Lakiasiaintoimisto Lawely Oy (”Lawely”)
Business ID: 3110195-5
Address: Hollantilaisentie 36 A, 00330 Helsinki, Finland
Data Protection Officer
Sari Leppikangas c/o Lakiasiaintoimisto Lawely Oy
Telephone: +358 (0) 504226068
Lawely complies with the EU’s General Data Protection Regulation 679/2016 when processing personal data.
Collection of personal data
Personal data can be collected in different ways. As a general rule, Lakiasiaintoimisto Lawely Oy collects and processes personal data that:
- the client has given Lawely when registering as a customer, accepting the assignment or during the assignment; or
- arises from material relating to the execution of the assignment and may have been obtained from the client, the counterparty or a third party:
- Such information includes, for example, sales contracts and other sales material, expert reports, minutes of the Annual General Meeting and the Board of Directors, correspondence between the parties, estate inventory deeds, division of assets deeds, contracts, judgments, pre-trial records, official documents and accounting material. Such material can also be from experts in different fields, from the liquidator or distributor of the estate or from other similar persons who are consulted in order to clarify the matter.
- arise from public registers, such as the Trade Register, the Population Information System, the Business Information System or the address information service of the Digital and Population Data Services Agency.
Lawely collects and processes, for example, the following categories of personal data:
- basic information (e.g. name, personal identification number and contact details)
- necessary for the execution of the assignment depending on the nature of the assignment.
- For example, information necessary for family and inheritance law assignments include information about family and relatives, property, previous divisions of assets and distributions of inheritance, gifts and preheritances. The information required varies depending on the nature and scope of the assignment.
- The information necessary for assignments related to housing and construction includes, among other things, information on trade between the parties and its terms, information related to the person’s housing, such as renovations, information about the management of the property or apartment, property information, and information about the decisions of the Board of Directors and the Annual General Meeting. The information required varies depending on the nature and scope of the assignment.
- Employer information, such as the name of the employer, the start and end dates of the employment relationship, the position of the person in the company, wage information and the grounds for termination, is necessary information for labour law assignments. The information required varies depending on the nature and scope of the assignment.
- For example, information about a person’s assets and solvency is necessary for corporate reorganisation. The information required varies a lot depending on the nature and scope of the task.
- A list of measures taken to execute the assignment, as well as billing and payment information.
- Information necessary for the collection of Lawely’s and the customer’s claims, as well as information regarding the legal capacity and credit information of a person, determined in a manner permitted by law.
- Insurance information necessary for the execution of the assignment, such as information on the commissioner’s liability or legal expenses insurance.
- Information necessary for the determination of incapacities, also in the absence of an assignment relationship. In this case, the name of the person who initiated the contact, the name of the counterparty and the issue at hand (for example, the identity of the property or apartment transaction, a brief explanation of the subject matter of the dispute or consultation request) are retained.
Personal data is collected from the data subject himself/herself, for example, when the data subject uses the data controller’s services. Personal data can also be collected from the data subject’s terminal devices using cookies or other similar technologies. We also collect data to improve the user experience.
Obtaining personal data is a prerequisite for opening a customer relationship.
Purpose and legal basis of the processing of personal data
Lawely processes personal data for the following purposes:
Lawely processes personal data necessary for the performance of assignments or mandatory tasks, or for agreeing on an assignment relationship and checking for incapacities.
Lawely may process the personal data of a data subject in order to comply with statutory obligations, e.g. regarding accounting, or to fulfill requests for information from authorities (e.g. tax authorities) based on legislation.
Lawely processes personal data to improve the user experience and to implement targeted marketing.
The collection and processing of personal data is based, in principle, on the consent of the customer. In connection with mandatory tasks and the personal data of a counterparty and witnesses, the processing of the information shall be based on legitimate interest.
To the extent that the information has been collected for the purpose of agreeing on the assignment relationship, for example, when a data subject makes contact via the contact form on Lawely’s website, the processing of the data to the extent necessary is based on consent until the assignment relationship has been established. Such information may be retained for the necessary period of time to determine any incapacities, also in the absence of an assignment relationship. To the extent that the data is processed in order to identify any incapacities, there is a legitimate interest.
Customer identification data and other personal data may be used for the prevention, disclosure and investigation of money laundering and terrorist financing, as well as for the investigation of the offence by which the property or criminal proceeds subject to money laundering or terrorist financing was obtained (Act on Preventing Money Laundering and Terrorist Financing 444/2017).
Transfers of personal data
Lawely may disclose personal data to third parties as follows:
- to the counterparties of the assignment, experts and witnesses, as well as a court and authorities, to the extent necessary for the performance of the assignment or task;
- to the extent permitted or required by law, to execute a request for information made by a competent authority, or to disclose information for the purposes of legal proceedings;
- when Lawely’s partners, such as IT system service providers or accountants, process personal data on Lawely’s behalf in accordance with Lawely’s instructions. Lawely will ensure the proper processing of personal data;
- where Lawely considers that disclosure is required, according to legislation, for the exercise of Lawely’s rights, for investigating abuses or for responding to a request from an authority;
- to insurance companies for the purpose of claiming insurance payments and invoicing the insurance company.
