Our privacy notice
This privacy notice was last updated 24 March 2023. In this privacy notice, you will find information about how we process your personal data. The purpose of the notice is to provide you with information about Wikborg Rein Advokatfirma AS' ("Wikborg Rein" or "we") responsibility for processing as a data controller, and the rights you have as a data subject (section 1). The privacy notice applies to our processing of personal data related to assignments of legal assistance and services (section 2.1), marketing activities (section 2.2), social media (section 2.3), recruitment (section 2.4) and use of wr.no (section 2.5).
1.1 Wikborg Rein's responsibility for processing
Wikborg Rein Advokatfirma AS is committed to processing your personal data in a safe and secure manner, and in line with Regulation (EU) 2016/679 ("GDPR"). Personal data is any information that can be linked to individuals.
We act as data controller for the personal data that we process about clients, contact persons at clients and other parties, contact persons at collaborators and suppliers, participants at events, recipients of newsletters, users of wr.no and services, job seekers and visitors to our pages on social media (collectively, the "data subjects").
1.2 Your rights as a data subject
As a data subject you have, with certain reservations, the right to:
- request confirmation from Wikborg Rein as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and information about the processing of personal data;
- request any inaccurate personal data about yourself to be rectified without undue delay, and to have incomplete personal data completed;
- request the erasure of your personal data;
- request Wikborg Rein to restrict the processing of your personal data;
- obtain from Wikborg Rein a copy of personal data concerning you that you have provided to us and request the transfer of these data to another controller without Wikborg Rein's hindrance;
- object to the processing of personal data concerning you;
- withdraw your consent given to us for the processing of your personal data.
As a law firm, however, we are subject to strict legal requirements, including confidentiality and archiving obligations, which can and will limit your above-mentioned rights as a data subject.
To exercise your rights, you can contact us, see section 1.4.
You also have the right to complain about the processing to the relevant supervisory authorities, which in Norway is the Norwegian Data Protection Authority (Nw: Datatilsynet). The Norwegian Data Protection Authority can be contacted by phone +47 22 39 69 00 and at the e-mail address email@example.com.
1.3 Changes to the privacy notice
We may update this privacy notice due to changes in the law or in our practices or when necessary for other reasons. You should, therefore, familiarize yourself with the content of the privacy notice at regular intervals.
1.4 Contact us
If you have questions about how we process your personal data, wish to exercise your rights mentioned above in section 1.2 or have other inquiries, you are welcome to contact us.
2. When do we process your personal data?
2.1 Assignments of legal assistance and services
2.1.1 Our processing of personal data
When Wikborg Rein carries out assignments of legal assistance and delivers legal services, we are the data controller for all personal data we process in this context. Data subjects are clients and their contact persons, parties and other third parties who are referred to in case documents. About these, we typically collect the following categories of personal data:
- Contact information such as name, address, job title and other contact information.
- Identification documents.
- Billing and payment information.
- Case information, various information about individuals with connection to the case, including counterparties.
In some assignments of legal assistance, we process special categories of personal data (e.g., in insurance and employment law cases) and information about criminal convictions and offences (e.g., in cases about financial crime.
2.1.2 Purpose and basis of the processing
Wikborg Rein processes personal data for the following purposes on the following basis:
- Independence and KYC verification when establishing client relationships. When establishing the client relationship, we investigate whether the assignment involves a conflict of interest for Wikborg Rein. In addition, we carry out KYC verifications in accordance with the money laundering regulations, which means that we obtain identification documents about the client or the client's ultimate beneficial owners. For private clients, we process, among other things, Norwegian national identity number (Nw: fødselsnummer) and address in connection with customer checks. The basis for this processing is that we are legally obliged to carry out these investigations.
- Administration of the client relationship. When we accept an assignment of legal assistance, we register the client's contact information, typically information about the client's contact person. The basis for this is our legitimate interest in being able to communicate with the client. When the client is a private person, the processing is necessary for the performance of a contract.
- The performance of the assignment of legal assistance. In connection with the performance of the assignment, we typically process personal data about the client or the client's counterparty, the counterparty's lawyers and other individuals with connection to the case, for example information that appears in the case documents. For personal data about private clients, the basis for the processing is that it is necessary to fulfil the agreement. Furthermore, we have a legitimate interest in processing personal data about other people because it is necessary to carry out the assignment of legal assistance. To the extent that the assignment involves processing of special categories of personal data about criminal convictions and offences, our basis for processing is that the processing is necessary to establish, enforce or defend legal claims or that the personal data has been made public by the data subject. If these grounds are not sufficient, we obtain consent from the data subject.
- Invoicing. We process contact information about business clients and private clients in order to be able to send invoices for the work that has been carried out. The basis for this is that processing is necessary to fulfil the agreement for private clients, and for business clients, we have a legitimate interest in being able to send an invoice to the business's contact person.
