Privacy Statement

All employees operate on behalf of Brackmann B.V. ("Brackmann"), located at Weena 690 (Millennium Tower) 3012 CN Rotterdam.

Brackmann respects your personal data and ensures that the personal information provided to us or otherwise obtained is treated confidentially. Personal data refers to all information about a person. This also includes information that indirectly reveals something about an individual. The following outlines how Brackmann fulfills the information obligation under the GDPR for the individuals whose personal data we process.

In the context of its services, Brackmann processes personal data of clients, third parties, suppliers, and website visitors. This privacy statement ("Privacy Statement") provides information about the processing of personal data and the possibilities for access, correction, and deletion.

If you have any questions about the processing of your personal data, you can contact us via email ([email protected]) or send your inquiry by mail to the above address.

1. Which personal data does Brackmann process from clients?

Brackmann may process the following personal data of (employees of) clients:

• Personal details (name, first names, initials, gender, address, postal code, city)
• Other contact details (phone number, email address, and similar communication data)
• Data related to the handling of a case or dispute, including third-party information such as the opposing party
• Data for billing purposes, including bank account number
• Other client data required by applicable laws and regulations, the Legal Profession Regulation, and professional conduct rules for lawyers, such as identity documents to establish identity in certain circumstances

2. Which personal data does Brackmann process from third parties?

Brackmann may process the following personal data of third parties (such as non-client individuals whose data appear in the files, (employees of) opposing parties, and lawyers and other advisors with whom Brackmann has contact):

• Personal details (name, first names, initials, titles, gender, address, postal code, city)
• Other contact details (phone number, email address, and similar communication data)
• Data related to electronic communications sent to or received from third parties and data necessary to maintain contact with these third parties
• Other third-party data obtained from public sources or provided by clients, opposing parties, or others in the context of handling a case or dispute

3. Which personal data does Brackmann process from suppliers?

Brackmann may process the following personal data of individuals from whom Brackmann purchases products or services:

• Personal details (name, first names, initials, titles, gender, address, postal code, city)
• Other contact details (phone number, email address, and similar communication data)
• Data for placing orders, purchasing services, calculating and recording fees and expenses, making payments, and collecting claims, including bank account number
• Other supplier data required to comply with applicable laws and regulations

4. Which personal data does Brackmann process from job applicants?

Brackmann may process the following personal data of individuals applying for positions at Brackmann:

• Personal details (name, first names, initials, titles, gender, address, postal code, city)
• Data on the CV and in the application letter

5. Which personal data does Brackmann process from website users/visitors?

Brackmann may process the following personal data from website users/visitors:

• Communication data consisting of technical details of the equipment used to visit the website, such as IP address, MAC address, and software used
• Technical data (depending on cookie preferences set)
• Browsing behavior on the website, including mouse and click behavior, as well as the duration and time of the visit to the websites

6. Cookies

Brackmann tracks website usage data for statistical purposes via Google Analytics. The data collected through this method is generally anonymous and is used to monitor user behavior and general trends, as well as to generate reports. This helps improve the functionality of the website(s). Google may share this information with third parties if required by law or if third parties process the information on Google's behalf and may store this information on servers in the United States. Brackmann has no control over this.

7. What legal grounds and purposes does Brackmann use to process personal data?

Brackmann processes the personal data mentioned above solely on the following legal grounds as outlined in Article 6 of the GDPR:

• Legal obligation
• Performance of a contract
• Obtained consent of the data subject
• Legitimate interest

When Brackmann processes personal data based on your consent, it will request this separately. This consent may always be withdrawn. The withdrawal of consent does not affect the legality of the processing of your personal data before the withdrawal.

Brackmann uses the personal data for the following purposes. When processing is based on "legitimate interest," the interest is briefly outlined in italics.

