Privacy Statement

The HVG Law network (hereinafter referred to as: HVG Law or we), consisting of HVG Law B.V. (having its registered office at Boompjes 258, 3011 XZ Rotterdam (Chamber of Commerce registration number: 24433164)) and Donahue & Partners B.V. (having its registered office at One Manhattan West 395 Ninth Avenue, NY 10001-8604 New York (Department of State ID: 2467542), attaches great importance to the protection of your privacy and the confidentiality of your personal data. This privacy statement (hereinafter referred to as: Privacy Statement) explains which personal data are collected and processed, for what purposes this occurs, how long we retain these personal data, what your rights are and how you can reach us. Below you will find an overview of all paragraphs of this Privacy Statement.

1. PROCESSING OF PERSONAL DATA: CATEGORIES, PURPOSES AND LEGAL BASES

1. Retention periods
2. Transfer of personal data to third parties
3. Security
4. Social media
5. Your rights
6. Cookie statement
7. Changes to the Privacy Statement
8. Questions and contact details
9. Processing of personal data: categories, purposes and legal bases

Personal data are data that can be used to (directly or indirectly) identify a person. HVG Law collects personal data in various ways, for example when you use our legal services, apply for a job, ask questions (via our website) and/or visits one of our events. Described below are the situations in which HVG Law collects personal data, for which purposes and based on which legal bases.

Clients

HVG Law collects and processes the following categories of personal data:

• contact information: name (including prefix), title, position, telephone number, Chamber of Commerce number, website, email address, company address, and other company and contact information;
• correspondence and other communications: procedural documents, letters, email messages, telephone notes and other communications;
• engagement information: information about our services to our clients, information regarding the content of the engagement, further information provided to us for the benefit of our clients or generated by us during our services, bank account numbers, payment history and information about making payments and collecting receivables; and
• identification and background information: gender, date of birth, place of birth, details of your identity document (such as identification number, document number, photo, height, nationality, signature, place of issue of your identity document).

HVG Law processes the aforementioned personal data for one or more of the following purposes:

1. to make offers to clients regarding the legal services we provide;
2. for the provision of services as agreed with clients (including conducting (legal) proceedings);

• to facilitate the sharing of documentation between clients and HVG Law (by means of iManage Share);

1. for handling complaints and/or feedback;
2. to make payments and collect receivables;
3. for a client acceptance investigation;

• to implement applicable legislation and regulations (including accounting obligations); and

• to maintain a business relationship with our clients, by sending newsletters, updates and ‘law alerts’ and/or to invite clients to our events.

HVG Law processes the aforementioned personal data on the basis of the following legal bases:

• the processing is necessary for the performance of an agreement to which our clients are a party, or to take measures at the request of our clients prior to the conclusion of an agreement (purposes I through V);
• the processing is necessary in order to comply with a legal obligation that rests with HVG Law (purposes VI and VII); and
• the processing is necessary for the purposes of the legitimate interests pursued by HVG Law or a third party (purpose VIII). If HVG Law processes personal data based on the legal basis ‘legitimate interest’, HVG Law assesses whether the impact on your interests and rights and freedom overrides HVG Law’s legitimate interests prior to the processing. If you wish to receive further information on the balancing of interests by HVG Law, please contact us. Our contact details are listed in paragraph 9 of this Privacy Statement.

(Potential) job applicants

HVG Law collects and processes the following categories of personal data:

• your contact information: name (including prefix), title, position, telephone number, address details and (company) email address;
• correspondence and other communications: letters, email messages, telephone notes and other communications; and
• further information related to recruitment (events): gender, date of birth, place of birth, CV and information on employment history, assessment results, identity data, capacity test results, dietary requirements.

HVG Law processes the aforementioned personal data for one or more of the following purposes:

1. to assess to what extent the (potential) job applicant is suitable and to initiate a job application procedure; and
2. to invite (potential) job applicants to our events and to have them participate in our events.

HVG Law processes the aforementioned personal data on the basis of the following legal bases:

• the processing is necessary for the performance of an agreement to which a job applicant becomes a party (purpose I);
• the job applicant has consented to the processing of his or her personal data (purpose II); and
• the processing is necessary for the purposes of the legitimate interests pursued by HVG Law or a third party (purpose II). If HVG Law processes personal data based on the legal basis ‘legitimate interest’, HVG Law assesses whether the impact on your interests and rights and freedom overrides HVG Law’s legitimate interests prior to the processing. If you wish to receive further information on the balancing of interests by HVG Law, please contact us. Our contact details are listed in paragraph 9 of this Privacy Statement.

