I. HSA LAWYERS B.V. 

HSA Lawyers B.V. (HSA Lawyers) is a Dutch law firm based in Den Haag, the Netherlands. 

II. GENERAL

HSA Lawyers acts as the data controller under the General Data Protection Regulation (GDPR) and the relevant implementing laws of the GDPR, as well as the provisions of other applicable laws, regulations, and rules.
HSA Lawyers processes your personal data when you use our legal services (Services). Our Services include legal assistance, your use of the application(s), website, and software that we offer.
HSA Lawyers reserves the right to modify this privacy statement. We will inform you when we make changes to the privacy statement. The latest version of our privacy statement is also available on our website at [https://www.hsalawyers.nl]. We also recommend periodically visiting our website and reviewing the available privacy statement there. 

III. WHERE DOES HSA LAWYERS’ STORE ITS DATA?

HSA Lawyers’ data is stored on servers within the European Economic Area (EEA). 

IV. WHAT PERSONAL DATA DOES HSA LAWYERS COLLECT FROM YOU AND FOR WHAT PURPOSES IS IT USED?

HSA Lawyers processes your personal data for specific purposes. Below, we indicate the data processed for each purpose. Personal data collected for the same purpose is grouped into one category.
Additionally, we specify the retention period for each category. Such personal data can be provided directly by you or collected by us.

a. Mandatory processing
When you become a client of HSA Lawyers, we process the following personal data to the extent necessary to comply with our mandatory legal administration and identification obligations: 

1. name
2. address
3. VAT identification number
4. date of issuance and expiration of your identification document
5. document number of your identification document
6. if required: a copy of your identification document Since we must comply with mandatory legal obligations, you are obliged to provide HSA Lawyers with the relevant personal data. You cannot object to the processing or request us to limit the processing thereof. The processing duration is 10 years. 

b. Processing necessary for the execution of our engagement (agreement) with you
HSA Lawyers processes the following personal data from you to the extent necessary for the execution of our service agreement with you:

7. name
8. business and/or private email address (including for contact about our Services)
9. business and/or private telephone number
10. other personal data that you provide to us in the context of our Services (such as
personal data in documents and information that you provide to us)
11. other personal data that you provide to us when you contact us.

You are obliged to provide the personal data mentioned under 1 up to and including 3 and cannot object to the processing, or request us to restrict the processing. If you do not provide the personal data mentioned under 1 up to and including 3, then we may terminate our engagement (agreement) with you.
If you do not provide the personal data referred to under 4 and 5, or wish the processing thereof to be restricted, this may have consequences for the execution of our service agreement with you. In such a case, we may terminate the engagement (agreement) with you.
The processing duration of the personal data referred to under 1 up to and including 5 is up to 2 years after the termination of the engagement (agreement) with you.

c. Processing to the extent necessary for protecting the legitimate interests of HSA Lawyers
1. For improving our Services:
- your name;
- other information you provide in an evaluation form or during an evaluation discussion with us. 

2. To inform you about other services that HSA Lawyers provides:
- email address (if you provide this when filling out the evaluation form) 

3. Marketing (if you are a client of HSA Lawyers):
- contact details 

4. (Job) Applications (as soon as you apply with us);
- Contact details
- Curriculum Vitae - Other information provided voluntarily
- As part of an assessment (investigation) that may be part of an application process, we receive the following personal data from the assessment agency:
-- name;
-- date of birth;
-- the results of the assessment (such as: strengths, areas for development, personality traits). 

You must provide the above personal data if you wish to use the respective Services mentioned in points 1 to 3, or if you wish to apply for a (job) position with us (point 4).
You can object to the processing already carried out of the respective personal data and the processing yet to be carried out. We will weigh your interests against our interests and decide whether we will follow up on your objection. If the processing of personal data is restricted, this may result in us no longer being able to provide the respective Service, or not being able to provide it properly.

If you object to the processing of your contact details for marketing purposes (see point 3), we will immediately stop the respective processing.
The processing duration of the personal data mentioned in points 1 up to and including 3 is 2 years after the end of our engagement (agreement) with you unless the processing is terminated earlier based on an objection raised by you.
For personal data processed during an application procedure (point 4), a different processing duration of 4 weeks after completing the application procedure applies, or 1 year if you have given permission for this. 

d. Processing with your consent
1. Upon your request, we can inform you about the Services we have rendered to you or you have followed or other services of HSA Lawyers:
- name
- organization
- email address 

2. We can inform you upon your request or answer your questions:
- name
- organization
- email address
- other personal data provided at the time you contact us. 

3. If you are not yet a client at HSA Lawyers, we can send you blogs, newsletters, and other marketing information upon your request:
- contact details
- interests

We only process the personal data for the respective Services mentioned in points 1 up to and including 3 if you have actually given your consent. Not providing the respective personal data for the Services mentioned in points 1 up to and including 3, or withdrawing your consent for processing, will not have negative consequences for you. The processing duration of the personal data for the Services mentioned in points 1 and 2 is up to 2 years after the termination of the service agreement with you. The personal data processed for the Service mentioned in point 3 will be processed until you indicate that you are no longer interested in the respective Service. You can unsubscribe by following the provided unsubscribe instructions, or by sending an email to info@hsalaw.nl with the instruction 'unsubscribe blog/newsletter/marketing (include what is applicable)’. Your unsubscribe request will be processed as soon as possible.

