01 Controller
FORM. is a partnership (maatschap) operating as a law firm registered with the Dutch Bar Association (Nederlandse Orde van Advocaten). FORM. is the controller for the processing described in this notice. This notice explains how FORM. uses personal data relating to clients and prospective clients, their representatives, other people involved in legal matters, business contacts, website users, suppliers and applicants. Please contact team@formlegal.com for any queries in relation to this notice.
02 Data and purposes
FORM. processes client, prospective-client and contact data; identification, UBO, PEP, sanctions and source information; matter documents and correspondence; billing and financial data; information about counterparties and advisers; and supplier, recruitment, complaint, claim and security data. Depending on our dealings with you, this may include your name, role, organisation, postal and email addresses, telephone number, payment details, and information in your messages or matter documents. For applicants, it may include CVs, qualifications, work history and interview information. For website users, we may process limited technical information needed to operate and secure the website. Matter documents or due-diligence information may also contain special-category data, such as health information or political opinions, or information concerning criminal allegations, offences or convictions, where relevant and legally permitted.
Purposes include providing legal services, checking conflicts and client identification and acceptance, anti-money laundering where applicable, sanctions and professional compliance, billing and administration, website operation, information security and continuity, relationship management, recruitment, handling complaints, and establishing, exercising or defending legal claims.
03 Legal bases
FORM. relies on performance of a contract, or steps requested before entering into one, when you are personally a party to that contract. We rely on legal obligations for applicable identification, anti-money laundering, sanctions, professional and tax requirements. Our legitimate interests include providing legal services to organisational clients, managing relationships and suppliers, checking conflicts, operating and securing our website and systems, handling complaints, and establishing, exercising or defending legal claims; we assess these interests against your rights and interests. Recruitment processing is based on pre-contractual steps at your request and, where appropriate, legitimate interests in assessing applications. Where consent is required, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. Special-category data are processed only with an applicable Article 9 GDPR exception, including Article 9(2)(f) where necessary for establishing, exercising or defending legal claims. Criminal-offence data are processed only as permitted by Article 10 GDPR and applicable Dutch law. These conditions apply in addition to an Article 6 legal basis.
04 Sources and recipients
Data may come from clients, individuals, representatives, counterparties and advisers, public registers, regulators, sanctions and PEP sources, and due-diligence providers. We require information needed to provide our services and comply with applicable identification and professional obligations. Without the necessary information, we may be unable to accept or continue an engagement. Necessary disclosures may be made to courts, regulators, public authorities, counterparties, counsel, notaries, accountants, professional indemnity insurers and other experts, subject to applicable confidentiality duties and legal requirements. We use service providers for website and cloud services, practice and document management, accounting, due diligence, cybersecurity and AI or other digital services. Providers acting as processors are subject to data-processing agreements; some recipients act as independent controllers under their own legal obligations. Where anti-money laundering legislation requires us to report an unusual transaction, we report it to the relevant authorities.
05 AI and international transfers
FORM. may use AI and digital tools, subject to confidentiality, security and human review. AI tools are used to support, not replace, professional judgement: FORM. does not make decisions producing legal or similarly significant effects based solely on automated processing. Matter-specific client restrictions are respected. These tools may assist with research, analysis, drafting, summarisation, translation and administration using data relevant to the underlying matter or business purpose.
FORM. seeks EEA processing and storage where reasonably practicable. Storage location alone does not exclude transfers through support access or subprocessors. Where personal data are transferred outside the EEA, we rely on an applicable European Commission adequacy decision or appropriate safeguards, such as the European Commission's standard contractual clauses, with a transfer assessment and supplementary measures where required. Switzerland is outside the EEA; transfers there may rely on the applicable adequacy decision. You can contact team@formlegal.com for information about the safeguards applicable to your data and to obtain a copy, subject to necessary redactions to protect confidential information.
06 Retention
FORM. retains personal data for no longer than necessary for the purposes described in this notice. Retention depends on the nature of the information, the duration of the relevant matter, relationship or recruitment process, applicable legal and professional obligations, and any need to establish, exercise or defend legal claims. Limited information may be retained for conflict checks and continuing confidentiality obligations. We review the need for continued retention and delete or anonymise data when it is no longer required, subject to applicable statutory deletion requirements. In case of an ongoing client relationship, personal data that is part of a KYC file will be retained for as long as such relationship continues and for five years thereafter. In case of termination of a client relationship as a result of completion or termination of a project, personal data that is part of a KYC file will be retained for five years after completion or termination.
07 Security
FORM. uses appropriate technical and organisational measures, including access controls, managed and updated devices, incident procedures and supplier due diligence.
08 Rights and complaints
You may request access, rectification, erasure or restriction of your personal data and, where applicable, data portability. These rights are subject to applicable legal conditions, including protections for other people and professional secrecy. You have the right to object, on grounds relating to your particular situation, to processing based on legitimate interests. You may object to direct marketing at any time, in which case that processing will stop. Contact team@formlegal.com to exercise your rights or withdraw consent. If we have reasonable doubts about your identity, we may request additional information necessary to verify it. You may complain to the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or another competent supervisory authority, including where you habitually reside or work.