Suppliers

HVG Law collects and processes the following categories of personal data:

• contact information: name (including prefix), title, position, telephone number, Chamber of Commerce number, website, VAT number, email address, company address, and other company and contact information;
• correspondence and other communications: letters, email messages, telephone notes and other communications; and
• engagement information: information about the supplier’s services to us, bank account numbers and information about making payments.

HVG Law processes the aforementioned personal data for one or more of the following purposes:

1. to purchase goods and/or services;
2. to implement applicable legislation and regulations (including accounting obligations); and

• to maintain a business relationship with our suppliers.

HVG Law processes the aforementioned personal data based on of the following legal bases:

• the processing is necessary for the performance of an agreement to which our suppliers are a party, or to take measures at the request of our suppliers prior to the conclusion of an agreement (purpose I);
• the processing is necessary in order to comply with a legal obligation that rests with HVG Law (purpose II); and

• the processing is necessary for the purposes of the legitimate interests pursued by HVG Law or a third party (purpose III).

• If HVG Law processes personal data based on the legal basis ‘legitimate interest’, HVG Law assesses whether the impact on your interests and rights and freedom overrides HVG Law’s legitimate interests prior to the processing. If you wish to receive further information on the balancing of interests by HVG Law, please contact us. Our contact details are listed in paragraph 9 of this Privacy Statement.

Business relations

HVG Law collects and processes the following categories of personal data:

• contact information: name (including prefix), title, position, telephone number, website, email address, company address, and other company and contact information;
• correspondence and other communications: procedural documents, letters, email messages, telephone notes and other communications; and
• other information: data that we obtain from clients or third parties or from public sources for the handling of a case.

HVG Law processes the aforementioned personal data for the following purposes:

1. to communicate with third parties; and
2. to offer and perform our legal services to clients.

HVG Law processes the aforementioned personal data based on the following legal basis:

• the processing is necessary for the purposes of the legitimate interests pursued by HVG Law or a third party (purposes I and II). If HVG Law processes personal data based on the legal basis ‘legitimate interest’, HVG Law assesses whether the impact on your interests and rights and freedom overrides HVG Law’s legitimate interests prior to the processing. If you wish to receive further information on the balancing of interests by HVG Law, please contact us. Our contact details are listed in paragraph 9 of this Privacy Statement.

Website visitors

HVG Law collects and processes the following categories of personal data:

• contact information (for example, in case of newsletter registration): name (including prefix), title, position, telephone number, , website, email address, company address, and other company and contact information;

• correspondence and other communications: letters, email messages, telephone notes and other communications;
• technical data of the equipment used to visit the website, such as IP address, MAC address and software used; and
• cookies: technical and functionality cookies. For more information about cookies and our cookie statement, please refer to paragraph 7 of this Privacy Statement.

HVG Law processes the aforementioned personal data for one or more of the following purposes:

1. to provide relevant information to our website visitors (including offering newsletters, legal updates and updates regarding our events);
2. to communicate with website users/visitors; and

III.      to enable the proper functioning of our website.

HVG Law processes the aforementioned personal data based on of the following legal basis:

• the processing is necessary for the purposes of the legitimate interests pursued by HVG Law or a third party (purposes I through III). If HVG Law processes personal data based on the legal basis ‘legitimate interest’, HVG Law assesses whether the impact on your interests and rights and freedom overrides HVG Law’s legitimate interests prior to the processing. If you wish to receive further information on the balancing of interests by HVG Law, please contact us. Our contact details are listed in paragraph 9 of this Privacy Statement.

Alumni

HVG Law collects and processes the following categories of personal data:

• contact information: name (including prefix), title, (new) position, telephone number, and email address.

HVG Law processes the aforementioned personal data for one or more of the following purposes:

1. to maintain contact with HVG Law alumni (for example through newsletters); and
2. to invite HVG Law alumni to our events and to have them participate in our events.

HVG Law processes the aforementioned personal data based on of the following legal bases:

• the HVG Law alumnus has consented to the processing of his or her personal data (purpose I and II); and
• the processing is necessary for the purposes of the legitimate interests pursued by HVG Law or a third party (purposes I and II). If HVG Law processes personal data based on the legal basis ‘legitimate interest’, HVG Law assesses whether the impact on your interests and rights and freedom overrides HVG Law’s legitimate interests prior to the processing. If you wish to receive further information on the balancing of interests by HVG Law, please contact us. Our contact details are listed in paragraph 9 of this Privacy Statement.

