Privacy notice

Updated 24 November 2023

This privacy notice describes the processing of the personal data of the following groups:

• our clients or their representatives
• counterparties or their representatives
• our clients’ customers
• our clients’ personnel or other contractual partners
• other persons related to the assignment depending on the nature of the assignment.

1. What data do we process?

We process your personal data relating to the client relationship and the assignment depending on the nature of the assignment. This data includes:

• name, date of birth and contact information (e.g. address, telephone number and email address)
• information relating to the employment or service relationship (e.g. organisation, job title)
• information on contractual relationships
• information on positions of trust and the right to sign the name of a legal entity
• information on the title or leasehold of a real estate property or other property
• categorisation data (e.g. prohibition of marketing, participation in and feedback on events, personal interests).

In some assignments, we must process special categories of personal data. These include:

• health-related information
• information on membership of a trade union
• personal identification numbers of persons involved in criminal sentences, offences and precautionary measures.

We process such personal data concerning special categories of personal data only to the extent required by the assignment or compliance with our statutory obligations.

2. Why do we process your data?

• We process your data in order to carry out the assignment and comply with our statutory obligations that concern us as a limited liability company practising advocacy.
• Data is also processed in order to:
• develop and offer services to clients;
• carry out marketing and sales measures;
• specify and identify persons included in the client register;
• manage contact information and maintain contact with clients;
• develop client relationships.

3. How do we collect your data?

We collect data from the following sources:

• our client, you or your representative
• credit data, association or trade register or other public registers
• authorities
• public sources
• monitoring tools used as part of any Know Your Client (KYC) processes.
• We can use the Refinitiv World-Check service or other monitoring tools to assist in the KYC processes and check the backgrounds of data subjects, for example the client’s counterparty, upon the client’s request.
• As it processes personal data, Refinitiv World-Check operates as an independent controller. Its privacy policy is available here.

4. What is the legal basis for the processing?

Our processing is based on

Our legitimate interest

• The processing is based on our legitimate interests related to handling assignments.
• We can also process assignment-related data based on out legitimate interest in order to develop our business.

Statutory obligations

• C&S is a limited liability company practising advocacy referred to in section 5(2) of the Advocates Act (496/1958). It operates under the authorisation and supervision of the board of directors of the Finnish Bar Association. We are subject to the obligations laid down in the Advocates Act and other provisions of law, including the Code of Conduct of the Finnish Bar Association, as applicable.
• Furthermore, we are subject to the obligations under the Act on Preventing Money Laundering and Terrorist Financing and the economic sanctions provided for in EU regulations. In order to comply with the above, we process personal data for the following reasons:
• identifying the client or the clients representative and verifying their identity
• making a risk assessment concerning money laundering and terrorist financing
• verifying and reporting sanctions.

The legitimate interest of the client

• If the processing of personal data is not based on our statutory obligations, it is based on the client’s following legitimate interests to:
• secure its rights and safeguard its assets;
• protect its interests related to contractual arrangements;
• make legal claims and use counsel for supervising its rights and interests and in the hearing of civil and criminal matters in courts.

The performance or enforcement of an agreement

• In case of private clients, the processing of personal data is based on the performance of an agreement between the client and us.

5. How long do we store your data?

During the assignment

• we process your personal data actively while carrying out the assignment to which your personal data relates to.

After the assignment

• we will archive the personal and client data relating to the assignment within one year after the assignment has ended and store the data in the archive for ten years in accordance with the Finnish Bar Association’s recommendation.

6. Who processes your data?

We disclose your personal data to third parties only if it is necessary for carrying out the assignment or fulfilling statutory obligations.

• Carrying out an assignment may require disclosing data to another client or an authority, for example.
• Complying with our statutory obligations may require disclosing data to, for example, the Finnish Bar Association or an authority.