DATA PROTECTION NOTICE
VUKMIR & ASSOCIATES ATTORNEYS AT LAW, Ltd.
This Data Protection Notice (“Notice”) describes how Vukmir & Associates Attorneys at Law, Ltd (“Vukmir & Associates”) collects, uses, and discloses personal data in the course of our business operations. This Notice does not address processing of personal data of our employees, which is subject to a separate set of rules.
The term “personal data” refers to any information relating to an identified or identifiable natural person (“data subject”). Therefore, it is any information directly identifying the natural person or by means of which the natural person may be identified, such as name, personal identification number, postal address, and email address. Identification can be by the information alone or in conjunction with any other information in our possession or likely to come into such possession.
This Notice answers the following questions:
- Personal data collected in the course of providing of our services
- Personal data collected in line with anti-money laundering regulations
- Personal data collected in the course of our business operations
- Personal data collected through business contacts
- Personal data collected in the recruitment process
- Personal data collected through video-surveillance
- Personal data collected through our website / use of IP addresses
- For what purposes do we use the personal data?
NOTE: Vukmir & Associates may license the use of our trademarks to unrelated third parties which operate businesses and websites independently from Vukmir & Associates, such as legal networks or publications. This Notice does not cover the processing of personal data by such third parties. Such third parties have separate and independent data protection or privacy policies that we recommend you examine carefully.
Vukmir & Associates acts as data controller in relation to processing of personal data addressed in this Notice. This means that Vukmir & Associates decides how such personal data is processed and for what purposes.
During the regular course of our business operations, Vukmir & Associates collects and further processes personal data in relation to providing of legal services, and as required by the law. We also process personal data of our business partners and service providers. In addition, Vukmir & Associates processes personal data as part of the recruitment process and through use of video-surveillance.
We take special care to collect and further process only those personal data, which are necessary in relation to the purposes for which they are processed and not process the same in a manner that is incompatible with those purposes.
Attorneys in Croatia are a regulated profession, principally through the Constitution and the Attorneys Act. Under the Attorneys Act, duly licensed attorneys in Croatia are authorized to provide legal services, which includes providing legal advice, drafting legal documents (such as contracts, lawsuits and other motions), and representing parties before courts and other competent authorities. Vukmir & Associates is a fully licensed law firm authorized to provide such services to our clients. In order to efficiently provide legal services, Vukmir & Associates collects information related to prospective or actual transaction, dispute or other matter in relation to which we assist our clients. Such information may include different personal data.
In the course of providing of legal services, we collect and further process personal data pertaining to prospective or existing clients and/or their employees/representatives and/or other related persons (e.g. clients’ shareholders, clients’ counsels). The same personal data typically include name, postal address, personal identification number, date/place of birth, personal identification document, telephone/telefax number, e-mail address, position, payment details, and other details related to prospective or actual transaction, dispute or other matter. For the same purpose, we also collect personal data of third parties, such as opposite parties, government officials (e.g. judges, court clerks etc.), opposite parties’ counsels and/or other representatives (e.g. opposite parties’ directors or shareholders). The latter personal data typically include name, postal address, personal identification number, telephone/telefax number, e-mail address and position. The same personal data may also include information about bank accounts or financial standing in case of opposite parties – natural persons.
The source of personal data collected in the course of providing of our services may comprise information and documentation collected through personal contacts and other means of communication (e.g. letters, telephone, email, our website) with the prospective or existing clients, government authorities, opposite parties and/or other sources (e.g. online sources, official registries). Occasionally, we are required to engage third-party service providers (e.g. private detectives) in order to obtain the personal data required for providing of our services, in which case we apply measures to ensure the adequate protection of the relevant personal data.
Failure to provide the personal data that we require for providing of our services, may result in inability of Vukmir & Associates to efficiently provide our services or even Vukmir & Associates declining the client representation. We inform our prospective and existing clients in timely manner when this is the case.
In Croatia, applicable laws and regulations are designed to fight money laundering. Generally, money laundering is the process by which proceeds from criminal activity are “cleaned” so that their illegal origins are hidden. The same activity is commonly associated with the types of organised crime that generate large profits in cash, such as trafficking in drugs, weapons and human beings as well as fraud and terrorism.
In order to comply with our legal obligations related to anti-money laundering, Vukmir & Associates is obligated to verify the identity of new clients, and in certain circumstances existing clients. In certain cases, we are additionally required to conduct detailed background checks on new or existing clients. For these purposes, we are required to collect and further process personal data about our clients or potential clients, their shareholders, beneficial owners, management, directors, other officers and the members of their families. The information we are required to process in this regard typically include name, postal address, personal identification number, position, date/place of birth, personal identification document, telephone/telefax number and e-mail address. This may possibly include also evidence of source of funds and detailed enquiries of any unusual transactions such as the transfer of large amounts of cash. The sources for such verification/background checks may comprise information and documentation that we request from our prospective or existing clients (e.g. certificates of good standing, extracts, shareholder documentation), or through the use of online sources or both.