V. SHARING OF PERSONAL DATA 

a. No sale or trading of personal information
HSA Lawyers does not sell or trade personal information about our visitors and users to others. This is only different if we have indicated this in this privacy statement. 

b. Sharing with processors
HSA Lawyers may engage third parties who process your personal data on behalf of HSA Lawyers in the delivery of a Service to you. This third party is hereinafter referred to as ‘Processor’. HSA Lawyers uses the following types of Processors:

- Suppliers of relationship management software;
- Hosting provider(s);
- Suppliers of (data) storage of (personal) data, database management, and database maintenance;
- Analytical software to improve our Services, such as Google Analytics which is set up in accordance with the advice of the Dutch Data Protection Authority to be privacy- friendly so that no personal data is shared with Google. HSA Lawyers enters into processor agreements with all its Processors. The processor agreement stipulates that Processors may only process your personal data within the framework of the Services to be provided. HSA Lawyers is not liable if you provide additional information to Processors yourself.

c. Sharing of personal data with your permission
If you give your permission, HSA Lawyers can share your personal data with third parties. For example, HSA Lawyers works with specific service providers who can also offer their services to you directly. If you wish to use these services, we can provide your name and contact details to the relevant third party at your request so that they can contact you. 

d. Our legal responsibility
HSA Lawyers may share your personal data with third parties if:
- it is reasonably necessary or appropriate to comply with legal obligations;
- it is necessary to comply with legal requests from competent authorities;
- it is necessary to respond to any claims;
- it is necessary to protect the rights, property, or safety of HSA Lawyers and/or its employees, our clients and relations, or the public;
- it is necessary to protect HSA Lawyers and/or its employees, our clients and relations from fraudulent, abusive, inappropriate, or unlawful use of our Services.
HSA Lawyers will immediately notify you of a request from any competent authority regarding your (personal) data, unless this is not permitted under applicable law and/or regulations.

VI. MERGER OR SALE OF (A PART OF) THE BUSINESS OF HSA LAWYERS 

It may occur that HSA Lawyers discloses, shares, or transfers your personal data if we are going to transfer/sell, merge, or obtain financing for a part of our business. 

VII. PROTECTION OF PERSONAL DATA

HSA Lawyers takes appropriate technical and organizational security measures to protect your personal data. In protecting your personal data, we follow generally accepted standards. HSA Lawyers has already taken the following measures:
- Physical and electronic measures designed to prevent unauthorized access, loss, or misuse of personal data as much as possible have been taken; 
- Sensitive information is stored encrypted where possible;
- TLS (Transport Layer Security) technology is used to encrypt the transmission of sensitive information or personal data to HSA Lawyers (such as (account) passwords and identifiable information about payments);
- Periodic back-ups of (personal) data are made where reasonably possible;
- Vulnerabilities in the software are identified and addressed as quickly as reasonably possible. Our Processors are obliged in the processing agreement to secure (the processing of) your personal data. HSA Lawyers would like to point out that absolute security of data being processed (including storage and transmission) does not exist and therefore cannot and is not guaranteed.

VIII. HYPERLINKS TO THIRD-PARTY (WEB)SITES

On our website, there may be hyperlinks to third-party websites. We may also provide you with hyperlinks to third-party websites in the performance of our Services. HSA Lawyers has no control over and is not responsible for third-party websites, the information collected about you on those websites, the activities of these third parties (including with respect to the processing of personal data), and the privacy policy that is followed. We advise you to critically review the privacy policy of these third parties before you provide (personal) data. 

IX. DOES HSA LAWYERS SHARE YOUR PERSONAL DATA IN A WAY THAT IS NOT REGULATED IN THIS PRIVACY STATEMENT?

HSA Lawyers will inform you and ask for your consent before we share your personal data with others in a way that is not regulated in this privacy statement.

X. YOUR RIGHTS

a. You have the right to control, update, correct, or delete your personal data processed by us through a Service. If you wish to exercise this right, please contact us at the following email address: info@hsalaw.nl. Deleting personal data, restricting processing, or withdrawing consent may result in your inability to use the relevant Services. In some cases, as outlined in this privacy statement, we have the right to retain your personal data. To gain email access to your personal data, we will ask you to provide sufficient proof of your identity. If we are unable to sufficiently verify your identity, we may deny access to your personal data until we can verify your identity to our satisfaction. 

b. You have the right to request that we limit or stop the processing of your personal data in the future. We will comply with your request wherever possible. However, your request may lead to partial or complete inability to use the relevant Services. 

c. You have the right to request that we transfer the personal information we process about you to another party. You must specify which information should be transferred. We will fulfill such a request if it pertains to information processed based on Article 3.2 or 3.4 of this privacy statement, unless this information also contains personal data about other (natural) persons. HSA Lawyers will respond to your request to exercise any of the rights described here within 4 weeks. If we consider a request to be more complex, HSA Lawyers may extend the deadline by an additional 4 weeks. In such cases, we will inform you accordingly.

d. d. You have the right to file a complaint with a competent privacy authority about the way we process your personal data. In the Netherlands, you can address the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at https://autoriteitpersoonsgegevens.nl/en.

XI. CONTACT

Please contact us if you have any questions or comments about this privacy statement, by sending an email to info@hsalaw.nl.

See our Complaints Procedure here.