drill. Law Firm (we, drill.) is a data controller which processes its clients (you, Client) personal data to provide its services and ensure that the Client is informed about the most crucial developments in its fields of interest.
This privacy policy (the Policy), among others, lays out for what purposes we process your personal data, how long and what are your rights in this regard.
Please feel free to contact us in case you have any questions regarding the processing of your personal data by writing to the email [email protected].
We process your personal data for three main purposes: provision of services, compliance with applicable laws, and informing you about any crucial developments in the fields most important to you.
drill. collects personal data from a variety of sources, including the Clients themselves (their representatives, authorized persons, employees, etc.), publicly available resources, databases and registers. The data sources vary on a case-to-case basis and depend on the services the Client has requested. The data sources are clarified and specified with each Client to provide our services in the most efficient way possible.
We process your personal data to provide you with our services which you have requested. This data processing activity is based on the necessity to perform the agreement and to take certain steps prior to entering the agreement.
Provision of service includes the following data processing activities:
If the Client does not provide or disclose personal data necessary for the conclusion and/or fulfilment of the agreement, drill. cannot fully or partially (depending on the case) fulfil its obligations to the Client. In each such case drill. informs the Client of the consequences of non-provision of the necessary information.
drill. is an entity subject to several laws that prescribe certain data processing activities, including activities in the fields of prevention of money laundering and terrorism and proliferation financing, prevention of sanction violations, and accounting.
As a law firm, drill. is also an entity subject to the Bar Law of the Republic of Latvia, which outlines the rights and obligations of the attorneys at law practicing in our law firm.
Read more
When processing personal data to comply with the applicable laws, drill. is in some cases obligated to obtain personal data from various sources or disclose it to state authorities without informing the Client. This is done only if required by applicable laws. In this regard drill. can request additional information and documents from the Client, for example, extracts from various registers, proof of origin of funds, copies of identification documents.
If the Client does not provide or disclose personal data necessary for compliance with the applicable laws, drill. cannot fully or partially (depending on the case) fulfil its obligations in accordance with the applicable laws, and consequently provide its services to the Client. In each such case drill. informs the Client of the consequences of nonprovision of the necessary information.
drill. occasionally can send its Clients relevant information and updates about the developments in the fields that we believe could be of interest to the Client. For example, if the Client engages drill. in providing continuous services regarding real estate, drill. can send the Client updates of recent activities and relevant drill. services in the field of real estate that might be of interest to the Client.
Sending of information material is done based on the legitimate interest of drill. to keep its Clients informed of relevant events in certain fields that might be of interest or affect the Clients interests. This also allows drill. to inform the Client about the assistance drill. can offer.
drill. provides an option to opt-out of receiving information material by clicking the unsubscribe link in the relevant email or by contacting drill. directly, either by email [email protected] or by contacting the relevant lawyer who is providing you with the services.
While providing services, drill. may disclose or make available your personal data to third parties, such as service providers, for example, couriers, IT providers, payment institutions, postal services, translators, as well as other persons as necessary to provide our services, for example, state authorities, notaries, agreement counterparties, etc. This may include data transfer outside the European Economic Area.
Any disclosure of personal data is done on a need-to-know basis and adheres to strict client-attorney confidentiality rules, as appropriate.
Read more
drill. can share Client’s personal data with parties outside the European Economic Area, insofar as it is directly requested by the Client, is necessary to perform the agreement with the Client or is required by applicable laws. In each case of such data transfer drill. informs the Client about the intended data transfer and ensures the application of additional safeguards, as appropriate.
In some cases stipulated by applicable laws, drill. may have the obligation to disclose Client’s personal data to state and local authorities without informing the Client. Disclosure in such cases is done only insofar as it is directly stipulated by the respective law, and only based on a substantiated request by the respective state or local authority. Prior to any data disclosure to the authorities, drill. reviews and assesses the legitimacy and justification of the request as well as the proportionality of the requested data amount.
Different categories of Client’s data are retained for different periods, depending on the document which contains the respective personal data, the importance and relevance of the information, the requirements of applicable laws and regulations, and the necessity to defend or bring any legal claims.
Client’s personal data is retained in the amount necessary to reach the respective data retention purpose, and once this purpose is fulfilled, the personal data is disposed of in a secure manner to ensure that it cannot be recovered.
For your convenience we have outlined the approximate data retention periods for key purposes below:
Please note that these retention periods can be changed due to changes in the applicable laws, drill.’s internal rules or other circumstances. These terms are only approximations provided for the Client’s convenience and are not binding on drill.
drill. is committed to alleviate the Client’s exercise of the rights listed below and promptly, though no later than within 30 (thirty) days of the receipt of the Client’s request, provides a response to the Client’s request to exercise these rights and act upon said request.
Should you wish to exercise your data subject’s rights, you can do so by submitting a request in one of the following ways:
drill. reserves the right to request additional information from the Client in order to verify the identity of the person, who has sent the request, and to protect the Client’s data from being disclosed to unauthorized persons.
Below is a summary of Client’s specific rights.
The Client is entitled to receive information on whether or not drill. processes the Client’s personal data, and, if drill. processes said personal data, request a copy of the Client’s personal data undergoing processing.
When exercising this right, the Client will receive information about how his/ her personal data specifically is being processed. This may differ from the general data processing described in the Policy.
The Client is entitled to request that drill. rectify the Client’s inaccurate or incorrect personal data. We will need to verify that the amended data is true and accurate.
drill. reserves the right to refuse rectification of the information indicated by the Client if there are substantiated reasons to do so, for example, to retain historical information about the origin of funds for anti-money laundering purposes.
The Client is entitled to request that drill. erase the Client’s data. This right can be exercised if one of the following grounds applies:
drill. reserves the right to reject the request for erasure of the Client’s personal data if there is a legitimate legal ground for doing so, for example, to comply with a legal obligation which requires processing, to establish, exercise or defend legal claims, or for statistical purposes, providing appropriate technical and organizational security measures.
The Client is entitled to request that drill. restrict processing if one of the following grounds applies:
Upon restricting the processing of the Client’s personal data, drill. will only process the Client’s personal data after receiving consent from the Client, or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest. This does not apply to storing personal data.
The Client is entitled to object to the personal data processing activities concerning direct marketing or which are based on drill.’s legitimate interests but given the basis of the Client’s particular situation, they want to object to processing on this ground.
The Client is entitled to request that drill. receive and transfer the Client’s personal data to the Client or another data controller. The Client can exercise this right insofar as the data has been provided by the Client based on consent or a contract and the processing is carried out by automated means.
This right also applies to raw data that has been provided by the Client, relates to the Client’s activities or result from observation of the Client, for example, activity logs, history of website usage. However, this does not apply to data that drill. creates, for example, risk assessments to comply with anti-money laundering rules and policies.
In case of any uncertainty related to your personal data, you are welcome to contact drill. and we will seek to provide you with an answer or find a solution to your issue. However, if you believe we cannot find the solution, the Client is entitled to submit a complaint to the national personal data protection authority regarding data processing activities conducted by drill.
The contact information of the national personal data protection authority of the Republic of Latvia:
Data State Inspectorate, Blaumaņa iela 11/13-15, Riga LV-1011, Latvia, phone: +371 67223131, email: [email protected].
drill. has the right to make changes to the Policy at any time by posting them on its website, as well as by informing the Clients individually by sending them an email. Any version of the Policy that is published on this website replaces all previous versions of the Policy and takes effect immediately upon posting or from the effective date as indicated.