Last updated 15 November 2022
1. Our privacy statement
Kvale processes personal data about you when you visit our website or contact us. We also process your personal data when we carry out legal assignments and provide other agreed services. If you consent to it, we may also process your personal data for other purposes.
We want you to feel confident that your personal data is processed responsibly. This privacy statement explains how we collect personal data and what we use it for. It also explains the legal basis for our processing, how we keep personal data secure, who we share it with, and your rights.
2. What is personal data?
Personal data is any information that can be linked to an individual, directly or indirectly, including name, postal address, email address, IP address and mobile number.
3. Whose personal data do we process?
This privacy statement covers our processing of personal data about the following people:
- Private clients
- Contact persons at business clients
- Contact persons at our suppliers and partners
- People involved in matters in which we assist
- Other people mentioned in case documents we gain access to
- Visitors to our website
- Job applicants
4. What personal data do we process?
Kvale processes the following categories of personal data, among others:
Contact information: This includes name, email address, telephone number, title and affiliated company.
Information about beneficial ownership: Name, ownership share and a copy of identification.
Case information: Any information relevant to the assignment. This information may relate to the client's employees, owners, opposing parties, witnesses, opposing parties' lawyers and others who are connected to the matter or mentioned in its documents.
Billing information: Contact information for the person responsible for invoicing.
IP addresses and metadata: Information about your IP address, the time of your visit and similar when you visit our website or use our services.
Giving us access to your personal data is voluntary. In some cases, however, we may need such information to provide agreed services, to contact you and so on. Section 6 below describes the purpose of and legal basis for processing the different types of personal data.
5. Who is the controller?
Kvale Advokatfirma DA (Haakon VII gate 10, 0122 Oslo), represented by its Managing Partner, is the controller of the personal data we process in connection with carrying out legal assignments, the use of our website and services, or when you contact us in any other way.
6. The purpose of, and legal basis for, the processing of personal data
This section gives you an overview of the purposes for which we process personal data, the types of personal data we process and the legal basis for our processing.
Establishing a client relationship: When a client asks us to take on an assignment, we carry out an internal independence check (conflict check) before we accept the assignment. The independence check serves a legitimate purpose and is based on Article 6(1)(f) GDPR (legitimate interests). A conflict check of a private client usually covers full name, what the matter concerns and, where relevant, creditworthiness. Conflict checks on behalf of business clients will generally not involve the processing of personal data.
When establishing a client relationship, we carry out customer due diligence in accordance with the Norwegian Anti-Money Laundering Act. This includes collecting information on, among other things, the name of the contact person, identification and politically exposed persons (PEP). Customer due diligence is necessary to fulfil our legal obligations under the Anti-Money Laundering Act, cf. Article 6(1)(c) GDPR.
If we can take on the assignment, we register contact and billing information. For private clients, registering contact information is necessary to enter into an agreement with them, cf. Article 6(1)(b) GDPR. For business clients, registering contact information is based on legitimate interests, cf. Article 6(1)(f) GDPR.
Case handling: Some legal assignments give us access to personal data about parties or other individuals affected by a matter. Such information may appear in documents the client sends us or in other correspondence in the matter. Processing personal data in connection with assignments for business clients is based on Article 6(1)(f) GDPR (legitimate interests). In some matters we also gain access to special categories of personal data, for example health information, or data relating to criminal convictions and offences. In such cases, the processing is based on Article 9(2)(f) GDPR (the processing is necessary for the establishment, exercise or defence of legal claims), cf. section 11 of the Norwegian Personal Data Act (2018).
Client administration: We create separate case files for assignments carried out on behalf of the client. Time and costs incurred on a matter are registered in our accounting system. For business clients, what we do in connection with client administration is based on Article 6(1)(f) GDPR (legitimate interests), while for private clients it is considered a necessary part of performing the agreement with them, cf. Article 6(1)(b) GDPR.
Storage and retention of case documents: We retain case documents after the assignment has ended. This is necessary for the client's sake and for our own, since questions or a dispute may later arise in which the information stored on a matter becomes relevant again. The legal basis for processing personal data is Article 6(1)(f) GDPR (legitimate interests, cf. the legitimate interest described above) and Article 9(2)(f) GDPR (establishment, exercise or defence of legal claims), cf. section 11 of the Norwegian Personal Data Act (2018).
Invoicing: Contact information received from business clients is used to mark invoices sent to the business if the client asks us to. For private clients, the person's private postal address is used to send invoices. The legal basis is Article 6(1)(f) GDPR (legitimate interests) for business clients and Article 6(1)(b) GDPR (necessary to perform the agreement with the data subject) for private clients.
IT operations and security: Personal data stored in our IT systems may be accessible to us or to our suppliers in connection with system updates, the implementation or follow-up of security measures, error correction or other maintenance. The legal basis is Article 6(1)(f) GDPR (legitimate interests, cf. our legitimate interest in these activities) and our legal obligation to maintain adequate information security, cf. Articles 32 and 6(1)(c) GDPR.
Marketing: We send newsletters to email addresses registered for clients to whom we provide ongoing legal services and to others who have asked to receive our newsletter. Recipients can easily unsubscribe using the link included in each message. The legal basis is Article 6(1)(f) GDPR (legitimate interests) where we have received the email address in connection with a legal assignment. Where there is an existing customer relationship, marketing takes place in accordance with section 15(3) of the Norwegian Marketing Control Act. In other contexts, marketing is based on the person's consent, cf. section 15(1) of the Marketing Control Act and Article 6(1)(a) GDPR.
