Fram’s processing of personal data (2021-09-01)
The Law firm cares for personal integrity and about the protection of any personal data processed by the Law firm. All processing of personal data complies with current personal data legislation. Information about the law firm’s processing of personal data may be found below.
Controller
Fram Advokatbyrå KB
Org. no. 556478-9583
Contact information for controller:
Postal address: Kungsgatan 2C, 223 50 LUND
Telephone number: 046 – 15 10 00
E-mail: info@framlaw.se
Website: www.framlaw.se
Data Protection Officer (DPO)
For questions relating to the GDPR, the law firm’s DPO is available at info@framlaw.se
Categories of Data subjects
The Law firm processes personal data regarding the following categories of Data subjects:
- Persons who are clients or potential clients to the Law firm, persons from client companies or potential client companies.
- Counterparties or partners to clients, counterparties’ agents and witnesses.
- Persons at consultants, advisors and other agents with which the Law firm cooperates.
- Important persons in the legal industry and other fields in which the Law firm is active.
- Relevant contacts persons at authorities.
- Persons who use the Law firm’s website to provide contact information.
- Persons who participate in the Law firm’s seminars, events and the like.
- Persons who visit the Law firm’s office.
- Employees, potential employees and persons seeking employment at the Law firm.
A person whose personal data is processed is referred to as Data subject.
The subject-matter/types (categories) of personal data being processed
Basic information: social security number, name and address as well as other contact information, such as telephone number and e-mail address. When required, identity documents such as copies of driver’s licenses and passports.
If Data subject is the Law firm’s client: Personal data related to the client’s business and to the client’s case taken by the law firm. Personal data related to the client’s finances. If Data subject has a case taken by the Law firm which is not related to commercial law, personal data concerning personal relationships. Personal data related to invoicing.
If Data subject is employed at the Law firm: Personal data related to the managing of employment such as information about salary, benefits, bank accounts, working hours, leave, absence, illness etc.
If Data subject has applied for employment/internship at the Law firm: Personal data about education, work experience, CV, references, grades, work certificates and similar matters.
The nature of the processing
The law firm processes personal data as follows:
- Personal data is collected, structured, processed, stored and sorted out.
The purposes of the processing
- The Law firm processes personal data for the following purposes:
- The Law firm shall be able to fulfill client assignments and serve the client’s interest.
- The Law firm shall be able to assess client’s or Data subject’s need for legal services.
- The Law firm shall be able to credit check Data subject or client.
- The Law firm shall be able to fulfill statutory controls and responsibilities concerning money-laundering and financing of terrorism.
- The Law firm shall be able to conduct counter-examinations of clients’ counterparties as well as otherwise follow the Bar Association’s regulations.
- The Law firm shall be able to market its services to clients and potential clients.
- The Law firm shall be able to develop its business as well as analyze its position on the market.
- The Law firm shall be able to make contacts with relevant persons within the legal industry, at courts, authorities, organizations and companies.
- The Law firm shall be able to fulfill its responsibilities towards employees.
The lawful grounds of the processing
The Law firm’s processing of personal data is based on the following grounds:
- The Law firm processes personal data to be able to fulfill contracts entered to/client assignments as well as to take action on request of potential clients before a contract is entered to/an assignment is received.
- The Law firm processes personal data to fulfill legal obligations.
- The Law firm processes personal data based on its legitimate interest in being able to market the Law firm’s services to clients and potential clients (concerning information sent from the Law firm – see below.)
- The Law firm processes personal data on the basis of consent from the Data subject.
Withdrawal of consent
If certain personal data is processed on the basis of consent from the Data subject, the Data subject has the right to withdraw his or her consent at any time.
Sources
Personal data is collected from the Data subject herself directly, via letter or e-mail or at Data subject’s visit to Law firm’s website.
Personal data is also collected from private and official registers and sources. This applies to e.g.:
- Courts
- The Swedish Companies Registration Office
- The Swedish Tax Agency/ the Swedish Population Register and the Swedish Enforcement Authority
- SPAR and other address registers
- Credit reference agencies
Required information and missing information
As a starting point, the Data subject voluntarily provides personal data. For a Data subject who is a client or employee of the Law firm, there may be agreed requirements to provide information, in some cases also legal requirements.
If a Data subject who is or wishes to become a client does not provide the requested information, it may result in the Data subject not receiving the Law firm’s services.
Receivers within the EU
Personal data is processed by the Law firm’s lawyers and other staff at the office in Lund, Sweden.
Personal data may be transferred to the following receivers:
- Data processors hired by the Law firm, such as IT-suppliers or printing houses.
- Other hired lawyers/law firms, primarily within the organization AllyLaw.
- The Law firm’s other chosen partners.
Receivers may exist in all EU countries depending on the character of the assignment.
Receivers outside the EU and international organizations
The law firm may transfer personal data to the following companies outside of the EU/EEA or to international organizations:
Other hired lawyers/law firms, primarily within the organization AllyLaw.
Transfer of personal data to companies outside of the EU/EEA is made to countries which have an adequate level of protection according to art 45 in the GDPR, and to companies which are bound by the EU model clauses for transfer to third countries or which are otherwise bound to maintain an adequate protection level for personal data according to art 46 in the GDPR.
Automated decision making and profiling
Automated decision making and profiling (automatic processing and evaluation of personal data) by the Data subject may occur. Automated decision making and profiling primarily concerns all decisions regarding
- Credit checks for decisions about accepting assignments from clients.
Duration of personal data processing
Personal data is processed for 10 years after the last assignment/client relationship or the longer period called for by the nature of the case. If the assignment no longer exists or has existed in the Law firm personal data will be processed for 5 years after application for engagement in the Law firm.
Personal data concerning employees is processed for 5 years after employment is terminated. Personal data concerning applicants for employment at the Law firm is processed for 3 years unless a shorter period is demanded by the applicant.
Personal data which is contact information concerning persons other than clients and employees is processed for as long as the information is correct and relevant for us.
Personal data is however always saved for as long as there is a legal obligation to save the information: For example, accounting material shall be saved for as long as accounting regulations require (currently 7 years).
Data subject’s right to information and Data subject’s rights
The Data subject has the right to receive information from the Law firm about what personal data the Law firm processes about the Data subject and the type of processing being performed. Requests are made to the Law firm, see address stated above.
The Data subject has the right to request rectification of personal data processed by Law firm concerning the Data subject. The Data subject also has the right to request erasure or restriction of, or object to, the processing of personal data, to the extent permitted by applicable regulations (in particular the EU regulation on the processing of personal data). The same applies to the right to receive information in digital format (data portability).
Newsletters etc.
The Data subject may request that the Law firm apply a direct mail advertising block. The Data subject, then, does not receive information directly from the Law firm.
The right to file a complaint with a supervisory authority
The Data subject has the right to file a complaint concerning the processing of personal data by the Law firm to a supervisory authority.
In Sweden the supervisory authority is the Swedish Authority for Privacy Protection, Box 8114, 104 20, www.imy.se.
Information about the personal data being processed
Information about personal data which concerns the Data subject is kept in a separate document. Such information
- is provided electronically via e-mail, if the Data subject’s identity may be secured, or
- is sent to the Data subject’s address registered in the Swedish Population Register, by ordinary post.
