Privacy notice – Philippe & Partners

1. Who collects your personal data?

The law firm Philippe & Partners, grouping its offices in Brussels, Liège, Mons, Luxembourg, Düsseldorf, London and Paris (for more information about our locations, see https://philippelaw.eu/fr/contact), collects your personal data on its own behalf, as the controller.

You can reach us via the following contact details:

Philippe & Partners
Chaussée de La Hulpe, 181/9
1170 Brussels
Tel.: 02/250.39.80
Email: privacy@philippelaw.eu

2. What personal data does the firm collect?

The data processed by the firm will depend on your status. The table below summarises the different situations that can occur.

The firm undertakes to do its utmost to collect and process only the data strictly necessary for the proper management of the file. In particular, we would like to draw your attention to the fact that it is important that you also ensure that you yourself only provide us with the information relevant to your case.

Client data and data concerning representatives / agents / insured parties / business partners / families, etc. of clients	Data concerning opponents and persons mentioned in the file	Data concerning lawyers of other firms / judges / legal representatives, etc.	Data concerning (employees and representatives of) suppliers and service providers
The firm is first and foremost a business firm. As a result, the personal data processed is rarely directly related to clients (who are often companies), but rather to persons related to these companies (representatives, employees, insured parties, clients, etc.). However, if you are a private client, the firm will also process personal data directly relating to you and/or your family. With the exception of contact data which is collected in a standardised way for the creation and management of the file (client identification data), the categories of data processed are potentially very varied and will depend to a large extent on the nature of the file entrusted to us by you. As lawyers, we are also likely to process data of a certain sensitivity: data relating to criminal convictions and offences; special categories of data.	To ensure the proper management of a file, it will, in most cases, be necessary to process personal data relating to “opponents” of the firm’s clients as well as to other third parties whose names will be included in the file, whether these third parties are members of his/her family, co-contractors, professional relations, etc. As in the case of clients, the nature of the data concerned will, by necessity, be very varied and will depend very largely on the type of dispute. Similarly, data relating to criminal convictions and offences and special categories of data may also be processed. In some cases, due to professional secrecy, this information will also be processed without the data subject’s knowledge.	In the exercise of his/her functions, the lawyer is necessarily required to be in contact with other actors within the judicial arena: here we think essentially of lawyers of other firms, bailiffs, magistrates and registrars. The personal data processed about these persons is relatively limited: it will include surnames and forenames, titles, professional activity and, in some cases, contact data, as well as partners (in the case of lawyers).	The firm also processes the personal data of the employees of its suppliers and service providers. This data is also relatively limited: it will include the first and last names and contact data of these persons, as well as their professional activity and the company for which they work.

Client data and data concerning representatives / agents / insured parties / business partners / families, etc. of clients

Data concerning opponents and persons mentioned in the file

Data concerning lawyers of other firms / judges / legal representatives, etc.

Data concerning (employees and representatives of) suppliers and service providers

The firm is first and foremost a business firm. As a result, the personal data processed is rarely directly related to clients (who are often companies), but rather to persons related to these companies (representatives, employees, insured parties, clients, etc.). However, if you are a private client, the firm will also process personal data directly relating to you and/or your family.
With the exception of contact data which is collected in a standardised way for the creation and management of the file (client identification data), the categories of data processed are potentially very varied and will depend to a large extent on the nature of the file entrusted to us by you.
As lawyers, we are also likely to process data of a certain sensitivity:

data relating to criminal convictions and offences;
special categories of data.

To ensure the proper management of a file, it will, in most cases, be necessary to process personal data relating to “opponents” of the firm’s clients as well as to other third parties whose names will be included in the file, whether these third parties are members of his/her family, co-contractors, professional relations, etc.
As in the case of clients, the nature of the data concerned will, by necessity, be very varied and will depend very largely on the type of dispute. Similarly, data relating to criminal convictions and offences and special categories of data may also be processed.
In some cases, due to professional secrecy, this information will also be processed without the data subject’s knowledge.

In the exercise of his/her functions, the lawyer is necessarily required to be in contact with other actors within the judicial arena: here we think essentially of lawyers of other firms, bailiffs, magistrates and registrars.
The personal data processed about these persons is relatively limited: it will include surnames and forenames, titles, professional activity and, in some cases, contact data, as well as partners (in the case of lawyers).

The firm also processes the personal data of the employees of its suppliers and service providers.
This data is also relatively limited: it will include the first and last names and contact data of these persons, as well as their professional activity and the company for which they work.

