Updated in June 2023

Your privacy is very important to Borenius Attorneys Ltd, no matter if you are our current or prospective client or any other kind of business contact. With this Privacy Notice, we want to make you aware of how we collect and process your personal data as a data controller.

We process personal data in accordance with all laws that apply to the protection of personal data, including the GDPR, i.e. the European Union’s General Data Protection Regulation 2016/679 GDPR (“Data Protection Laws”). We process personal data for the purposes of identifying our client, checking for conflicts of interest, handling assignments, managing client relationships and marketing, amongst others. In accordance with the Data Protection Laws, those persons whose personal data we process are entitled to obtain information on the personal data we process and to use their rights based on the GDPR as further described in this Privacy Notice.

We do our best to ensure that your personal data is processed lawfully and in a transparent manner, and to ensure that your personal data is safe, accurate and up to date.

You may help us in keeping your personal data up to date by reviewing and updating your contact details as well as your marketing preferences. You can do this by clicking the link we include in every newsletter you receive from us. If you have any additional updates, please contact our GDPR team at gdpr@borenius.com.

We apply the appropriate technical and organisational measures to ensure that your personal data is safe with us. These measures include, for example, data processing agreements and non-disclosure agreements that we have concluded with our vendors and business partners. In addition, besides having a dedicated GDPR team to help in solving GDPR-related issues in our operations, we train our employees and advise our clients on GDPR issues.

Our main duty as a law firm is to provide legal services to our clients, and this is the main purpose for which we process personal data. We also use personal data to develop our services and to manage our business relationship with our clients. When we provide legal services and manage client assignments and the business relationships we have with our clients, we act as the data controller, and the processing of personal data is necessary for the purposes of our legitimate interests or for the fulfilment of a contract.

Sometimes processing is necessary to ensure that we as a law firm can comply with our legal obligations (for example identifying our clients or screening data against sanction lists). This partially applies in situations where our duties are based on applicable laws or guidelines issued by the Finnish Bar Association, such as when we e.g. process data that we need in the know-your-client process and to conduct conflict of interest research.

You may also give your consent for the processing of your personal data for one or more specific purposes (for example in relation to invitations to events and seminars).

We primarily collect personal data from the data subject him/herself when we manage our client assignments and provide legal services. We obtain personal data e.g. through the know-your-client process and by conducting conflict of interest researches or when we communicate with or meet the data subjects. We collect personal data that relates to e.g. identification, which includes personal data such as basic identifying information, contact details and matter-related background information provided to us directly by our clients (either natural persons or companies), their representatives or their counterparties.

We also collect personal data when we manage our marketing activities and communicate with the data subjects for the purposes of marketing. We collect personal data e.g. in order to send invitations to our seminars and events, or to send out our newsletters or other news relating to our services and firm.

We also collect personal data via our website as follows:

Job applications / recruitment data (http://www.borenius.com/careers/). Any personal data that you submit in connection with a job application is saved separately to our recruitment system. Please see our separate notice on job applications (http://www.borenius.com/privacy-notice-for-job-applicants/).

Newsletter (http://www.borenius.com/contacts/). You can subscribe to our newsletter to receive event invitations and news regarding our services and the firm. You can unsubscribe at any time to stop receiving this information.

Alumni (http://www.borenius.com/careers/alumni/). As a former Borenius employee, you are part of our alumni network. We appreciate the opportunity to stay in touch and keep exchanging ideas with our former colleagues. You may join our alumni network and update your contact details in Borenius’ alumni register.

Cookies. Our website uses cookies to analyse how the site is used, including the number of visitors, how you found your way to our website and the pages you visit as well as the total time you spend on our website. Cookies are text files that are placed on your computer that allow your computer to be recognised by our website. The cookies on our website may be used by and delivered to you by us or by third-party web analytics services, such as Google Analytics, Hotjar and Vuture. The cookies collect information in an anonymous form, and we do not use this data to identify our website visitors even if the technologies used would make such identification possible. You may refuse to accept cookies from our website and delete existing cookies by selecting the appropriate settings on your browser. If you wish to do so, please refer to your browser’s user guide to find out how to control cookies by adjusting your browser’s preferences.

