Privacy Policy

1. Who We Are (Controller Identity)

This website and legal matching service is operated by Leadvise Legal B.V. ("we", "us", "our"). We are the data controller responsible for your personal data.

This policy should be read together with our Terms and Conditions. Where the two describe the same processing, this Privacy Policy is the authoritative description.

2. Data Protection Officer (DPO)

Based on the nature and scale of our data processing activities, we are not legally required to appoint a Data Protection Officer under Article 37 GDPR. However, all privacy-related inquiries are handled with the same level of care and urgency.

For all privacy matters, contact: leads@findlawyer.nl

3. What Personal Data We Collect and Why

3.1 Legal Help Request Form

What we collect:

• Required: Full name, email address, legal issue description, preferred location (city/region)
• Optional: Phone number, additional case details, preferred contact method, preferred language
• Special category data: Your legal issue description may contain sensitive information about your health, criminal matters, religious beliefs, or other protected characteristics

Why we collect it (Purpose): To match you with qualified English-speaking lawyers in your area who specialize in your legal matter

Legal basis:

• Contractual necessity, including steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) - to provide our lawyer matching service
• Explicit consent (Article 9(2)(a) GDPR) and, where applicable, establishment, exercise or defence of legal claims (Article 9(2)(f) GDPR) - for special category data only

Consequences of not providing data: Without required information (name, email, location, legal issue), we cannot match you with suitable lawyers and cannot provide our service.

Retention period:

• Active inquiries: until your inquiry is resolved and closed, or 12 months of inactivity, whichever occurs first;
• Inquiries where no introduction was made: 6 months from submission;
• Inquiries where an introduction was made: 12 months from the date of introduction, for quality assurance and complaint handling.

These periods do not apply to the separate records described in Section 3.7, which are kept for longer because we are required to be able to evidence them. After the applicable period expires, data is securely deleted or anonymised.

3.2 Newsletter Subscription

What we collect:

• Required: Email address
• Optional: Name, legal interests, frequency preference

Purpose: To send you legal tips, updates about our service, and information about Dutch law

Legal basis: Consent (Article 6(1)(a) GDPR)

How to withdraw consent: Click "Unsubscribe" in any email or email leads@findlawyer.nl

Retention: Until you unsubscribe or withdraw consent

3.3 Contact Form Inquiries

What we collect: Name, email address, message content

Purpose: To respond to your questions and provide customer support

Legal basis: Legitimate interest (Article 6(1)(f) GDPR) - we have a legitimate interest in responding to inquiries about our service

Retention: 12 months from last correspondence

3.4 Website Analytics and Cookies

What we collect:

• Technical data: IP address, browser type, device type, operating system
• Usage data: pages visited, time spent, click patterns, referral source
• General location data (city/region level only, derived from IP address)

Purpose: To understand how visitors use our site, improve user experience, and optimize our service

Legal basis: Consent (Article 6(1)(a) GDPR) for non-essential cookies; legitimate interest for strictly necessary cookies

Retention: Up to 14 months for user and event data in Google Analytics 4

Third parties: Google Analytics 4 (see Section 6 for details)

3.5 Partner Lawyer Information

What we collect:

• Professional details: Name, law firm, bar registration number, practice areas, languages spoken
• Contact information: Email, phone, office address, website
• Service data: Lead acceptance rate, response time, client feedback (aggregated and anonymized)

Purpose: To manage our network of partner lawyers and facilitate lawyer-client matches

Legal basis: Contractual necessity (Article 6(1)(b) GDPR)

Retention: Duration of partnership agreement plus 3 years for legal and contractual purposes

3.6 Job Applications

What we collect: Name, email, phone, CV, cover letter, work history, references

Purpose: To evaluate your application and contact you regarding employment opportunities

Legal basis: Legitimate interest (Article 6(1)(f) GDPR) and explicit consent for extended retention

Retention: 4 weeks after position is filled (unless you consent to longer retention for future opportunities)

3.7 Matchmaking Service Records

Where you purchase our paid matchmaking service, we keep a separate record of the contract itself. This is not the same as your case data, and it is kept for longer.

