Last updated 16/03/2022
1. General
This Privacy Policy describes how we at Arntzen de Besche Advokatfirma AS ("AdeB") process personal data about our clients, customers, candidates, visitors and any other persons involved (hereinafter collectively referred to as "data subjects") in connection with legal assistance, knowledge management, participation in courses, lectures or other events, newsletters, recruitment, visits to our website and the use of cookies.
AdeB is the data controller for the processing of personal data as set out in this Privacy Policy. Our business address is:
Arntzen de Besche Advokatfirma AS
Visiting address: Ruseløkkveien 30, 0250 Oslo
Postal address: Postboks 2734 Solli, 0204 Oslo
Org.nr: NO 982 409 705 VAT
2. Your rights
As a data subject, you have the right, under certain conditions, to:
- gain access to the personal data we process about you;
- require that erroneous, unnecessary, inadequate or outdated personal data be corrected or supplemented;
- have personal data about you deleted,
- require us to restrict processing,
- object to any direct marketing,
- withdraw any consents given for processing;
- receive your personal data in an approved format and have it transferred to another data controller (data portability), and to
- complain to the Norwegian Data Protection Authority if you believe that we have processed your personal data in violation of applicable data protection regulations.
Please note that exceptions to the rights mentioned above apply. The right to access may, for example, be limited by a statutory duty of confidentiality or if it infringes on the rights or freedoms of others. We also cannot delete personal data that we have a basis for processing to keep anymore.
We will respond to any enquiry from you as soon as possible, and no later than one month after we have received your inquiry, unless the number or complexity of the requests necessitates the use of additional resources.
3. Security
AdeB has implemented technical, organizational and physical measures to ensure that the processing of your personal data takes place in accordance with applicable data protection regulations, including in accordance with Article 32 GDPR.
This means, among other things, that we use technical measures such as encryption and access control, and have prepared internal routines and guidelines, including routines for risk assessment of all suppliers who assist with the processing of personal data before they are used.
Everyone who works at AdeB is subject to statutory and/or contractual duty of confidentiality. We also ensure that everyone with whom we share personal data is subject to a suitable duty of confidentiality.
4. Sharing
In order to fulfil the specified purposes for the processing of personal data, it may be necessary to share the personal data with, including providing access to, other relevant actors. This may, for example, involve:
- Courts and other dispute resolution bodies;
- Supervisory bodies and authorities;
- Counterparties and other parties involved (within the framework of the duty of confidentiality); and
- Suppliers, such as IT system providers.
AdeB may share or provide access to personal data to actors acting in the role of both data processor and data controller. To the extent that personal data is shared with or made available to actors acting as a data processor for AdeB, AdeB will ensure that a data processing agreement is entered into in accordance with Article 28 GDPR. In cases where personal data is shared with actors acting in the role of joint data controller with AdeB, an arrangement will be established in accordance with Article 26 GDPR.
If personal data is transferred to a country outside the EU/EEA (third countries), we will ensure that the transfer takes place on the basis of a legal transfer basis in accordance with Chapter V of the GDPR, such as on the basis of standard data protection regulations supplemented by analyses, risk assessments and any supplementary measures.
5. Contact information
If you have any questions about our processing of your personal data or would like to exercise one or more of your rights set out in section 2 above, please contact us at privacy@adeb.no
6. Legal assistance
6.1 Purpose and basis of processing
When you contact us in connection with the need for legal assistance, we will process ordinary personal data about you on the basis of Article 6 (b) of the GDPR, no. 1 letter b or f, specifically in order to enter into or fulfil an agreement on legal assistance with you as a private individual or representative of a company (necessary for our legitimate interests). We will also process personal data in order to be able to fulfil our legal obligations, such as obligations under the money laundering regulations and accounting legislation.
For the processing of special categories of (sensitive) personal data and personal data about criminal convictions or offences, our basis for processing the GDPR is Article 9 (2) (f) of the Data, specifically in order to establish, enforce or defend a legal claim.
