data, and device data. This processing is necessary for the purposes of complying with legal requirements to which we are subject.
To consider individuals for employment/freelancing, and to manage subsequent successful on-boarding we use job applicant data and compliance data. The processing is necessary for the purposes of recruitment and on-boarding and for complying with applicable legal obligations.

Legal Grounds for Processing Your Personal Data.

We process your personal data on the basis of one of the following grounds provided for by the GDPR:

a) for the purpose of performing Edson’s professional services as instructed by the client – pursuant to art. 6 sec. 1 letter b) of GDPR (performance of agreement);

b) for the purpose of performing the legal obligations imposed on the Data Controller in connection with performance of Edson’s professional services – i.e. pursuant to art. 6 sec. 1 letter c) of GDPR;

c) for the purpose of the legitimate interest of the Data Controller making the cooperation under and/or performance of Edson’s professional services easier – pursuant to art. 6 sec. 1 letter f) of GDPR (legitimate interest);

d) for the purpose of the legitimate interest of the Data Controller consisting in establishing, requesting the recovery of claims or rights of the Data Controller or defending against such claims – pursuant to art. 6 sec. 1 letter f) of GDPR (legitimate interest);

e) for the purpose of direct marketing of the Controller or a third party – pursuant to art. 6 sec. 1 letter f) of GDPR (legitimate interest) (notwithstanding the need for possible additional opt-in agreements required to proceed to actual sending of direct marketing communications);

f) for the purpose of establishing, pursuing or defending claims – pursuant to art. 9 sec. 1 letter f) of GDPR and within the scope of data concerning convictions and law infringements – pursuant to the rules specified in art. 10 of GDPR – if applicable.

The Controller’s legitimate interests include: (i) establishing and pursuing claims or rights of the Controller (or client thereof) or defence against such claims, (ii) direct marketing of the services rendered by the Controller or third parties, (iii) delivery of professional services and (iv) communication with the client.

Retention Period.

Depending on the categories of personal data, Edson will apply the following retention periods:

Personal data of (prospective) clients.

Edson will retain data related to our clients and/or prospective clients, for the purposes as set forth above, for 10 years after termination of our client relationship or of the relevant file/matter.

CCTV footage.

To the extent applicable, Edson will keep camera footage during maximum 24 hours. However, if the camera footage is relevant to address irregularities discovered during said retention period (e.g. burglary), we will keep the relevant camera footage for a longer period to enable us to investigate and handle these irregularities. After this period, the camera footage is destroyed.

Personal data needed to engage in direct marketing (this includes compiling mailing lists and determining the moment of dispatch thereof, engaging in telemarketing, sustaining informal and one-on-one business development-related discussions, and/or compiling registration lists).

We will store your personal data until the moment you have informed us that (i) you no longer wish to receive our mailings, (ii) we cease the sending of the relevant mailings, or (iii) it appears that you no longer exercise a relevant activity. Information relating to your partner or your dietary requirements will be deleted as soon as a specific event has taken place and we no longer need that information.

Candidates in a selection procedure.

Your personal data will be kept during our application and selection procedure and will be kept for 3 months after completion thereof, unless the applicant has indicated that the data may be kept for a longer period of time.

Suppliers of goods and services to Edson.

Edson will retain data related to our suppliers for the purposes as set forth above, for 20 years after termination of our contractual relationship with the relevant supplier.

We may share personal data with the following categories of recipients:

Suppliers and service providers: We share personal data with suppliers and service providers to enable them to perform services that they are contractually bound to perform for Edson’s benefit, such as infrastructure and IT services providers, the providers of our client intake system, our finance systems and our CRM system; business analytics consultants and marketing campaign orchestrators; and providers of external venues where we host conferences and events. These are always required, either by law and/or by contract, to provide reasonable security for personal data and to use and process such personal data on our behalf only.
Financial institutions: We share personal data with financial institutions in connection with invoicing and payments.
Mandatory disclosures and legal claims: We share personal data in order to comply with Edson’s legal and compliance obligations, inter alia anti-money laundering and fraud prevention, court order or other legal process, to comply with a request from our regulators, governmental request or any other legally enforceable demand. We also share personal data to establish or protect our legal rights, property, or safety, or the rights, property, or safety of others, or to defend against legal claims.

If you have questions about the parties with which we share personal data, please contact us as specified below.

Contact.

In all matters related to processing of your personal data protection by the Data Controller, you can contact us:

by regular mail: Edson Legal BV, Tweekerkenstraat 45 Rue des Deux Eglises, 1000 Brussels, Belgium.
by e-mail: info@edsonlegal.eu.

Your Data Protection Rights.

Access. Subject to certain exceptions, you have the right to request a copy of the personal data we are processing about you, which we will provide to you in electronic form. We may require you to prove your identity before providing the requested information. If you require multiple copies of your personal data, we may charge a reasonable administration fee.
Rectification. You have the right to require that any incomplete or inaccurate personal data that we process about you is amended.
Deletion. You have the right to request that we delete personal data that we process about you, unless we are required to retain such data in order to comply with a legal obligation or to establish, exercise or defend legal claims.
Restriction. You have the right to request that we restrict our processing of your personal data where:
- you believe such data to be inaccurate;
- our processing is unlawful; or
- we no longer need to process such data for a particular purpose, but where we are not able to delete the data due to a legal or other obligation or because you do not want us to delete it.
Portability. You have the right to request that we transmit your personal data to another data controller, where this is:
- personal information which you have provided to us; and
- we are processing that data to perform our professional services to you (including but not limited to legal services).
Objection. In case we process your personal data based on our legitimate interest, you have the right to object to such processing on grounds relating to your particular situation except if we have compelling legitimate grounds for the processing which override your interests and rights, or if we need to continue to process the data for the establishment, exercise or defence of a legal claim.
Withdrawing Consent. If you have consented to our processing of your personal data, you have the right to withdraw your consent at any time, free of charge. This includes cases where you wish to opt out from marketing messages that you receive from us.

If you are in the EEA you also have the right to lodge a complaint with the local data protection authority if you believe that we have not complied with applicable data protection laws. Access a list of local data protection authorities in EEA countries.

Changes to Edson Privacy Notice.

From time to time, Edson may need to change this Notice. The most recent version of this Notice is available on our website. In case of important changes to our Notice, we may, where appropriate, notify you by e-mail or other form of in-person communication.