As mentioned above, we primarily process personal data we have obtained directly from you. When necessary, we may also collect or update personal data from publicly available sources or from commercial databases.

We may process personal data of the following categories:

We primarily process personal data on servers located within the EU/EEA.

However, we may need to transfer your personal data from a location within the EU/EEA to a third country. With regard to transfers of personal data to countries where the local data protection legislation does not provide an adequate level of data protection, we will implement appropriate safeguards under the GDPR to ensure that your personal data remains protected and secure. Such international transfers of personal data will be based on the standard contractual clauses approved by the European Commission. To learn more about the appropriate safeguards we use, please contact our GDPR team at gdpr@borenius.com.

Generally, we will not disclose personal data to any third parties unless we are required to do so under applicable laws, to prepare for legal proceedings or to defend a claim, or in order to provide services to our clients. Occasionally we may however disclose a limited amount of personal data to third parties for legitimate purposes. For example, we may disclose contact information (name, title, email address) to third parties when we arrange seminars and events together with other organisations. In these cases, you will always be informed about the disclosure in the invitation and you will also have the right to object to the disclosure of your contact information by contacting gdpr@borenius.com or by other means informed to you on a case-by-case basis.

We use partners and service providers in connection with business activities that require the processing of personal data, and as such, personal data will be transferred to and processed by third-party providers (data processors) that provide services to Borenius Attorneys Ltd. All of these partners and third-party service providers must comply with our written data processing agreements, and they must implement appropriate technical and organisational measures to ensure the protection of your personal data. Furthermore, they may not process any personal data transferred to them for any other purposes than for providing services to us. The only employees with access to your personal data will be those employees who need to process your personal data.

How long we retain specific personal data depends on the personal data concerned and the purposes for its processing. We will retain personal data at least for as long as needed in order to carry out the purposes of processing mentioned above, such as in order to perform our contractual or statutory obligations or in order to manage the business relationship between us and the data subject or the entity represented by the data subject.

The retention periods are determined in accordance with the following criteria:

When your personal data is no longer needed, your personal data will be destroyed in a secure way or irrevocably anonymised.

The GDPR ensures that the data subject has a number of rights and that the data subject can exercise these rights in many cases to govern the processing of their personal data. The extent of the data subject’s rights is subject to the legal basis provided for processing the relevant personal data, and the data subject must provide identification in order to exercise the said rights. Where we have reasonable doubts concerning the identity of the natural person making the request referred to below, we may request you to provide additional information that we require to confirm your identity.

You can use your rights by contracting our GDPR team at gdpr@borenius.com.

If your personal data relates to our client work, there may be situations where our confidentiality and other obligations under the applicable legislation and the respective rules established by the Finnish Bar Association may prohibit us from disclosing or deleting your personal data or otherwise prevent you from exercising your rights.

We do not engage in any kind of automated individual decision-making.

We do not process any personal data that is included in the special categories of personal data (i.e. personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, health data, etc.).

In the event that you consider the way in which we process your personal data to be in breach of the applicable legislation, you may lodge a complaint with the national supervisory authority regarding our processing of your personal data. If you are located in Finland, your local data protection authority is the Data Protection Ombudsman (Tietosuojavaltuutettu) (www.tietosuoja.fi).

If you have any questions regarding the processing of your personal data, please feel free to contact our GDPR team at gdpr@borenius.com.

This Privacy Notice was updated in June 2023. We reserve the right to update and amend this Privacy Notice. Unless otherwise provided in mandatory applicable legislation, we may not personally notify the data subjects of any changes we make to this Privacy Notice. We kindly ask that you review this Privacy Notice from time to time for possible changes.