Privacy Statement

Persons whose personal data are processed by Van Doorne in the context of its provision of legal services are:

• Contact persons at our clients;
• Contact persons at our potential clients;
• Contact persons at our business relations;
• Contact persons at our referrers;
• Recipients of our communications, such as our newsletters and invitations to events organised by or in cooperation with Van Doorne;
• Visitors to our website www.vandoorne.com; and
• Persons who otherwise contact us or whose personal data we otherwise process in the context of our services.

• Personal data provided by you:
  • contact details and other personal data that are necessary for the handling of your case by a lawyer, civil-law notary or tax consultant. These are details such as your name, address, telephone number and identification documents;
  • contact details and other personal data filled in on contact forms or other web forms. The precise content of the data depends on the content of the contact forms and web forms;
  • contact details provided during initial meetings, events, seminars, etc. These may include details such as those set out on business cards; and
  • other personal data provided by you, such as personal data included in email correspondence addressed to one of our employees.
• Personal data that give insight into the use of our website or other electronic means of communication. These may include data such as:
  • IP address (the unique identification number of your device when you connect to the internet), which we use to measure your interest in our website;
  • your browsing behaviour on the website, such as data on your first visit, previous visit and current visit, the pages visited, and the way in which you navigate through the website and the type of device used; and
  • the opening and reading of a newsletter or commercial email. This also includes click behaviour in the email or newsletter.

• Personal data obtained from other sources:
  • personal data available on public professional social media platforms such as LinkedIn. These are names and contact details;
  • personal data obtained from the Trade Register of the Chamber of Commerce and from the Land Registry Office (Kadaster). These include, for example, the Chamber of Commerce number and contact details; and
  • personal data available on public professional websites, such as company websites.

• To perform an agreement in which you have engaged our lawyers, civil-law notaries or tax consultants to provide legal and tax-related services

If you engage a lawyer, civil-law notary or tax consultant to handle your case, your contact details will be requested in that context. Other personal data may also be necessary for the handling of the matter, depending on the nature of the case. Data of the parties involved may also be processed.

• To conduct legal proceedings
• To invoice for services rendered
• To comply with our legal obligations

A civil-law notary is required under the Civil-Law Notaries Act (Wet op het notarisambt) to include certain personal data in a deed, such as the surname, first and middle names, date and place of birth, address, city of residence and civil status of the parties. Civil-law notaries are also required by law to provide certain personal data to the Chamber of Commerce and the Land Registry Office. Under the Legal Profession Regulations (Verordening op de advocatuur (Voda)) and the Civil-Law Notaries Act, we are required to verify the identity of our clients or their representatives. This is done on the basis of a valid identification document (a legalised copy in the case of remote identification). The document type and document number are stored to demonstrate that this obligation has been complied with. Under the Money Laundering and Terrorist Financing (Prevention) Act (Wwft), broader retention obligations apply. If the services fall under the Wwft, a copy of the identification document will therefore be retained. The photograph and citizen service number (BSN) are blacked out.

• To respond to your questions or messages that we receive from you via email correspondence, whether or not in the context of one of the purposes referred to above

In the event of the prolonged absence or departure of one of our employees, it may therefore be necessary for another employee to be granted temporary access to the messages you have sent us. Access to the mailbox and personal folders will only be granted to another colleague in exceptional circumstances, following a careful weighing of the interests involved and only on a need-to-know basis as referred to under 7. If an employee is absent for a prolonged period or has left the firm, you will receive an out-of-office message in response to your message stating this and offering you the option to indicate that you wish the message to be deleted. In addition to this temporary access, some employees whose position makes it necessary to have access to the mailboxes of other employees, such as secretaries, have ongoing access to that information.