- Knowledge management. We can use de-identified documents from previous cases to prepare templates and other standard documentation for internal use. The basis for this is our legitimate interests in ensuring the professional quality of our services and advice, the opportunity for competence development and cost-effective legal advice.
2.1.3 Sharing of personal data with third parties and transfer of personal data
Lawyers have a duty of confidentiality regarding all information they gain access to in connection with legal practice, and all employees of Wikborg Rein are subject to a duty of confidentiality. Within the framework of the duty of confidentiality, we share information when it is necessary to fulfil statutory requirements or for the operation of the law firm with, among others, the following actors:
- Counterparties, witnesses, other involved parties, courts or public bodies, for example supervisory authorities, among others, through "Aktørportalen".
- Our suppliers of IT and administrative services, for example systems for communication, case management, document processing, KYC/Client onboarding, ERP, IT infrastructure and operation. We always enter into necessary data processing agreements with suppliers when these process personal data on behalf of Wikborg Rein.
If the circumstances of the case require it, we may transfer your personal data to countries outside the EU/EEA, for example to our offices in Shanghai and Singapore. For the sake of good order, it is noted that we have separate systems in the various countries, and documentation from a case in Norway will therefore not be given access outside the EU/EEA unless the circumstances of the case require it. Where the sharing of personal data with third parties involves the transfer of personal data, we ensure that the personal data is afforded a level of protection that is equivalent to that guaranteed within the EU/EEA, including by entering into agreements based on the European Commission's standard contractual clauses and by implementing relevant supplementary measures.
2.1.4 Retention and deletion
We archive the case documents after we have carried out the assignment of legal assistance. The basis for this is that we have a legal obligation to do so, in addition to the fact that we have a legitimate interest in meeting the client's needs or in connection with future legal proceedings. How long we retain the personal data and documents depends on the type of documents in question:
- Case documents. We retain physical and electronic documents related to the assignment of legal assistance for at least 10 years, and as a rule all case documents are deleted after 20 years if an assessment of the documents or the type of assignment indicates a need for a longer storage period, e.g. in case of long term contractual relationships, testaments and so on. After 10 years, access to the case is limited and will only be available to the CEO and the partner responsible for the case.
- Invoicing documentation and documentation related to KYC. We retain invoicing information and personal data related to customer check in accordance with statutory requirements in Section 13 of the Bookkeeping Act (Nw: bokføringsloven) (3,5 or 5 years) and Section 30 of the Anti-Money Laundering Act (Nw: hvitvaskingsloven) (5 years).
2.2 Marketing and events
2.2.1 Our processing of personal data
We collect personal data in connection with marketing, courses, seminars, other events and newsletters, as well as other information about our services and activities, and to answer inquiries. Data subjects are employees of our clients, participants in events and others who sign up for our newsletter or otherwise approach us with an enquiry. In this respect, we process personal data such as:
- Basic contact information such as name, e-mail address and phone number.
- Job title and place of work, possibly year of study and place of study for students.
- Allergies and food preferences if we serve food at our events.
- Areas of interest when you tick which areas of interest you wish to receive newsletters about.
- Picture(s) of participants if we take pictures or videos at events etc.
- Other information that we receive when someone makes an inquiry, or which is necessary to follow up on such inquiries.
2.2.2 Purpose and basis of the processing
- Marketing inquiries, newsletters and invitations to events. We send information to clients and other parties concerned to follow up, to inform about news and our services and to invite to events. When we send information to clients with whom we have an existing customer relationship, the basis is our legitimate interest in following up the customer relationship. In all other cases, we obtain your consent before we send you marketing-related information. For more information about our newsletter, how to sign up, unsubscribe etc., see [link to the disclaimer text for newsletters].
- Registration for events. In connection with registration for our events, we consider that we have a legitimate interest in processing personal data in order to manage and plan the event.
- Publication of photos and videos. In those cases where we take photos or videos at events organized by Wikborg Rein, we follow Section 104 of the Copyright Law (Nw: åndsverkloven) on the right to one's own photos before we publish any photos. We will, therefore, ask for consent before we publish a photo where a person, and not the event itself, is the main focus. If you have consented, but later wish to withdraw your consent, you can contact us via e-mail.
2.2.3 Sharing of personal data
22.214.171.124 Sharing of personal data with co-organizers for events
We carry out some events (seminars, lectures etc.) in collaboration with co-organisers. In such cases, we may share your contact information with co-organizers and these may send you newsletters and other marketing inquiries on behalf of Wikborg Rein. If you have given consent to receive newsletters and other marketing inquiries, the consent will also include the sharing of information with co-organisers.
