Privacy Notice

Last updated: 26 March 2024

I WHO IS THIS NOTICE FOR?

This Privacy Notice applies to the processing of personal data by BDK Advokati (as defined in Section II below). The processing concerns personal data of the following categories of individuals:

“Candidates”: natural persons who apply for positions at BDK Advokati, or are approached by BDK Advokati for the purposes of (potential) recruitment;
“Internship Candidates”: law students who apply for BDK Advokati’s internship programme;
“Clients”: actual or potential clients who are natural persons; individuals working for actual or potential clients that are legal entities (this includes shareholders, contact persons, signatories of agreements entered into with BDK Advokati, and any client’s employees or contractors); and suppliers or customers of BDK Advokati’s actual or potential clients;
“Counterparties”: actual or potential clients’ counterparties who are third-party natural persons; and individuals working for actual or potential clients’ counterparties that are legal entities (this may include shareholders, contact persons, lawyers for the counterparties, or other individuals whose data need to be processed for BDK Advokati’s provision of legal support);
“Competition”: lawyers practicing in Serbia, Montenegro, and Bosnia and Herzegovina;
“Website Visitors”: visitors of this website (for more details, see our cookie policy); and
“Suppliers”: contact persons of the entities and entrepreneurs which supply goods and services to BDK Advokati (for example: office suppliers; providers of equipment; providers of IT, transportation, and courier services; translation agencies; and travel agencies); and signatories of contracts between BDK Advokati and the entities and entrepreneurs which supply goods and services to BDK Advokati.

References in this notice to “you” or “your” are references to individuals whose personal data BDK Advokati processes, as explained above.

BDK Advokati is committed to protecting the privacy and security of your personal data. This notice explains how BDK Advokati collects, uses, and discloses your personal data.

II WHO IS THE DATA CONTROLLER?

BDK Advokati advokatsko ortačko društvo Beograd is the sole data controller in relation to the processing of personal data of the following data subjects:

Candidates and Internship Candidates, applying for positions or internships in BDK Advokati advokatsko ortačko društvo Beograd;
Suppliers, in the context of their supply of goods and services to BDK Advokati advokatsko ortačko društvo Beograd; and
Website Visitors and Competition.

Additionally, BDK Advokati advokatsko ortačko društvo Beograd and independent attorneys-at-law and counsels in Belgrade, Podgorica, and Banjaluka, who cooperate with BDK Advokati advokatsko ortačko društvo Beograd, act as joint data controllers. This applies to the processing of personal data of

Clients and Counterparties: individual attorneys-at-law and counsels are joint controllers of personal data related to a legal matter when they are substantively involved in the provision of legal services for that specific matter;
Candidates and Internship Candidates applying for positions or internships with independent attorneys-at-law in Podgorica or Banjaluka: individual attorneys-at-law and counsels in Podgorica or Banjaluka are joint controllers with BDK Advokati advokatsko ortačko društvo Beograd if they lead the relevant projects in which the candidates would be involved; and
Suppliers, in the context of their supply of goods and services to the independent attorneys-at-law and counsels in Podgorica or Banjaluka.

Throughout this Privacy Notice, the terms “BDK Advokati”, “we”, “us”, and “our” are used as follows:

solely to refer to BDK Advokati advokatsko ortačko društvo Beograd, when it acts as the sole data controller, and
jointly to refer to BDK Advokati advokatsko ortačko društvo Beograd and the aforementioned independent attorneys-at-law and counsels, when acting as joint controllers.

III WHICH PERSONAL DATA DO WE PROCESS AND WHY?

For details about the data that we process about you, and the purposes of the processing, please refer to section XIII Specifics of the processing.

IV WHAT IS THE LEGAL BASIS FOR PROCESSING PERSONAL DATA?

We use your personal data based on various legal grounds, as outlined below. For further information about the legal bases applied to the processing of specific categories of your personal data, please refer to section XIII Specifics of the processing.

Processing of your personal data is based on:

legitimate interests: where it is necessary for our legitimate interests or those of a third party, provided that your fundamental rights do not override such interests. Before we process your data on this basis, we consider and balance any potential impact on your fundamental rights and freedoms. Where our processing is based on legitimate interests, you can request information on the balancing test we have conducted using the contact details provided in section XII Contact us below. You are entitled to object to the processing of your data based on legitimate interests;
consent: where you have given us consent to process your personal data. When processing is based on your consent, you have the right to withdraw consent at any time;
contractual necessity: where it is necessary for the performance of a contract with you or in order to take steps at your request prior to entering into such a contract; or
legal obligations: where it is necessary for compliance with a legal obligation to which we are subject.

