Privacy Policy

At PwC Legal, we take privacy and confidentiality matters very seriously. We have developed this Privacy Policy (the "Privacy Policy") to clearly define our ongoing commitment to protecting privacy rights and to explain how we collect, use and disclose personal data when you interact with PwC Legal.

We  collect personal information from you in the course of our business, including through your use of our website, when you contact or request information from us, when you engage our legal or other services or as a result of your relationship with one or more person of our staff, business partners and clients.

This Privacy Policy is issued by the Luxembourg law firm PwC Legal S.à r.l. (société à responsabilité limitée), a company established at 2 rue Gerhard Mercator, L-2182 Luxembourg, Grand Duchy of Luxembourg, and registered with the Luxembourg Trade & Companies Register under number B 169476 and with the Luxembourg Bar ("PwC Legal").

For the purpose of this Privacy Policy, PwC Legal is considered as the data controller of your personal data as PwC Legal determines why and how to process such personal data within the meaning of applicable data protection laws.

Any processing performed by PwC Legal is made in accordance with applicable data protection laws, including but not limited to, the European General Data Protection Regulation 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

In this Privacy Policy, we use the following terms within the meaning of applicable data protection laws:

"personal data" which means any information allowing the direct or indirect identification of an individual;

"processing" which means any act made in relation to such personal data (e.g. collecting, storing, and transferring data);

"data subjects", "you" and "your" refer to you as individuals whose personal data are being processed by PwC Legal, or to individuals associated with you or our clients, suppliers, business partners, contacts, and any other third party of whom we collect personal data.

1. Collection of personal data

When do we collect your personal data? We collect, store and otherwise process personal data relating to individuals having interactions with PwC Legal including through your use of our website, for instance, when you engage our legal consultation, advice, assistance or other services, when you provide services to us as a supplier, when you request to attend an event, when you contact or request information from us, when we exchange information or interact in any way.

How do we obtain your personal data?

  • We collect information from you as part of our business acceptance process as well as information about you as necessary in the course of providing legal services;
  • We gather information about you when you provide it to us, or interact with us directly, for instance when engaging with our staff or registering to an event;
  • We collect or receive information about you from other sources; we notably keep the contact details we already hold about you accurate and up to date using publically available sources;
  • We collect your personal information while monitoring our technology tools and services, including our websites and email communications sent to and from PwC Legal.

When we indirectly receive personal data relating to third party individuals. , the persons providing PwC Legal with such personal data undertake to do so in compliance with the applicable data protection laws and, in particular, to inform such third party individuals of the processing performed by PwC Legal and, as the case may be, to provide them with this Privacy Policy.

Update of personal data. We will endeavor to keep the personal data in our possession or control accurate. Data subjects providing personal data are however responsible for promptly informing us of any change to their personal data.

Refusal to provide your personal data. You have the right to refuse to provide us with your personal data but you are aware that not providing us with certain personal data (e.g. data requested in the course of our business acceptance process) would unfortunately prevent PwC Legal from interacting with you, providing you services, entering into an agreement or maintaining any ongoing agreement with you.

2. Types of personal data processed

We aim to be transparent about what we process and why. For further information on our processing activities, please review the relevant sections below:

(i) Clients and individuals associated with clients:

- Collection: We request that our clients provide us with personal data that is necessary for us to run our business acceptance process and perform our services. We sometimes process personal data regarding clients and individuals related to clients (e.g. their employees, managers, beneficial owners, etc.) that we received from a third party or acquired from public sources, for example, when a request is made on a client’s behalf by its representative or external advisors.

- Types of personal data processed:

  • Identification information (such as first name, family name, date and place of birth, gender, picture, copy of identity document).
  • Contact information (such as phone and fax numbers, email address, country of residence).
  • Financial information (such as identification and number of bank account, notably linked to billing).
  • Criminal records when required and in accordance with applicable laws (such as anti-money laundering laws or when preparing and defending a case).
  • Identification and background information provided by you or collected as part of our business acceptance process (such as data related to KYC).
  • Personal information provided to us by or on behalf of our clients or generated by us in the course of providing services to them, which may include special categories of data.
  • References information (such as, as the case may be, your details, the general scope of our mission, the legal services we provided you with and/or the transactions on which we assisted you, when PwC Legal submits applications to be referenced in leading guides of lawyers worldwide).
  • Types of services received or provided.
  • Other relevant personal details (such as nationality, citizenship, family-related data, job title, function within a company, preferred language, dietary preferences, license plate).
  • Footage from video surveillance cameras.
  • Any other personal data related to the provision of PwC Legal’s services to its clients.

