Privacy Statement of Legal Consultants AZ BV

1 Data controller

Legal Consultants AZ B.V. is the data controller for the processing activities described in this privacy statement.

2 Who this statement applies to

This statement applies to clients, prospective clients, representatives, contact persons of organisations, opposing parties, authorised agents, experts, suppliers, and visitors to the website or client portal. When a client provides data about other individuals, that client must have a valid legal basis for doing so and must inform the individual concerned where necessary.

3 What personal data we process

Depending on the relationship and the engagement, we may process the following categories of personal data:

• –identification and contact details, such as name, address, place of residence, date of birth, telephone number and email address;
• –business and role details, such as organisation name, position, KvK number and details of authority to represent;
• –case file data, including decisions, correspondence, agreements, statements, evidence, procedural documents and other information provided by or on behalf of the client;
• –data needed to draw up, sign and use an engagement letter or a power of attorney;
• –financial and administrative data, such as billing address, bank account number, payment status, and data needed for bookkeeping;
• –communication data from email, telephone, letters, contact forms and messages in the client portal;
• –portal and security data, such as account details, authorisations, IP address, login times, failed login attempts, session data and technical log data;
• –data on website use, to the extent functional, security-related or permitted analytical cookies and similar techniques are used.

Legal case files may contain information about health, ethnic origin, religion, political opinions, trade union membership, sexual behaviour, criminal offences or other sensitive circumstances. We process such data only when it is relevant and necessary for the provision of legal services and the processing is legally permitted, for example for the establishment, exercise or defence of legal claims.

4 Source of personal data

We usually receive personal data directly from the client or their representative. We may also receive data from an opposing party, lawyer, bailiff, expert, employer, insurer, administrative body, court, public register or another party involved in the case. We may consult public sources when this is necessary and lawful for the engagement, verification of authority, or prevention of misuse.

5 Purposes and legal bases

Where we ask for consent, that consent can always be withdrawn. Withdrawal has no retroactive effect. Where we rely on a legitimate interest, we weigh our interest against the rights and interests of the data subject.

6 Identification, authority and fraud prevention

For administrative-law and other representation matters, we must be able to establish, before starting, who the client is and whether we are authorised to act on that client's behalf. We use the basic information provided to draw up the engagement letter and, where needed, a power of attorney. The client checks and signs these documents.

We do not routinely ask for a photograph or a copy of an identity document. Additional identity verification takes place only when:

• –a statutory obligation, including an applicable obligation under the Dutch Anti-Money Laundering and Anti-Terrorist Financing Act (Wwft), requires this;
• –a competent administrative body, court or other competent authority demonstrably requires this;
• –there is concrete doubt about identity or authority to represent;
• –there is a concrete risk of fraud, a security issue or misuse.

In those cases, we determine in advance which check is necessary. Where inspection or recording of limited data suffices, we do not keep a full copy. A copy we do receive is, where possible, redacted of unnecessary data and marked with its purpose and date. Identification data is made accessible only to persons who need it for their tasks.

7 Client portal and case-building

Clients can use the secure client portal to provide documents, build their case file, exchange messages and access the case information made available to them. For some routine legal services, contact can take place without a portal account. The public contact form does not offer the option to upload case documents.

The specialist department for government and administrative-law matters is additionally restricted. Access is granted only to authorised clients, staff and other persons for whom access is necessary. Accounts are personal and may not be shared.

For security and misuse prevention, we record technical log data. This data is not used for commercial profiling.

8 Wwft and integrity screening

Legal Consultants AZ B.V. is not a bank, and not every legal engagement falls under the Dutch Anti-Money Laundering and Anti-Terrorist Financing Act (Wwft). When a specific service does fall under the Wwft or another statutory investigation obligation, we carry out the legally required client due diligence. This may relate to, among other things, identity, representative, ultimate beneficial owner, purpose and nature of the relationship, source of funds, and unusual transactions. The data necessary for this is processed and retained only within that statutory framework.

9 Sharing personal data

We share personal data only when necessary and lawful. Recipients may include:

• –employees and persons who carry out administrative or secretarial work under the responsibility of Legal Consultants AZ B.V.;
• –lawyers, notaries, bailiffs, experts, translators and other professional service providers involved in the engagement;
• –administrative bodies, courts, dispute resolution bodies, supervisory authorities and other competent authorities;
• –bookkeeping and tax service providers;
• –suppliers of hosting, email, form delivery, security, back-up and technical management;
• –insurers, advisers or opposing parties when necessary for a complaint, claim or dispute.