As a general rule, AdeB acts in the role of independent data controller for the processing of personal data in connection with the assignment for legal assistance. As a general rule, there is no need to enter into a data processing agreement between AdeB and our clients. Should AdeB exceptionally act in the role of data processor in connection with an assignment, a data processing agreement will be entered into pursuant to Article 28 GDPR.
6.2 Type of personal data
In connection with legal assistance assignments, we may process the following personal data about you and any other persons involved (such as counterparties, witnesses and other contact persons):
- Contact details, such as name, telephone number, email address, postal address, employer and role (for client contacts);
- Information for conducting conflict checks, such as contact details and information about what the case relates to. Conflict checks on business customers do not normally involve the processing of personal data;
- Information for control according to the money laundering regulations, such as ID including contact details and national identity number or D-number;
- Case data, which may involve a wide range of personal data related to the case and the persons involved; and
- Invoice information, such as detailed information about the assistance, e-mail or postal address for receiving invoices, and information about the due date and payment of invoices.
6.3 Storage
We will delete or anonymize your personal data as soon as it is no longer relevant to the purposes for which it has been processed.
This means, among other things, that:
- Necessary case information may be retained for up to 20 years from the conclusion of the case, in order for AdeB to conduct knowledge management and be able to defend itself against any legal requirements from, or provide for necessary retention on behalf of, the client;
- Personal data necessary for money laundering control is retained for five years from the conclusion of the case in accordance with the required retention period under the Money Laundering Act; and
- Retentionable accounting material may be retained for three and a half to five years in accordance with accounting legislation's retention requirements for primary and secondary documentation.
Consent to processing, or a potential or ongoing legal dispute, may extend the retention periods set out above.
7. Market assets
7.1 Purpose and basis of processing
If you wish to attend a course, lecture or other type of event organised by us, or wish to subscribe to our newsletters, we will process personal data about you on the basis of Article 6 (a) of the GDPR, (a) or f, specifically on the basis of your express consent to marketing or filming/image-taking, or on the basis of our legitimate interests in facilitating, conduct or provide you with relevant information about news, courses, lectures or other types of events.
To the extent it is necessary to process sensitive personal data about you in this regard, such as information about allergies, we will process it on the basis of your express consent (cf. Article 9 (a) of the GDPR).
7.2 Type of personal data
If you wish to attend a course, lecture or other type of event, or subscribe to our newsletters, we may process the following personal data about you:
- Contact details, in connection with courses, lectures or other types of event, such as name, telephone number, email address, postal address, employer and role, place of study and academic year (for students);
- User behaviour, in connection with sending newsletters and registrations to courses, lectures or other types of events, such as whether or not the email has been delivered, opened, clicks, cancellation requests and abuse reporting;
- Photos or video, in connection with courses, lectures or other types of event; and
- Allergies and food preferences, if food is to be served in connection with courses, lectures or other types of events.
7.3 Storage
We will delete or anonymize your personal data as soon as it is no longer relevant to the purposes for which it has been processed.
This means, among other things, that:
- Personal data processed in connection with a course, lecture or other type of event is normally deleted after the event has finished, or after we have sent out, received and processed any evaluation of the event; and
- Personal data in pictures/video or newsletter subscriptions is deleted if you withdraw your consent to processing, or unsubscribe from the newsletter.
Consent for processing may extend the retention periods specified above.
8. Recruitment
8.1 Purpose and basis of processing
If you send us a job application, either directly or through a supplier, we will process personal data about you on the basis of Article 6 (a) of the GDPR and/or b, specifically on the basis of your express consent to extended storage of your application and/or to be able to enter into a potential employment agreement with you.
To the extent it is necessary to process sensitive personal data about you in this regard, such as any health challenges, we will process it on the basis of your express consent (cf. Article 9 (a) of the GDPR).
