Privacy Policy
1. Data Controller and Contact Information
Advokatbyrå Kim Åstrand Ab
Hovioikeudenpuistikko 15 C 34
65100 Vaasa
Kim Åstrand
Email: kim@kimastrand.fi
Phone: +358 (0)40 8410 811
2. Processing of Personal Data by Attorneys at Law Kim Åstrand
Attorneys at Law Kim Åstrand is a law firm operating in Finland. Personal data is processed in connection with its operations, for instance, to manage cases, develop business operations, and for recruitment purposes. We value the protection of your personal data, and this privacy policy describes how and in what situations personal data is processed, as well as your rights as a data subject. Below are several purposes for which personal data is processed; however, which purposes apply to you depends on your role. For example, you may be a visitor to our website, a client, or a counterparty in a case. The personal data we process about you therefore depends on your activity and our relationship with you.
3. Purposes and Legal Grounds
To develop the products and services of Attorneys at Law Kim Åstrand, manage client cases efficiently, comply with applicable legislation, and more, personal data is processed primarily for the following purposes and on the following legal grounds:
Case Management. When you contact us for assistance, we need personal data to stay in touch with you and any counterparties and their representatives, and to assess and handle the case in the manner we consider best for you. The personal data needed for this purpose varies case by case, and this type of processing is based on general contractual terms, attorney legislation (including bar association guidelines), and legitimate interests.
Handling Billing, Payments, and Debt Collection. Naturally, we need to be compensated for our work. This is managed by invoicing for a case and tracking payments, based on our general contractual terms. If payments are not received, we may contact debt collection agencies, which is based on legitimate interests.
Managing Client Funds. If you entrust us with your client funds, they are not mixed with our own assets. Client funds are held in separate accounts, as required by attorney legislation (including bar association guidelines).
Preventing Money Laundering and Terrorist Financing. As a law firm, Attorneys at Law Kim Åstrand is obligated to collect data to facilitate the detection and investigation of such activities. This is based on legislation on the prevention of money laundering and terrorist financing, as well as attorney legislation (including bar association guidelines).
Conflict of Interest Investigation and Registration of Client Relationships and Cases. The operations of Attorneys at Law Kim Åstrand are highly regulated, and our obligations include registering clients and cases and investigating conflicts of interest. This processing is based on attorney legislation (including bar association guidelines) and our general terms and conditions.
Development of Products, Services, and Business Operations. It benefits both you and us that our products and services are relevant and up-to-date. Personal data you provide through activities on our website or as a client helps us achieve these goals, and this is also based on legitimate interests.
Sending Newsletters and Conducting Marketing. We offer many services that we want you to access, and we keep you updated on legal news. Newsletters and other marketing aim to remain relevant to you, based on legitimate interests.
Managing Invitations and Registrations for Events. We believe events are excellent opportunities to meet and network, and we want you to participate. If you register, we need to manage the invitation and any allergies. This processing is based on our legitimate interests and applicable event terms.
Managing Supplier Relationships. When we purchase goods and services, we process certain personal data to maintain supplier records, evaluate products or services, and follow up on and pay for purchases. This processing is based on contracts and legitimate interests.
Providing Visitors a Smooth Website Experience. A user-friendly website ensures it is tailored to your needs and operates faster, benefiting both you and us. This processing is based on legitimate interests.
Managing Job Applications, Evaluations, Interviews, and Selections. Attorneys at Law Kim Åstrand may use your personal data to contact you, assess your suitability for employment, invite you for interviews, and use basic personal data as a foundation for potential employment contracts. Processing is based on legitimate interests, and in limited cases, consent (e.g., when using data not directly obtained from you).
For processing based on legitimate interests, Attorneys at Law Kim Åstrand has conducted a balancing test between your interests, fundamental rights, and our interests. In many cases, our interests align with yours. Nonetheless, we have limited the personal data, storage period, and other processing to what is necessary for the purpose.
4. Categories of Personal Data Processed
The categories of personal data processed vary depending on the type of data subject. The various categories of personal data are as follows:
Technical user data, such as cookies, IP addresses, language settings, location data, software and hardware versions, sections of our website you have visited, as well as likes and comments on our social media.