Job applications: We also process personal data in recruitment processes and in connection with other marketing. The information we collect for these purposes includes both information you provide yourself, for example as our client, and the information we collect when you use our website.
If you consent to it, we may also process your personal data for other purposes. Giving us access to your personal data is voluntary.
7. How do we keep your personal data secure?
Kvale has established procedures and measures to ensure that no unauthorised person gains access to your personal data, and that all other processing of the data complies with applicable law.
We have established procedures to ensure confidentiality, integrity and availability. The measures are both technical and organisational. They include encryption, authentication solutions and procedures for verifying requests for access and rectification.
We regularly assess the security of all key systems used to handle personal data, and we have agreements in place requiring the suppliers of such systems to ensure adequate information security.
Access to personal data (and client and case information) is limited to staff who need access to perform their duties.
We have adopted internal IT guidelines, and we regularly train employees in security and the use of IT systems.
8. How long do we store personal data?
Kvale does not keep personal data for longer than is necessary to provide our legal services or otherwise fulfil the purpose of the processing.
This means, for example, that personal data we process on the basis of your consent is deleted when the consent is withdrawn. Where the legal basis is our legitimate interest, the personal data will be deleted when that legitimate interest no longer exists. Information stored to meet statutory obligations is deleted when the obligation ends. Typical examples are the retention obligations under anti-money laundering and bookkeeping legislation.
In line with the Norwegian Bar Association's recommendations, case documents are normally retained for 10 years. This retention period is considered necessary for the client's sake and for our legitimate interest in being able to refer back to older case information that may be relevant to ongoing disputes or case handling.
Accounting legislation also requires us to keep certain accounting documents for a specified period, as a rule 3.5 or 5 years. Where such a specific purpose requires storage for a given period, we ensure that the personal data is used solely for that purpose during that period.
9. Who do we share personal data with?
Unless you have specifically consented to the disclosure of personal data or disclosure is required by law, your personal data will only be disclosed to others where this is necessary to fulfil our obligations under the assignment.
We may share personal data with our technical subcontractors, or with public authorities where there is a statutory duty of disclosure.
To safeguard your rights, we have entered into data processing agreements with our suppliers which, among other things, mean that your personal data cannot be used for purposes other than those we have agreed with you.
Our IT service providers may have access to personal data if it is stored with the provider or is otherwise available to the provider under its contract with us. The providers act under a data processing agreement and on our instructions. A provider may only use the personal data for the purposes we have determined and that are described in this privacy statement. We do not use suppliers located in countries outside the EU and the EEA.
Lawyers are subject to a duty of confidentiality, backed by criminal penalties, under section 111 of the Norwegian Penal Code. All information entrusted to us in connection with an assignment is treated confidentially.
10. Your rights
Data protection law gives you a number of rights in relation to the personal data we process about you. Which rights you have depends on the circumstances. This section gives an overview of important rights.
Withdraw consent: If you have consented to receive newsletters from us, you may withdraw that consent at any time. We make it easy to opt out of such messages by including a link to an unsubscribe form in each message. If you have consented to other processing of personal data, you may also withdraw your consent to that processing at any time by contacting us.
Request access: You have the right to receive a copy of the personal data we hold about you, insofar as our duty of confidentiality does not prevent it. To ensure that personal data is disclosed to the right person, we may require requests for access to be made in writing or identity to be verified in another way.
Request rectification: You may ask us to correct or complete inaccurate information we hold about you.
Request erasure: You may ask us to erase personal data. We will comply with a request to erase personal data as far as possible, but we cannot do so if there are compelling reasons not to erase it, for example that we must retain the information for documentation purposes.
Request restriction: In some situations you may also ask us to restrict the processing of information about you.
Object: Where we process information about you on the basis of our tasks or of legitimate interests, you have the right to object to our processing of information about you.
Data portability: Where we process information about you on the basis of consent or a contract, you may ask us to transfer information about you to another law firm in a machine-readable format.
Complain to the supervisory authority: If you disagree with the way we process your personal data, you may lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).
You can read more about your rights and how to complain on the Norwegian Data Protection Authority's website: www.datatilsynet.no.
11. Our use of cookies
We do not use cookies on kvale.no.
12. Changes to this privacy statement
We may make minor changes to this privacy statement. You will always find the latest version on our website. We will give notice of any significant changes.
13. Contact us
Please email us at post@kvale.no if you have questions about how we process personal data or wish to exercise your right of access, rectification, erasure and so on.
Cookies and privacy
Kvale Advokatfirma DA is the controller for the collection and processing of personal data in connection with the operation and maintenance of kvale.no.
The purpose of collecting personal data through the website is to log the use of kvale.no in order to develop and improve the website.
The website does not use cookies. When you use the website, the following information is collected:
- Your IP address, browser and operating system
- Your location
- The time of your visit
- Which pages on kvale.no the registered IP address visits and the duration of each visit
- Which link, if any, referred you to kvale.no
- What was clicked during the visit and any files downloaded
- Information about you when you register personal data on the website, such as name, telephone number, email and workplace