Privacy policy

Last amended: 1 July 2026

1. About Lawrence

Lawrence is the joint trade name under which two independent law practices operate: Lawrence Privacy (Due Diligence) & Tech B.V., established in The Hague and registered in the Dutch Commercial Register under number 85250414, and Feyr Law B.V., established in Eindhoven and registered under number 97705845. Each company conducts a legal practice for its own account and risk and is separately insured for professional liability in the manner prescribed by the Netherlands Bar (Nederlandse orde van advocaten).

For the processing of personal data, both companies act as independent controllers within the meaning of the General Data Protection Regulation (GDPR). Which company is the controller depends on the contractual relationship: the company that accepts the engagement or enters into the agreement is the controller for the related processing. The other company is not. Where the companies exchange data with one another to support each other or to carry out a conflict-of-interest check, each company is an independent controller for the data it receives in that context. For our website, for contact requests, for communication and marketing purposes and for job applications, Lawrence Privacy (Due Diligence) & Tech B.V. is the controller.

2. About this privacy statement

This privacy statement applies to the processing of personal data by Lawrence relating to our clients and their contact persons, business relations and network contacts, opposing parties and other third parties involved in a matter, our suppliers, visitors to our website, job applicants and other data subjects. It describes which personal data we process, for which purposes and on which legal basis, how long we retain data, with whom we share data and which rights you can exercise.

By personal data we mean, in line with the GDPR, any information relating to an identified or identifiable natural person: a person who can be identified, directly or indirectly, on the basis of that information.

3. Contact details

If you have a question about this privacy statement or about the way we process your personal data, or if you wish to exercise one of your rights, please contact us at info@lawrence-advocaten.nl. More information about our firm can be found at www.lawrence-advocaten.nl.

4. Which personal data we process and why

Below we describe, per category of data subjects, the purposes for which we process personal data. For each purpose we explain what we do, which data this concerns, on which legal basis the processing rests and, where this can be specified, how long we retain the data.

Clients and contact persons at clients

Legal services and invoicing. For the provision of our legal services and the invoicing thereof, we process the contact details of our clients and their contact persons (such as name, position, address, email address and telephone number), the data required to handle the matter and the financial data related to invoicing. If the client is a natural person who is itself a party to the engagement agreement, the legal basis is the performance of that agreement (Article 6(1)(b) GDPR). For contact persons who are not themselves party to the agreement, the processing rests on our legitimate interest in the efficient performance of the engagement (Article 6(1)(f) GDPR). We retain file data for the periods that follow from the statutory rules applicable to lawyers: in principle at least five years after closure of the file, on the basis of the limitation period for requesting documents (Article 7:412 of the Dutch Civil Code), and, in connection with the limitation period for professional liability, longer where applicable, up to a maximum of twenty years (Article 3:310 of the Dutch Civil Code).

Client due diligence and compliance with the Wwft. Prior to certain forms of service, we verify the identity of our clients and of ultimate beneficial owners (UBOs). For this we process, among other things, name, position, contact details, employer and a copy of an identity document, with the photograph and citizen service number (BSN) shielded. Where the law so requires, we report unusual transactions to the Financial Intelligence Unit. The legal basis is compliance with a legal obligation (Article 6(1)(c) GDPR) arising from the Dutch Money Laundering and Terrorist Financing (Prevention) Act (Wwft). We retain this data for five years after the end of the business relationship or after the execution of the relevant transaction.

Administration. For our financial administration, including the audit, we process the data required for that purpose. We retain the fiscally relevant data in fulfilment of our statutory retention obligation (Article 6(1)(c) GDPR, in conjunction with Article 52 of the Dutch State Taxes Act) for seven years after the end of the relevant financial year. For the remainder, our administration rests on our legitimate interest in sound business operations (Article 6(1)(f) GDPR).

Handling of complaints and disputes. If a complaint or dispute arises, we process the data required to handle it. The legal basis is our legitimate interest in the careful handling of complaints and in defending our rights (Article 6(1)(f) GDPR), in light of the complaints procedure applicable to us under the rules governing the legal profession. We retain this data until no later than two years after the conclusion of the complaint or of any resulting proceedings.