Event participants

HVG Law collects and processes the following categories of personal data:

• contact information: name (including prefix), title, position, telephone number, email address, company address, and other company and contact information; and
• possible photographs and image and sound recordings of the event (for physical events).

HVG Law processes the aforementioned personal data for one or more of the following purposes:

1. to invite visitors to our events and to have them participate in our events; and
2. to take atmospheric images during the event for publication.

HVG Law processes the aforementioned personal data based on of the following legal bases:

• the visitor of the event has consented to the processing of his or her personal data (purpose I and II); and
• the processing is necessary for the purposes of the legitimate interests pursued by HVG Law or a third party (purposes I and II). If HVG Law processes personal data based on the legal basis ‘legitimate interest’, HVG Law assesses whether the impact on your interests and rights and freedom overrides HVG Law’s legitimate interests prior to the processing. If you wish to receive further information on the balancing of interests by HVG Law, please contact us. Our contact details are listed in paragraph 9 of this Privacy Statement.

Visitors to HVG Law and EY offices

Please note that Ernst & Young Nederland B.V. (EY) is the controller with regard to the processing of personal data of visitors of the HVG Law and EY offices and the use of the surveillance cameras to secure her offices.

More information on the processing of personal data of visitors of the HVG Law and EY offices and the use of the surveillance cameras can be found in the ‘General Privacy Statement EY Nederland’ and in the ‘Privacy Statement Camera Surveillance’.

2. RETENTION PERIODS

HVG Law will not retain your personal data for any longer than necessary for the purposes described above. In some cases, HVG Law is forced to comply with a legal obligation, as a result of which personal data must be retained for a longer period of time. For example in the case of our statutory obligation to keep records:  certain personal data must be kept for a period of at least seven years after the end of a tax year. We may also need to retain some personal data in our files for a longer period of time if an (expected) dispute or (legal) proceedings are involved.

HVG Law also applies retention periods that are not subject to a legal retention period. For example, personal data of job applicants will be retained for a maximum of four weeks after the end of the application process, unless the job applicant provides consent to retain his or her personal data longer. If a job applicant provides consent, HVG Law will retain the personal data for a maximum period of two years.

For more information about our retention periods, please contact us using the contact details mentioned in paragraph 9 of this Privacy Statement.

3. TRANSFER OF PERSONAL DATA TO THIRD PARTIES

If HVG Law uses the services of third parties with which it has a strategic alliance and/or other suppliers, such as EY, HVG Law transfers your personal data – where necessary – on to these third parties. For example, HVG Law uses different types of IT suppliers, Recruitee B.V. as part of the application procedure, Validata Group B.V. to assess if a (potential) applicant is suitable to work at HVG Law and Three Hearts Digital Ltd. (EmailOctopus) to send external newsletters.

In order to provide you with our legal services in the best possible way, you agree that your personal data may be used in countries outside the European Union and that your personal data may be exchanged with third parties established in countries outside the European Union engaged by HVG Law. For the purposes as specified in this Privacy Statement, your personal data may be shared between our offices in the United States of America (Donahue & Partners LLP, located in New York, San Jose and Chicago). Please click here for the privacy statement of Donahue & Partners LLP.

HVG Law has taken extensive technical and organisational measures to protect your personal data and only discloses these personal data to third parties with similar standards of technical and organisational measures. Please contact us using the contact details mentioned in paragraph 9 of this Privacy Statement if you prefer receiving the transfer mechanisms that are being used.

Under no circumstances HVG Law provides your personal data to third parties for commercial purposes. Only if HVG Law is legally required to do so HVG Law provides your personal data to regulatory authorities, tax authorities and investigative authorities. In all cases, HVG Law takes appropriate measures to ensure the confidentiality and security of the data as much as possible.

4. SECURITY

HVG Law has taken appropriate technical and organisational measures to protect your personal data against loss or any other unauthorised use. Those who have access to your personal data on behalf of HVG Law have a duty of confidentiality, including the obligations prescribed by the applicable code of conduct and professional rules.

5. SOCIAL MEDIA

HVG Law has profile pages on various social media channels, that is LinkedIn, Instagram, Facebook, YouTube and Twitter. The HVG Law website contains links to these social media channels and these social media channels could collect information about you. HVG Law is not responsible for the content or activities on the websites of these third parties. We recommend that you consult the privacy statements of these social media channels.

