Privacy Policy

At M&S Law, we take privacy and confidentiality matters very seriously. We have developed this Privacy Policy (the “Privacy Policy”) to clearly define our ongoing commitment to protecting privacy rights and to explain how we collect, use and disclose personal data when you interact with M&S Law.

We collect personal information from you in the course of our business, including through your use of our website, when you contact or request information from us, when you engage our legal or other services or as a result of your relationship with one or more person of our staff, business partners and clients.

This Privacy Policy is issued by the Luxembourg law firm M&S Law S.à r.l. (société à responsabilité limitée), a company established at 205, route d’Arlon à L-1150 Luxembourg, Grand Duchy of Luxembourg, and registered with the Luxembourg Trade & Companies Register under number B 215086 and with the Luxembourg Bar (“M&S Law”).

For the purpose of this Privacy Policy, M&S Law is considered as the data controller of your personal data as M&S Law determines why and how to process such personal data within the meaning of applicable data protection laws.

Any processing performed by M&S Law is made in accordance with applicable data protection laws, including but not limited to, the European General Data Protection Regulation 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

In this Privacy Policy, we use the following terms within the meaning of applicable data protection laws:

“personal data” which means any information allowing the direct or indirect identification of an individual;
“processing” which means any act made in relation to such personal data (e.g. collecting, storing, and transferring data);
“data subjects”, “you” and “your” refer to you as individuals whose personal data are being processed by M&S Law, or to individuals associated with you or our clients, suppliers, business partners, contacts, and any other third party of whom we collect personal data.

1. Collection of personal data

When do we collect your personal data?

We gather, retain, and handle personal information pertaining to individuals who interact with M&S Law. This encompasses various scenarios such as using our website, seeking legal consultation, advice, or assistance, providing services as a supplier, expressing interest in attending an event, contacting us for information, or engaging in any form of interaction or information exchange with us.

How do we obtain your personal data?

• We obtain information from you during our business acceptance procedures and throughout the provision of legal services as needed;
• We acquire information directly from you when you provide it to us or engage with us, such as interacting with our staff or registering for an event;
• Information about you may also come from other sources; for instance, we maintain the accuracy and currency of contact details using publicly available sources;
• Your personal information is collected as we monitor our technological tools and services, including our websites and email communications exchanged with M&S Law.

When we receive personal data indirectly concerning third-party individuals, the individuals providing M&S Law with such data commit to doing so in accordance with relevant data protection laws. Specifically, they agree to inform these third-party individuals about the processing carried out by M&S Law and, if necessary, provide them with this Privacy Policy.

Updating personal data: We strive to maintain accuracy in the personal data under our possession or control. However, individuals providing personal data are responsible for promptly notifying us of any changes to their information.
Refusal to provide personal data: You have the option to decline providing us with your personal data. However, please note that refusing to provide certain personal data (such as information required during our business acceptance process) would regrettably hinder M&S Law from engaging with you, providing services, entering into agreements, or upholding any existing agreements with you.

2. Types of personal data processed

We strive for transparency regarding our processing activities and their purposes. For more details on our processing activities, please refer to the relevant sections below:

(i) Clients and individuals associated with clients:

- Collection: We ask our clients to furnish us with personal data essential for conducting our business acceptance process and delivering our services. Occasionally, we process personal data concerning clients and associated individuals (such as their employees, managers, beneficial owners, etc.) obtained from third parties or public sources. This might occur, for instance, when a request is made on behalf of a client by their representative or external advisors.

- Types of personal data processed:

• Identification information (such as first name, family name, date and place of birth, gender, picture, copy of identity document).
• Contact information (such as phone and fax numbers, email address, country of residence).
• Financial information (such as identification and number of bank account, notably linked to billing).
• Criminal records when required and in accordance with applicable laws (such as anti-money laundering laws or when preparing and defending a case).
• Identification and background information provided by you or collected as part of our business acceptance process (such as data related to KYC).
• Personal information provided to us by or on behalf of our clients or generated by us in the course of providing services to them, which may include special categories of data.
• References information (such as, as the case may be, your details, the general scope of our mission, the legal services we provided you with and/or the transactions on which we assisted you, when M&S Law submits applications to be referenced in leading guides of lawyers worldwide).
• Types of services received or provided.
• Other relevant personal details (such as nationality, citizenship, family-related data, job title, function within a company, preferred language, dietary preferences, license plate).
• Footage from video surveillance cameras.
• Any other personal data related to the provision of M&S Law’s services to its clients.

In certain cases, some of the personal data we gather may be classified as falling within a special category under applicable data protection laws. This can include data collected during the preparation or defense of your case, or information regarding dietary or accessibility requirements to accommodate your needs during meetings at M&S Law’s premises. Such data will only be processed in accordance with relevant laws, specifically for the establishment, exercise, or defense of legal claims, or when courts are acting in their judicial capacity, or to fulfill any legal or regulatory obligations held by M&S Law. Additionally, these personal data will be subject to appropriate technical and organizational security measures.

(ii) Business contacts and prospects: - Collection: The personal data of business contacts and potential clients who are not clients of M&S Law and do not provide services to us are stored in a database and processed as outlined below. Most of the personal data we handle concerning business contacts and potential clients is information knowingly provided to us by these individuals (such as when they give a member of M&S Law a business card or request a call for information about M&S Law and our services). However, in certain cases, we may process personal data received from a third party or accessed from public sources.

- Types of personal data processed:

• Identification information (such as first name, family name).
• Business contact information (such as phone and fax numbers, email address).
• Other relevant professional details (such as nationality, preferred language, job title, function within a company).
• Any other personal data in relation with the conduct of M&S Law’s business.

