This privacy notice concerns any processing of personal data Advokatfirmaet Selmer AS (org. number 920 969 798)("us" or "we"). We are controllers for the processing of personal data described in this privacy notice. You will find our contact information in section 9 below. In this privacy notice, you will find information about how we use and protect personal data about you as well as your rights in this regard.
Last updated: 13 November 2023.
This privacy notice describes how we process personal data related to the following data subjects:
i) Contact persons with our business clients
ii) Private clients
iii) Contact persons with our suppliers and partners
iv) Persons involved in or mentioned in cases that we handle
v) Participants on seminars, courses and other events
vi) Job applicants
vii) Persons sending us requests or that in other ways are in contact with us
We have listed the typical purposes for our processing of personal data, the categories of personal data we typically process, and the legal bases for the processing below.
When we are contacted by a potential client requesting our services, we perform a conflict check internally before taking on the engagement. This is required to ensure that we comply with rules of professional conduct for lawyers, including avoiding ending up in conflicts of interest when providing our services. The personal data processed in this relation shall generally be limited to name, position/role and the nature of the engagement.
The legal basis for the processing is provided in the balancing of interest after GDPR Article 6 (1) (f) and Article 6 (1) (c) (our legal obligation according to the rules of ethical behaviour for lawyers in Code of Conduct for Norwegian Lawyers of 20th December 1996 nr. 1161).
Where necessary pursuant to the Norwegian Money Laundering Act, we will perform a background check of our clients when the client relationship is established. For this purpose, we use authentication functions such as passport information, eID or BankID, and we may conduct database searches. The basis for conducting such a money laundering check is provided in the GDPR Article 6 (1)(c) (legal obligation).
If we take on the assignment, we will register the client’s contact details in our systems. For business clients, we primarily register the name, telephone number and e-mail address of contact persons. The basis for such processing is provided in the GDPR Article 6 (1)(f), balancing of interests, where our interest is entering into an agreement with the client, following up this agreement and communicating with our client. Correspondingly, we will for any private clients register name, telephone number, address and e-mail address. The basis for such data processing is provided in the GDPR Article 6 (1)(b) (contract).
We will not be able to undertake the assignment without receiving the personal data mentioned above.
In carrying out legal assignments, we can process personal data about the parties in a case or other persons involved in the case, for example employees and owners of the client’s business or the opponent’s business, witnesses and the opponent’s advisors or lawyers. Such personal data may appear in documents and correspondence (such as letters, e-mails, pleadings, memos, agreements and minutes) prepared or received by us in connection with the case.
The basis for processing of personal data in connection with assignments for business clients is provided in the GDPR Article 6 (1)(f), balancing of interests, where our interest is in providing services to our clients. The legal basis in connection with processing of personal data about private clients is provided in the GDPR Article 6 (1)(b) (contract).
In our handling of cases, we occasionally gain access to sensitive personal data, such as health information in employment matters or information concerning violations of the law in matters of financial crime. The legal basis for such processing is provided in the GDPR Article 9 (2)(f) (the processing of such data is necessary to establish, enforce or defend a legal claim), cf. the Norwegian Personal Data Act, Section 11.
We archive case documents and correspondence after the assignment has ended, in order to be able to retrieve information when necessary, including in connection with a subsequent court case or other processes. The processing is based on GDPR article 6 (1) (f), balancing of interests, where our legitimate interest is to fulfil our clients' expectations and needs in relation to the storing of the case documents.
If the case documents or correspondence contain special categories of personal data or personal data about criminal convictions or offences, the processing is based on GDPR article 9 (2) (f) (to establish, enforce and defend legal claims), cf. the Norwegian Personal Data Act, Section 11.
We use the contact details we have received from our business clients to mark invoices sent to the client if required by the client. For our private clients, we use the person`s private postal address to send invoices.
The legal basis for such processing of personal data in respect of business clients is provided in the GDPR Article 6 (1) (f), balancing of interests, where our legitimate interest is to fulfil agreements with the business clients. For the corresponding processing in respect of private clients in the GDPR Article 6 (1) (b), the processing is necessary to fulfil the contract with the private client).
We will not be able to undertake the assignment without receiving the personal data mentioned above.