Transfers of personal data 0utside the EU of EEA
Data will not be disclosed outside the EU, the European Economic Area or countries identified by the European Commission as having an adequate level of data protection, unless an adequate level of data protection has been ensured by agreements or otherwise in ways required by law or in accordance with the EU General Data Protection Regulation (679/2016).
Retention of personal data
Lawely will retain the information obtained in the performance of the assignment or mandatory task for 10 years from the completion of the assignment or task.
Lawely will also retain the information required to check incapacities for more than 10 years, if necessary. Such information shall include the name of the person, the name of the counterparty and the matter at hand (e.g. identification information of the property or apartment transaction, a brief description of the subject matter of the dispute or request for consultation) and a list of the measures taken.
If the retention of personal data is based on an agreement, such as the fact that the customer and Lawely have entered into an agreement on the retention of a will document or power of attorney, Lawely will retain the document for as long as it is necessary or disclosed as explained above, or if the agreement ends due to termination by the customer.
Personal data shall be deleted when their retention is no longer necessary for the fulfillment of legislation or the rights or obligations of either party.
Personal data will be destroyed in a secure manner.
Register data sources / regular data sources
Customer related information is collected from the customers themselves through electronic and/or paper customer information forms and agreements in connection with the customer relationship, in customer service and otherwise directly from the customer. Lawely may also collect customer information from public registers, such as the Digital and Population Data Services Agency, the Trade Register, Suomen Asiakastieto Oy or other reliable parties, as appropriate. Lawely may collect customer information from registers kept by authorities to the extent permitted by law.
Principles of registry protection
Lawely complies with the legislation and official regulations and guidelines regarding the processing and protection of personal data. Personal data is processed only by persons expressly appointed by Lawely who need the data stored in the register in order to manage a customer or service relationship or to ensure internal risk management. Lawely has provided instructions for the use of the register. The user of the register shall be identified, and the access rights and their registration shall be carefully monitored.
- The information is stored in a locked storage or fire safety cabinet at Lawely’s site, accessible only to Lawely’s personnel.
- The processing of personal data requires a personal username and password, which are only given to expressly specified persons. In this way, it is possible to monitor who processes the data and how the data is processed. If the information is changed, it leaves an electronic trace with information about the time of the change and the modifier. Two copies of the electronic material are stored and protected by firewalls and antivirus software.
Rights of the data subject
The data subject has the right to know whether Lawely processes their data and, if so, the right to have their personal data checked.
The data subject has the right to check the data concerning them in the register. If the data subject wishes to verify their personal data, they shall submit a written and signed request to the controller or submit the request in person to the controller. In principle, the verification of data is free of charge. The controller shall provide the data subject with the requested information or arrange for access without undue delay.
The obligation of professional secrecy and confidentiality may restrict the provision of information and give the right to refuse, in whole or in part, the right of inspection.
The data subject has the right to request rectification or clarification of incorrect or inaccurate data or to restrict the processing of personal data, taking into account the intended use of the data. If, for example, the information in the register is out of date, incomplete, incorrect or unnecessary, the data subject has the right to request that the information concerning them be corrected. The request for rectification must be made in writing and in sufficient detail and sent to the address indicated. Lawely shall, on its own initiative and without undue delay, rectify any incorrect, unnecessary, incomplete or outdated personal data that it observes. The data subject also has the right to require that the controller restrict the processing of their personal data, for example, when the data subject waits for the controller’s reply to a request for rectification or removal of their data.
To the extent that the data subject has submitted to the register information that is processed with the consent of the data subject, the data subject shall have the right to receive such information, as a general rule, in a machine-readable format and to transmit it to another controller.
The data subject has the right to request the deletion of their personal data if the data is no longer needed for the original purpose, the processing of personal data is based on a consent which the data subject withdraws, the data subject exercises their right of objection under Article 21 of the Data Protection Regulation, the personal data has been unlawfully processed or the personal data must be deleted in order to comply with a legal obligation.
The data subject always has the right to withdraw their prior consent to the processing of their personal data. However, the withdrawal of consent shall not affect the processing of personal data in order to fulfill Lawely’s legal obligations.
According to Article 17 (3) of the GDPR, the right to be forgotten does not apply, for example, where processing is necessary for the establishment, prevention or defence of a legal claim. Consequently, the data subject shall not have the right to have their personal data erased for a period of 10 years from the end of the assignment or mandatory task, or for a longer period if the request concerns information that Lawely is required to retain for the purpose of checking incapacities. In addition, if a member of Lawely’s staff has, for example, witnessed a will or other document, the records relating to the witnessing may be retained for longer than 10 years.
The data subject has the right to file a complaint with the competent supervisory authority, for example, if the data subject considers that the controller has not complied with the applicable data protection regulations in its activities.
The data subject shall have the right to prohibit data concerning them from being disclosed to the controller for the purposes of direct advertising, distance selling and other direct marketing, market research and opinion polling, as well as vital records and genealogical research.
The data subject may exercise the above rights by contacting the controller or the controller’s data protection officer.