Basic (contact) information, such as name, phone number, email address, postal address, postal code, city, and website.
Information about your position, such as employer, job title, and industry.
Event registrations, including any dietary restrictions and allergies.
Marketing permissions and prohibitions.
Consents.
Areas of interest and the types of messages you wish to receive.
Social security number.
Client information, such as legal or natural person, responsible office, responsible person at Law Firm Kim Åstrand, conflict-of-interest check details, industry, and client number.
Case information, such as handling lawyer, conflict-of-interest check details, case number, legal area, counterparties, opposing counsel, contacts at insurance companies and authorities, and other necessary or provided information for the case.
Payment information, such as credit limits, invoiced amounts, paid amounts, outstanding amounts, invoice date, due date, reminders, billing address, contact person, and bank account number.
Client funds information, such as amounts, types, value, and retention periods.
Information for the prevention of money laundering and the financing of terrorism, as listed in the Act on Preventing Money Laundering and Terrorist Financing. Examples include name, date of birth, and personal identification number, representatives’ names, dates of birth, and identification numbers, as well as names, dates of birth, and citizenships of board members or equivalent decision-making bodies of legal entities.
Qualifications, experience, expertise, and other work-related information, such as current and previous job roles, degrees, study records, references and evaluations from references, IT, language, and other skills, suitability assessments, salary expectations, and any additional information.
Images, such as photographs of students and scholarship recipients.
The personal data processed by Law Firm Kim Åstrand is limited to what is necessary for the specific purpose. To fulfill obligations under applicable legislation and contractual terms, Law Firm Kim Åstrand requires certain personal data. You have the right to refrain from providing us with this personal data, but in such cases, we cannot guarantee that we can deliver our products and services in the best possible way or at all. For example, we cannot initiate a case if you do not provide us with the personal data necessary for conflict-of-interest checks, risk assessments for money laundering or terrorist financing, or other required information to handle your case.
5. Sources used by Attorneys at Law Kim Åstrand
Attorneys at Law Kim Åstrand primarily collects personal data directly from you, for example, when conducting investigations to prevent money laundering and the financing of terrorism, when you contact us for assistance, or when you provide dietary information for an event. Personal data is also generated by your own activity, such as on our website and social media platforms.
In many cases, we can save you the trouble of providing all the personal data yourself by retrieving it from third parties. For instance, we often use the public trade register maintained by the Finnish Patent and Registration Office when registering you as a client, recording your case, or conducting investigations to prevent money laundering and the financing of terrorism. We may also collect information from sources such as your employer’s website.
For case management, we gather the necessary personal data, which may come from third parties, and the extent of this varies depending on the case. Additionally, Attorneys at Law Kim Åstrand may collect assessments about you from the references you have provided in your job application.
6. Categories of Recipients
Attorneys at Law Kim Åstrand primarily processes personal data within its own organization and for its own purposes. In certain situations, however, Attorneys at Law Kim Åstrand may need to share personal data with third parties. For example, Attorneys at Law Kim Åstrand organizes certain events in cooperation with other organizations, and personal data may need to be shared with other organizers or companies providing catering services. We also collaborate extensively with various business organizations, and from time to time, it may be necessary to share personal data with them to process personal data in accordance with our purposes.
Case management often requires sharing personal data with third parties. A case often involves counterparties, counterparty representatives, authorities, banks, and insurance companies, and we share personal data with them to the extent necessary. Various experts engaged by Attorneys at Law Kim Åstrand in a case may also receive necessary data. According to legislation on the prevention of money laundering and the financing of terrorism, Attorneys at Law Kim Åstrand is obligated to share data with the police’s Financial Intelligence Unit in certain situations. As another example, Attorneys at Law Kim Åstrand may engage third parties to carry out suitability tests for job applicants.