In some cases we may decline to, or may not be permitted to, proceed to act until aforedescribed anti-money laundering procedures have been completed. In other cases, we may agree to commence acting whilst these procedures are carried out. We reserve the right to decline to act or, if appropriate, cease to act should these procedures not be completed to our satisfaction.
In case where we instruct counsel or other professionals to act on behalf of our clients, they may request us to provide them with copies of evidence of identity of clients or their representatives that we have obtained from our clients or from other sources. We will provide such copies to them if we so decide, unless particular client specifically advises us not to do so. However, in the latter case, it is possible that counsel and other professionals will decline to act on behalf of such client.
In order to ensure proper functioning of our law firm as well as that our services are rendered in most efficient matter, we may engage business partners outside the firm and other third-party service providers, such as outside counsels, court appointed translators, IT service providers, accountants, etc. to provide respective services. Therefore, we may collect and further process personal data about such business partners / service providers and/or their employees/representatives, which may include name, postal address, personal identification number, date/place of birth, telephone/telefax number, e-mail address, and payment details. The same personal data are principally collected through personal contacts and other means of communication (e.g. letters, telephone, email, our website) with such business partners and third-party service providers.
In regular business contacts (e.g. at conferences and other similar events, through e-mail correspondence) between our law firm and other participants in the business community (e.g. prospective clients, other counsels, court appointed translators etc.), we may collect personal data of such other participants and/or their representatives. The same personal data usually include name, postal address, telephone/telefax number, e-mail address and position. Commonly this type of information is collected through personal contacts (e.g. by exchanging the business cards) and/or follow-up communication (e.g. by e-mail or telephone). In addition, very often we receive introduction emails from other participants in the business community, who are interested in business cooperation with our law firm (e.g. legal counsels from other countries). Personal data about such other participants and/or their representatives is entered into a database we keep and used when required or appropriate (e.g. when one of our clients requires legal assistance in other country or certified translation).
As part of the recruitment process, we collect personal data of prospective employees and other candidates (e.g. candidates for internship). Personal data collected in this regard includes CVs and/or other information usually contained in the CV and/or usually related to the recruitment process, such as name, postal address, personal identification number, date/place of birth, telephone/telefax number, e-mail address, information about education and previous work experience, and photographs. The same information may also include special categories of personal data (e.g. state of health).
Personal data is collected through personal contacts and other means of communication (e.g. letters, telephone, email, our website) with the candidates who apply to the employment adds as published by Vukmir & Associates. Often, candidates also send us unsolicited petitions for employment, usually via email or through our website. Where we deem necessary for the recruitment process, in addition to the information supplied by the candidates, we may also collect information about them from other sources (e.g. online sources). Occasionally, we may also engage third-party service providers (e.g. employment agencies) to assist us in the recruitment process and to collect information, including personal data about prospective employees.
If a candidate has not been offered a role on certain occasion but we feel such candidate may be suitable for a different role in the future, with such candidate’s consent, we may also keep the information for future consideration.
Our business premises are under video-surveillance in order to ensure adequate protection of persons and property. Therefore, we may collect through video-surveillance personal data of our visitors, including prospective / existing clients and their representatives, opposite parties and their counsels, business partners and service providers. Such personal data comprises principally of video images of the visitors. The same data is stored in our IT system for a limited period of time, after which it is erased. Only authorized personnel of Vukmir & Associates have access to such personal data and we have established a system of logs for the purpose of safekeeping of the same data, as required by the law.
Visitors of our website are not required to provide personal data in order to use the most of its functionalities. However, visitors who wish to submit a query through our website are required to provide name and email address.
In addition to the information we collect through our website as described above, we use technology to automatically collect information about the use of our web site. For example, our web server automatically logs when visitors view our website, their IP addresses and which web browsers our visitors use. We use this information to manage our website and our technical solutions, understand how visitors navigate through our website, enhance your experience on our websites and improve our services.
Vukmir & Associates use the personal data described above for the following purposes:
- For the purpose of providing of legal services;
- For the purpose of complying with legal obligations (e.g. in case of processing in line with anti-money laundering regulations);
- For the purpose of enabling regular operation of our law firm;
- For the purpose of maintaining of business network;
- For recruitment purposes;
- For the purpose of protection of persons and assets (e.g. in case of video-surveillance);
- To inform our clients and business partners of relevant news or activities (e.g. in case of change of important regulations);
- For the purpose of contacting data subjects where necessary or appropriate (for example, if data subjects have a query about our services);
- For the purpose of operating and maintaining of our website;
- For the purpose of collection of our claims.
