Privacy policy — Solicitors Organisation LLP

1. Who we are and how to reach us

Solicitors Organisation LLP, Avenue Louise 231 box 4, 1050 Brussels, Belgium, VAT BE 0456 891 227, is the controller for the personal data described in this notice. Our offices in Luxembourg, Amsterdam, Milan and Málaga are part of the same firm and the same controller.

Our data protection officer can be contacted at enquiries@solicitorsorganisation.com, marked for the attention of the DPO, or by post at the Brussels address above. The DPO function is exercised by a partner of the firm supported by our data protection team.

2. The personal data we process

The data we hold depends on your relationship with the firm. In most cases it includes the following categories:

Identification and contact data: name, address, telephone number, email address, date and place of birth, nationality and, where legally required, identity document details.
Matter data: the facts of your case, correspondence, documents you provide, notes of meetings and telephone calls, and advice we give.
Counterparty and third-party data: information about opposing parties, witnesses, family members, employees or company officers, where that information is necessary to the matter.
Financial data: bank account details, invoices, payment records and, where we hold funds for you, third-party account records.
Compliance data: anti-money laundering verification records, beneficial ownership details for corporate clients, and conflict-of-interest checks.
Website data: IP address, browser type, pages viewed and, with your consent, anonymised analytics. See our cookie policy.

3. Special category data

Some matters require us to process data revealing health, racial or ethnic origin, religious belief, political opinion, trade union membership or sexual orientation, and data relating to criminal offences — for instance in family, employment, discrimination or immigration work. We process such data where it is necessary for the establishment, exercise or defence of legal claims under Article 9(2)(f) GDPR, or with your explicit consent.

4. Why we process it and on what legal basis

To provide legal services under our engagement letter — performance of a contract (Article 6(1)(b)) and, for third-party data within a matter, our legitimate interests and the establishment or defence of legal claims.
To comply with legal and professional obligations, including anti-money laundering verification, bar rules, accounting and tax law — legal obligation (Article 6(1)(c)).
To carry out conflict-of-interest checks before accepting an instruction — legitimate interests and professional obligation.
To invoice, collect fees and, where necessary, recover unpaid fees — contract performance and legitimate interests.
To send occasional legal updates to business contacts — legitimate interests, with an unsubscribe link in every message; consent where required by national marketing rules.
To operate and secure this website and measure its use — legitimate interests for strictly necessary cookies, consent for analytics cookies.

5. Professional secrecy

Everything you tell us in the course of an instruction is covered by lawyers' professional secrecy under the rules of the bars to which we are admitted. Professional secrecy is broader than data protection and is not overridden by it: we will not disclose the content or the existence of your instruction except where the law compels disclosure or you authorise it.

6. Who we share data with

We disclose personal data only where it is necessary, and we require written confidentiality and data protection commitments from the recipients:

Courts, tribunals, arbitral institutions, opposing parties and their lawyers, where required to conduct your matter.
Notaries, bailiffs, translators, experts and foreign counsel we instruct on your behalf.
Public authorities and registries, including tax, immigration and company registries, and supervisory authorities where we are legally obliged to report.
Our IT, document management, email, accounting and archiving providers, acting as processors under Article 28 agreements.
Insurers and, where relevant, our professional indemnity insurers and their legal advisers.

7. International transfers

Our systems are hosted within the European Economic Area. A small number of service providers process data outside the EEA; where they do, we rely on an adequacy decision or on the European Commission's standard contractual clauses, supplemented by a transfer impact assessment and, where appropriate, encryption or pseudonymisation. Copies of the safeguards in place can be requested from the DPO.

Where a matter itself requires disclosure outside the EEA — for example proceedings before a non-EU court or an arbitration seated outside the Union — the transfer is made under Article 49(1)(e) GDPR for the establishment, exercise or defence of legal claims.

8. How long we keep it

Matter files: ten years from the closure of the file, reflecting professional obligations and limitation periods applicable to lawyers' liability. Certain documents relating to property, succession or long-term corporate structures are kept for thirty years.
Anti-money laundering records: ten years from the end of the business relationship, as required by Belgian law implementing the EU anti-money laundering directives.
Accounting and invoicing records: ten years.
Prospective client enquiries that do not become instructions: twelve months.
Legal update mailing list: until you unsubscribe, and thirty-six months after the last interaction.
Website analytics: fourteen months in aggregated form.

9. Your rights

You have the right to request access to your personal data, rectification of inaccurate data, erasure, restriction of processing, and portability where the processing is based on consent or contract and carried out by automated means. You may object to processing based on our legitimate interests, and withdraw consent at any time where consent is the basis relied on.

These rights are subject to limits. We cannot erase or restrict data we are required to retain by law, nor data needed for the establishment or defence of legal claims, and professional secrecy may prevent us from disclosing a third party's information within your file. Where we refuse a request in whole or in part we will explain why.

To exercise a right, write to enquiries@solicitorsorganisation.com marked for the DPO. We respond within one month, extendable by two further months for complex requests, and we will tell you if an extension applies. We may ask you to verify your identity first.

10. Complaints to a supervisory authority

If you are not satisfied with how we have handled your data, please tell us first so that we can put it right. You also have the right to lodge a complaint with a supervisory authority — the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels, or the authority in your country of residence or work. The Dutch Autoriteit Persoonsgegevens, the Luxembourg CNPD and the Italian Garante are also competent in relation to our offices in those countries.

11. Security

We apply technical and organisational measures appropriate to the sensitivity of legal files: encrypted storage and transmission, multi-factor authentication, role-based access to matter files, logging, staff training and confidentiality undertakings, tested restoration of backups, and a documented incident response procedure that enables notification within seventy-two hours where the GDPR requires it.

12. Changes to this notice

We review this notice at least annually and when our processing changes. The version in force is always the one published here, with the date of last update shown above. Where a change materially affects clients with open matters, we notify them directly.

Questions about this document can be sent to enquiries@solicitorsorganisation.com. Our registered office is Avenue Louise 231, box 4, 1050 Brussels, Belgium.