(iv) Users of the M&S Law website:

- Collection: Several features on our website prompt you to provide us with personal information. Most of the personal data we handle regarding users of the M&S Law website is information voluntarily provided by these individuals (for example, when they reach out to obtain information about M&S Law and our services).
Additionally, we gather technical information, such as data from your website visits or related to materials and communications sent to you electronically. This technical information is often collected and processed through cookies, and further details can be found in our Cookies Policy.

- Types of personal data processed:

• IT-related information (such as record of your correspondence including e-mail address, terms of search).
• Identification information (such as your name).
• Contact and details information (such as postal address, e-mail address, phone numbers, country of residence, nationality, job title, function within a company).
• Types of services received or provided.
• Any other personal data in relation with the operation of the M&S Law’s website and business.

Our Privacy Policy does not apply to information collected on any third party website that may link to or be accessible from our website.

3. Legal basis for the processing of personal data

We will only process personal data where we have a lawful reason for doing so. The lawful basis for the processing of personal data performed by us will always be one of the following, depending on the concerned processing, nature of personal data and data subjects:

• it is necessary for M&S Law to take measures at your request prior to entering into a contract or for the performance of any contractual obligations towards you;
• it is necessary for M&S Law to be able to comply with legal obligations (including those imposed by virtue of applicable commercial, tax and anti-money laundering laws) as well as any regulatory obligations and to respond to requests and comply with requirements from public authorities and professional supervisory bodies;
• it is necessary for the establishment, exercise or defence of legal claims or proceedings;
• it is necessary for the purposes of the legitimate interests pursued by us or by a third party, such as, for us:

- to provide and improve our website, including auditing and monitoring its use;
- to provide and improve our services to you and to our clients, including handling the personal information of others on behalf of our clients;
- to provide information requested by you;
- to promote our services, including by sending legal updates, publications and details of events;
- to manage and administer our relationship with you and our clients (e.g. for billing purposes);
- to implement video-monitoring measures in respect of M&S Law’s premises, notably with a view to protecting our assets, in accordance with applicable legal and regulatory requirements;

• you have given your prior consent to the processing of your personal data for us to contact you and send you commercial communications (such as invitations to events and to our conferences, our newsflash, etc.) and your consent has been obtained pursuant to applicable laws

No automated decisions will be made in relation to the personal data processed.

4. Disclosure of personal data

To fulfill the purposes listed above, and in adherence to our ethical obligations (including professional secrecy requirements), we may disclose personal data to the following recipients:

• commercial partners;
• clients;
• external services providers (including IT services providers);
• subcontractors;
• third parties to which we provide services;
• professional advisors;
• purchasers or sellers of our assets and entities linked to M&S Law, if any;
• members of as well as public organizations, administrative or legal authorities and supervisory bodies, if applicable;
• professional associations;
• entities of the professional network which M&S Law adheres to.

Please note that certain recipients listed above may be situated outside the European Economic Area in countries that do not offer a level of protection equivalent to that granted in the European Union. Any transfer of personal data to such recipients will, depending on the nature of the transfer:

• Be safeguarded by appropriate measures such as standard contractual clauses approved by the European Commission. You can request a copy of these clauses by contacting us.
• Be otherwise authorized under applicable data protection laws, where such transfer is necessary for the performance or execution of a contract concluded in your interest between us and a third party, or for the establishment, exercise, or defense of legal claims, or for the performance of a contract between you and us.

5. Retention

M&S Law will retain your personal data only for the duration necessary to complete the relevant processing activity and/or for the retention period allowed or mandated by applicable laws.

6. Your rights

In relation to your personal data, you have the right to:

• access the personal data held about you and receive additional information about how it is processed;
• rectify or complete any inaccurate or incomplete personal data about you;
• seek the erasure of your personal data when its processing is no longer necessary for the purposes described above, when the processing is not or no longer lawful for any reasons, when you have withdrawn your consent to the processing according to applicable laws, when the erasure is necessary to comply with applicable laws or when you object to the processing in the absence of any overriding legitimate ground for such processing;
• object, on grounds relating to your particular situation, to any processing based on M&S Law’s legitimate interests;
• receive your personal data and transmit it to another data controller to the extent that the legitimacy of the processing lies on contractual performance and is carried out by automated means;
• withdraw any consent given to the processing at any time to the extent that your consent justified such processing;
• seek the restriction of the processing, for instance, when you contest the accuracy of the personal data.

We will only be able to accommodate requests related to the right to object, the right to erasure, and the right to restriction if (a) it does not conflict with or contravene a legal obligation of M&S Law (such as a legal requirement to retain the relevant personal data) or (b) any other impediment exists that prevents M&S Law from fulfilling such requests. M&S Law commits to handling each request at no cost and within a reasonable timeframe. M&S Law will address individual complaints and inquiries regarding privacy and will undertake investigations to resolve all complaints.

You may also lodge a complaint with the data protection authority in Luxembourg, the Commission Nationale pour la Protection des Données (the “CNPD”), or with your local data protection authority if you do not reside in Luxembourg. The CNPD can be contacted as follows:

7. Technical and organizational security measures

Safeguarding personal data from data breaches is a paramount concern for M&S Law. We employ suitable technical and organizational security measures, which may include password protection, physical locks, and other appropriate measures depending on the equipment used. These measures are designed to ensure a level of security commensurate with the risks associated with the processing and the sensitivity of the personal data involved.

Access to personal data is restricted to employees solely for the purpose of fulfilling their professional duties. They are bound by confidentiality obligations and receive training and documentation to enhance their proficiency and understanding of data protection matters.

8. Amendment

M&S Law retains the right to modify, supplement, and/or amend this Privacy Policy at any time. In such instances, we will notify you via email or other methods chosen by us and permitted under applicable law.

9. Contact and exercise of your rights

For any question or for exercising your rights by email at: info@moyal-simon.com