Privacy notice

1. IVY Advocaten (‘IVY’) is a data controller within the meaning of the General Data Protection Regulation (‘GDPR’). This privacy notice fulfils IVY’s obligation under the GDPR to provide information about the processing of personal and company data (‘personal data’).
2. In the context of its services, as well as pursuant to applicable laws and regulations, IVY processes information which may contain personal data, for instance through copying, storing, filtering, studying documents and data, interviews, analyses and reports thereon.
3. In this respect, IVY decides for which purpose, how and on what ground (including consent, performance of a contract, legal obligation and/or legitimate interest) data shall be processed. Processing shall be limited to what is sufficient, relevant, and necessary, in view of the performance of services, laws and regulations.
4. The (special categories of) personal data processed by IVY are, for instance, addresses, financial information (invoices), legal documents (dossier), other information pertaining to the case, and data to be studied in connection with the work to be carried out. Hence, the personal data may originate from IVY’s client, but also from other sources.
5. Outside the context of the agreed services, IVY shall—also given a lawyer’s legal duty of confidentiality—, in principle, not share personal data with third parties without prior consent, unless necessary for the performance of IVY’s services and/or required by law. Should the transfer of personal data outside the European Union be necessary, the appropriate statutory requirements shall be observed.
6. Should IVY, for the purpose of the performance of its services, retain a third party who, on behalf of IVY, processes data, said processing shall be governed by an agreement and the appropriate requirements pursuant to the GDPR shall be observed.
7. If and when IVY, in the context of its services, (also) processes personal data of others, these persons shall not be informed of the processing of their personal data, if this would compromise the legal duty of confidentiality, would involve a disproportionate effort, would render achieving the purposes of processing impossible or would seriously compromise those. In (internal) investigations, IVY shall, in principle, inform those involved (‘data subjects’) about the GDPR through an investigation protocol.
8. Personal data will be stored in IVY’s locked/encrypted physical and digital archives, for a period not longer than is necessary for the purposes for which the data are processed or than is required by law or regulations, with the appropriate technical and organisational measures in place to prevent loss or unlawful processing of personal data. Subsequently, they will, in principle, be destroyed.
9. The data subject have the right to access, to rectification, to erasure, to restriction, and to transferability of your personal data, as well as the option to object and to file a complaint with the Dutch Data Protection Authority, if the legal requirements under the GDPR to do so are met.
10. For more information or questions about the processing of personal data and this privacy notice, please contact IVY’s duly appointed privacy officer, Ms A.A.M. Sanders, LL.M. (asanders@ivyadvocaten.com).