• The State Taxes Act (Algemene wet inzake rijksbelastingen) requires us to process and retain certain personal data
• To maintain contact with you

We consider it important to approach you with information that is relevant to you. To make this possible, we combine and analyse the personal data available to us. On that basis, we determine which information and channels are relevant and which moments are most suitable for providing information or making contact. In our marketing activities, we do not process any special categories of personal data or any confidential information that is protected by the professional privilege of lawyers or civil-law notaries.

• For webinars and the communications related thereto

If you register for a webinar, we ask for your email address so that we can communicate with you about the webinar. You will receive a registration email at the email address you have provided. After the webinar you will also receive an email with the recording of the webinar. You will also receive this email if you have indicated that you cannot attend the webinar live. In addition, we ask you to enter your company name and job title. This is not mandatory. If you provide this information, we can tailor the content of the webinar to you more effectively. To attend a webinar, you register with your name and email address via the link we send you. We process your data relating to your participation in the webinar (such as registration details, time of registration, time of attendance and duration of your attendance). If you have given your consent, we will contact you afterwards to discuss the content of the webinars and to see whether we can be of further assistance to you. This contact may take place through various communication channels, including by telephone if you have provided your telephone number. The list of participants is shared internally with our Education department for the purpose of allocating professional development points. We also analyse this data for the ongoing improvement of our webinars. During the webinar, the participants cannot be heard or seen. Nor are the names of the participants visible to other participants. If you ask questions during the webinar, those questions, together with the name of the person asking them, are only visible to the host (Van Doorne) and not to other participants. We process this data in order to answer the questions during the webinar or, if necessary, afterwards.

• To conduct evaluations

If you have given your consent for this purpose, you will receive an email with a link to the evaluation (an online questionnaire). Participation is voluntary and can be anonymous. Prior to the evaluation, you will receive further information on the way in which we handle the information obtained.

• To conduct analyses

To conduct analyses we use:

• Interaction data:
  • Personal data obtained from contact between Van Doorne and you. For example, about your use of our website or supporting applications. This also applies to offline interactions, such as how often there is contact between Van Doorne and you.
• Behavioural data:
  • Personal data that Van Doorne processes about your behaviour, such as your preferences, opinions, wishes and needs. We may derive these data, for example, from your browsing behaviour on our website, from your reading of our newsletters or from the fact that you have requested information. Also from inbound telephone conversations and email contact with our employees. Information obtained via a tracking cookie is only collected and used with your consent, which you may withdraw at any time.

• To conduct client satisfaction surveys

We sometimes ask clients to cooperate in a client satisfaction survey. This is done by means of an online questionnaire. Participation is voluntary.

• For security purposes, your data may be used as follows:

• IP addresses are stored
• Use is analysed in the event of suspicious activity
• Data is temporarily processed in security software

• To compile user statistics

The user statistics of the website enable us to obtain a picture of, among other things, the number of visitors, the duration of visits, which parts of the website are viewed and click behaviour. These are generic reports, without any information about individual persons. We use the information obtained to improve the website.

• To monitor access to the office and safeguard security

When you visit our office, we note your name upon arrival. Camera footage is also recorded outside the office, at the entrances and exits of the office, in the car park and at the reception desk. We do this in order to know who is in the building in the event of an emergency and to ensure that unauthorised persons do not gain access to the office. Camera footage is in principle destroyed after four weeks.

• To conduct audits

• Consent
  • We ask for your consent to participate in a client satisfaction survey.
  • We ask for your consent for direct marketing purposes, which will be further specified when you give your consent.
  • We ask for your consent for the use of cookies on our website.
  • If we have asked for your consent to process your personal data and you have given that consent, you also always have the right to withdraw such consent. You can do so by contacting us at: privacy@vandoorne.com.

• The processing is necessary for the conclusion of an agreement or in the run-up to the conclusion of an agreement
  • If you engage us to provide legal or tax-related services, we process personal data if and to the extent that this is necessary for the performance of the engagement.