3. For what purpose and on what basis does the firm use personal data?

Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (“General Data Protection Regulation” or”GDPR”) requires that any processing be based on one of the six bases of legitimacy it lists:

the consent of the person concerned,
the need for the performance of a contract concluded with the person concerned or pre-contractual measures at the latter’s request,
a legal obligation,
the protection of the vital interests of a natural person,
a public mandate or,
the legitimate interest of the controller.

The table below summarises the different purposes of the processing operations carried out by the firm and the bases of legitimacy on which these operations are based.

Client data and data concerning representatives / employees / insured parties / business partners / families, etc. of clients	Data concerning opponents and persons mentioned in the file	Data concerning lawyers of other firms / judges / legal representatives, etc.	Data concerning (employees and representatives of) suppliers and service providers
1st objective: the management of the file entrusted by the client to the firm (legal opinion or judicial or other procedure). Personal data is necessary to apply the law to a particular situation. The bases of legitimacy of this processing are, depending on the case, the performance of a contract (for data relating to the client himself/herself), a legal obligation (in particular in the context of judicial proceedings) or, in other cases, the weighted legitimate interest of the lawyer in having all the data necessary to defend his/her client (Article 6.1, f GDPR), in accordance with the mission conferred on him/her by law and the oath he/she has taken. 2nd objective: administrative management of clients (opening of the file, encoding of services, invoicing, etc.). The bases of legitimacy of this processing are the execution of a contract (for data relating to the client himself/herself) or the legitimate interest (for data relating to the client’s representatives/employees) or, in certain cases, a legal obligation (in accounting and tax matters). 3rd objective: the prevention of money laundering. The basis for the legitimacy of this processing is a legal obligation. 4th objective: the management of any litigation (mainly in terms of fees). The legitimate basis for this processing is the legitimate interest of the firm. 5th objective: the promotion of our services. The legitimate basis for this processing is the legitimate interest of the firm.	The only purpose for which this data may be used is to manage the client’s file and defend his or her interests. Due to its specific nature and the different facets of the legal profession, the processing of this personal data may be based on two bases of legitimacy which will be combined according to the circumstances: the legitimate interest of the lawyer in having all the data necessary to defend his/her client, in accordance with the mandate conferred upon him/her by law and the oath he/she has taken; the legal obligations of the lawyer (Article 6.1, c) GDPR), such as the obligation to provide information on certain personal data in a summons or to attach a certificate of domicile or an extract from the national register to a contradictory request.	The only purpose for which this data may be used is to manage the client’s file. The bases of legitimacy on which this processing is based will be: the legal obligations of the lawyer in the judicial proceedings (such as the communication of submissions to the opposing party, etc.); the legitimate interest of the firm. The contact data we have is either public (in the case of lawyers, for example) or is communicated to us in the context of our professional relationship with these actors (for example, the email addresses of bailiffs).	1st objective: the management of the firm’s contractual relationship with these suppliers and service providers. The bases of legitimacy of this processing are the necessity for the performance of a contract – when it is concluded directly with the data subject – or the legitimate interest of the firm when the contract for the supply or provision of services is concluded with the employer of the data subject or the company that the data subject represents. 2nd objective: litigation management. The legitimate basis for this processing is the legitimate interest of the firm.

Client data and data concerning representatives / employees / insured parties / business partners / families, etc. of clients

Data concerning opponents and persons mentioned in the file

Data concerning lawyers of other firms / judges / legal representatives, etc.

Data concerning (employees and representatives of) suppliers and service providers

1st objective: the management of the file entrusted by the client to the firm (legal opinion or judicial or other procedure). Personal data is necessary to apply the law to a particular situation.
The bases of legitimacy of this processing are, depending on the case, the performance of a contract (for data relating to the client himself/herself), a legal obligation (in particular in the context of judicial proceedings) or, in other cases, the weighted legitimate interest of the lawyer in having all the data necessary to defend his/her client (Article 6.1, f GDPR), in accordance with the mission conferred on him/her by law and the oath he/she has taken.

2nd objective: administrative management of clients (opening of the file, encoding of services, invoicing, etc.). The bases of legitimacy of this processing are the execution of a contract (for data relating to the client himself/herself) or the legitimate interest (for data relating to the client’s representatives/employees) or, in certain cases, a legal obligation (in accounting and tax matters).

3rd objective: the prevention of money laundering. The basis for the legitimacy of this processing is a legal obligation.

