SUMMARY
1. Introduction
2. Fair and transparent collection of your personal data
3. Appropriate and legitimate use of your personal data
4. Types of personal data that we process
5. Legal grounds and purpose for processing this data
6. Persons allowed access to your personal data
7. Transfer of your personal data
8. Periods of storage of your personal data
9. Security for your personal data
10. Sub-contractors
11. Your rights
11.1 Your right of access
11.2 Your right to correct your personal data
11.3 Your right to the removal of your personal data
11.4 Your right to the limited processing of your personal data
11.5 Your right to oppose processing of your personal data
11.6 Your right to the transfer of your personal data
11.7 Your right to withdraw your consent
11.8 Your right to lodge a complaint
11.9 Your right to define post-mortem arrangements
11.10 How to exercise your rights
12. Modification of this document
1. Introduction
1. In the course of its activities, HMN & Partners (hereinafter ‘the Firm’) collects and processes personal data relating to its potential and current clients and its personnel.
2.The main objective of this document is to bring together in a concise, transparent, comprehensible and easily accessible format all the appropriate information relating to the processing of data in order that you can understand how and why your personal data will be processed.
2. Fair and transparent use of your personal data
3. In order to ensure fairness and transparency for its clients, members and service providers, the Firm is careful to inform each person concerned about the processes it uses through information notices.
4. This data is collected fairly. No data is collected without notice or without the person concerned being informed, except in cases where personal data must remain private due to the obligation of professional confidentiality required in our role as lawyers.
3. Fair and legitimate use of your personal data
5. When the Firm processes personal data, it seeks to meet specific objectives: every process has a legitimate, specific and explicit purpose.
6. For each process, the Firm is committed to collect and use only essential and pertinent data in order to meet requirements in pursuing the purposes for which it is being processed.
7. The Firm ensures that data will be updated, if necessary, and it will also employ procedures that will allow the removal and correction of inexact data.
4. Types of personal data that we process
8. With regard to processing of personal data collected for the purposes described below, the Firm collects and processes the following categories of personal data:
– data identifying the person concerned, such as your first name and surname;
– data relating to the personal life of the person concerned, such as your email address, your postal address and your data of birth;
– data relating to the professional situation of the person concerned, such as your profession and your professional contact information;
– economic and financial data for the person concerned;
– data relating to the education, diplomas and distinctions of the person concerned;
– data relating to the social security number for the person concerned;
– sensitive data, such as on the state of health of the person concerned;
– data relating to criminal sentences and infractions, and related security measures;
– data on digital connections such as domain names and IP addresses of its users, statistics on usage (notably types of browser and operating systems used) as well as browser history.
5. Legal grounds and purpose for processing this data
1. Some processes used by the Firm are necessary for preparing a contract or taking pre-contractual measures relating to your situation. Other processes serve the following purposes:
– preparation, management and treatment of clients’ files;
– recovery of fees.
2. Some processes are used to meet the Firm’s legal and regulatory obligations. These are required for the following purposes:
– prevention of money laundering, financing of terrorism and corruption;
– billing;
3. Processes for the following purposes are initiated in order to allow the Firm to pursue its legitimate interests, in particular the development of its business activities:
– management of contacts;
– management of interactions with clients and potential clients;
– organization, registration and invitations to events arranged by the Firm.
6. Persons allowed access to your personal data
1. Personal data collected by the Firm, in addition to data collected at a later date, is used as part of our role as controller of data processing.
2. Your personal data is also made available to the following categories of persons:
– members of the Firm;
– any third party carrying out missions on behalf of the Firm;
– the relevant authorities and jurisdictions.
3. We ensure that only authorized persons will have access to your personal data. The Firm adheres to a strict policy of authorization which ensures that the data it processes is only made available to persons authorized to have access to this data.
7. Transfer of your personal data
15. The Firm will not transfer your personal data to any country outside of the European Union, except in situations where it is necessary for the execution of the contract that we have established.
16. Within this framework, only personal data relating specifically to the contract in question can be transferred outside the European Union.
17. If the Firm is required to transfer data outside the European Union in situations other than those necessary for the execution of the contract, it will not do so without having first taken the necessary measures for ensuring a level of protection and security for personal data equivalent to that available in Europe, in which case you will be informed prior to the transfer.
18. To ensure the security of these transfers outside the European Union, we will establish, for example, standard clauses for regulating data feed as defined by the European Commission.
8. Periods of storage for your personal data
19. The Firm will ensure that personal data will not be kept in a format allowing identification of the person concerned any longer than is necessary for the purposes for which it has been processed.
