Processing of personal data at Advokatfirmaet SGB AS

In connection with our business, Advokatfirmaet SGB AS (“SGB”) will process personal data.

Our processing of personal data as data controller is based on the business we carry out and the purpose of our business. Information about the personal data we process about you, the legal basis for the processing, the purpose of the processing, how long we process the personal data, and so on is set out below.

If you have questions or want to know more about our processing of personal data, you can contact us; see the contact details below.

1. Controller for the processing of personal data

SGB, represented by its board, is the controller for the personal data we process. Day-to-day responsibility for the processing is delegated to the managing director.

• Address: Parkveien 53B, 0256 Oslo
• Email: al@sgb.no
• Phone: 957 02 489
• Reg. no.: 986 552 073

2. Why we collect personal data and what information we collect

We collect and use personal data for different purposes depending on who you are and how we come into contact with you.

All processing of personal data takes place in accordance with the data protection rules in force at any time, including the Personal Data Act and the General Data Protection Regulation (GDPR).

“Personal data” means any information that can be linked to a natural person (the latter is referred to as the “data subject”).

“Processing” means anything done with personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of making available, alignment or combination, restriction, erasure or destruction.

3. Purposes of the processing

3.1 Legal practice

SGB carries on legal practice in accordance with the rules in chapter 11 of the Courts of Justice Act. When we register new clients and accept legal assignments, we collect a number of personal data such as name, contact details, place of work, national identity number, and other types of information and assessments of and about persons that will be relevant to establishing the client relationship and to resolving the individual assignment. This applies both when we enter into assignments with private individuals and when we enter into assignments with legal entities. For business clients the assignment is not entered into with a private individual, but there will always be at least one contact person acting on behalf of the business client about whom we register personal data. In addition, it will normally be necessary to collect and process a range of other personal data from the business client in order to resolve the assignment. In addition to client information and information about contact persons, the information we process as part of our legal practice will normally also contain personal data about other third parties, for example opposing parties, witnesses, experts and others involved. Such third parties have no right to either information about or access to the personal data SGB processes about them as part of an assignment, because of the lawyer's statutory duty of confidentiality.

The personal data we process comes mainly from the client. Under the Money Laundering Act, lawyers are required to carry out customer due diligence when registering new clients; see our standard terms.

Certain assignments require that we can collect and process so-called “special categories” of personal data (previously referred to as “sensitive personal data”). This includes, among other things, health data and information such as trade union membership, sexual orientation, political opinion and religious belief. In addition, we may handle cases where information is collected about criminal offences or suspicion of such. Such personal data will mainly be collected from our clients and other persons the client brings in as witnesses in the case, but may also come from opposing parties and other third parties.

In assignments with private clients and business clients, the legal basis for processing the personal data is that the processing is necessary to perform our agreement (the legal assignment) with the client, cf. GDPR Article 6(1)(b), and to comply with a legal obligation to which SGB is subject, cf. GDPR Article 6(1)(c). For the processing of personal data about other third parties in an assignment, the legal basis will in addition be Article 6(1)(f) where the processing is necessary to resolve the assignment and the interests or fundamental rights and freedoms of the data subject do not override and require protection of the personal data.

If we process special categories of data in an assignment, we will in addition fulfil one of the following legal bases: the data subject's consent, cf. GDPR Article 9(2)(a), or the processing is necessary for the establishment, exercise or defence of legal claims, cf. GDPR Article 9(2)(f). For the processing of personal data about criminal or possibly criminal matters, the legal basis corresponds to GDPR Article 9(2)(a) and/or (f), cf. Personal Data Act section 11.

All information about a case is archived for 10 years after the case has ended, after which the information is deleted.

3.2 The website sgb.no

This section describes what happens to information about you when you visit sgb.no. The website does not use Google Analytics or other tools that track individuals, and sets no tracking or marketing cookies. Cloudflare, which delivers and protects the website, may in some cases set technical security cookies that are necessary to prevent abuse. The website otherwise stores no information in your browser, with the exception mentioned under “Map”.

Operation and security. The website is operated on Cloudflare's platform. When you visit the pages, Cloudflare processes technical information such as IP address, browser, device and which pages are fetched, in order to deliver the pages and protect them against attacks and abuse. The legal basis is our legitimate interest in operating a secure website, cf. GDPR Article 6(1)(f). Such logs are stored for a short time at Cloudflare.