In the course of our services, clients may provide us with personal data that qualify as special categories of personal data (such as data concerning health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or data concerning a person’s sex life or sexual orientation), or that relate to criminal convictions and offences. We process such data only to the extent permitted and necessary for handling the matter, in particular for the establishment, exercise or defence of a legal claim (Article 9(2)(f) GDPR) and, for criminal data, within the limits set by the GDPR and the Dutch GDPR Implementation Act (Article 10 GDPR). Outside the handling of a matter, we process such data only on the basis of your explicit consent.

Opposing parties and other third parties involved in a matter

In files we also process personal data of persons who are not themselves clients, such as opposing parties, their advisers and other third parties involved in the matter. Which data this concerns is determined by the content of the file and by what our client provides to us; we therefore generally receive this data from our client and not from the data subject. The legal basis is our legitimate interest, and that of our client, in being able to provide legal assistance (Article 6(1)(f) GDPR). Where it concerns special categories of personal data, the processing rests on the necessity for the establishment, exercise or defence of a legal claim (Article 9(2)(f) GDPR); where this data includes personal data relating to criminal convictions and offences, we process it only within the limits set by the GDPR and the Dutch GDPR Implementation Act (Article 10 GDPR). We retain this data as part of the file and apply the same retention period as for the file.

Because we generally do not receive this data from the data subject, an obligation to inform that data subject applies in principle. Insofar as providing separate information is incompatible with our statutory duty of confidentiality (Article 11a of the Dutch Act on Advocates), the confidentiality of the file, the position of our client or the handling of the matter, we rely on the exceptions to that obligation, including Article 14(5) GDPR. Where it is possible, we do inform data subjects, including through this privacy statement.

Business relations, network contacts and newsletter subscribers

Communication and marketing. If you are an existing or former client, or a business relation whose contact details we obtained in the course of our services, we use your name, position and email address to send you newsletters, firm updates and invitations to events concerning similar services and legal developments. The legal basis is our legitimate interest in maintaining our relationships and informing you about developments relevant to you (Article 6(1)(f) GDPR), within the limits set by the rules on electronic communications. You can unsubscribe free of charge and easily in every message.

Subscribing to the newsletter via the website. If you subscribe to the newsletter via our website, or otherwise provide us with your details outside an existing client relationship, the processing rests on your consent (Article 6(1)(a) GDPR). You may withdraw this consent at any time, as easily as you gave it; the withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal. For communication and marketing purposes, Lawrence Privacy (Due Diligence) & Tech B.V. is the controller. We process this data until you unsubscribe or withdraw your consent.

Suppliers and contact persons at suppliers

Procurement and communication. For the procurement of products and services and the related communication, we process the contact details and, where applicable, the financial and order data of our suppliers and their contact persons. We process the procurement and the communication on the basis of the performance of the agreement with the supplier (Article 6(1)(b) GDPR). We retain the fiscally relevant data in fulfilment of our statutory retention obligation (Article 6(1)(c) GDPR, in conjunction with Article 52 of the Dutch State Taxes Act) for seven years after the end of the relevant financial year.

Visitors to our website

Responding to contact requests. If you contact us via our website, we process the data you provide (such as name, position and email address, and your telephone number if you provide it) in order to respond to your message. The legal basis is our legitimate interest in maintaining contact and developing our services (Article 6(1)(f) GDPR). We retain this data for as long as necessary to handle your message and for a limited period thereafter.

Cookies and similar techniques. Our website uses only functional cookies and analytical cookies with no or only minor consequences for your privacy. No consent is required for these cookies under Article 11.7a of the Dutch Telecommunications Act. We do not use tracking or marketing cookies and do not build profiles of you with these cookies.

Job applicants

Recruitment and selection. If you apply to us, we process the data you provide, such as your name, contact details and the data in your CV and cover letter. We use these solely to assess your application and to conduct the procedure. The legal basis is our legitimate interest in efficient recruitment and selection (Article 6(1)(f) GDPR). If no employment contract is concluded, we delete your data no later than four weeks after the procedure ends, unless you give us consent to retain your data for longer with a view to future vacancies (Article 6(1)(a) GDPR); in that case we retain it for no more than one year.