V HOW DO WE OBTAIN YOUR PERSONAL DATA?

We obtain your data through various means, including direct interactions with you and from other sources, such as third parties and publicly available information. Our methods of data collection encompass:

interactions with you: you provide personal data to us through our interactions via phone, email or mail, social media, our website forms, or in person;
third parties: we collect your data from third parties, such as: the employer or company you are engaged with; human resources and consulting partners of BDK Advokati; individuals or entities provided by you as references in the course of the recruitment process; faculty of law you are attending; your business partner where we process your data to provide legal support to your business partner (our client); and your opposing party in a legal matter (our client);
cookies: when you visit our website, we gather information about your use of the website by using cookies; and
publicly available sources: we process your data obtained from publicly available sources, including public registers (such as business registers agency), the website of the law firm with which you are associated as a lawyer, online resources for legal professionals, and business networking sites like LinkedIn.

In addition to these methods, we also generate data internally. This includes creating documents or reports that might contain your personal information, such as candidate evaluation reports.

VI WITH WHOM DO WE SHARE YOUR PERSONAL DATA?

We will share your personal data with the following categories of recipients, on a need-to-know basis:

We will share the personal data of Clients and Counterparties with:
- BDK Advokati offices and attorneys at law associated with BDK Advokati. Depending on the circumstances and law applicable to the specific matter, the provision of our services may require that we transfer your personal data among our various offices and attorneys at law. This ensures the most efficient and highest quality of service provision; and
- lawyers and other professional counsels engaged in the matter or cooperating with BDK Advokati. In certain instances, we collaborate with third-party lawyers and other professional counsels. This, for example, includes seeking support for matters involving foreign law or issues that fall outside our area of expertise. Our cooperation with these external professionals ensures comprehensive and expert handling of your case.
We will share the personal data of Clients and Competition with legal directories, to inform them about leading legal practitioners and to allow them to contact our Clients to request feedback regarding the services we have provided to them.
We will share the personal data of all data subjects with:
- public authorities, courts and other persons as required by law or necessary for legal proceedings; and
- companies supplying us with products or services (such as IT systems delivery and IT support, and human resources services) that we use in the course of our activities.

VII TO WHICH LOCATIONS DO WE TRANSFER YOUR PERSONAL DATA INTERNATIONALLY?

We will transfer your personal data abroad only if:

the country to which the data are transferred is a party to the Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data, or the European Commission has granted the adequacy decision to that country; or
for transfers outside of
- Serbia, we use the Standard Contractual Clauses adopted by the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia, which set forth the minimum conditions to be met for the personal data to be adequately protected; or
- Montenegro or Bosnia and Herzegovina, you have consented to the transfer of your data.

If you require further information about these safeguards that we provide, you can request it by using the contact details provided in section XII Contact us below.

Other than in exceptional cases in which a transfer may occur for different reasons or to another destination, we will transfer the personal data to the following locations:

personal data of Candidates, Internship Candidates, Clients, Counterparties, Competition, and Suppliers:
- to the Netherlands, where Microsoft servers are located. The transfer occurs when the personal data are included in emails within BDK Advokati’s mailboxes;
personal data of Clients and Counterparties:
- to Serbia, Montenegro, and Bosnia and Herzegovina, where BDK Advokati advokatsko ortačko društvo Beograd and independent lawyers cooperating with BDK advokati advokatsko ortačko društvo Beograd are located. The transfer occurs when the provision of our service in a specific matter requires that we transfer your personal data among our offices and attorneys at law located in different countries;
- to the United States or Member States of the European Union, when a Client is located there and the legal advice which we prepare for the Client contains personal data;
Clients, Counterparties and Competition personal data:
- to the United Kingdom, where legal directories with whom we may share personal data are located; and
Website Visitors’ personal data:
- to the United States, where our cookie providers are located.

VIII HOW DO WE PROTECT YOUR PERSONAL DATA?

We use various technical, organisational, and personnel security measures to protect your personal data from unauthorised access, use, disclosure, alteration, or destruction, in accordance with applicable data protection regulations. The safeguards that we implement include pseudonymising and encrypting personal data, ensuring continuous confidentiality, integrity, availability, and resilience of processing systems, timely restoring data in case of incidents, and regular testing to assess and enhance the effectiveness of security measures.

IX HOW LONG DO WE KEEP YOUR PERSONAL DATA?