Visitor statistics. We use Cloudflare Web Analytics to see how many people visit the pages and which pages are used. The tool sets no cookies, stores nothing in your browser and does not follow you across websites or visits. The statistics we see are aggregated and cannot be linked to you. The legal basis is our legitimate interest in improving the website, cf. GDPR Article 6(1)(f).

The “Ask SGB” chat. The chat answers questions about SGB, the practice areas and the people here, and does not give legal advice. What you write in the chat is sent to Anthropic, which provides the language model (Claude) that formulates the answers. SGB does not store the conversations. Anthropic deletes the content from its systems within 30 days, unless longer storage is necessary to enforce Anthropic's terms of use or is required by law, and under the commercial terms (Commercial Terms) that apply to our use it may not use the content to train models. You should not write names, case details or other personal data in the chat. The legal basis is our legitimate interest in answering questions from visitors, cf. GDPR Article 6(1)(f). Use of the chat is voluntary.

The contact form. When you send an enquiry via the form, we process your name, email address, any phone number, the chosen practice area and what you write. To stop automated enquiries, the submission is checked with Cloudflare Turnstile, which processes technical information about your browser. The enquiry is read and assessed by people. It is sent as an email to SGB from a mailbox provided by KerLabs AS, which operates the website for us. The website does not store the enquiry. Further processing follows section 3.6. The legal basis is your consent, cf. GDPR Article 6(1)(a), which you give when you submit the form.

Map. The map on the contact page is first an image from Mapbox that is fetched when you open the page. Mapbox then receives technical information such as IP address and browser information, but nothing is stored in your browser. The interactive map is also provided by Mapbox and is only loaded if you press “Open interactive map”. The map library may then store a random identifier in your browser to measure use of the map, and by pressing the button you request this service. You can instead use the links to Google Maps or Apple Maps.

Fonts and scripts. The fonts on the website are delivered from our own servers. The protection against automated enquiries (Cloudflare Turnstile) is only loaded when you submit the contact form, and is necessary for the form to work.

3.3 Marketing, newsletters

SGB may send newsletters with relevant professional articles or information about courses and seminars. We only send newsletters to those who have consented to receive them. The legal basis is your consent to the processing of personal data under GDPR Article 6(1)(a) and consent to receive newsletters by email under section 15 of the Marketing Control Act.

To be able to send you newsletters we need to collect your name and email address. You can also choose which categories of newsletters you wish to receive.

Subscribing to our newsletters is voluntary and you can withdraw your consent to newsletters at any time. You do this by clicking the unsubscribe link in the newsletter you receive, or by sending an email to al@sgb.no.

The information is stored for as long as you consent to receiving newsletters. Your personal data is deleted from our newsletter register when you withdraw your consent. If you are a client of ours or have otherwise given us the necessary contact details, these are retained. See also your rights below.

3.4 Courses and seminars

When you register for our courses, seminars or webinars, we collect personal data necessary to administer and carry out such events. We will also send you necessary information and reminders about the event by email. If you have given us your mobile number, reminders will also be sent by SMS. The information collected will be name, contact details and place of work, and we ask about allergies and any other dietary considerations we should take into account when the event involves food service. The legal basis follows from GDPR Article 6(1)(b), and is based on our having an agreement with you on participation in and carrying out the event. Collection and processing of information about allergies and dietary considerations is based on your consent to our processing this information, cf. GDPR Art. 9(2)(a), cf. Art. 6(1)(a).

We may take photographs at events. The photographs may be used in connection with marketing SGB on social media and on our website. We will always ask for consent before we publish pictures in which participants have a prominent place or are the focus.

The participant lists will be available to SGB's employees. For events in cooperation with external speakers, your personal data may be shared with them. We will always inform you which other speakers your personal data is shared with.

3.5 Administration of recruitment and new hires

When you apply for a job with us you must share a range of information about yourself, including name, contact details, education, previous workplaces and other information that forms part of a CV.

The basis for processing personal data in recruitment is that the processing is necessary to take steps before an employment contract with the applicant is possibly entered into (GDPR Article 6(1)(b)).