4th objective: the management of any litigation (mainly in terms of fees). The legitimate basis for this processing is the legitimate interest of the firm.

5th objective: the promotion of our services. The legitimate basis for this processing is the legitimate interest of the firm.

The only purpose for which this data may be used is to manage the client’s file and defend his or her interests.
Due to its specific nature and the different facets of the legal profession, the processing of this personal data may be based on two bases of legitimacy which will be combined according to the circumstances:

the legitimate interest of the lawyer in having all the data necessary to defend his/her client, in accordance with the mandate conferred upon him/her by law and the oath he/she has taken;
the legal obligations of the lawyer (Article 6.1, c) GDPR), such as the obligation to provide information on certain personal data in a summons or to attach a certificate of domicile or an extract from the national register to a contradictory request.

The only purpose for which this data may be used is to manage the client’s file.
The bases of legitimacy on which this processing is based will be:

the legal obligations of the lawyer in the judicial proceedings (such as the communication of submissions to the opposing party, etc.);
the legitimate interest of the firm. The contact data we have is either public (in the case of lawyers, for example) or is communicated to us in the context of our professional relationship with these actors (for example, the email addresses of bailiffs).

1st objective: the management of the firm’s contractual relationship with these suppliers and service providers. The bases of legitimacy of this processing are the necessity for the performance of a contract – when it is concluded directly with the data subject – or the legitimate interest of the firm when the contract for the supply or provision of services is concluded with the employer of the data subject or the company that the data subject represents.

2nd objective: litigation management. The legitimate basis for this processing is the legitimate interest of the firm.

4. Why do we share your personal data?

Under no circumstances will the firm sell your personal data.

In order to ensure the proper execution of our mandate and the purposes detailed above, however, we are sometimes required to communicate or give access to certain information to third parties such as:

the opposing party’s lawyers, bailiffs and courts and tribunals in the context of case management;
our IT service providers, for example in the event of any intervention on our systems;
the tax authorities for invoicing data.

5. How long will personal data be kept?

The duration of the storage of your data will be determined by:

the purposes detailed above;
any legal obligations to keep data;
the applicable legal limitation period.

The main deadlines are as follows:

Client data and data concerning representatives / employees / insured parties / business partners / families, etc. of clients	Data concerning opponents and persons mentioned in the file	Data concerning lawyers of other firms / judges / legal representatives, etc.	Data concerning (employees and representatives of) suppliers and service providers
Billing data: until the end of our tax and accounting obligations (7 full tax years) Data specific to each file: 5 years after creation of the fileData common to all files: 5 years after the completion of the last mandate entrusted to us by youPromotion of our services: until you ask us to stop this processingMoney laundering: 10 years after arrangement of the last mandate entrusted to us by you	Data specific to each file: 5 years after creation of the file	Contact data: Your data will be kept as long as our professional relationship justifies it.	Contact data: 10 years after the end of the contract

6. What are your rights and how can you exercise them?

As a data subject, you have various rights. Below is a brief description of these rights and how you can implement them.

However, we would like to draw your attention to the fact that professional secrecy will, in some cases, prevent us from responding to your request.

Right to information

You can send us any questions regarding the recording and processing of your data.

Right of access

You may, at any time, and by written request to the firm, obtain confirmation that personal data concerning you is processed or not and, where applicable, obtain access to such data and a free copy thereof. Any additional copies will be provided to you upon prior payment of an administrative fee of €50.

Right to rectification

You may, at any time, and via a written request addressed to the firm, obtain the rectification of any inaccurate personal data concerning you or your children. You can also request that incomplete data be completed in the same way.

Right to erase

You may, at any time, and by written request to the firm, obtain the deletion of your personal data, provided that one of the following reasons applies:

the data is no longer necessary for the purposes for which it was collected and processed;
you have withdrawn your consent on which the processing was based and there is no other legal basis for it;
you object to the processing and there is no compelling legitimate reason for it;
the data has been unlawfully processed;
the data must be deleted in order to comply with a legal obligation.

Right to limitation of processing

You may request, by sending a written request to the firm, that the processing be limited for one of the following reasons:

you dispute the accuracy of the personal data (processing will be limited for the period necessary to verify the accuracy of the data);
in the event of unlawful processing, you object to the deletion of your data and request that its use be limited;
the firm no longer needs your personal data for processing purposes, but it is still necessary for you to establish, exercise or defend legal claims;
you have objected to the processing (the processing will be limited for the period necessary to verify the existence of legitimate grounds pursued by the firm that would prevail over yours).