We will retain your personal data only for as long as necessary to fulfil the purposes for which we collected the data. For further information about the retention periods we apply to specific categories of your personal data, please refer to section XIII Specifics of the processing. We may retain your personal data for longer periods than those indicated in section XIII Specifics of the processing where necessary to fulfil a legal obligation which requires processing according to applicable law or in order for BDK Advokati to be able to establish, enforce or defend against legal claims.

X WHAT RIGHTS DO YOU HAVE REGARDING YOUR PERSONAL DATA?

Under applicable data protection laws, you have data subject’s rights including:

right of access: you can request information about how we process your personal data and obtain a copy of your personal data;
right to rectification: you can ask us to correct any inaccuracies or incomplete personal data;
right to erasure: in certain circumstances, you can request the deletion of your personal data;
right to restriction of processing: you can request that we limit the processing of your personal data in certain situations;
right to object to processing: you have the right to object to the processing of your personal data in specific circumstances;
right to data portability: you can request the transfer of your personal data to another organisation or to yourself, under certain conditions;
right to withdrawal of consent: you have the right to withdraw your consent for the processing of your personal data at any time;
right to lodge a complaint with a supervisory authority: if you consider that the processing of personal data relating to you infringes the applicable data protection regulation, you can file a complaint with the relevant supervisory authority:
- Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia, always;
- Agency for Personal Data Protection of the Republic of Montenegro, for the processing of personal data for which BDK Advokati advokatsko ortačko društvo Beograd and an independent attorney-at-law, counsel, and consultant in Podgorica are joint data controllers; or
- Agency for Personal Data Protection of Bosnia and Herzegovina, for the processing of personal data for which BDK Advokati advokatsko ortačko društvo Beograd and an independent attorney-at-law, counsel, and consultant in Banjaluka are joint data controllers.

If you need more information about your rights, please let us know using our contact details provided in section XII Contact us below.

XI CAN YOU REFUSE TO PROVIDE US WITH YOUR PERSONAL DATA?

When processing your personal data is necessary for us to fulfil a legal obligation (such as an obligation related to anti-money laundering or restriction on the provision of services to individuals included in blacklists), or to perform or enter into a contract with you (as specified in XIII Specifics of the processing, column Legal basis), the provision of your personal data is voluntary, but your failure to provide personal data to BDK Advokati may result in our inability to establish or maintain the relevant relationship with you (for example, to provide services to you or receive services from you, or to consider you for a position at BDK Advokati).

XII CONTACT US

If you have any questions about this notice, including any requests to exercise your rights, please contact us at:

BDK Advokati
Bulevar kralja Aleksandra 28
11000 Beograd
Email: office@bdkadvokati.com
Phone: +381 11 3284 212

XIII SPECIFICS OF THE DATA PROCESSING

CANDIDATES

Personal data	Purpose	Legal basis	Retention period
(i) information contained in the Curriculum Vitae: – name and surname; contact details (email address, phone number, postal address, city, country); – education details; – work experience (such as previous employers and departments; previous job titles; duration of employment at the previous companies); – languages; – skills; and – any other information that you may include in your CV; (ii) references, when you provide them; (iii) motivation letter; (iv) your responses to interview questions, such as: – details on university grades; – reasons for job change; – financial expectations; – notice period; and – preferred department; (v) results of the tests on general culture, logical thinking and English-language writing; (vi) candidate evaluation reports: HR generates concise reports for equity partners, which include your name, reasons for recommending your hiring, and test results.	– identifying and engaging skilled and experienced talents; – ensuring an efficient recruitment process that will attract talented individuals; – contacting the candidate; – making a decision about the candidate’s recruitment; – determining the terms on which the candidate will work at BDK;	– BDK Advokati’s legitimate interest: selecting the best candidates for the relevant positions; – taking steps prior to entering into a contract: for shortlisted candidates;	– six months from the date when we notify the unsuccessful candidate of the outcome of the recruitment process.
	– contacting rejected candidates in relation to other vacant positions.	– consent.	– If the candidate consents, one year after the date when we notify the unsuccessful candidate of the outcome of the recruitment process.

INTERNSHIP CANDIDATES

Personal data	Purpose	Legal basis	Retention period
(i) information contained in the Curriculum Vitae: – name and surname; contact details (email address, phone number, postal address, city, country); – education details; – work experience (such as previous employers and departments; previous job titles; duration of employment at the previous companies); – languages; – skills; and – any other information that you may include in your CV; (ii) references, when you provide them; (iii) motivation letter; (iv) your responses to interview questions, such as: – details on university grades; – preferred department; (v) results of the tests on general culture, logical thinking and English-language writing;	– identifying and engaging skilled and experienced talents; – ensuring an efficient recruitment process that will attract talented individuals; – contacting the candidate; – making a decision about his/her internship.	– BDK’s legitimate interest: selecting the best candidates for the internship. – taking steps prior to entering into a contract: for shortlisted candidates.	– unsuccessful candidates: six months from the date when we notify the candidate of the recruitment process outcome. – successful candidates: until the end of the internship period.

