Processing of Personal Data at Merino Law Firm

Information pursuant to the General Data Protection Regulation (2016/679/EU)

Data Controller and Purposes

Merino Law Firm (Merino) is the data controller for the personal data we receive in connection with an engagement, or that is otherwise processed when an engagement is being prepared or administered (which also includes personal data regarding the contact person).

You are not required to provide us with personal information, but without it, we cannot accept an assignment because we cannot perform the necessary conflict-of-interest and anti-money laundering checks. We process data to conduct mandatory conflict of interest and anti-money laundering checks, to perform and administer assignments, to protect your interests, and for accounting and billing purposes.

Data may also be used for business and process development, market analysis, statistics, and risk management.

Legal basis for the processing

Data processed for the purpose of developing and analyzing our operations is processed on the basis of our legitimate interest in developing our operations and communicating with our contacts.

• For client matters (individuals or sole proprietorships): The legal basis for our processing is that it is necessary to fulfill our agreement with you, or to take steps prior to entering into our agreement.
• For representatives (client organizations): If you are a representative or contact person, the legal basis is a balancing of interests, which means that the processing is necessary for a purpose related to our legitimate interest in maintaining and fulfilling our obligations in client relationships.
• The same balancing of interests applies when we process personal data about you, as another natural person, in connection with assignments within Merino’s legal practice.

Special Types of Cases (Insolvency and Bankruptcy)

Merino has attorneys who serve as bankruptcy trustees and who, in that capacity, comply with the provisions of the General Data Protection Regulation. The bankruptcy trustee distinguishes between the processing of personal data that takes place within the scope of the bankruptcy estate’s operations and the processing that occurs as part of the law firm’s normal business activities. This distinction means that there may be two different data controllers in bankruptcy cases.

The following is the legal basis on which Merino processes personal data in these types of cases:

• Bankruptcy: As part of the law firm’s normal operations and the bankruptcy estate’s activities, personal data is processed to fulfill a legal obligation imposed on us by law. Processing may also take place to fulfill a contract.
• Liquidation: Personal data is processed as part of our fulfillment of a legal obligation imposed on us by law in our capacity as liquidators.
• Corporate Reorganization: Personal data is processed as part of our obligation to comply with legal requirements imposed on us by law in our capacity as corporate reorganizers.
• Wage Guarantee: Personal data is processed in order to comply with a legal obligation imposed on us by law; furthermore, this involves the exercise of official authority. The purpose of the processing is to ensure that eligible employees receive wage guarantee funds.

What personal data do we process?

The types of personal data processed include names, social security numbers, contact information (such as address, email address, and phone number), property identification numbers, vehicle registration numbers, IP addresses, bank details, payroll information, and other information relevant to the matter that arises in each individual case.

Personal identification numbers are used only when necessary to distinguish between individuals. Information regarding union membership and health data is used only when necessary, for example, to assess a claim for wage guarantee.

Disclosure of Information and Third Countries

We will not disclose personal data to third parties except in cases where:

1. This has been specifically agreed upon between the law firm and you.
2. This is necessary within the scope of a specific assignment to protect your rights.
3. This is necessary for us to fulfill a legal obligation or comply with a decision by a public authority or a court.
4. We engage third-party service providers to perform tasks on our behalf, such as auditors and bankruptcy appraisers.

Information may be disclosed to courts, government agencies, county administrative boards, counterparties, and their representatives.

Merino does not currently transfer data to third countries. Should this change, the necessary measures will be taken to ensure that the transfer is carried out in a lawful manner and that the data continues to be protected by the recipients outside the EU/EEA.

How long is the data retained?

In accordance with the law firm’s obligation under the Guidelines on Professional Conduct for Attorneys, personal data is retained for a period of ten years from the date the matter is closed, or for a longer period if required by the nature of the matter.

Data processed for the purpose of developing, analyzing, and marketing the law firm’s operations is retained for a period of ten years following the last contact.

Your rights

• Record Extract: You have the right to request information from the law firm regarding the use of your personal data free of charge. A fee may be charged if the record extract requires a significant amount of work on the part of the law firm. Anyone requesting personal data about themselves will be required to present identification at the law firm’s office to ensure that the correct person receives the correct information.
• Correction and Deletion: At your request or on our own initiative, we will correct or delete any inaccurate information, or restrict the processing of such information.
• Objection and restriction: You have the right to object to how we process your personal data. You may also request that we restrict the processing of your personal data.
• Data portability: You also have the right to receive your personal data in a machine-readable format. You have the right to request that your personal data be transferred to a third party if the processing is based on a contract or consent, provided that it is technically feasible.

Complaints, Changes, and Contact Information

If you are dissatisfied with our processing of your data, you may file a complaint with a supervisory authority, which in Sweden is the Swedish Data Protection Authority (formerly the Swedish Data Inspection Board): www.imy.se. You may also contact the supervisory authority in the country where you live or work.

Merino reserves the right to amend the above information without prior notice if necessary (for example, in the event of changes to laws, regulations, or interpretations).

Do you have any questions regarding our processing of personal data?Please contact us at reception@merino.se or by mail: Merino Law Firm, Olof Palmes gata 23, 111 22 Stockholm