Where processing restrictions are granted, personal data may, with the exception of storage, be processed only with the consent of the data subject, or for the establishment, exercise or defence of legal rights, or for the protection of the rights of another natural or legal person, or for important reasons relating to the public interest.

Right of opposition

You have the right to object, at any time and by sending a written request to the firm, for reasons relating to your particular situation, to the processing of your personal data based on the performance of a public mandate or necessary for the legitimate interests pursued by the firm.

The firm will no longer process such personal data unless it is demonstrated that there are legitimate and compelling reasons for processing that prevail over your interests and rights and freedoms, or for the establishment, exercise or defence of legal rights.

When your personal data is processed for the purpose of prospecting, you have the right to object at any time to this processing.

Right to portability

You have the right, by sending a written request to the firm, to receive the personal data concerning you or your children that you have provided to us in a structured, commonly used and machine-readable format, and to transmit such data to another controller without the firm hindering it, when:

the processing is based on your consent or a contract; and
the processing is carried out using automated processes.

Right to withdraw consent

Where the processing is based on your consent, you have the right to withdraw it at any time by sending a written request to the firm. The withdrawal of your consent will not affect the lawfulness of the processing operation based on the consent given before it was withdrawn.

Right to lodge a complaint

The firm makes every effort to ensure that its legal obligations regarding data protection are respected and to respond as quickly as possible to any complaint addressed to it in this regard.

In the event that you are not satisfied with the response received, you have the option of filing a complaint with the Belgian supervisory authority.

Rue Haute, 139
1000 Brussels
Tel.: +32 2 213 85 40
Fax: +32 2 213 85 65
Email: contact@apd-gba.be

You also have the option of contacting the supervisory authority in your country. You will find the contact details of all the supervisory authorities here: https://edpb.europa.eu/about-edpb/board/members_en.

Cookie	Type	Duration	Description
cookielawinfo-checkbox-[category]	persistent	1 year	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Non Necessary".
CookieLawInfoConsent	persistent	1 year	The cookie is set by the GDPR Cookie Consent plugin and is used to remember the user’s choice about cookies on the website to avoid opening the popup after acceptance.
PHPSESSID	session		This cookie sets the unique session of the user on the site.
pll_language	persistent	1 year	This cookie sets the language of the user.
viewed_cookie_policy	persistent	1 year	The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.

Cookie	Type	Duration	Description
tk_ai	persistent	1 year	This cookie is set by WooCommerce. It stores a randomly-generated anonymous ID. This is only used within the dashboard (`/wp-admin`) area and is used for usage tracking, if enabled. More info: https://docs.woocommerce.com/document/woocommerce-cookies/
woocommerce_cart_[hash]	session		This cookie is set by WooCommerce and is used to help WooCommerce determine when cart contents/data changes. More info: https://docs.woocommerce.com/document/woocommerce-cookies/
woocommerce_items_in_cart	session		This cookie is set by WooCommerce and is used to help WooCommerce determine when cart contents/data changes. More info: https://docs.woocommerce.com/document/woocommerce-cookies/
wp_woocommerce_session_	persistent	2 days	This cookie is set by WooCommerce. It contains a unique code for each customer so that it knows where to find the cart data in the database for each Customer. More info: https://docs.woocommerce.com/document/woocommerce-cookies/

Cookie	Type	Duration	Description
wordpress_[hash]	session		This cookie is set by Wordpress and is used to store the authentication details on login. The authentication details include the username and double hashed copy of the password. However, this usage of the cookie is limited to the admin console area, the backend dashboard of the website. Here [hash] represents the value that is obtained by applying a specific mathematical formula applied to the username and password. It is to ensure that the input values are safe, and no one can access these data using the cookies as it is difficult to ‘unhash’ the hashed data. More info: https://wordpress.org/support/article/cookies/
wordpress_test_cookie	session		This cookie is set by Wordpress and is used to store the authentication details on login. The authentication details include the username and double hashed copy of the password. However, this usage of the cookie is limited to the admin console area, the backend dashboard of the website. Here [hash] represents the value that is obtained by applying a specific mathematical formula applied to the username and password. It is to ensure that the input values are safe, and no one can access these data using the cookies as it is difficult to ‘unhash’ the hashed data. More info: https://wordpress.org/support/article/cookies/
workpress_logged_in_[hash]	session		This cookie is set by Wordpress and is used to to indicate when you are logged in, and who you are. This cookie is maintained on the front-end of the website as well when logged in. More info: https://wordpress.org/support/article/cookies/
wp-settings-{time}-[UID]	persistent	1 year	This cookie is set by Wordpress and is used to customize the view of your admin interface and the front-end of the website. The value represented by [UID] is the individual user ID of the user as given to them in the users' database table. More info: https://wordpress.org/support/article/cookies/