5. With whom we share personal data

Lawrence shares personal data with third parties only insofar as this is necessary for the provision of our services or to comply with a legal obligation, and always under appropriate safeguards for the protection and confidentiality of that data. We may share data with the following categories of recipients:

  • external service providers who process personal data on our behalf, such as providers of IT, hosting, email, software and cloud services, with whom we conclude a processing agreement where necessary;

  • professional service providers and other independent recipients, such as accountants, bailiffs, translators, couriers and other advisers, insofar as their involvement is necessary for our services, administration or legal obligations;

  • providers of AI systems that we use in our services and that act as processors in doing so; we engage them solely under a processing agreement and on the condition that they do not use the data for their own purposes, including training or improving their models;

  • opposing parties and their advisers, insofar as the handling of the matter so requires;

  • the other company operating under the name Lawrence, where the companies support each other or exchange data in the context of a conflict-of-interest check; this exchange rests on our legitimate interest in complying with the rules applicable to lawyers for the prevention of conflicts of interest (Article 6(1)(f) GDPR), whereby the receiving company is an independent controller for the data it receives;

  • courts, supervisory authorities and other government bodies, insofar as the handling of the matter or a legal obligation so requires;

  • a substitute lawyer or the external complaints officer, in the context of the substitution arrangement and the handling of complaints respectively, each acting as an independent controller for the data they receive;

  • a legal successor or a party involved in a proposed transfer of practice, merger or restructuring, solely insofar as this is necessary and permitted under the applicable confidentiality, professional and conduct rules for the legal profession and under appropriate confidentiality safeguards;

  • other third parties, solely where you have given your consent.

6. Transfers outside the European Economic Area

We process personal data in principle within the European Economic Area. Insofar as data are transferred in the course of our services to a country outside the European Economic Area, we do so only where an adequacy decision of the European Commission applies to that country, or where appropriate safeguards are in place, such as the standard contractual clauses (SCCs) adopted by the European Commission, binding corporate rules or an approved code of conduct or certification. This may occur in particular when using the providers of IT and AI services referred to in section 5.

7. Retention periods

We do not retain personal data longer than necessary for the purposes for which we process them, and in any event for as long as necessary to comply with our statutory retention obligations. The periods applicable per purpose are stated above with the relevant processing activities. Where this is necessary to serve a legitimate interest, for example in connection with an ongoing or threatened dispute, we may extend a retention period.

8. Security

We have taken appropriate technical and organisational measures to protect personal data against loss and against unlawful processing, and we keep these measures up to date. If you have questions about the security of your personal data, you can contact us using the details stated in section 3.

9. Automated decision-making

We do not take decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). Insofar as we use AI systems in our work, this is to support our lawyers; assessment and decision-making always remain with a human.

10. Your rights

As a data subject you have various rights regarding your personal data. You can:

  • request access to the personal data we process about you;

  • have inaccurate or incomplete data corrected or supplemented;

  • have your data erased (the right to be forgotten);

  • have the processing of your data restricted;

  • object to processing that rests on a legitimate interest; you can object at any time to the use of your data for direct marketing;

  • receive your data in a commonly used format or have it transferred to another party (data portability), insofar as the processing rests on your consent or on an agreement;

  • withdraw consent you have given.

These rights apply within the limits of the GDPR. We may refuse or restrict a request in whole or in part insofar as this is necessary to protect our statutory duty of confidentiality, the rights and freedoms of others, the confidentiality of our services, or the establishment, exercise or defence of legal claims.

If you wish to exercise one of these rights, or if you have a question about this privacy statement, please contact us at info@lawrence-advocaten.nl. We may ask you for additional information to establish your identity. We respond in principle within one month. If a request is complex or if we receive many, we may extend this period by no more than two months; we will inform you of this within one month of receiving your request.

If you believe that we are not handling your personal data with care, we would appreciate it if you would first discuss this with us. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). If you live or work in another Member State of the European Union, you can also contact the supervisory authority in that Member State.

11. Changes to this privacy statement

We may amend this privacy statement from time to time. We announce material changes on our website and, where appropriate, communicate them to our clients. We recommend that you consult this privacy statement regularly. The current version is always available on our website. Where, in addition to the Dutch text, we make an English translation available, the Dutch text prevails in the event of any discrepancy. This version was last amended on 1 July 2026.