Purposes and associated legal grounds:

• To provide the requested legal services, including identifying the client and conducting a conflict check to prevent conflicts of interest
• For Brackmann’s administration, including calculating or recording fees or payments, income and expenses, paying and collecting claims (including using collection agencies or bailiffs) (interest in maintaining proper administration)
• For handling complaints and disputes about services
• To communicate with you and keep in touch (interest in promoting Brackmann's services to existing clients)
• For placing orders or purchasing services (interest in maintaining proper administration)
• For conducting audits and internal control (interest in maintaining proper administration)
• To comply with legal and regulatory obligations, including the Legal Profession Regulation and the professional conduct rules for lawyers (interest in meeting these obligations)
• To ensure proper functioning of the websites (interest in proper functioning of the website)
• To design marketing activities and adjust website content accordingly (interest in promoting services to a broader audience)
• In connection with the recruitment process

8. To whom does Brackmann provide personal data?

Brackmann shares personal data only with third parties as necessary for providing services in line with the above purposes.

This may include appointing another lawyer to oversee the practice, conducting expert studies, or engaging other third parties on behalf of Brackmann, such as IT service providers. Personal data may also be shared in the context of legal proceedings or correspondence with opposing parties.

Additionally, Brackmann may disclose personal data to third parties, such as regulators or other authorities, if required by law.

A data processing agreement is concluded with third parties processing personal data on behalf of Brackmann, ensuring compliance with the GDPR. Third parties engaged by Brackmann who offer services as data controllers are responsible for their own compliance with the GDPR.

9. Transfer of data outside the EU?

For the provision of services, Brackmann may transfer personal data to a recipient in a country outside the European Economic Area. In such cases, Brackmann will ensure that the data transfer complies with applicable laws and regulations, such as by using a model contract approved by the European Commission. Brackmann will also assess whether additional measures are necessary to ensure appropriate protection for your personal data.

10. How long does Brackmann retain your personal data?

Brackmann retains your personal data for no longer than necessary to achieve the purposes outlined in this Privacy Statement. Specifically, Brackmann applies the following retention periods:

• Files for cases handled by Brackmann are retained for at least five years, in accordance with the Dutch Bar Association's Archiving Manual (and longer if legally required).
• Personal data processed under the Office Complaints Procedure is deleted no later than two years after the complaint and/or related legal proceedings are resolved.
• Personal data that must be administrated under Article 52 of the General Tax Act (AWR) is retained for seven years (from the end of the year in which the data loses relevance for fiscal purposes) in compliance with fiscal retention obligations under Article 52, paragraph 4, AWR.

The above retention periods may be extended if longer statutory retention obligations apply or if longer retention is required for incident or legal dispute resolution.

11. Security

Brackmann has taken appropriate technical and organizational measures to secure your personal data against unauthorized or unlawful processing and against loss, destruction, damage, alteration, or disclosure. Brackmann uses an online cloud solution with encrypted connections and encryption.

12. Your privacy rights

You have the following rights regarding the processing of your personal data by Brackmann:

• The right to request whether Brackmann processes your personal data and, if so, to access your data and certain information about its processing
• The right to rectify your personal data if it is incorrect or incomplete
• The right to request the deletion of your personal data ("right to be forgotten")
• The right to object to the processing of your personal data or to restrict its processing
• The right to withdraw consent for the processing of your personal data, if processing is based on your consent
• The right to receive or provide your personal data to a third party in a structured, commonly used, and machine-readable format ("right to data portability")

Brackmann does not use automated decision-making as defined in Article 22 of the GDPR. To exercise your rights, you can contact Brackmann via [email protected] or by mail at: Weena 690 (Millennium Tower) 3012 CN Rotterdam.

When you exercise your rights, Brackmann may ask for additional information to verify your identity. In principle, Brackmann will inform you within one month after receiving your request whether it can comply with your request.

This period can be extended by two months in specific cases, such as complex requests. Brackmann will inform you of any extension within one month of receiving your request. There may be circumstances in which Brackmann cannot fully comply with your request, such as due to confidentiality obligations or statutory retention periods. More information about your privacy rights can be found on the website of the Dutch Data Protection Authority.