Cookie	Type	Duration	Description
__utma	persistent	2 years	Used to distinguish users and sessions. The cookie is created when the javascript library executes and no existing __utma cookies exists. The cookie is updated every time data is sent to Google Analytics. More info: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage
__utmb	session	30 minutes	Used to determine new sessions/visits. The cookie is created when the javascript library executes and no existing __utmb cookies exists. The cookie is updated every time data is sent to Google Analytics. More info: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage
__utmc	session		This cookie operates in conjunction with the __utmb cookie to determine if there is a new visit from the current visitor.. More info: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage
__utmt	session	10 minutes	Used to throttle request rate. More info: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage
__utmv	persistent	2 years	Used to store visitor-level custom variable data. This cookie is created when a developer uses the _setCustomVar method with a visitor level custom variable. This cookie was also used for the deprecated _setVar method. The cookie is updated every time data is sent to Google Analytics. More info: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage
__utmz	persistent	6 months	Stores the traffic source or campaign that explains how the user reached your site. The cookie is created when the javascript library executes and is updated every time data is sent to Google Analytics. More info: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage
_fbp	persistent	3 months	Used by Facebook to provide a variety of advertising products such as real-time bidding from third-party advertisers.
1P_JAR	persistent	1 month	This cookie provides information about how the end user uses the website and any advertising that the end user may have seen before visiting that website. It is added by Google with the tracking of Linkedin.
AnalyticsSyncHistory	persistent	30 days	Used to store data about when a synchronisation was performed with the lms_analytics cookie.
ANID	persistent	9 months	This is a Google advertising cookie (which may be injected when using a service such as Facebook Pixel, MailChimp or Linkedin).
bcookie	persistent	1 year	This cookie is set by Linkedin for the tracking of on-board services.
bscookie	persistent	2 years	This cookie is set by Linkedin for the tracking of on-board services.
c_user	persistent	3 months	This cookie is used by Facebook for social sharing of information and integration of Facebook services.
cli_user_preference	persistent	1 year	Stores the consent status of the user's cookies.
CONSENT	persistent	± 18 years	This cookie stores information related to user consent and stores the user's language.
datr	persistent	2 years	Cookie for statistical analysis of Facebook advertising. For more information, please see Facebook's Cookie Usage Policy.
DSID	persistent	2 weeks	Is used to identify a user who is signed in to his or her Google Account on non-Google sites and to store his or her ad personalization preferences.
fr	persistent	3 months	The “fr” cookie is used to deliver, measure and improve the relevance of advertisements, and its lifespan is 90 days.
IDE	persistent	13 months	Used by Google to present Google Ads ads to users on non-Google sites.
JSESSIONID	session		This cookie is set by Linkedin to define a new session.
lang	session		This cookie stores the language of the browser. This cookie is added by Linkedin.
li_at	persistent	1 year	This cookie is set by Linkedin for the tracking of on-board services. This cookie is used to protect against XSS attacks.
li_oatml	persistent	1 month	Indirect ID of the member for conversation tracking, retargeting and user. This cookie is added by Linkedin.
lidc	session	1 day	Linkedin cookie used for routing.
lissc	persistent	1 year	This cookie is set by Linkedin for the tracking of on-board services.
lms_ads	persistent	30 days	Used to identify LinkedIn members outside LinkedIn in designated countries for advertising purposes.
lms_analytics	persistent	30 days	Used to identify LinkedIn members in designated countries for analysis purposes
NID	persistent	6 months	This Google cookie is used to personalize advertisements. It stores a unique identifier that allows Google to save preferences and other information such as language.
sb	persistent	2 years	This cookie is used by Facebook for social sharing of information and integration of Facebook services.
UserMatchHistory	persistent	30 days	This Linkedin cookie is used to track visitors so that the most relevant advertisements can be shown based on the visitor's preferences.
xs	persistent	90 days	This cookie from Facebook stores a certain amount of session data when a person is connected to Facebook via their browser or device.