We collect personal information from you in the course of our business, including through your use of our website, when you contact or request information from us, when you engage our legal or other services or as a result of your relationship with one or more person of our staff, business partners and clients.
Any processing performed by PwC Legal is made in accordance with applicable data protection laws, including but not limited to, the European General Data Protection Regulation 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
"personal data" which means any information allowing the direct or indirect identification of an individual;
"processing" which means any act made in relation to such personal data (e.g. collecting, storing, and transferring data);
"data subjects", "you" and "your" refer to you as individuals whose personal data are being processed by PwC Legal, or to individuals associated with you or our clients, suppliers, business partners, contacts, and any other third party of whom we collect personal data.
When do we collect your personal data? We collect, store and otherwise process personal data relating to individuals having interactions with PwC Legal including through your use of our website, for instance, when you engage our legal consultation, advice, assistance or other services, when you provide services to us as a supplier, when you request to attend an event, when you contact or request information from us, when we exchange information or interact in any way.
How do we obtain your personal data?
Update of personal data. We will endeavor to keep the personal data in our possession or control accurate. Data subjects providing personal data are however responsible for promptly informing us of any change to their personal data.
Refusal to provide your personal data. You have the right to refuse to provide us with your personal data but you are aware that not providing us with certain personal data (e.g. data requested in the course of our business acceptance process) would unfortunately prevent PwC Legal from interacting with you, providing you services, entering into an agreement or maintaining any ongoing agreement with you.
We aim to be transparent about what we process and why. For further information on our processing activities, please review the relevant sections below:
(i) Clients and individuals associated with clients:
- Collection: We request that our clients provide us with personal data that is necessary for us to run our business acceptance process and perform our services. We sometimes process personal data regarding clients and individuals related to clients (e.g. their employees, managers, beneficial owners, etc.) that we received from a third party or acquired from public sources, for example, when a request is made on a client’s behalf by its representative or external advisors.
- Types of personal data processed:
In some instances, certain personal data we collect may be considered as falling within a special category of personal data as defined by applicable data protection laws. This includes personal data that can be collected in the context of preparing or defending your case or information about your dietary or access requirements in order to cater for your needs when you attend a meeting at PwC Legal’s premises. Such personal data will only be processed in accordance with applicable laws, for the establishment, exercise or defense of legal claims or whenever courts are acting in their judicial capacity or for PwC Legal to meet any legal or regulatory obligations we may have. Moreover, these personal data will be subject to appropriate technical and organizational security measures.
(ii) Business contacts and prospects:
- Collection: The personal data of business contacts and prospects that are not clients of PwC Legal and do not provide services to us are stored by PwC Legal in a database and processed as described below.
Most personal data we process with respect to business contacts and prospects is information that is knowingly provided to us by such data subjects (such as when they provide a member of PwC Legal with a business card or when a contact asks us to call him or her to provide some information about PwC Legal and our services). However, in some instances, we process personal data received from a third party or accessed from public sources.
- Types of personal data processed:
(iii) Suppliers including individual contractors:
- Collection: We collect personal data from our suppliers and individuals related to our suppliers (e.g. their employees or contact persons) and from individual contractors.
Most of the personal data we process with respect to suppliers is information that is knowingly provided to us by them. However, in some instances, we process personal data of individuals related to suppliers (such as when a supplier provides us with the contact details of one of its employees).
- Types of personal data processed:
(iv) Users of the PwC Legal website:
- Collection: A number of features on our website invite you to provide us with personal information.
Most personal data we process in respect to users of the PwC Legal website is information that is knowingly provided to us by such data subjects (such as when they contact us to obtain some information about PwC Legal and our services).
We also collect technical information, such as information from your visits to our website or in relation to materials and communications we send to you electronically. The collection and processing of such technical information is often made via cookies and is described in more detail in our Cookies Policy.
- Types of personal data processed:
We will only process personal data where we have a lawful reason for doing so. The lawful basis for the processing of personal data performed by us will always be one of the following, depending on the concerned processing, nature of personal data and data subjects:
- to provide and improve our website, including auditing and monitoring its use;
- to provide and improve our services to you and to our clients, including handling the personal information of others on behalf of our clients;
- to provide information requested by you;
- to promote our services, including by sending legal updates, publications and details of events;
- to manage and administer our relationship with you and our clients (e.g. for billing purposes);
- to implement video-monitoring measures in respect of PwC Legal’s premises, notably with a view to protecting our assets, in accordance with applicable legal and regulatory requirements;
No automated decisions will be made in relation to the personal data processed.
To achieve the above-listed purposes, in compliance and to the extent permitted under our deontological obligations (and notably the professional secrecy requirement), we disclose personal data to the following recipients:
You are informed that certain of the above-listed recipients may be located outside the territory of the European Economic Area in countries that do not offer a level of protection equivalent to the one granted in the European Union. Any personal data transfer to such recipients will, depending on the nature of the transfer:
- be covered by appropriate safeguards such as standard contractual clauses approved by the European Commission, in which case you may obtain a copy by contacting us; or
- be otherwise authorised under applicable data protection laws, as the case may be, as such transfer is necessary for the performance or execution of a contract concluded in your interest between us and a third party or for the establishment, exercise or defense of legal claims or for the performance of a contract between you and us.
PwC Legal will store your personal data only for as long as necessary for the relevant processing activity to be completed and/or for the retention period permitted or required under applicable laws.
In relation to your personal data, you have the right to:
- access the personal data held about you and receive additional information about how it is processed;
- rectify or complete any inaccurate or incomplete personal data about you;
- seek the erasure of your personal data when its processing is no longer necessary for the purposes described above, when the processing is not or no longer lawful for any reasons, when you have withdrawn your consent to the processing according to applicable laws, when the erasure is necessary to comply with applicable laws or when you object to the processing in the absence of any overriding legitimate ground for such processing;
- object, on grounds relating to your particular situation, to any processing based on PwC Legal’s legitimate interests;
- receive your personal data and transmit it to another data controller to the extent that the legitimacy of the processing lies on contractual performance and is carried out by automated means;
- withdraw any consent given to the processing at any time to the extent that your consent justified such processing;
- seek the restriction of the processing, for instance, when you contest the accuracy of the personal data.
We will only be able to answer favorably to any of the above requests related to the right to oppose, the right of erasure and the right of restriction if (a) it does not interfere with or contradict a legal obligation of PwC Legal (e.g. a legal obligation to keep the related personal data) or (b) any other impediment justifies that PwC Legal is not be able to fulfil such requests. PwC Legal undertakes to handle each request free of charge and within a reasonable timeframe.
PwC Legal will respond to individual complaints and questions relating to privacy and will investigate and attempt to resolve all complaints.
You may also lodge a complaint with the data protection authority in Luxembourg, the Commission Nationale pour la Protection des Données (the "CNPD"), or with your local data protection authority if you do not reside in Luxembourg. The CNPD can be contacted as follows:
Ensuring that personal data is appropriately protected from data breaches is a top priority for PwC Legal. We implement adequate technical and organizational security measures, such as, depending on the equipment, password protection, physical locks, etc., to ensure a level of security appropriate to the risks represented by the processing and the nature of the personal data to be protected.
Access to personal data is permitted to employees for the sole purpose of performing their professional duties. They are subject to a confidentiality obligation and are notably provided with training and documentation in order to improve their practical skills and knowledge on data protection issues.
PwC Legal has appointed a Data Protection Officer in order to manage and monitor our compliance. You can contact our Data Protection Officer for any question or for exercising your rights by email at: firstname.lastname@example.org.