What we keep: the written offer we sent you; your written acceptance of it; your express request that we begin performance during the 14-day cooling-off period and your acknowledgement that the right of withdrawal is lost on full performance (see Article 15.5 of our Terms and Conditions); the date on which an introduction was provided; and the payment record.

Why: Dutch consumer law requires us to be able to demonstrate that these steps took place. Without these records neither of us could establish what was agreed if a dispute or a withdrawal request arises later.

Legal basis: Compliance with a legal obligation (Article 6(1)(c) GDPR) and our legitimate interest in establishing, exercising, or defending legal claims (Article 6(1)(f) GDPR); for financial records, Article 6(1)(c) GDPR in connection with Dutch tax law.

Retention: 5 years from the date the contract was concluded, reflecting the limitation period in Article 3:310 of the Dutch Civil Code. Payment and invoicing records are kept for 7 years as required by Dutch tax law.

3.8 How Matching Works

Matching is carried out on four criteria only: practice area relevance, geographic proximity, language compatibility, and Partner Lawyer availability. Whether a Partner Lawyer pays us for lead generation has no effect on ranking, ordering, or the number of referrals they receive. This is set out in full in Article 3.8 of our Terms and Conditions.

We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you. Software helps us shortlist Partner Lawyers against the criteria above, but a person reviews every match before an introduction is made. Your rights in relation to automated decision-making are described in Section 8.8.

4. Data Processing Summary Table

5. Who We Share Your Data With

5.1 Partner Lawyers (Independent Controllers)

When you ask us to find you a lawyer, we first put a summary of your matter to a small number of Partner Lawyers without your name or contact details, so they can tell us whether they can take it. Your name and contact details are shared only with the one lawyer you confirm you wish to proceed with. A case summary can identify someone indirectly, so we treat it as your personal data throughout and share no more of it than that assessment needs.

Partner Lawyers who tell us they cannot take your matter are required to delete the summary they received. That summary contains no details identifying you.

Important: Once we pass your name and contact details to a lawyer, that lawyer becomes an independent data controller in respect of that data from the moment of transfer, and handles it under their own privacy policy and their professional duty of confidentiality. We are not joint controllers with Partner Lawyers within the meaning of Article 26 GDPR.

5.2 Service Providers (Processors)

We work with trusted third-party service providers who process data on our behalf:

• Web hosting: Our website is hosted on WordPress.
• Email services: We use Google Workspace (Gmail) for email communication.
• Analytics: Google Ireland Limited (Google Analytics 4)
• Payment processing: If applicable, we use Mollie to process payments.

All processors are bound by Data Processing Agreements (DPAs) that comply with Article 28 GDPR.

5.3 Legal and Regulatory Authorities

We may disclose your data when required by law, including:

• Dutch tax authorities (Belastingdienst)
• Autoriteit Persoonsgegevens (Dutch DPA) upon official request
• Law enforcement agencies with valid legal orders
• Courts and tribunals in legal proceedings

5.4 Business Transfers

If Leadvise Legal B.V. is sold, merged, or undergoes restructuring, your personal data may be transferred to the new owner. You will be notified of any such change, and the new owner will honor the commitments made in this policy (or obtain your fresh consent if needed).

6. International Data Transfers

Your personal data is primarily stored and processed within the European Economic Area (EEA). When we use service providers located outside the EEA (such as Google Analytics with US-based parent company), we ensure appropriate safeguards are in place:

• EU-US Data Privacy Framework: For transfers to certified US companies
• Standard Contractual Clauses (SCCs): EU-approved contract terms for international transfers
• Adequacy decisions: Transfers to countries deemed adequate by the European Commission
• Technical measures: Encryption in transit (TLS) and at rest, access controls, pseudonymization where possible

For more information about specific safeguards for a particular transfer, contact leads@findlawyer.nl.