In some instances, certain personal data we collect may be considered as falling within a special category of personal data as defined by applicable data protection laws. This includes personal data that can be collected in the context of preparing or defending your case or information about your dietary or access requirements in order to cater for your needs when you attend a meeting at PwC Legal’s premises. Such personal data will only be processed in accordance with applicable laws, for the establishment, exercise or defense of legal claims or whenever courts are acting in their judicial capacity or for PwC Legal to meet any legal or regulatory obligations we may have. Moreover, these personal data will be subject to appropriate technical and organizational security measures.

(ii) Business contacts and prospects:

- Collection: The personal data of business contacts and prospects that are not clients of PwC Legal and do not provide services to us are stored by PwC Legal in a database and processed as described below.

Most personal data we process with respect to business contacts and prospects is information that is knowingly provided to us by such data subjects (such as when they provide a member of PwC Legal with a business card or when a contact asks us to call him or her to provide some information about PwC Legal and our services). However, in some instances, we process personal data received from a third party or accessed from public sources.

- Types of personal data processed:

  • Identification information (such as first name, family name).
  • Business contact information (such as phone and fax numbers, email address).
  • Other relevant professional details (such as nationality, preferred language, job title, function within a company).
  • Any other personal data in relation with the conduct of PwC Legal’s business.

(iii) Suppliers including individual contractors:

- Collection: We collect personal data from our suppliers and individuals related to our suppliers (e.g. their employees or contact persons) and from individual contractors.

Most of the personal data we process with respect to suppliers is information that is knowingly provided to us by them. However, in some instances, we process personal data of individuals related to suppliers (such as when a supplier provides us with the contact details of one of its employees).

- Types of personal data processed:

  • Identification information (such as surname, family name).
  • Business contact information (such as phone and fax numbers, email address).
  • Other relevant professional details (such as job title, function within a company).
  • Any other personal data in relation with the management by PwC Legal of its suppliers.

(iv) Users of the PwC Legal website:

- Collection: A number of features on our website invite you to provide us with personal information.

Most personal data we process in respect to users of the PwC Legal website is information that is knowingly provided to us by such data subjects (such as when they contact us to obtain some information about PwC Legal and our services).

We also collect technical information, such as information from your visits to our website or in relation to materials and communications we send to you electronically. The collection and processing of such technical information is often made via cookies and is described in more detail in our Cookies Policy.

- Types of personal data processed:

  • IT-related information (such as record of your correspondence including e-mail address, terms of search).
  • Identification information (such as your name).
  • Contact and details information (such as postal address, e-mail address, phone numbers, country of residence, nationality, job title, function within a company).
  • Types of services received or provided.
  • Any other personal data in relation with the operation of the PwC Legal’s website and business.

Our Privacy Policy does not apply to information collected on any third party website that may link to or be accessible from our website.

3. Legal basis for the processing of personal data

We will only process personal data where we have a lawful reason for doing so. The lawful basis for the processing of personal data performed by us will always be one of the following, depending on the concerned processing, nature of personal data and data subjects:

  • it is necessary for PwC Legal to take measures at your request prior to entering into a contract or for the performance of any contractual obligations towards you;
  • it is necessary for PwC Legal to be able to comply with legal obligations (including those imposed by virtue of applicable commercial, tax and anti-money laundering laws) as well as any regulatory obligations and to respond to requests and comply with requirements from public authorities and professional supervisory bodies;
  • it is necessary for the establishment, exercise or defence of legal claims or proceedings;
  • it is necessary for the purposes of the legitimate interests pursued by us or by a third party, such as, for us:

- to provide and improve our website, including auditing and monitoring its use;

- to provide and improve our services to you and to our clients, including handling the personal information of others on behalf of our clients;

- to provide information requested by you;

- to promote our services, including by sending legal updates, publications and details of events;

- to manage and administer our relationship with you and our clients (e.g. for billing purposes);

- to implement video-monitoring measures in respect of PwC Legal’s premises, notably with a view to protecting our assets, in accordance with applicable legal and regulatory requirements;  

  • you have given your prior consent to the processing of your personal data for us to contact you and send you commercial communications (such as invitations to events and to our conferences, our newsflash, etc.) and your consent has been obtained pursuant to applicable laws.