7. Storage Period
Attorneys at Law Kim Åstrand retains personal data for as long as it is necessary for the purpose for which it was collected. This varies depending on the category of personal data and the purpose for which it was collected. For example, cookies and other personal data obtained through your activity on the website and our social media are stored for as long as Attorneys at Law Kim Åstrand needs them for your use of the website and for as long as Attorneys at Law Kim Åstrand needs them to develop its products, services, and operations. This typically varies but is usually up to a few years. You have the option to configure your browser not to store cookies and to delete them. In such cases, Attorneys at Law Kim Åstrand will naturally not store personal data after you have deleted it.
Personal data necessary for sending out newsletters is stored as long as Attorneys at Law Kim Åstrand deems you may be interested in its products and services. This can depend, for instance, on changes in your position within the company or if you change workplaces. Personal data used for events is generally stored only until the event is completed. However, Attorneys at Law Kim Åstrand may retain the data longer to follow up on your opinions about the event and to determine if you are interested in similar events in the future.
For the registration and maintenance of the client relationship, Attorneys at Law Kim Åstrand retains personal data for as long as you remain a client and thereafter in accordance with the guidelines of the Bar Association or other applicable regulations. Personal data processed in connection with case management and client fund management is stored as long as the personal data concerning the client relationship. However, conflict of interest data may be stored even longer to investigate conflicts of interest under applicable laws. Personal data for payments, billing, and debt collection is stored until the claim is paid and thereafter as long as necessary to fulfill legal requirements, such as obligations under the Accounting Act or tax legislation.
Personal data for the prevention of money laundering and the financing of terrorism is stored for five years after the client relationship has ended, in accordance with applicable legislation. Additionally, Law Firm Kim Åstrand complies with other relevant legislation that specifies certain retention periods, such as accounting laws. The retention period for recruitment data depends on whether it concerns an application process with a fixed schedule or an open application. After the application process itself has concluded, we store the personal data for at least one year to be able to follow up with the data subject, for instance, in the event of new recruitment needs.
8. Transfer of Personal Data Outside the EEA
Attorneys at Law Kim Åstrand primarily processes your personal data within the EU and EEA. For technical reasons, however, Law Firm Kim Åstrand may need to transfer some of your personal data to third countries where the level of data protection may be lower than within the EU and EEA. If such countries are not covered by a decision from the European Commission regarding an adequate level of protection, the processing will be safeguarded by other appropriate protective measures. These measures mainly consist of standard contractual clauses developed by the European Commission, and you can find more information about them here: https://ec.europa.eu/info/law/law-topic/data-protection_sv.
9. The Data Subject’s Rights
You have the right to request access to, rectification of, and deletion of the personal data processed about you by Attorneys at Law Kim Åstrand. You also have the right to request restriction of processing and the right to object to the processing of your personal data. In addition, you have the right to exercise your right to data portability. The scope of these rights is determined in accordance with the General Data Protection Regulation and other applicable legislation.
You have the option to access and delete cookies, as well as adjust certain other technical settings in your browser, phone, or other devices you use. In other cases, a request or objection must be submitted in writing to Attorneys at Law Kim Åstrand’s contact person specified above.
Attorneys at Law Kim Åstrand is subject to legislation governing attorneys (including the guidelines of the Bar Association), which includes confidentiality and professional secrecy obligations for the benefit of the client, as well as confidentiality obligations related to the prevention of money laundering and the financing of terrorism. In practice, this may limit, among other things, your ability to know whether personal data is being processed about you and to gain access to such data.
10. Consents
The processing of certain personal data is based on your consent. In such cases, you always have the right to withdraw your consent. For example, regarding cookies, you have the right to change your browser settings so that cookies are not collected.
11. Right to Lodge a Complaint with a Supervisory Authority
You have the right to lodge a complaint regarding Attorneys at Law Kim Åstrand’s processing of your personal data with a supervisory authority. The supervisory authority overseeing Law Firm Kim Åstrand’s processing of personal data in Finland is the Data Protection Ombudsman’s Office (www.tietosuoja.fi). You may also lodge a complaint with the supervisory authority responsible for monitoring compliance with the General Data Protection Regulation in the country where you reside.
12. Profiling and Automated Decision-Making
Attorneys at Law Kim Åstrand does not engage in automated decision-making, including profiling.