• Legal obligation
  • A civil-law notary is required under the Civil-Law Notaries Act to include certain personal data in a deed, such as the surname, first and middle names, date and place of birth, address, city of residence and civil status of the parties.
  • Civil-law notaries are also required by law to provide certain personal data to the Chamber of Commerce and the Land Registry Office.
  • The Money Laundering and Terrorist Financing (Prevention) Act (Wwft) requires lawyers, civil-law notaries and tax consultants to obtain and record certain information. This includes, among other things, a copy of an identification document (passport) with the citizen service number (BSN) and the photograph blacked out.

• Legitimate interest
  • We may also process personal data where we have a legitimate interest and doing so does not disproportionately infringe your privacy. For instance, we use your contact details to invite you to seminars and events.
  • We also have a legitimate interest where we use your personal data to contact you after you have contacted us on your own initiative.
  • We do not always need consent to contact you. Where we obtain your email address as a result of providing services, we may offer you similar services via direct marketing. In that case, we have a legitimate interest in offering you those services.

Personal data are provided to third parties in, among other things, the following cases:

When handling a file, it may be necessary to share your personal data with third parties. For example, when litigating against another party, when concluding an agreement or in the case of a notarial deed involving several parties.

Furthermore, Van Doorne is required under the Wwft to report unusual transactions to the FIU-Netherlands (Dutch Financial Intelligence Unit). Van Doorne is not permitted to inform its clients about (an intention to make) such a report.

In addition, as a result of Council Directive (EU) 2018/822 of 25 May 2018, Van Doorne is, in certain circumstances, also required to provide information on reportable cross-border arrangements to the tax authorities.

Civil-law notaries are required by law to provide certain personal data to the Chamber of Commerce and the Land Registry Office.

If a court order requires us to provide personal data to third parties, we shall have to comply with such order.

Your personal data are not shared with third parties for commercial purposes. There is one exception. We sometimes organise a joint activity, such as an event or seminar, with another organisation. In that case, only the necessary contact details are exchanged.

Personal data may furthermore be provided to third parties in the event of a reorganisation or merger of our business, or the sale of (part of) our business.

For example, we work with service providers that offer SaaS (software as a service) solutions or provide hosting services. There are also ICT service providers that support us in keeping our systems secure and stable. We also use third-party services for the sending of newsletters and commercial emails.

To secure your personal data, we have taken, among other things, the following technical and organisational measures:

• Availability and continuity: We take appropriate technical and organisational measures to safeguard the availability and continuity of our critical systems and services.
• Device management and security: Access to our systems is based on device-compliance and risk-driven access controls. Devices managed by Van Doorne are centrally managed and equipped with security measures such as encryption, patch management and endpoint protection. Access from unmanaged or private devices is only possible subject to additional security conditions, such as limited functionality, prevention of local storage of data, and strong authentication via conditional access measures.
• Physical security: Our building is secured by physical access control and camera surveillance. Access to the building is limited to authorised persons.
• Authorisations: Access to our systems is granted on the basis of roles and functions, whereby users are only granted access to the information and systems that are necessary for their work.
• Encryption: Data is encrypted by default when stored and transmitted, so that confidential information is adequately protected both on devices and during exchange.
• Monitoring of our systems: Our systems are continuously monitored for security incidents and anomalous behaviour, with an external security service providing 24/7 monitoring, detection and response.
• Periodic penetration testing: On a regular basis, our IT environments are tested for internal and external vulnerabilities by an independent external party.
• Threat protection: We take technical measures to prevent and to detect in a timely manner security threats, unauthorised access and misuse of data.
• Privacy-by-design and privacy-by-default: New systems are tested in advance for compliance with the privacy principles, so that data protection is safeguarded from the design stage onwards.
• Data Protection Impact Assessment (DPIA): For new systems we carry out a data protection impact assessment in advance, where legally required.
• Training and awareness: Our employees receive continuous training on information security and data protection.
• Data breaches: For the detection, handling and reporting of a data breach, we have set up a Data Breach Team and implemented a protocol.