No automated decisions will be made in relation to the personal data processed.

4. Disclosure of personal data

To achieve the above-listed purposes, in compliance and to the extent permitted under our deontological obligations (and notably the professional secrecy requirement), we disclose personal data to the following recipients:

  • commercial partners;
  • clients;
  • external services providers (including IT services providers);
  • subcontractors;
  • third parties to which we provide services;
  • professional advisors;
  • purchasers or sellers of our assets and entities linked to PwC Legal, if any;
  • members of as well as public organizations, administrative or legal authorities and supervisory bodies, if applicable;
  • professional associations;
  • entities of the professional network which PwC Legal adheres to.

You are informed that certain of the above-listed recipients may be located outside the territory of the European Economic Area in countries that do not offer a level of protection equivalent to the one granted in the European Union. Any personal data transfer to such recipients will, depending on the nature of the transfer:

- be covered by appropriate safeguards such as standard contractual clauses approved by the European Commission, in which case you may obtain a copy by contacting us; or

- be otherwise authorised under applicable data protection laws, as the case may be, as such transfer is necessary for the performance or execution of a contract concluded in your interest between us and a third party or for the establishment, exercise or defense of legal claims or for the performance of a contract between you and us.

5. Retention

PwC Legal will store your personal data only for as long as necessary for the relevant processing activity to be completed and/or for the retention period permitted or required under applicable laws.

6. Your rights

In relation to your personal data, you have the right to:

- access the personal data held about you and receive additional information about how it is processed;

- rectify or complete any inaccurate or incomplete personal data about you;

- seek the erasure of your personal data when its processing is no longer necessary for the purposes described above, when the processing is not or no longer lawful for any reasons, when you have withdrawn your consent to the processing according to applicable laws, when the erasure is necessary to comply with applicable laws or when you object to the processing in the absence of any overriding legitimate ground for such processing;

- object, on grounds relating to your particular situation, to any processing based on PwC Legal’s legitimate interests;

- receive your personal data and transmit it to another data controller to the extent that the legitimacy of the processing lies on contractual performance and is carried out by automated means;

- withdraw any consent given to the processing at any time to the extent that your consent justified such processing;

- seek the restriction of the processing, for instance, when you contest the accuracy of the personal data.

We will only be able to answer favorably to any of the above requests related to the right to oppose, the right of erasure and the right of restriction if (a) it does not interfere with or contradict a legal obligation of PwC Legal (e.g. a legal obligation to keep the related personal data) or (b) any other impediment justifies that PwC Legal is not be able to fulfil such requests. PwC Legal undertakes to handle each request free of charge and within a reasonable timeframe.

PwC Legal will respond to individual complaints and questions relating to privacy and will investigate and attempt to resolve all complaints.

You may also lodge a complaint with the data protection authority in Luxembourg, the Commission Nationale pour la Protection des Données (the "CNPD"), or with your local data protection authority if you do not reside in Luxembourg. The CNPD can be contacted as follows:

7. Technical and organizational security measures

Ensuring that personal data is appropriately protected from data breaches is a top priority for PwC Legal. We implement adequate technical and organizational security measures, such as, depending on the equipment, password protection, physical locks, etc., to ensure a level of security appropriate to the risks represented by the processing and the nature of the personal data to be protected.

Access to personal data is permitted to employees for the sole purpose of performing their professional duties. They are subject to a confidentiality obligation and are notably provided with training and documentation in order to improve their practical skills and knowledge on data protection issues.

8. Amendment

PwC Legal reserves the right to change, supplement and/or amend this Privacy Policy at any time. In such case, notification will be given to you by email, or any other methods chosen by us and allowed under applicable law.

9. Contact and exercise of your rights

PwC Legal has appointed a Data Protection Officer in order to manage and monitor our compliance. You can contact our Data Protection Officer for any question or for exercising your rights by email at: dataprotection@pwclegal.lu.

Follow us