We process personal data about our contact person at our suppliers and partners to administer the contracts and relationship with these entities. We primarily process the name, telephone number and e-mail address of contact persons at the respective parties.
The basis for this processing is provided in the GDPR Article 6 (1) (f), where our legitimate interest is to fulfil our agreements and administering our relationship with suppliers and partners.
We regularly arrange seminars, courses and other events for clients, partners, students and other interested parties. In connection with such events, we sill process personal data about the participants, such as name, e-mail address, telephone number, any food allergies and other preferences, as well as the academic year or which company the participants work for.
The personal data is processed so that we can register the participants enrolment and organise for any allergies or other preferences for the event. The consequences of not providing the personal data are that we will not be able to register your enrolment.
The processing is based on GDPR Article 6 (1) (b), to fulfil our agreement with the participant. To the extent that we process health information, such as food allergies, we will obtain your explicit consent in accordance with GDPR Article 9 (2) (b).
If you send us a job application, we will process personal data in order to assess your application and possibly offer you a position or a traineeship.
In this connection, we process personal data such as CV, diplomas, application texts, certificates and references (provided by you), and any other information that you provide. The consequences of not providing such personal data are that we cannot assess your application.
The processing is based on GDPR Article 6 (1) (b), to take steps at the request of the applicant with the aim to enter into an employment contract. The personal data is obtained from the applicant and from provided references.
We receive requests from students, representatives of businesses or public authorities or from private individuals via e-mail, telephone or in other ways. In connection with such requests, we may process personal data such as name, telephone number, e-mail address, what the requests relates to, and other information provided in connection with the request. The consequences of not providing such personal data are normally that we cannot process and respond to the request.
The processing is based on a balancing of interests according to GDPR Article 6 (1) (f), where our legitimate interest is to be able to respond to and follow up the request.
If the request results in the establishment of a client relationship or a recruitment process, the personal data will be processed in accordance with the information given in the relevant sections above.
We send out newsletters, event invitations and other information by e-mail to contact persons registered in our client database and others who consented to receiving such information.
Any recipients of our newsletter or communication can easily unsubscribe from the service by using the link included in our e-mails.
The basis for sending such e-mails to contact persons at our existing clients is provided in the GDPR Article 6 (1) (f), where our legitimate interest is following up our clients by providing legal news and relevant information about our services, cf. the Norwegian Marketing Control Act, Section 15 (3).
In other contexts, mentioned above, marketing is based on consent from the person concerned, cf. the Marketing Act, Section 15 (1) and GDPR Article 6 (1) (b).
We have pages on social media. In connection with these pages, we process personal data such as your name, your comments, likes or anything else you make available to us via these pages.
The processing is based on a balance of interests according to GDRP Article 6 (1) (f), where our legitimate interest is to manage and have pages on social media in order to easily reach out to customers, students and others.
When preparing templates based on previous advice we have given, we will anonymize any personal. In order to develop and improve our knowledge and competence, we can also use experience from previous cases in our future legal advice.
This processing of personal data is based on a balancing of interests according to GDPR Article 6 (1) (f), where our legitimate interest is to manage knowledge and improve our services
We use the following cookies on our website:
"playIntro" is our cookie and expires within a maximum of five years. On your first visit to our start page, it is stored to ensure the welcome animation is only shown once.
Our suppliers, such as it-suppliers, will process personal data if personal data is stored with the supplier or is otherwise made available to the supplier in accordance with the contract with us. The suppliers act in accordance with the data processing contract and under our instructions. The supplier can only use the personal data for the purposes we have determined, and which are described in this privacy policy.
Lawyers are subject to a duty of confidentiality, c.f. Section 111 of the Norwegian Criminal Code. Any information shared with us in confidence or which we receive in connection with an assignment is handled confidentially.
We share personal data in other cases where there is a sufficient legal basis for this, for example in correspondence with courts, public authorities, opponents and other advisers in order to execute the assignment.
We do not disclose personal data in other cases or in other ways than those described in this privacy policy, unless the client explicitly encourages or consents to this or the disclosure is required by law.
Your personal data may be subject to processing or storage outside the EU/EEA. In such case, we will ensure that your personal data is subject to sufficient security guarantees in line with GDPR Chapter V, usually through the use of the EU`s standard terms for such transfer or by transfer to countries that have been subject to an adequacy decision by the European Commission. Please contact us if you would like more information about this.