If you get a job with us, necessary personal data is transferred to our HR system and you will receive a separate privacy notice for SGB's employees. As a job applicant you can consent to our storing your personal data for possible later assessments. If you do not want this, your information is deleted within 1 year after the relevant recruitment process has ended.

If we carry out enquiries about you beyond contacting persons given as references and searching for history and so on, personal data is processed on the basis of our necessary legitimate interest in ensuring the right candidate for the position (GDPR Article 6(1)(f)). For the latter we have assessed that our legitimate interest in recruiting new employees outweighs the individual's privacy. We encourage you not to include special categories of personal data, such as health, religion, political opinions, trade union membership and so on, in your application.

Personal data is deleted as soon as the recruitment has been completed, unless you have consented to longer storage.

3.6 Communication and dialogue

We process personal data about those who contact us in order to answer and document the communication and to contact others. This applies to all forms of communication, physical and digital, written and oral.

In such cases we process name, phone number, email address and any personal data that follows from the enquiry, including history/logs about the enquiry.

The processing is based on our necessary legitimate interest in processing personal data connected with the above (see GDPR Article 6(1)(f)). We have therefore assessed that our legitimate interest in having contact with the outside world is part of our business, and in documenting the business we carry out, answering those who contact us and registering such contact. We have assessed that this is necessary for us to handle the enquiries we receive, and that the data subjects' privacy does not override these interests.

Information collected and kept through electronic communication will often also be covered by legal practice or other services we provide as described above.

Giving us personal data is voluntary, but it will be necessary to give us the information for us to be able to answer enquiries.

We process the information until we expect there will be no further follow-up of the contact, normally one year.

3.7 Invoice administration and supplier administration

Contact persons at subcontractors will be registered in our accounting system with the information necessary to administer the contractual relationship and to be able to pay invoices. The information collected is name, position, email and mobile number.

The legal basis is our legitimate interest in storing personal data necessary to administer the supplier relationship, cf. GDPR Article 6(1)(f).

The personal data is stored in our systems for as long as you are employed by a supplier to SGB.

However, certain information may be stored beyond this, as the Bookkeeping Act requires SGB to retain accounting records (such as invoices) for five years after the end of the financial year. The legal basis for such storage follows from GDPR Article 6(1)(c), legal obligation.

4. Retention and storage (deletion) of personal data

We retain personal data for as long as is necessary for the purpose for which the personal data was collected, and delete the information in accordance with the requirements of the rules. How long we process each type of information we process is set out above where the individual processing operations are described.

This means, for example, that personal data we process on the basis of your consent is deleted if you withdraw your consent. Personal data we process to fulfil an agreement with you is deleted when the agreement has been fulfilled and all obligations that follow from the contractual relationship have been fulfilled, such as statutory obligations connected with accounting, follow-up of the customer relationship in connection with complaints and so on. Personal data we process as a result of a statutory obligation will be deleted as soon as we have no obligation to retain the information.

5. Disclosure of personal data to others

We do not pass your personal data on to others unless there is a lawful basis for doing so. Examples of such a basis are typically an agreement with you or a statutory obligation requiring us to disclose the information, such as the following:

5.1 Statutory reporting obligation, money laundering

Under the Money Laundering Act, lawyers must report to Økokrim if there is suspicion of transactions linked to criminal acts or terrorist financing. In the event of such suspicion, SGB will transfer the necessary information to Økokrim.

5.2 Necessary assistance from subcontractors

To carry on our business we depend on partners who can assist with the development, delivery and operation of our ICT systems. Our subcontractors may gain access to personal data we process as part of their delivery and operation of our ICT systems. They are required to comply with applicable data protection legislation, including the necessary technical and organisational measures to ensure that the personal data we have collected is secured and processed safely. We have entered into written data processing agreements with all our subcontractors.

For the website we use these suppliers:

• KerLabs AS (Norway): development and operation of the website, and sending enquiries from the contact form as email.
• Cloudflare, Inc. (USA): operation of the website, security, visitor statistics and protection against automated enquiries (Turnstile).
• Anthropic (USA): the language model behind the chat. Enquiries from the contact form are not sent there.
• Mapbox, Inc. (USA): the map on the contact page.