20. The period for which your personal data will be kept is defined by the purpose for which it is collected.
21. Specifically, our policy on data storage provides that data will be stored for the following periods:
Type of data and purpose
– Management of contacts, clients and potential clients
Period of storage : 3 years
– Prevention of money-laundering, financing of terrorism and corruption
Period of storage : 5 years
– Billing and accounting
Period of storage : 10 years
9. Security for your personal data
22. The Firm places particular importance on ensuring the security of personal data
23. It has established technical and organizational measures designed for a level of sensitivity to personal data, in order to ensure the integrity and confidentially of data and to protect data from any malicious intrusion, loss, corruption or disclosure to unauthorized third parties.
24. Nevertheless, the security and confidentiality of personal data is dependent on everyone taking the best possible care. All persons concerned are invited to remain particularly vigilant about their personal data.
10. Sub-contractors
25. When the Firm decides to sub-contract to service providers, it will not communicate personal data without first obtaining from those service providers a commitment to, and guarantees on, their capacity to meet these criteria of security and confidentiality.
26. All contracts with our sub-contractors contain clauses regarding respect for our contractual legal and regulatory obligations which define precisely the conditions and methods for processing personal data by sub-contractors.
11. Your rights
27. The Firm is particularly mindful of the need for respect of your rights with regard to its use of processed data, in order to guarantee that your personal data is processed fairly and transparently, given the particular circumstances and the context in which your personal data is processed.
28. In this regard, we will confirm to you whether your personal data has or has not been processed and that, when it has, you have the right to request a copy of your data and other information relating to:
– the reasons for processing the data;
– the categories of personal data involved;
– the persons or groups receiving data as well as, in the event that the data must be communicated, the international organizations with which the personal data has been or will be shared, in particular, those located in foreign countries;
– where possible, the period foreseen for storing personal data or, where that is not possible, the criteria used for determining this period;
– the existence of the right to request from the person responsible for the processing, correction, and removal of your personal data, the right to request limits to the processing of your personal data, and the right to oppose any processing;
– the right to lodge a complaint to a regulatory authority;
– information relating to the source of data when it is not collected directly from the persons concerned;
– the presence of automatic decision-making, including profiling, and in this situation of useful information relating to the underlying logic, significance and consequences foreseen in these processes for the persons concerned.
29. You can ask us to correct and update your personal data, if it is inexact, incomplete, ambiguous, or out of date.
30. You can ask us to remove your personal data in accordance with the provisions laid down in the legislation and regulations.
31. We draw your attention to the fact that the right to the removal of your personal data is not a general right and that it can only be exercised for one of the reasons mentioned in the applicable regulations.
32. You can ask that processing of your personal data be limited in situations mentioned in the legislation and regulations.
You have the right to oppose, at any time and for any reasons relating to your personal situation, the processing of your personal data for which the legal basis is the legitimate interests pursued by the person responsible for the processing (cf. the article below on the legal basis for data processing).
In the event of your wishing to exercise this right of opposition, we will ensure that processing of your personal data will be discontinued for that specific process unless we can demonstrate that we have legitimate and compelling reasons for maintaining the process. These reasons must have greater importance than your personal interests and your rights and freedoms, or must be justified by recognition, exercise or defence of rights before the courts.
You have the right to oppose any personalized solicitation.
You have the right to transfer your personal data. We draw your attention to the fact that this is not a general right. Indeed, not all data used in all processes are transferable and this right is limited to automated processes, to the exclusion of manual or paper processes.
This right is limited to processes for which you have given your consent or which are required for the execution of pre-contractual proceedings or of contracts.
This right does not apply to either derived or inferred data, which is personal data created by the Firm.
When the data processes that we carry out are based on your consent, you can withdraw that consent at any time. We will terminate all processing of your personal data. However, processes carried out prior to the date on which your consent is withdrawn will not be cancelled.
You have the right to lodge a complaint with the Conseil national de l’informatique et des libertés (CNIL, 3 place de Fontenoy 75007 Paris) in France and without prejudice to any other administrative or legal appeals.
You have the possibility of defining specific directives relating to the storage, removal and communication of your personal data after your death as specified below. These specific instructions concern only those processes undertaken by our services and will be limited to this one condition.
You also have the right, when this person has been designated by the executive power, to define the general dispositions for the same objectives.
33. All rights described above can be exercised by an electronic message sent to paris@lexing.law or by post to Lexing Alain Bensoussan Avocats, Immeuble Cap Etoile – 58 boulevard Gouvion-Saint-Cyr 75017 Paris, together with proof of identity.
12. Modification of this document
34. We invite you to review our policy regularly on our web site. It may be updated at any time.