We do not sell personal data. We make written agreements with processors on confidentiality, security, purposes and deletion. Independently responsible professionals process data under their own statutory responsibility.

10 Technical service providers and transfers outside the EEA

The website and client portal of Legal Consultants AZ B.V. are built in Next.js. Email is hosted via Hostnet. Messages from the public contact form are forwarded via Resend to our email environment. The digital environment, case data and portal functions are hosted via Railway, using a European server region for the production environment.

11 Retention periods

We do not retain personal data for longer than necessary for the purpose, a statutory obligation, or the protection of legal positions. The following periods apply as a starting point:

A specific statutory retention period or a demonstrable necessity may lead to a deviation. In back-ups, deleted data remains shielded from regular use during the back-up cycle and is then overwritten or deleted.

12 Security and data breaches

We take appropriate technical and organisational measures, including role-based access restrictions, personal accounts, encrypted connections, logging, back-ups, security updates and confidentiality agreements. Only people who need the data for their work are given access.

No digital system is without risk. In the event of a security incident, we investigate its nature and consequences, limit the damage, and, where necessary, notify the Dutch Data Protection Authority and the data subjects concerned. Suspicions of unauthorised access can be reported to secretariaat@legalconsultantsaz.nl.

13 No automated legal decision-making

Legal documents and case file materials are assessed substantively by people. We do not use fully automated decision-making that has legal effects for a data subject or otherwise significantly affects them. We do not use automated facial recognition for standard identification and do not carry out commercial profiling based on case data.

14 Mandatory and voluntary data

Some data is necessary to identify a client, assess an engagement, draw up a power of attorney, handle a case, or comply with a statutory obligation. Without this data, we may not be able to accept or perform the engagement. Data that is not necessary need not be provided.

15 Rights of data subjects

Within the limits of the GDPR, a data subject may request:

• –access to the personal data we process;
• –rectification of inaccurate or incomplete data;
• –erasure of personal data;
• –restriction of processing;
• –data portability, for data eligible for this;
• –objection to processing based on legitimate interest;
• –withdrawal of previously given consent.

A request can be sent to secretariaat@legalconsultantsaz.nl. We may ask for additional information to verify the identity and authority of the requester. We respond, in principle, within one month. This period may be extended for complex or multiple requests in accordance with the GDPR. Rights may be limited when necessary to protect the rights of others, confidentiality, a statutory retention obligation, or legal proceedings.

A data subject may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at https://autoriteitpersoonsgegevens.nl. We ask data subjects to first raise a complaint with us, so that we can investigate it.

16 Cookies and the website

The website may use necessary cookies and similar techniques for functioning, security, session management and preference settings. Non-necessary analytical or marketing cookies are placed only when consent has been obtained in accordance with applicable rules. Current cookie information and available choices are shown on the website in the cookie statement.

17 Minors

Our services and digital environment are not specifically aimed at children. When personal data of a minor is necessary for a case, we process it only to the extent lawful and necessary. Where legally required, the legal representative is involved in the engagement and the processing of personal data.

This also applies to adults who cannot independently manage their own interests and for whom a legally valid guardian, mentor, administrator or other authorised representative has been appointed. The representative is involved only to the extent their statutory or recorded authority relates to the relevant engagement, decision or data processing.

Legal Consultants AZ B.V. may require the representative to demonstrate their identity and authority to represent. Personal data is not shared with family members, carers or healthcare providers solely because of a physical, mental or psychological disability. This requires consent, a valid power of attorney, a court decision or another legally valid basis.

18 Changes and contact

We may amend this privacy statement when our services, systems, suppliers or applicable regulations change. The most recent version is published on the website. In the event of material changes, we inform existing clients in an appropriate manner.

Questions, requests or complaints about personal data can be sent to secretariaat@legalconsultantsaz.nl or to Postbus 2015, 5600 CA Eindhoven, the Netherlands.

About this translation

This page is an English translation of the Dutch privacy statement, provided for information only. It has not been reviewed by a lawyer. In the event of any difference between this translation and the Dutch original, the Dutch text is legally authoritative.