8.2 Type of personal data
In connection with a recruitment process, we may process the following personal data about you:
- Contact details, such as name, telephone number, email address and postal address;
- Application information, such as application, CV, diploma and education, nationality and citizenship, references, certificates, relevant work experience, including current and former employer and role;
- Tests and checks, such as personality tests, skill tests and background checks;
- Internal reviews; and
- Special categories of personal data, such as health data, to the extent necessary for the fulfilment of our obligations under labour or equality and anti-discrimination legislation.
8.3 Storage
We will delete or anonymize your personal data as soon as it is no longer relevant to the purposes for which it has been processed.
This means, among other things, that:
- Personal data of candidates who are added and necessary for the further employment will be stored, other personal data will be deleted; and
- Personal data about candidates who are not offered a position is normally deleted as soon as the recruitment process is complete.
Consent to processing, or a potential or ongoing legal dispute, may extend the retention periods set out above.
9. Website visitors and cookies
9.1 Purpose and basis of processing
When you visit our website, we will process personal data about you through the use of cookies. Cookies are small text files that are downloaded and stored on your computer or other type of device when you open a webpage.
We will process personal data about you through the use of necessary cookies on the basis of Article 6 (1) (f) of the GDPR, specifically on the basis of our legitimate interest in providing you with satisfactory information through a well-functioning website. Furthermore, we may process personal data about you through the use of cookies that are not necessary, including through functional and statistical cookies. The use of cookies that are not necessary requires your express consent in accordance with Article 6 (a) of the GDPR. We collect any consents from you through our cookie banner when you first access our website. You may change or withdraw your consents to the use of cookies that are not necessary at any time by changing your browser settings.
9.2 Type of personal data
AdeB uses analysis tools provided by Matomo. Matomo provides analytical tools in accordance with the data protection regulations and does not imply any transfer to third countries.
The tool collects information about visitors to our website and their activity on and in connection with it, for analysis and reporting purposes.
The analysis tool includes the use of the following cookies:
- _pk_id#
- _pk_ses#
The cookies set above collect, among other things, the following information about you:
- IP address;
- Optional user ID;
- Date and time;
Title of the page visited;
- URL of the page displayed and visited prior;
- Screen resolution;
- Time in the user's local time zone;
- Files clicked on and downloaded;
- Links to external domains that have been clicked on;
- Page generation time;
- User's location: country, region, city, approximate latitude and longitude (geolocation);
- Primary language of the browser used;
- User agent for the browser used;
- Web browser;
- Operating system; and
- Which device is used (desktop, tablet, mobile, tv, car, console, etc.) as well as make and model.
- Some information stored in the first-party cookie which is then collected by Matomo: Random unique visitor ID, time of first visit, time of last visit and number of visits for this user
For more detailed information, see Matomo's website.
Among other things, we collect the following information about you:
- IP address;
- Browser provider;
- Information about equipment or device, such as type of device, operating system, language, country, etc.);
- User behaviour, such as which website you came from and which parts of our website are visited; and
- Date and time of visitation.
9.3 Storage
AdeB will ensure that personal data stored through Matomo's analysis tools is deleted or anonymized as soon as it is no longer relevant to the purposes for which it has been processed. We ensure this through settings and tools in Matomo, which facilitate anonymization and automatic deletion of older raw data (visitor logs). As a general rule, we will not store data logs longer than three to six months.
10. Other contact
10.1 Purpose and basis for processing
To the extent that you contact us with other general questions, including via the contact points stated on our website, we will normally process your personal data on the basis of Article 6 (f) of the GDPR, specifically on the basis of our legitimate interest in answering your inquiry in the best possible way.
10.2 Type of personal data
When you contact us, we may process the following personal data about you:
- Contact details, such as name, telephone number, email address and postal address; and
- Questions and needs, with which you need assistance.
10.3 Storage
We will delete or anonymize your personal data as soon as it is no longer relevant to the purposes for which it has been processed.
This means, among other things, that the personal data will normally be deleted when the question is answered and the need is resolved, yet after a somewhat longer period if we have reason to believe that it may be necessary to see any subsequent contact in context.