Commercium Legal

Your privacy is important to us. In this policy we describe how we collect and process personal data of our clients, potential clients, and other business contacts.

Should you have any questions relating to the processing of your personal data, or should you wish to use your rights as a data subject, please contact us at: info@commercium.fi.

1. How we collect data

As a law firm, we regularly receive and process various types of personal data in connection with our business operations, for example when performing and managing assignments from our clients.

We mainly process personal data we obtain from you directly, for example when you send e-mails to us or communicate with us through other channels. We can, however, also process personal data, which has been provided to us by our clients in connection with assignments given to us.

Where applicable, we also process your personal data obtained from publicly available sources, such as your employer’s website, and personal data that accumulates from your use of our website.

We mainly process the following types of your personal data:

• basic information, such as your name, your contact information (e-mail, address, phone number(s)), your employer, your title or position;
• identification and background information provided by you or collected by us as part of our business acceptance processes in accordance with the applicable laws and regulations (such as anti-money laundering regulations);
• personal data provided to us by or on behalf of our clients, partners, and employees or generated by us in the course or providing services; and
• any other information relating to you which you may provide to us.

2. How we use data

We use the personal data we collect for the following purposes:

• performing the assignments given to us;
• the management and administration of our business relationship with you and your organisation;
• business development and marketing; and
• compliance with our legal obligations, including obligations with respect to anti-money laundering and sanctions checks as well as other legal and regulatory requirements.

3. Legal basis for processing data

When processing personal data for the purposes described in this policy, we process data based on our legitimate interest in maintaining and developing business relationships, performing assignments given to us and fulfilling our legal obligations.

4. Sharing and transferring data

We do not sell, rent, distribute, or otherwise make personal data available to any third party for marketing purposes. However, we may share information with our suppliers when they perform services on our behalf. However, such suppliers are obliged to process the data on our behalf and for the above mentioned purposes only.

We may also need to transfer personal data to third parties, such as other counsels, advisors, and third parties involved in the assignments given to us by you of third parties, including third parties based outside the European Union (the “EU”) and the European Economic Area (the “EEA”).

The personal data we process are not regularly transferred outside the EU or the EEA. However, if we transfer personal data outside the EU or the EEA, such transfer will be performed subject to appropriate safeguards required by applicable data protection laws.

We take appropriate technical and organisational measures against unauthorised or unlawful processing of your personal data and against accidental loss or destruction of, or damage to, personal data in accordance with our internal security procedures covering the storage and destruction of personal data as well as access to personal data.

5. How long we will store data

Personal data will be stored for the purposes mentioned above for as long as we have a meaningful business contact or other contact or as may otherwise be required by law.

When the processing of personal data is no longer necessary for the purposes they were collected, we will delete or anonymise the personal data relating to you in a secure manner.

We may retain personal data for a longer period to the extent required by our automated backup systems or to the extent we deem the data necessary to assert or defend legal claims during any relevant retention period.

6. Your rights and how to exercise them

You have the right to:

• request a copy of the personal data we process relating to you;
• request the correction of incorrect personal data relating to you and in some cases the deletion of your personal data;
• request the restriction of processing of your personal data or to object to processing; and
• receive, under certain preconditions, your personal data in a structured, commonly used, and machine-readable format, and the right to transmit those data to another controller.

In addition, you have an express right to ask us not to send you marketing-related communications.

If you consider that your rights under the applicable data protection laws have been infringed, you may lodge a complaint with the competent supervisory authority (in Finland Tietosuojavaltuutettu).

7. Updates

This policy has been updated in September 2018. We reserve the right to amend this policy from time to time to reflect changing legal requirements or our processing practices.