7. How We Protect Your Data

We implement technical and organizational security measures to protect your personal data against unauthorized access, loss, or misuse:

Technical Measures:

• TLS/SSL encryption for all data in transit
• Encryption at rest for databases containing personal data
• Secure password policies and multi-factor authentication on accounts used to access personal data
• Regular security patches and updates
• Firewall protection at hosting level
• Periodic review of access rights and security settings

Organizational Measures:

• Access to personal data limited to authorized personnel only
• Staff training on GDPR and data protection
• Confidentiality obligations for staff and contractors with access to personal data
• Data breach response plan and incident management procedures
• Privacy by design and by default in all new systems
• Regular review and update of security policies

Data breach notification: In the event of a personal data breach, we will notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours of becoming aware of it where the breach poses a risk to your rights and freedoms, as required by Article 33 GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay, as required by Article 34 GDPR.

8. Your Rights Under GDPR

Under the General Data Protection Regulation, you have the following rights regarding your personal data:

8.1 Right of Access (Article 15)

You have the right to obtain confirmation of whether we process your personal data and to receive a copy of that data along with information about how we use it.

8.2 Right to Rectification (Article 16)

You can request correction of inaccurate or incomplete personal data.

8.3 Right to Erasure / "Right to be Forgotten" (Article 17)

You can request deletion of your personal data when:

• The data is no longer necessary for the purpose it was collected
• You withdraw consent (where processing was based on consent)
• You object to processing based on legitimate interests
• The data was unlawfully processed
• Legal obligations require deletion

Limitations: We may need to retain certain data for legal compliance (for example financial records for 7 years) or to establish, exercise, or defend legal claims. In practice this means the matchmaking service records described in Section 3.7 are kept for their stated period even if you ask us to delete your case data.

8.4 Right to Restriction of Processing (Article 18)

You can request that we limit how we use your data while we verify its accuracy or assess your objection to processing.

8.5 Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, machine-readable format (e.g., CSV, JSON) and to transmit it to another service provider.

8.6 Right to Object (Article 21)

You can object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we have compelling legitimate grounds that override your interests.

8.7 Right to Withdraw Consent (Article 7(3))

Where processing is based on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal, and does not affect records we are required to keep under Section 3.7.

8.8 Right Not to be Subject to Automated Decision-Making (Article 22)

As explained in Section 3.8, we do not make decisions about you by automated means that produce legal effects or similarly significantly affect you. Should that ever change, you would have the right to request human intervention, express your point of view, and contest the decision. Contact leads@findlawyer.nl to exercise this right.

8.9 Right to Lodge a Complaint

If you believe we have violated your privacy rights, you can file a complaint with:

You also have the right to bring a claim before the competent court.

How to Exercise Your Rights

9. Cookies and Tracking Technologies

9.1 What Are Cookies?

Cookies are small text files stored on your device when you visit our website. They help us provide a better user experience and understand how our site is used.

9.2 Types of Cookies We Use

Strictly Necessary Cookies (No consent required):

• Session cookies - maintain your session as you navigate the site
• Security cookies - detect abuse and protect user accounts
• Load balancing cookies - distribute traffic across servers
• Cookie consent cookies - remember your cookie preferences

Analytics Cookies (Consent required):

• Google Analytics 4 - understand visitor behavior, traffic sources, and popular content
• Google Analytics 4 uses your IP address to derive an approximate location and does not store it in your analytics record

Marketing Cookies (Consent required, if used):

• Currently, we do not use marketing or advertising cookies
• If implemented in the future, we will obtain your explicit consent first

9.3 Cookie Consent Management

When you first visit findlawyer.nl, you will see a cookie banner asking for your consent to non-essential cookies. You can:

• Accept all: Allows all cookies including analytics
• Reject non-essential: Only strictly necessary cookies will be used
• Customize: Choose which categories of cookies to allow

Your cookie preferences are stored for 12 months. You can change your preferences at any time by clicking "Cookie Settings" in the website footer or by clearing your browser cookies.

