Data Protection Policy

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, commonly known as the General Data Protection Regulation (hereinafter the “GDPR”), establishes the legal framework applicable to the processing of personal data.

The GDPR strengthens the rights and obligations of data controllers, processors, data subjects and data recipients.

In the course of its activities, AARPI PROMARK AARON processes personal data.

For the purposes of this Policy, the following terms are used:

·  “Controller” means the natural or legal person that determines the purposes and means of processing personal data. For the purposes of this Policy, the controllers are jointly the PROMARK and AARON law firms forming AARPI PROMARK AARON.

·  “Processor” means any natural or legal person that processes personal data on behalf of the Controller. In practice, these are service providers working with AARPI PROMARK AARON and handling personal data it processes.

·  “Data subjects” means persons who can be identified, directly or indirectly, and are referred to in this Policy as “clients” or “contacts”.

·  “Recipients” means natural or legal persons to whom personal data is disclosed. Recipients may be internal (e.g. accounting staff) or external (e.g. support service providers, judicial authorities and their auxiliaries, professional bodies).

Article 12 of the GDPR requires data subjects to be informed of their rights in a concise, transparent, intelligible and easily accessible manner.

For its business needs, AARPI PROMARK AARON carries out and operates processing of personal data relating to its clients and contacts.

This Policy is intended to meet the AARPI’s information obligations and to set out the rights and obligations of its clients and contacts with regard to the processing of their personal data.

This Policy applies to all processing of personal data relating to clients and contacts of AARPI PROMARK AARON.

It covers only processing for which the PROMARK and AARON law firms forming the AARPI are controllers, and data described as “structured”.

This Policy does not cover processing carried out by lawyers of the PROMARK and AARON firms in connection with their personal clientele.

Personal data may be processed directly by AARPI PROMARK AARON or by a processor specifically appointed by it.

This Policy is independent of any other document that may apply within the contractual relationship between the AARPI and its clients or contacts.

AARPI PROMARK AARON will not process clients’ or contacts’ personal data unless the data has been collected by or for the AARPI’s services, or is processed in connection with those services, and the processing complies with the general principles of the GDPR.

Any new processing, modification or deletion of existing processing will be brought to the attention of clients and contacts by amending this Policy.

NON-TECHNICAL DATA (depending on the use case):

·  Identification: surname, first name, title, position, pseudonym and social-media username;

·  Contact details: telephone number, email address, postal address and fax;

·  Photographs, where permission to use them has been granted to AARPI PROMARK AARON;

·  Professional life;

·  Personal life (family or assets-related information), where necessary for handling a case;

·  Banking data, where necessary.

TECHNICAL DATA (depending on the use case):

·  Identification data (IP address);

·  Connection data (including logs);

·  Consent data (clicks).

The PROMARK and AARON law firms forming the AARPI do not process special-category data within the meaning of Article 9 of the GDPR, except for data covered by Article 9(2)(f), namely data necessary for the establishment, exercise or defence of legal claims or when courts are acting in their judicial capacity.

AARPI PROMARK AARON collects clients’ and contacts’ data from the following sources:

·  Information provided by the client in connection with a matter entrusted to the AARPI (client file);

·  Business cards;

·  Forms completed by clients (attendance sheets, post-conference satisfaction forms);

·  Registration for or subscription to the AARPI’s online services, particularly the client area;

·  Registration for events organised by the AARPI;

·  Lists provided by organisers of events or conferences in which the AARPI participates;

·  Exchanges via social media.

In exceptional circumstances, the AARPI may rent databases.

Depending on the circumstances, the PROMARK and AARON law firms forming the AARPI process personal data for the following purposes:

·  Handling matters entrusted to the AARPI;

·  Customer relationship management (CRM);

·  Managing events organised by the AARPI (conferences, breakfasts, etc.);

·  Answering questions submitted to the AARPI by telephone or online;

·  Managing the client area;

·  Responding to public or private tenders;

·  Sending newsletters, season’s greetings and other congratulatory messages on behalf of AARPI PROMARK AARON;

·  Improving the AARPI’s services;

·  Meeting the AARPI’s administrative obligations;

·  Producing statistics.

The processing purposes set out above rely on the following legal bases:

Clients: taking steps prior to entering into a contract or performance of a contract.

Contacts: legitimate interests and, where required by law, consent.

AARPI PROMARK AARON ensures that personal data is accessible only to authorised internal or external recipients.

INTERNAL RECIPIENTS:

·  Lawyers;

·  Non-lawyer staff;

·  Trainees;

·  Communications department;

·  IT department.

EXTERNAL RECIPIENTS:

·  Service providers or support services (e.g. translation services, IT providers, reprographics);

·  Judicial authorities, judicial officers, fellow lawyers, experts, representatives, bailiffs, investigators, etc.;

·  Professional bodies;

·  Public authorities.

AARPI PROMARK AARON determines retention periods in light of its legal and contractual obligations. These periods are set out in its data-retention policy.

After the applicable periods expire, data is either deleted or retained after anonymisation, in particular for statistical purposes.

Clients and contacts are reminded that deletion and anonymisation are irreversible operations and that the AARPI will not be able to restore the data afterwards.

Clients and contacts may ask AARPI PROMARK AARON to confirm whether or not personal data concerning them is being processed.

