Privacy notice

1. Introduction

Nyblin Attorneys Ltd (Business ID 3428531-5, hereinafter referred to as “NyA”) processes personal data in the course of its business activities as a law firm.

Personal data refer to information concerning an identified or identifiable natural person, such as a name or e-mail address.

NyA ensures the lawfulness of the processing of personal data and respects privacy. NyA protects personal data in accordance with industry best practices in both manual and automated processing.

With this Privacy Notice, NyA provides information about the processing of personal data structured according to the following main points:

• processing of personal data in connection with a) assignments, b) client relationship management or marketing, and c) NyA’s website
• rights of the data subject

NyA provides information about what personal data it may process as a data controller in each context, the purposes of the processing and the legal grounds for the processing. NyA also provides information about the situations in which personal data may be disclosed to third parties and how long the data will be retained.

NyA also provides information about the data subject’s rights in relation to the processing of personal data and how the data subject can contact NyA as the data controller in the event that they have questions or comments about this Privacy Notice or the processing of personal data by NyA.

2. Processing of personal data in connection with assignments

​When NyA is offered an assignment and NyA assesses its possibilities of accepting and/or executes the assignment, NyA may collect, store and process personal data as described below.​

NyA may process the following personal data, among others.​

A client who is a natural person:

• name and contact details
• personal identification number or date of birth, nationality and a copy of a passport or other form of identity document with the relevant information, as well as information on whether the client is a politically exposed person or a family member or partner of such person, as the case may be
• information about whether the client is subject to any EU sanctions
• personal data relating to the assignment itself, including, on a case-by-case basis, data belonging to special categories of personal data

Natural person representing a corporate client:

• name and contact details, position or job title and employer
• information from Trade Register register extract of the corporate client
• personal identification number or date of birth, nationality and a copy of a passport or other form of identity document with the relevant information, information about the actual beneficiaries of the corporate client as well as information on whether the beneficiary is a politically exposed person or a family member or partner of such person, as well as information about whether the person is subject to any EU sanctions, as the case may be

Counterparty or natural person otherwise associated with the assignment:

• information corresponding to the above, where applicable, to the extent that the processing is necessary for the performance of the assignment​

The personal data are usually provided to NyA by the client, or NyA may collect personal data from public sources.​

Personal data may be processed for the following purposes:

• identification and identity verification of the legal and/or natural person upon receipt of the assignment, as well as verification of a potential conflict of interest and whether NyA can accept the assignment, taking into account, among other things, obligations based on mandatory legislation and NyA’s own risk management
• general purposes relating to the performance of the assignment, such as providing legal advice or asserting or responding to legal claims
• invoicing or other financial purposes

The legal grounds for the processing are, depending on the category of personal data, either the fulfilment of a legal obligation, the assertion or defence of a legal claim or the performance or enforcement of a contractual obligation. A legal obligation may be based solely on a regulation applicable exclusively to attorneys or, for example, on anti-money laundering and anti-terrorist financing legislation.

​Under no circumstances shall personal data be disclosed to third parties if such disclosure would constitute a breach of the attorney’s statutory duty of confidentiality. Personal data may be disclosed to third parties in the following situations:

• disclosure to the client’s insurance company, auditor, counterparty or counterparty’s counsel, public authority or other public official, court or arbitral tribunal
• disclosure if specifically requested or demanded by the client
• disclosure to a subcontractor of NyA in the event that this is required for the proper performance of the assignment
• disclosure to the competent authority where NyA is required to disclose information in order to comply with legal obligations relating to the prevention of money laundering and terrorist financing
• disclosure to NyA’s accountant, auditor or liability insurer

​​Personal data is not disclosed or transferred outside the EU/EEA unless the disclosure or transfer is necessary, for example, to enable cross-border legal proceedings or because the corporate client or its representative operates outside the EU/EEA. NyA ensures that legal grounds for transfer are used.​

Personal data is retained for as long as NyA is required to retain data related to assignments, for example under regulations applied to attorneys. As a rule, the retention obligation continues for ten years after the end of the assignment.​

3. Processing of personal data for client relationship management or marketing purposes​

NyA may collect, store and process personal data about a client or representative of a potential client or business partner for the purpose of managing the client relationship or for marketing purposes as follows:

• maintaining and developing the client relationship
• marketing NyA’s services to a natural person representing a client or potential client, unless they have opted out of marketing
• processing of personal data for the purpose of the person acting as a referral to another potential client, on the basis of separate consent​​​​

If an individual has expressed an interest in NyA’s seminars, other events or communications, NyA will collect, store and process personal data such as name and contact details, position or job title and information about the employer. NyA may also collect and process similar information about representatives of potential corporate clients from public sources.

Personal data may be processed for the purpose of sending and administering invitations and information, as well as for the organisation of seminars or other events.​​

The processing of personal data is based on the controller’s legitimate interest.

The data subject has the right to object to the processing of data concerning themselves for marketing purposes or to withdraw their previous consent.

No personal data is disclosed or transferred outside the EU/EEA.​

Personal data is retained for a maximum of two years from the date of the last contact with the data subject. ​

4. Processing of personal data on the NyA website​

When NyA's website is visited, personal data such as the IP address, the time and duration of the visit and information about cookies are stored.

NyA’s website only uses cookies that are necessary for the website to function. They are used to ensure the technical functionality of the website and are not used for any other purpose.​

5. Rights of the data subject


The data subject has the right to:

• request clarification as to whether NyA processes personal data concerning them
• check which personal data NyA processes about them, unless there is a legal reason for refusing the right of access
• request information from NyA about how their personal data are processed
• require NyA to rectify any incorrect or incomplete personal data relating to them
• withdraw their prior consent to the processing of personal data collected by NyA; in such case, NyA may, however, continue processing the data if required by mandatory law
• prohibit NyA from processing their personal data for marketing purposes
• on a case-by-case basis, require NyA to erase personal data concerning them; for example, in the event that the basis on which NyA originally processed the data no longer applies
• on a case-by-case basis, require NyA to restrict the processing of personal data, such as in the event of an allegation of inaccuracy of personal data; in this case, the data subject may request the restriction of processing for the duration of the investigation of the inaccuracy
• lodge a complaint about unlawful processing of personal data with a competent authority, such as the Data Protection Ombudsman in Finland​

If the data subject wishes to contact NyA regarding the processing of their personal data, they can send e-mail to the address where the first part is privacy and the end part @nyblin.eu.

NyA may amend this Privacy Notice by posting an updated version on its website. This notice is dated 5 March 2024.