Privacy and cookie statement

Introduction

Wals Corporate Law B.V., trading under the name walslaw (the "Firm"), is the controller responsible for the processing activities described in this privacy and cookie statement (the "Statement").

Privacy is very important to the Firm. By means of this Statement we explain what happens to personal data provided to and collected by us. Personal data means any information relating to an identified or identifiable natural person, such as a name, address, e-mail address or IP address. Personal data is collected and processed by the Firm in accordance with this Statement and the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR").

This Statement was last updated on 21 August 2026. The Firm may change the Statement by amending this page. We therefore recommend checking this page from time to time.

Collection of personal data

We process personal data only where there is a legal basis under the GDPR. Depending on the purpose, that basis is the performance of an agreement, compliance with a legal obligation, our legitimate interests or, where required, the data subject's consent.

We process personal data of our clients and their employees, directors, direct or indirect shareholders and other affiliated persons where this is necessary to perform our engagement, to comply with a legal obligation or, where applicable, with the data subject's consent. Where data are required for an engagement, the legal basis is performance of the agreement where the data subject is a party, or otherwise our legitimate interest in providing legal services. We process, where required by applicable law, including anti-money laundering legislation, data such as a name, date of birth and a copy of an identity document on the basis of the relevant legal obligation. Client due diligence records under the Wwft are retained for five years after the business relationship ends or the transaction is carried out. Other personal data in the file are retained for five years after the file is closed, unless a longer statutory retention period applies. These periods do not apply to original documents.

We process the name, business email address, business telephone number and company address of contact persons at our business relations, including clients and suppliers. We use these data to provide our services and to send occasional newsletters, legal and regulatory updates, office announcements and invitations to events. The legal basis is our legitimate interest in maintaining our business relationships and communicating about our services. Where the law requires prior consent for such electronic communications, we send them only with that consent. Recipients may object to these communications at any time by using the unsubscribe option included in them or by contacting us. We retain these data for as long as necessary for these purposes.

We collect and process personal data submitted to us in connection with a job application. In the event a candidate is not hired, we delete the personal data after a period of one month, unless we have the candidate's consent to keep the personal data on file for a longer period of time in order to contact such candidate in the future with regard to job openings.

Third parties

We may share personal data, where necessary for our services, with recipients such as other law firms, notaries, tax advisors, counterparties, courts and public authorities. A transfer to a recipient outside the European Economic Area takes place only in accordance with Chapter V GDPR, for example on the basis of an adequacy decision or appropriate safeguards under art. 46 GDPR. Data subjects may request information about the applicable safeguards and, where relevant, how to obtain a copy of them.

The Firm shares personal data with third-party service providers, such as hosting and cloud service providers. Only personal data required for the provision of our services is shared with these service providers.

Recipients that determine the purposes and means of their processing are independent controllers and are responsible for their own processing. Where a third party processes personal data solely on behalf of the Firm, it acts as the Firm's processor and the Firm enters into a written processing agreement meeting the requirements of art. 28 GDPR.

Employees have access to personal data, to the extent required for the performance of their tasks. All attorneys and other employees of the Firm are subject to a duty of confidentiality.

Use of IT systems and artificial intelligence

The Firm does not take decisions based solely on automated processing, including profiling, within the meaning of art. 22 GDPR.

Unless expressly agreed otherwise in writing, the Firm does not input personal data or client-confidential information into publicly accessible or non-secured artificial intelligence systems. Where a third-party technology provider processes personal data on behalf of the Firm, it acts as a processor under a written agreement meeting the requirements of art. 28 GDPR, and appropriate technical and organisational measures are agreed before the system is used on client material.

Our approach to artificial intelligence, including the conditions a tool has to meet before it is adopted, is set out in Responsible use of AI.

Security measures

The Firm values privacy. The Firm has therefore implemented appropriate technical and organisational measures for the protection of personal data in accordance with applicable laws and regulations.

Rights of data subjects

Persons whose personal data we process have the rights set out below, subject to the conditions and limitations in the GDPR.

• Data subjects can ask us to confirm if we are processing their personal data.
• Data subjects can ask for access to their personal data.
• Data subjects can ask for their personal data to be corrected if it is factually incorrect.
• Data subjects can ask us to delete their personal data.
• Data subjects can ask us to restrict the processing of their personal data. Where the GDPR applies, they can also ask to receive the personal data they have provided to us in a structured, commonly used and machine-readable format, or to have it transmitted to another controller.
• Data subjects may object at any time to processing based on our legitimate interests, including direct marketing, and withdraw their consent at any time, without affecting the lawfulness of processing before withdrawal. They also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

Cookies

This website uses cookies. A cookie is a small text file placed on a visitor's device when they visit a website.

We use two categories of cookies. Functional cookies are strictly necessary to provide the website and remember visitors' cookie preferences. They are exempt from the consent requirement under art. 11.7a of the Dutch Telecommunications Act. Analytical cookies enable us to understand how the website is used, including which pages are read and how visitors reach the website. We use Google Analytics for this purpose. We place analytical cookies, and load Google Analytics, only after the visitor has given prior consent, in accordance with art. 11.7a of the Dutch Telecommunications Act and art. 6(1)(a) GDPR.

No analytical cookie is placed before the visitor has given consent. Until then, Google Analytics does not load and no data is sent to it. We do not use advertising or tracking cookies, we do not build profiles of visitors, and we do not share website data with third parties for advertising purposes.

Where analytical cookies process personal data, including the visitor's IP address, the legal basis for that processing is the visitor's consent under art. 6(1)(a) GDPR. Google acts as our processor and processes the data on our instructions under Google's data processing terms. Google may process data outside the European Economic Area; where it does, the transfer takes place on the basis of the European Commission's adequacy decision for the EU-US Data Privacy Framework or, where applicable, standard contractual clauses.

Visitors may withdraw or change their consent at any time through the "Cookie settings" link in the footer of every page. Withdrawing consent stops the processing and removes the analytical cookies from their device. Visitors may also delete or block cookies through their browser settings, although doing so may affect how the website functions.

Contact

For questions about this Statement, the processing of your personal data or the exercise of your rights, please contact us at info@walslaw.nl.