PRIVACY AND DATA PROTECTION POLICY
We, Lexpert Advocates and Legal Consultants, a law firm registered in Riyadh, Saudi Arabia as detailed below, for and on behalf of all the Lexpert group entities operating in various jurisdictions (“we”, “us”, “our”), set out this Privacy and Data Protection Policy (“Policy”).
In compliance with Saudi Arabia and UAE law, and Regulation (EU) 2016/679 of the European Parliament and of the Council, dated 27 April 2016, regarding the protection of natural persons with regard to the processing of personal data, and repealing Directive 95/46/CE (“GDPR”) and any other applicable law, we guarantee the protection and confidentiality of personal data of any type provided to us by our clients, in accordance with the law.
We are committed to safeguarding the privacy of the personal information that we process in the course of our business, including the personal information we receive from you (“you” or “your”). This Policy describes how and why we collect, store and use personal information, and provides information about the rights of the individuals to whom such personal information relates.
The data provided will be treated in the terms established in the GDPR and other applicable laws. The website has adopted the levels of protection that are legally required, and has installed all the technical measures at its disposal to avoid loss, misuse, alteration, unauthorised access by third parties, as set out below. However, users are aware that Internet security measures are not infallible.
Name: Lexpert Advocates and Legal Consultants.
Registered office: Olaya District 7720, 12212 Riyadh, Saudi Arabia.
Registered as a law firm.
We may collect personal information from you in the course of our business, when you contact us or request information from us, when you instruct us to provide legal services, when you use our website (or other platforms), or as a result of your relationship with any of our staff or clients.
The personal information that we process includes:
We may collect your personal information:
We collect most of this information directly from you, or through your use of our website. However, we may also collect data about you from a third party source, such as our clients, your employer, other parties to matters in which we are involved, platform operators for technology used in our business (e.g. webinar platforms), other organisations that you have dealings with, regulators or other government authorities, credit reporting agencies, information service providers, or from publicly available records.
All data provided by our clients and/or visitors on the website or its staff will be included in the record of personal data processing activities, created and maintained under our responsibility, for the purposes of providing legal services to you; communicating with you in respect of legal developments and updates; managing our business relationship with you; complying with our legal and tax obligations (e.g. tax audits, anti-money laundering and sanctions checks, enquiries by regulatory authorities); keeping your contact details accurate; and for any purpose related and/or ancillary to any of the above or any other purposes for which your personal data was provided to us.
We are legitimised to collect and treat your data based on either or all of the following reasons:
We do not transfer your personal data to anyone, except to those public or private entities to which we are obliged to provide your personal data in order to comply with any law.
In the event that, apart from the aforementioned assumptions, we must disclose your personal information to other entities, we will previously request your permission through clear options that will allow you to decide in this regard.
We will not carry out international transfers of your personal data.
As an exception, we may transfer personal data from the European Economic Area (“EEA”) to other countries where we operate. When we do so, we use a variety of legal mechanisms, including contracts where required by applicable law, to help ensure your rights and protections. In addition, to the extent a transfer of EEA customer data is required for us to perform services for our EEA customers, we have intracompany Standard Contractual Clauses (“SCCs”) in place to validate the transfer.
The SCCs are written commitments between parties that can be used as a ground for data transfers from the EEA to third countries by providing appropriate data protection safeguards. SCCs have been approved by the European Commission and cannot be modified by the parties using them. We rely on SCCs for our data transfers where required and in instances in which they are not covered by an adequacy decision.
We will only retain your personal data for as long as necessary to achieve the purposes for which it was collected. When determining the appropriate retention period, we consider the risks involved in the processing, as well as our contractual, legal and regulatory obligations, internal data retention policies and our legitimate business interests described in this Policy.
In this sense, the website will keep the personal data once its relationship with you has ended, duly blocked, during the prescription period of the actions that may arise from the relationship maintained with the interested party.
Once blocked, your data will be inaccessible to the website, and will not be processed except to make it available to government authorities and/or courts, for the attention of possible responsibilities arising from the data treatment, or in any data protection claims.
We use all reasonable efforts to maintain the confidentiality of personal information processed on our systems. We maintain strict levels of security to protect the personal data we process against accidental loss and unauthorised access, processing or disclosure, taking into account the state of technology, the nature and the risks to which the data is exposed.
However, we cannot be responsible for the use you make of the data that you use on our website. Our staff follows strict privacy standards and if we hire third parties to provide support services, we require them to abide by the same standards and allow us to audit them for compliance.
We inform you that you may exercise the following rights:
To exercise your rights, you can do so free of charge and at any time by contacting us.
If you are based in Spain and understand that your rights have been neglected by us, you may file a claim with the Spanish Data Protection Agency, through any of the following means:
Filing a claim with the Spanish Data Protection Agency does not entail any cost and the assistance of a lawyer or attorney is not necessary.
Claims for data protection violations committed in countries other than Spain may be brought before the relevant competent authority.
We reserve the right to amend this Policy at any time, to adapt it to legislative or jurisprudential developments that may affect it.