We store your personal data as long as it is necessary to fulfil the purposes described in this privacy policy. This essentially means the following:
i) We usually store case information for a period of 10 years.
ii) We store the details of contact persons at our clients for a period of 5 years after the client relationship has ended.
iii) We store information collected for money laundering check purposes for a period of 5 years.
iv) We store invoice information for a period of 5 years.
v) We store the names and e-mail addresses of individuals who have consented to receiving newsletters until such consent is withdrawn. We will ask for a renewed consent if required.
vi) We store personal information about job applicants during the recruitment process. If the applicant is not employed, we will delete the personal data no later than 1 year from the position being filled, unless the applicant has consented to longer storage.
When employed, the personal data in your application documentation will be regulated by the privacy policy that applies to our employees.
Our website (www.selmer.no) may contain links or references to other websites. These websites have their own privacy policies that provide information about how the websites are operated and how personal data is collected and processed. We recommend that you familiarize yourself with the third-party websites` own privacy policies when you visit and use these websites.
When you "like" or become a member of Selmer`s social media profiles, your personal data will be shared with the relevant platform. The same applies to other activity on Selmer`s pages on social media, such as content you post and posts you like. The relevant platform will also be responsible for the personal data it collects and processes. More information about this processing and your rights follows from the individual platform`s privacy policy.
You have several rights under the current privacy regulations. We have provided a list of these rights below. Please do not hesitate to contact us if you wish to exercise your rights. We will respond to your inquiry as soon as possible, generally within one month at the latest.
If you have given consent to receive newsletters from us, you can withdraw this consent at any time. We have made it possible for you to easily make a reservation against this type of inquiry though a link in each individual inquiry. If you have consented to other processing of personal data, you can also withdraw your consent at any time by contacting us.
You have the right to access the personal data we process about you, if the duty of confidentiality does not prevent this. In order to ensure that personal data is handed over to the right person, it may be required that a request for access is made in writing or that identity is verified in another way.
You have the right to request that we rectify any incorrect personal data about you or erase personal data about you. We will as far as possibly accommodate a request to delete personal data, but we can not do this if there are compelling reasons not to delete it, for example that we must store the personal data for documentation purposes.
In some cases, you can require that we stop processing your personal data:
i) If you claim that your personal data is incorrect, you can request that the processing of your personal data is restricted while we check the accuracy of the personal data;
ii) If the processing of your personal data is illegal, you can demand that the processing of the personal data is restricted instead of the personal data being deleted;
iii) If we no longer need your personal data to achieve the purpose of the processing, you can demand that the processing of the personal data is limited; and
iv) If you object to the processing of your personal data in line with section 6.5 below, you can demand that we limit the processing of the personal data while we verify whether we have compelling legitimate reasons for the processing.
You have the right to object to the processing of your personal data for marketing purposes at any time. You also have the right to object to the processing of personal data about you based on GDPR Article 6 (1) (e) or (f), for reasons related to your particular situation. Unless we can prove that there are compelling legitimate reasons for the processing that take precedence over your interest, rights and freedoms or to establish, enforce or defend legal claims, we will no longer process the personal data.
In some cases, you can have a general right to request transfer of your personal data in a common, machine-readable format to another law firm or to other controllers. If it is technically possible, we can transfer the personal data directly to the other company.
If you wish to complain about our processing of your personal data, you can contact us using the contact information in section 9 or submit a complaint to the Norwegian Data Protection Authority.
We have implemented technical and organisational security measures in order to ensure that we handle personal data in a secure manner. We perform regular assessments of the security of all of our systems used for the handling of personal data, and have entered into agreements instructing the suppliers of such systems to ensure an adequate level of data security.
We will amend this privacy statement from time to time. You will always be notified if we make any significant amendments. We will obtain or update consents when necessary. The most up-to-date version of our privacy statement is available on our website.
Please contact us if you have any questions or comments or if you wish to exercise your rights. Our contact details are as follows:
Advokatfirmaet Selmer AS
P.O. Box 1324 Vika, NO-0115 Oslo, Norway
Tel.: +47 231 16 500
E-mail: selmer@selmer.no