126.96.36.199 Use of sub-processors
In some cases, suppliers; for example IT suppliers, marketing companies, providers of customer satisfaction surveys, issuers of newsletters etc., will process personal data on our behalf. Wikborg Rein always enters into necessary data processing agreements in these cases.
2.2.4 Retention and deletion
We delete your personal data related to marketing and events when they are no longer necessary for the purpose for which they were collected. When we process personal data in relation to existing customer relationships, we delete these data when the customer relationship ceases to exist. When we process personal data in relation to events and seminars, we delete these data as soon as possible after the event. The personal data that we process on the basis of your consent to receive newsletters, we delete when you withdraw your consent,
2.3 Social media
2.3.1 Our processing of personal data
Wikborg Rein uses Facebook and Instagram (Meta) and LinkedIn. Wikborg Rein and Meta are joint data controllers for the the following processing activities on our company pages on the Meta platforms: collection of personal data about persons who visit and interact with our company pages, processing to generate aggregated statistics for activities on our company pages, as well as processing of data for the provision of information to the users of the platforms through targeted dissemination. Similarly, we are joint data controllers with LinkedIn. Data subjects are visitors to our company pages, whether the visit is done via a user account or other type of log-in function, or without such an account or log-in function.
Through these channels, we typically process following personal data:
- name, user name and other visible information about people who visit and interact with our pages on social media.
- Information we receive through your interaction with us, including through likes, comments and messages we receive on the various platforms.
- Other available information about browsing behaviour, preferences etc.
Please be aware that additionally, Meta and LinkedIn process your personal data for their own purposes. Wikborg Rein is not responsible for Meta and LinkedIn's processing of personal data for their own purposes. You can limit Meta and LinkedIn's collection of personal data by changing the settings in your user account on the respective platforms. See Meta's guidelines for privacy here, and LinkedIn's guidelines here.
2.3.2 Purpose and basis of the processing
We process personal data in relation to social media to provide information to and to communicate with users of our pages on social media. The legal basis for this is our legitimate interest in using, managing and optimizing our pages on social media and in developing and strengthening our brand and profile.
2.3.3 Retention and deletion
We delete your personal data when they are no longer necessary for the purpose for which they were collected. You can delete your personal data yourself on our social media or contact us and convey your wish to have the data deleted.
2.4.1 Our processing of personal data
We process personal data about job applicants and other potential candidates, including for positions such as permanent employees, trainees, law students writing their master's thesis etc.
The following data is processed in the recruitment of permanent employees, trainees, law students writing their master's thesis and other employees:
- Contact information such as name, e-mail address, postal address, phone number, job title, employer, place of study and year of study if this is relevant.
- Information about qualifications and interests such as diplomas/transcripts, application, CV, courses, references and information that you provide access to in connection with your application process and interview.
We also process the following information in connection with the recruitment and follow-up of trainees:
- Assessments and evaluations of the applicant which are carried out during traineeship.
2.4.2 Purpose and basis of the processing
The processing of personal data in the recruitment process is necessary to hire the best qualified candidate. The basis for the processing is partly that the processing is necessary to enter into an employment agreement with you, and partly our legitimate interest in ensuring that we select the right candidate.
2.4.3 Sharing of personal data with third parties
In Wikborg Rein, only the HR department and others involved in the recruitment process, i.e. recruiting partners and members of the trainee committee for trainees, have access to information about you when you apply for a job with us. Our suppliers of systems for IT, HR and communication process personal data on our behalf. We always enter into necessary data processing agreements with these suppliers.
2.4.4 Retention and deletion
You can delete your personal data in CVideo at any time. It is your responsibility to delete your user profile, but applications are automatically deleted after 2 years if they are submitted after the start of 2022. 6 months after submitting an application, you will receive a reminder from CVideo that you have applications in the system, so that you can delete these if you wish.
Personal data about trainees is kept for 3 years after the last traineeship if the relevant candidate has consented to this. The reason for this is that the information may be relevant andnecessary for later recruitment of the candidate in question. Evaluations and other surveys of trainees are stored in Netigate and deleted automatically after 3 years.
2.5 Users of wr.no
2.5.2 Purpose and basis of the processing
- Strictly necessary cookies. These are cookies we must use for the various services on our website to function. These are the only cookies we use that you cannot opt out of in our cookie banner.
- Functionality. These are cookies that help us store information that changes the way the website looks or behaves.
- Analysis and statistics. These are cookies that help us understand how visitors use our websites.
- Marketing. These are cookies that we use to track your activity across websites, in order to show you advertisements that are relevant and interesting to you.
More information about the purpose and retention period for each individual cookie can be found under "details" in our cookie banner at the bottom left side of wr.no.
2.5.3 Retention and deletion
Information about the retention period for each individual cookie can be found under "details" in our cookie banner at the bottom left side of wr.no.
2.5.4 Do you have questions?