The legal basis for our processing of personal data for the purposes described above will typically include:
- Processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract (e.g. in case of providing legal services to clients who are natural persons, in case of contracts with service providers who are sole proprietors);
- Processing is necessary for compliance with a legal obligation to which our law firm as the controller is subject to (e.g. in case of complying with anti-money laundering regulations);
- Legitimate interest (e.g. in case of providing of our legal services, in case of processing through video-surveillance, in case of processing for the purpose of maintaining the business network, or in case of collection of our claims);
- Explicit consent of the data subject (e.g. in case of prospective employees who consent for us to keep their personal data for future reference, or in case we engage other counsels to work with us on particular assignment for the client).
Vukmir & Associates does not share, or distribute personal data, except as otherwise provided for in this Notice or as otherwise required or permitted by applicable law:
- We share, transfer or disclose the personal data with the competent government authorities (e.g. courts), other legal counsels, court appointed translators, and/or opposite parties and their representatives, where this is required for providing of our services;
- We may furthermore share, transfer or disclose the personal data to the competent authorities in order to comply with a legal requirement, principally in line with anti-money laundering regulations (e.g. we may be required to disclose the data to the Financial Inspectorate in case of suspicious transactions);
- We may also share, transfer or disclose the personal data with the competent government authorities (e.g. courts) and other third parties (e.g. other legal counsels, debt collection agencies) to take precautions against legal liability and/or collection of our claims;
- In addition, we may disclose the personal data to our service providers in order to enable the proper functioning of our law firm and to protect the security or integrity of our IT systems and website.
If we transfer personal data outside the European Economic Area we will, as required by applicable law, ensure that data subject’s rights are adequately protected by appropriate safeguards, such as standard contractual clauses.
Unless subject to an exemption under the applicable data protection laws, data subjects have the following rights with respect to their personal data processed by Vukmir & Associates:
- The right to obtain from us confirmation as to whether or not personal data concerning such data subject are being processed, and, where that is the case, access to such personal data (“Right of access by the data subject”);
- The right to request that we correct or complete any personal data if it is found to be inaccurate or uncomplete (“Right to rectification”);
- The right to request personal data is erased where it is no longer necessary for the purposes for which Vukmir & Associates is processing the same date (“Right to erasure”);
- The right to withdraw the consent to the processing at any time if the processing is carried out based on the consent;
- The right to request that Vukmir & Associates provides you with your personal data and where possible, to transmit that data directly to another data controller, where applicable (“Right to data portability”);
- The right to request restriction of further processing, where applicable (“Right to restriction of processing”);
- The right to object to the processing of personal data, where applicable (“Right to object”);
- The right to lodge a complaint with the supervisory authority.
In case when data subjects decide to exercise one of the aforelisted rights, Vukmir & Associates shall act upon the client’s request without undue delay. We shall also provide the data subject with the information on actions taken without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. We shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. The same information shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, we reserve the right to either:
- charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or
- refuse to act on the request.
We will keep the personal data for as long as it is required for the purposes of processing set out above, and so this period will vary depending on such purpose. For example, under the applicable Attorneys Act, we are required to keep the records of the matters in which we provided legal services to our clients for 10 years following the representation. The same deadline applies to keeping documentation collected in line with anti-money laundering regulations. Similarly, any accounting documentation must be kept for the period of 11 years. After the personal data is no longer required for the purpose for which the same have been collected, we will destroy or anonymize the same personal data, so that it is no longer in a form which permits identification of data subjects.
If we intend to use your personal data for a new purpose, not covered by this Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent such new processing.
We are complying with our obligations under the applicable data protection laws by storing and destroying personal data securely, by protecting personal data from loss, misuse, unauthorised access and disclosure, and by ensuring that appropriate technical measures are in place to protect personal data.
We also use firewalls and have implemented other reasonable technical, administrative and physical measures designed to protect the personal data in our custody or control from unauthorized access, use, modification and disclosure.
While we implement the above security measures on our web site, you should be aware that regarding our web site and electronic communications, 100% security is not always possible.
We are continually observing and improving our data protection practices. Because of these ongoing changes, changes in the law and the changing nature of technology, our data protection practices will change from time to time. We therefore encourage you to check this page frequently for any updates.
To exercise all relevant rights, queries or complaints please in the first instance contact us at:
VUKMIR & ASSOCIATES ATTORNEYS AT LAW, Ltd
Gramača 2L, 10000
Tel: +385 1376 0511
Fax: +385 1376 0555
You can contact the Croatian Personal Data Protection Agency on 00385 (0)1 4609-000 or via email firstname.lastname@example.org or at Agencija za zaštitu osobnih podataka, Martićeva ulica 14, HR – 10 000 Zagreb, Croatia.
This Data Protection Notice was last updated on May 2018.