CLIENTS

a) actual or potential clients who are natural persons

Personal data	Purpose	Legal basis	Retention period
– name and surname;	– conflict of interest assessment;	– BDK Advokati’s legitimate interest: verifying the absence of conflict of interest.	– for the duration of the cooperation between BDK Advokati and the client.
– name and surname; – ID number; – contact details (postal address, email address and telephone number); – emails sent/received to/from you; – signature in agreements signed with BDK Advokati; – information relevant for the provision of legal advice to the client, which vary depending on the matter.	– communication related to the matter (e.g. receiving information and instructions, handling administrative tasks, invoicing, etc.); – provision of legal advice;	– performance of a contract or taking steps prior to entering into a contract; – BDK Advokati’s legitimate interests: communicating with the potential client before being formally engaged and, once BDK Advokati has been formally engaged, performing the tasks agreed with the client and maintaining commercial relationship with the client.	– for the duration of the cooperation between BDK Advokati and the client, or until all invoices have been resolved, whichever is later.
	– marketing-related actions (e.g. sending newsletters, inviting you to events, pitching for potential new work, etc.); – asking for feedback (legal directories may approach the contact persons requesting feedback of BDK Advokati’s advice).	– BDK Advokati’s legitimate interest: marketing.	– two years from the last contact with the client
	– record-keeping and archiving.	– legal obligation: keeping records and documents entrusted by the client (Legal Profession Act, Article 31)	– permanently – personal data contained in: register of clients; final decisions in civil, criminal, and non-contentious proceedings; documents, items, photographs, and similar materials entrusted by the client as evidence in proceedings; case files in which individuals known in public, scientific, or cultural life, or significant in these spheres and other fields of social life, appear as clients; real estate transaction contracts; records of returning case files to the client; case files where BDK Advokati acted as a guardian or temporary representative; business records; and final accounts. – in case of legal proceedings: two years after the termination of the proceedings – personal data contained in the correspondence and other documentation that forms an integral part of the case but were not introduced as evidence in the proceedings.

b) individuals working for actual or potential clients that are legal entities

Personal data	Purpose	Legal basis	Retention period
– names and surnames of shareholders.	– conflict of interest assessment;	– BDK Advokati’s legitimate interest: verifying the absence of conflict of interest.	– for the duration of the cooperation between BDK Advokati and the client.
– information about contact persons: – name and surname; – company; – position; – professional contact details (postal address, email address and telephone number); and – emails sent/received to/from you.	– communication related to the matter (e.g. sending fee proposal, formalising engagement letter, receiving information and instructions, handling administrative matters, invoicing, etc.);	– BDK Advokati’s legitimate interests: communicating with the potential client before being formally engaged and, once BDK Advokati has been formally engaged, performing the tasks agreed with the client and maintaining commercial relationship with the client.	– for the duration of the cooperation between BDK Advokati and the client, or until all invoices have been resolved, whichever is later.
	– marketing-related actions (e.g. sending New Year’s presents, inviting the contact persons to events, pitching for potential new work, etc.); – asking for feedback (legal directories may approach the contact persons requesting feedback of BDK Advokati’s advice).	– BDK Advokati’s legitimate interest: marketing.	– two years from the last contact with the contact persons
– information about signatories of the engagement agreement with BDK Advokati or documentation relevant within the context of the legal advice/transaction: – name and surname; – capacity in which they act; and – document signed by them.	– preparing the relevant documentation.	– BDK Advokati’s legitimate interests: formalizing the contractual relationship, and performing the tasks agreed, with the client.	– for the duration of cooperation between BDK Advokati and the client, or until all invoices have been resolved, whichever is earlier.
– information relevant for the provision of legal advice to the client, including: – name and surname; – address; – phone number; – work post; – capacity; – salary; – signature; – copies of the data subject’s communication with the client;	– providing legal advice to clients; – representing the client before authorities; – communication with the counterparty (e.g. negotiating or sending cease and desist letters).	– BDK Advokati’s legitimate interest: performing the tasks agreed with the client.	– for the duration of cooperation between BDK Advokati and the client, or until all invoices have been resolved, whichever is later.
– any of the above information.	– record-keeping and archiving.	– legal obligation: keeping records and documents entrusted by the client (Legal Profession Act, Article 31)	– permanently – personal data contained in: register of clients; final decisions in civil, criminal, and non-contentious proceedings; documents, items, photographs, and similar materials entrusted by the client as evidence in proceedings; case files in which individuals known in public, scientific, or cultural life, or significant in these spheres and other fields of social life, appear as clients; real estate transaction contracts; records of returning case files to the client; case files where BDK Advokati acted as a guardian or temporary representative; business records; and final accounts. – in case of legal proceedings, two years after the termination of the proceedings – personal data contained in the correspondence and other documentation that forms an integral part of the case but were not introduced as evidence in the proceedings.