9.4 Browser Controls

You can also control cookies through your browser settings:

• Most browsers allow you to block or delete cookies
• Note: Blocking strictly necessary cookies may affect website functionality
• For instructions, visit your browser's help section

Important: We do not use "cookie walls" that prevent you from accessing the website if you decline non-essential cookies. We do not use pre-ticked boxes for cookie consent.

10. Children's Privacy

findlawyer.nl is intended for adults aged 18 and over. We do not knowingly collect personal data from children under 16 years of age without parental consent, as required by Article 8 GDPR and the Dutch UAVG.

If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us immediately at leads@findlawyer.nl. We will promptly delete such information from our systems.

11. Third-Party Websites and Services

Our website may contain links to external websites, including:

• Partner lawyer websites
• Legal resource sites
• Social media platforms
• Government websites (e.g., Rechtspraak.nl, Government.nl)

Important: We are not responsible for the privacy practices of third-party websites. When you click a link to leave findlawyer.nl, you should review the privacy policy of the destination website. This Privacy Policy applies only to findlawyer.nl.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes in our data processing practices
• New legal requirements or regulatory guidance
• User feedback and best practices
• Introduction of new features or services

How we notify you of changes:

• Material changes: Email notification to registered users, prominent website notice, or pop-up notification
• Minor changes: Updated "Last Updated" date at the top of this policy

This policy is an information notice rather than a contract, so changes take effect once we have informed you of them. Where a change means we need your consent for something new, we will ask for that consent separately and specifically; we will not treat your continued use of the website as consent. You can exercise your rights under Section 8 at any time.

Version history: Previous versions of this policy are available upon request at leads@findlawyer.nl.

13. Legal Framework and Compliance

This Privacy Policy is designed to comply with:

• General Data Protection Regulation (GDPR) - EU Regulation 2016/679
• Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming) - national implementation law
• Dutch Telecommunications Act (Telecommunicatiewet) - regarding cookies and electronic communications
• Dutch Bar Association Rules - professional confidentiality requirements for legal services
• ePrivacy Directive - EU Directive 2002/58/EC (pending ePrivacy Regulation)

14. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or our data practices:

We aim to acknowledge privacy inquiries within 2 business days. Requests to exercise your rights under Section 8 are answered within the statutory period of 1 month.

15. Definitions

To help you understand this policy, here are definitions of key terms:

• Data Controller: The entity that determines the purposes and means of processing personal data (Leadvise Legal B.V. for this service)
• Data Processor: An entity that processes personal data on behalf of the controller (e.g., our hosting provider)
• Data Subject: The individual whose personal data is being processed (you)
• Personal Data: Any information relating to an identified or identifiable natural person (name, email, IP address, location, etc.)
• Special Category Data: Sensitive personal data requiring extra protection (health information, criminal records, religious beliefs, etc.)
• Processing: Any operation performed on personal data (collection, storage, use, sharing, deletion, etc.)
• Consent: Freely given, specific, informed, and unambiguous indication of your wishes (e.g., ticking an unticked box)
• Pseudonymization: Processing data so it can no longer be attributed to a specific individual without additional information
• Anonymization: Irreversible removal of all identifying information

16. Your Acknowledgment

This Privacy Policy tells you what we do with your personal data. It is an information notice, not an agreement you sign, and reading it does not in itself give us consent for anything.

Where we rely on your consent, we ask for it separately and specifically at the point it is needed: the cookie banner for non-essential cookies, the subscription form for our newsletter, and the tick box on the legal help form for any special category data in your description. You can withdraw any of those consents at any time, as described in Section 8.7.

Our other processing does not rely on consent. It rests on the legal bases set out against each purpose in Section 3, and your rights in Section 8 apply to all of it.

If you have questions about anything in this policy, contact us at leads@findlawyer.nl before using our service.