Privacy policy
Introduction
Advokatfirmaet KPU DA (hereinafter KPU) is committed to handling your personal data safely and securely, in accordance with applicable rules. Below you will find information on how we handle personal data that we collect from users of our website, participants in talks, suppliers, partners and other users of our services and functions. This privacy policy describes the cases in which we process your personal data and on what basis.
The purpose of this privacy policy is to inform you about our processing of your personal data in accordance with the requirements of the General Data Protection Regulation (GDPR) and the Personal Data Act, both of which entered into force in July 2018.
Data controller
KPU, represented by its board, is the data controller for the personal data we process. All enquiries regarding data protection can be sent to post@kpu.no.
Purposes of processing
Legal services
KPU carries on legal practice in accordance with the rules in Chapter 11 of the Norwegian Courts of Justice Act. When we register new clients and accept legal engagements, we collect a range of personal data such as name, contact details, place of work, national identity number and other types of information and assessments of and about persons that are relevant to establishing the client relationship and to carrying out the individual engagement. This applies both when we enter into engagements with private clients and when we enter into engagements with business clients. For business clients, the engagement is not entered into with a private individual, but there will always be at least one contact person acting on behalf of the business client about whom we will register personal data. In addition, it will normally be necessary to collect and process other personal data from the business client in order to carry out the engagement. In addition to client information and information about contact persons, the data we process as part of our legal practice will normally also include personal data about other third parties, for example opposing parties, witnesses, experts and others involved. Such third parties have no right either to information about or to access to the personal data KPU processes about them as part of a legal engagement, owing to the lawyer's statutory duty of confidentiality.
The personal data we process comes almost entirely from the client. Under the Anti-Money Laundering Act, lawyers are required to carry out customer due diligence when registering new clients. This means that we may check the information we receive from a new client against external registers such as the Brønnøysund Register Centre or the National Population Register. It may be necessary to supplement the information we have received from a new client with information from such registers. In cases provided for by law, we are also required to inform the authorities of this information.
Certain engagements require us to collect and process so-called «special categories» of personal data. These include, among other things, health data, financial circumstances, etc. In addition, in a number of cases we process information about criminal offences or suspected offences.
Such personal data will mainly be collected from our clients or from other persons the client brings in as witnesses in the case, but may also come from opposing parties and other third parties such as doctors, NAV (the Norwegian Labour and Welfare Administration), the police, etc.
In engagements with private clients and business clients, the legal basis for processing the personal data will be that the processing is necessary to perform our agreement (the engagement) with the client and to comply with a legal obligation to which KPU is subject.
If we process special categories of data in an engagement, we will in addition meet one of the following legal bases: consent from the data subject, where applicable, or the processing is necessary for the defence of a legal claim.
All information about a case is archived for 10 years after the case is closed, after which the information is deleted or destroyed.
Marketing and presentation of Advokatfirmaet KPU DA online
Our web systems log your activity on our website. Such logs are analysed in the event of hacking or other types of attack or criminal activity directed at our website. The information stored is your IP address and which links you have clicked on, your browser and other information about your browser and device. The legal basis follows from Article 6(1)(f) of the General Data Protection Regulation, under which we have, following an assessment, found it necessary to log such traffic in order to monitor and secure our systems.
Administration of recruitment and new hires
When you apply for a job with us, you must provide a range of information about yourself, including name, contact details, education, previous places of work and other information included in a CV.
The legal basis is your consent to our collecting and processing personal data in connection with your job application. You may withdraw this consent at any time.
We will then delete all information you have provided in connection with your job application, and we will then no longer be able to consider you as a candidate for a job with us.
If you are offered a job with us, the necessary personal data will be transferred to our personnel system and you will receive a separate privacy policy for KPU employees. As a job applicant, you may consent to our storing your personal data for possible later assessments. If you do not wish this, your data will be deleted within 1 year after the recruitment process in question has ended.
Communication and dialogue
If you communicate with us electronically by email, via our website or in other forums, personal data is stored in our systems. The data is deleted regularly when it is no longer necessary for the purpose for which it was collected, or after the period for which we are required to store it under applicable legislation.
Information collected and stored via electronic communication will often also be covered by our legal practice or other services we provide as described above.