Transfers to suppliers outside the EEA are covered in section 5.4.

5.3 Transfer on the basis of law or judgment/court order

SGB will transfer personal data to public authorities if this is required under statute or by a final judgment or court order.

5.4 Transfer of personal data outside the EEA

As a starting point, SGB does not transfer personal data from legal assignments outside the EEA. However, such a transfer may be necessary in connection with an assignment if we are, on your behalf, to pursue or defend you against a legal claim directed at/from authorities, persons or organisations outside the EEA.

The suppliers of the website mentioned in section 5.2 that have their head office in the USA may process information from visits, chat and contact form outside the EEA. The transfer takes place on the basis of the EU-U.S. Data Privacy Framework where the supplier is certified, and otherwise on the basis of the European Commission's standard data protection clauses, cf. GDPR Chapter V.

6. Security of the processing

All processing of personal data is secured with the required technical and organisational measures.

We handle information so that it is correct, available and handled according to the degree of sensitivity of the information. We also use a range of security technologies and information security procedures to protect the personal data from unauthorised access, use or disclosure. Risk assessments are carried out for the processing of personal data.

We have entered into data processing agreements with all our suppliers who process personal data, in which they undertake the same degree of security as we have for our own processing of personal data.

We limit access to personal data to the staff or the third parties who are to process the information on our behalf. These parties are subject to a duty of confidentiality.

Procedures have been established for handling breaches of information security (personal data breaches), and if there is a breach that entails a risk to the privacy of those the personal data concerns, we will send a breach notification to the Norwegian Data Protection Authority (Datatilsynet) as soon as possible and no later than 72 hours after the breach was discovered. If the breach entails a high risk to the privacy of those affected, they will also be notified.

7. Your rights when we process personal data about you

Your rights regarding the processing of personal data are set out below. To exercise your rights you must contact the managing director. Contact details are given above.

We will reply to your enquiry as soon as possible, and no later than within one month. If it takes longer than one month you will be told.

We will ask you to confirm your identity or provide further information before we let you exercise your rights against us. We do this to be sure that we only give access to your personal data to you, and not to someone pretending to be you.

7.1 Information

You have the right to receive information about the personal data we process about you. Through this notice we inform you about our processing of personal data. You can also contact us if you want more information.

7.2 Access

You have the right to request access to the personal data processed about you. Contact us if you want access.

7.3 Rectification and erasure

You can also ask us to correct inaccurate information we hold about you or to delete personal data. We will, as far as possible, comply with a request to delete personal data, but we cannot do so if we still need the information.

7.4 Processing based on consent

If we process personal data on the basis of your consent, you can withdraw the consent at any time. The easiest way to do this is to use the method stated when you gave the consent, or to contact us.

7.5 Right to restrict or object to the processing

You have the right to have the processing restricted in certain cases, see GDPR Article 18, such as:

• a) You contest the accuracy of the personal data - the processing is stopped for a period that enables us to verify the accuracy of the personal data.
• b) The processing is unlawful, and you oppose the erasure of the personal data and instead request that the use of the personal data be restricted.
• c) We no longer need the personal data for the purpose of the processing, but you need them for the establishment, exercise or defence of legal claims.

You can also object to processing under GDPR Article 21(1) pending verification of whether our legitimate interests override your privacy.

7.6 The right to data portability

For information you have given to us that is necessary to carry out an agreement with us, and that is processed automatically (that is, not manually by us), you can ask to have the personal data about you handed over or transferred to another supplier in a structured, commonly used and machine-readable format (data portability).

7.7 Automated processing, including profiling

No automated processing, including profiling, will be carried out on the basis of your personal data that produces legal effects or significantly affects those the personal data concerns. See GDPR Article 22(1) and (4).

8. Complaints

If you feel that our processing of personal data is not in accordance with what we have described here, or that we otherwise breach data protection legislation, you can complain to the Norwegian Data Protection Authority (Datatilsynet).

You will find information about your rights and how to contact Datatilsynet on its website: www.datatilsynet.no.

9. Changes

If our services change or the rules on the processing of personal data change, this may lead to changes in the information given to you here. You will always find the current version of the privacy policy on our website.