6. YOUR RIGHTS

You have a number of rights with regard to your personal data and the processing thereof:

• the right to a confirmation from HVG Law that your personal data are being processed or not, and in the event that they are processed, the right to access your personal data and additional information about the processing of your personal data;
• the right to rectification of your personal data, for example if your personal data are not accurate;
• in certain cases the right to request HVG Law to delete your personal data, for example when your personal data is no longer necessary for the purposes for which the personal data are collected or otherwise processed, if you withdraw your consent (when consent is the legal basis for processing) of if the personal data are unlawfully processed;
• in certain cases, the right to a confirmation from HVG Law of a restriction on the processing of your personal data, for example because you contest the accuracy of your personal data;
• the right to receive, at your request, the personal data that you have made available to HVG Law in a structured and commonly used electronic format and the right to transfer these personal data to another controller, where the processing is based on your consent or on an agreement;
• the right to object to the processing of your personal data based on legitimate interests of HVG Law. When you object, HVG Law no longer processes your personal data unless HVG Law demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or when it is necessary for the establishment, exercise or defence of a right in legal proceedings;
• when personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for marketing purposes. In that case, HVG Law no longer processes your personal data for such purposes;
• the right not to have a decision based solely on automatic processing including profiling, which has legal consequences or affects you in a far-reaching way; and
• the right to withdraw your consent at any time (if consent is the basis for the processing). If you have applied for a job at HVG Law, you can withdraw your consent for the retention of your personal data for more than four weeks after the end of the application procedure by using the link at the bottom of the confirmation e-mail of your application. Withdrawal of consent has no retroactive effect. This means that consent no longer applies from the time of withdrawal.

These rights are not absolute. There may be circumstances in which HVG Law cannot (fully) implement your request as a data subject. This includes the confidentiality obligation of attorneys. As regards requests for the deletion of personal data, it should be taken into account that HVG Law will not grant such a request if it is incompatible with the mandatory statutory retention periods of HVG Law.

If you wish to exercise any of the above rights, please contact us using the contact details mentioned in paragraph 9 of this Privacy Statement. The information provided is in principle free of charge. You may exercise these rights at reasonable intervals.

We will respond to your request within one month, unless this is not possible due to the complexity of your request or the number of requests submitted. In such a case, we will inform you no later than within one month and extend our period to respond by a maximum of two months. If a request is granted by HVG Law, HVG Law implements the decision to correct, change, delete and/or transfer the personal data as soon as possible.

In addition to the aforementioned rights, if you are dissatisfied with the way in which we process your personal data, handle your request or any other complaint, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens; AP), post office box number 93374, 2509 AJ The Hague, the Netherlands. For more information, please visit the AP website at https://autoriteitpersoonsgegevens.nl.

7. COOKIE POLICYSTATEMENT

A cookie is a small unit of information that is transmitted by your browser when you are on the HVG Law website. In some cases, HVG Law uses cookies to ensure that the use of the HVG Law website is as efficient as possible. If you do not want HVG Law to use cookies with your browser, the settings on your browser can be adjusted so that the cookies are deactivated. This may affect the ease of use of the HVG Law website.

The HVG Law website automatically generates log files that record your use and that of other users. HVG Law keeps records of user data, such as a source address of the pages requested, IP (internet protocol) addresses and domain names, dates and number of requests for a page, links from their own websites and other parameters in the URLs (universal resource locators). These log files and data will be used for statistical purposes and for improving the services offered by HVG Law.

For more information about our cookie statement, click here.

8. CHANGES TO THE PRIVACY STATEMENT

We update this Privacy Statement from time to time. We therefore recommend that you consult it regularly so that you are aware of any changes. We will notify you of significant changes to this Privacy Statement, such as changes in the purposes of processing and changes in the way you can exercise your data subject rights. This Privacy Statement was last amended in February 2024.

9. QUESTIONS AND CONTACT DETAILS

If you have any questions about this Privacy Statement, how we process your personal data or if you wish to submit a request to exercise your rights as referred to above in paragraph 6 of the Privacy Statement or if you have any other privacy related questions, please contact the Data Protection Officer of HVG Law B.V. Mrs S.E.A. Vermeer-de Jongh at [email protected] or by telephone +31 88 40 70103. You can also send a letter to HVG Law, for the attention of Mrs S.E.A. Vermeer-de Jongh, post office box 7925,1008 AC Amsterdam. Our Data Protection Officer is available to investigate your question or complaint and to inform you about how your question or complaint will be dealt with.