Invoice administration and supplier administration
Contact persons at subcontractors will be registered in our accounting system with the information necessary to administer the contractual relationship and to pay invoices. The information collected is name, position, email address and mobile number.
The legal basis is our legitimate interest in storing the personal data necessary to administer the supplier relationship.
The personal data is stored in our systems for as long as you are employed by a supplier to KPU.
Certain information may nevertheless be stored beyond this, as the Bookkeeping Act requires KPU to retain accounting records (such as invoices) for five years after the end of the financial year.
Your rights
Under applicable data protection legislation, you have a number of rights in connection with access to – and processing of – your personal data.
Subject to the exceptions set out in section 16 of the Personal Data Act, you have the right at any time to request access to the personal data we process about you. You may also demand correction of your personal data if it is inaccurate or incomplete. In certain circumstances you also have the right to demand that we delete your personal data.
In certain circumstances you also have the right to demand that we restrict the processing of your personal data and/or to object to the processing of your personal data.
In certain situations you have the right to receive, in a structured, commonly used and machine-readable format, personal data about you that you have shared with KPU, and you may request that it be transferred to another controller, e.g. another similar organisation.
Enquiries regarding your rights can be addressed to post@kpu.no. See also other contact details at the bottom of this document.
The right to erasure
We will delete all personal data we process about you without undue delay after we have received your request and in accordance with the time limits set out in Article 12 of the General Data Protection Regulation. The data will nevertheless not be deleted if we have another lawful basis for processing and a need for continued storage of your personal data.
Retention period
KPU stores personal data for as long as we have a legal basis for processing it, and no longer than is necessary to fulfil the purpose for which the data was collected.
Personal data stored in connection with legal engagements is routinely kept for 10 years after the engagement has ended, in accordance with the practice of the Norwegian Bar Association. The data may be stored beyond 10 years if we have a lawful basis for processing and a need for continued storage of the personal data.
Security measures
KPU has implemented the necessary technical and organisational measures to ensure that the personal data we have collected is protected and processed securely. We carry out regular assessments of the security of our systems.
Transfer of personal data to third parties
KPU will not transfer or otherwise share your personal data with others, with the exception of the following:
Statutory reporting obligation, money laundering
Under the Anti-Money Laundering Act, lawyers must report to ØKOKRIM if there is suspicion that transactions are connected with criminal acts or terrorist financing. In the event of such suspicion, KPU will share the necessary information with ØKOKRIM.
Necessary assistance from subcontractors
In order to carry on our business, we depend on partners who can assist with the development, delivery and operation of our ICT systems. Our subcontractors may be given access to personal data we process as part of their delivery and operation of our ICT systems. All our data processors are required to comply with applicable data protection legislation, including the necessary technical and organisational measures to ensure that the personal data we have collected is protected and processed securely. We have entered into written data processing agreements with all our subcontractors.
Transfer on the basis of law or a judgment/ruling
KPU will transfer personal data to public authorities if required to do so by law or by a final judgment or ruling.
Transfer of personal data outside the EEA
As a rule, KPU does not transfer your personal data outside the EEA. However, such a transfer may be necessary in connection with a legal engagement if, on your behalf, we are to assist you or defend you against a legal claim directed against or brought by authorities, persons or organisations outside the EEA.
Such a transfer will only take place with your consent. You may withdraw this consent at any time. If you withdraw your consent, however, this will normally make it difficult to carry out the engagement.
Complaints
You may complain to the Norwegian Data Protection Authority (Datatilsynet) if you believe that our processing of your personal data is not in accordance with this privacy policy or applicable data protection legislation.
You can find up-to-date contact details for the Norwegian Data Protection Authority here: datatilsynet.no/om-datatilsynet/kontakt-oss/
Changes to this privacy policy
We reserve the right to update and amend this privacy policy as required, and when necessary to adapt it to data protection legislation. We encourage you to familiarise yourself with its content from time to time. You will always find the current version of our privacy policy here on our website.
Our contact details
Advokatfirmaet KPU DA
Organisation number: 980 325 091
Phone: 22 40 36 40
Email: post@kpu.no
Visiting address: Tullins gate 2, 0166 Oslo
Postal address: Postboks 447 Sentrum, 0104 Oslo
See also our website: www.kpu.no