The right of access is subject to the following requirements:

·  The request must be made by the person concerned and accompanied by a valid copy of an identity document;

·  The request must be made in writing to AARPI PROMARK AARON, 36 rue de Penthièvre 75008 Paris (France), or by email to contact@promark-aaron.com.

Clients and contacts may request a copy of their personal data being processed by AARPI PROMARK AARON. For additional copies, the AARPI may charge a fee reflecting the administrative costs.

The right of access does not extend to confidential information or data whose disclosure is not authorised by law. It does not permit access to documents or materials entrusted to the AARPI that are protected by professional secrecy.

The right of access must not be exercised abusively, for example repeatedly for the sole purpose of disrupting the service concerned.

To keep the personal data it collects up to date, AARPI PROMARK AARON may ask clients and contacts to update their information.

The AARPI cannot be held responsible for a failure to update data where the client or contact has not updated it.

The right to erasure does not apply where processing is necessary to comply with a legal obligation. In other cases, clients and contacts may request erasure in the following limited circumstances:

·  The personal data is no longer necessary for the purposes for which it was collected or otherwise processed;

·  The data subject withdraws consent on which the processing is based and there is no other legal basis for the processing;

·  The data subject objects to processing necessary for the legitimate interests pursued by AARPI PROMARK AARON and there are no overriding legitimate grounds for the processing;

·  The data subject objects to processing of personal data for direct marketing purposes, including profiling;

·  The personal data has been processed unlawfully.

Clients and contacts are informed that this right is not intended to apply insofar as processing carried out by the PROMARK and AARON law firms forming the AARPI is lawful and all personal data collected is necessary for performance of the commercial contract.

AARPI PROMARK AARON provides data portability where data has been provided by clients or contacts themselves through online services offered by the AARPI and processing is based solely on their consent. In such cases, the data will be provided in a structured, commonly used and machine-readable format.

AARPI PROMARK AARON does not make automated individual decisions.

Clients and contacts may issue instructions concerning the retention, erasure and disclosure of their personal data after death. Specific post-mortem instructions and the exercise of their rights may be sent by email to contact@promark-aaron.com or by post to AARPI PROMARK AARON, 36 rue de Penthièvre 75008 Paris (France), accompanied by a copy of a signed identity document.

The rights described in this Policy are individual rights and may be exercised only by the person concerned in relation to their own information. To meet this requirement, AARPI PROMARK AARON verifies the identity of the person concerned.

Clients and contacts are informed on each personal-data collection form whether answers are mandatory or optional, by means of an asterisk.

Where answers are mandatory, AARPI PROMARK AARON explains the consequences of failing to provide them.

Clients and contacts grant AARPI PROMARK AARON the right to use and process their personal data for the purposes set out above.

However, enriched data resulting from processing and analysis carried out by AARPI PROMARK AARON (including usage analysis and statistics) remains the exclusive property of AARPI PROMARK AARON.

AARPI PROMARK AARON informs clients and contacts that it may engage processors of its choice to process their personal data.

The AARPI ensures that processors comply with their obligations under the GDPR.

AARPI PROMARK AARON undertakes to enter into a written agreement with each processor and to impose the same data-protection obligations as those applicable to itself. It also reserves the right to audit processors to verify compliance with the GDPR.

AARPI PROMARK AARON defines and implements the technical, physical or organisational security measures it considers appropriate to protect against accidental or unlawful destruction, loss, alteration or unauthorised disclosure of personal data.

These measures include, in particular:

·  Security measures for access to premises (locked offices, access badges, etc.);

·  Secured access to the AARPI’s computers and smartphones (with access codes changed regularly);

·  Login and password protection for all business applications;

·  Access-rights management for data;

·  VPN for remote connections;

·  Password protection for the Wi-Fi network.

The AARPI may use any third party of its choice to conduct vulnerability audits or penetration tests at intervals it considers necessary.

If the means used to ensure the security and confidentiality of personal data change, AARPI PROMARK AARON undertakes to replace them with means offering a higher level of performance. No change may result in a reduction in the level of security.

Where all or part of the processing is outsourced, the AARPI undertakes to impose contractual security guarantees on its processors through technical data-protection measures and appropriate human resources.

In the event of a personal data breach, AARPI PROMARK AARON undertakes to notify the CNIL in accordance with the GDPR.

If the breach is likely to result in a high risk to clients and contacts and the data has not been protected, the AARPI will:

·  Notify the affected clients and contacts;

·  Provide them with the necessary information and recommendations.

Clients and contacts whose personal data is processed are informed of their right to lodge a complaint with a supervisory authority, namely the CNIL in France, if they consider that the processing of their personal data does not comply with European data-protection rules.

CNIL – Service des plaintes

3 Place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07 (France)

Tel.: +33 1 53 73 22 22

This Policy may be amended at any time in the event of changes in legislation or case law, decisions and recommendations of the CNIL, or practices.

Any new version of this Policy will be brought to the attention of clients and contacts by any means determined by AARPI PROMARK AARON, including electronically (for example, by email or online).

For further information, please contact AARPI PROMARK AARON at: contact@promark-aaron.com.

For general information about personal-data protection, please visit the CNIL website: www.cnil.fr.