c) suppliers or customers of our actual or potential client

Personal data	Purpose	Legal basis	Retention period
– information relevant for the provision of legal advice to the client, including: – data about the client’s suppliers or customers whose personal data we process in order to provide legal advice to the client: – name and surname; – address; – capacity; – data subject’s written communication with the client; – data about the data subjects of the client as the data controller, who address BDK Advokati as the client’s data protection representative: – name and surname; – email address; – information provided by the data subject in their request.	– providing legal advice to clients; – representing the client before authorities;	– BDK Advokati’s legitimate interests: performing the tasks agreed with the client.	– for the duration of cooperation between BDK Advokati and the client, or until all invoices have been resolved, whichever is later.
	– record-keeping and archiving.	– legal obligation: keeping records and documents entrusted by the client (Legal Profession Act, Article 31)	– permanently – personal data contained in: register of clients; final decisions in civil, criminal, and non-contentious proceedings; documents, items, photographs, and similar materials entrusted by the client as evidence in proceedings; case files in which individuals known in public, scientific, or cultural life, or significant in these spheres and other fields of social life, appear as clients; real estate transaction contracts; records of returning case files to the client; case files where BDK Advokati acted as a guardian or temporary representative; business records; and final accounts. – in case of legal proceedings, two years after the termination of the proceedings – personal data contained in the correspondence and other documentation that forms an integral part of the case but were not introduced as evidence in the proceedings.

COUNTERPARTIES

Personal data	Purpose	Legal basis	Retention period
– information relevant for the purposes of providing legal advice. Although the specific categories of data vary depending on the nature of the legal matter, the categories of data typically include: – name and surname; – address; – phone number; – work post; – capacity; – salary; – signature; – data subject’s written communication with the client.	– providing legal advice to clients; – representing the client before authorities; – communication with the counterparty (e.g. negotiating or sending cease and desist letters).	– BDK Advokati’s legitimate interest: performing the tasks agreed with the client.	– for the duration of cooperation between BDK Advokati and the client, or until all invoices have been resolved, whichever is later.
– name and surname of shareholders of clients’ counterparties.	– conflict of interest assessment.	– BDK Advokati’s legitimate interest: performing the tasks agreed with the client.	– for the duration of cooperation between BDK Advokati and the client, or until all invoices have been resolved, whichever is later.
– information about contact persons: – name and surname; company; – position; – professional contact details (postal address, email address and telephone number); and – emails sent/received to/from them.	– communication related to the matter.	– BDK Advokati’s legitimate interest: performing the tasks agreed with the client.	– for the duration of cooperation between BDK Advokati and the client, or until all invoices have been resolved, whichever is later.
– information about signatories of documentation relevant within the context of the legal advice/transaction: – name and surname; – capacity in which they act; and – document signed by them;	– preparing the relevant documentation.	– BDK Advokati’s legitimate interests: performing the tasks agreed with the client.	– for the duration of cooperation between BDK Advokati and the client, or until all invoices have been resolved, whichever is earlier.
– any of the above information.	– record-keeping and archiving.	– legal obligation: keeping records and documents entrusted by the client (Legal Profession Act, Article 31).	– permanently – personal data contained in: register of clients; final decisions in civil, criminal, and non-contentious proceedings; documents, items, photographs, and similar materials entrusted by the client as evidence in proceedings; case files in which individuals known in public, scientific, or cultural life, or significant in these spheres and other fields of social life, appear as clients; real estate transaction contracts; records of returning case files to the client; case files where BDK Advokati acted as a guardian or temporary representative; business records; and final accounts. – in case of legal proceedings, two years after the termination of the proceedings – personal data contained in the correspondence and other documentation that forms an integral part of the case but were not introduced as evidence in the proceedings.

COMPETITION

Personal data	Purpose	Legal basis	Retention period
– name and surname; – position; – name of the law firm; – articles, blog posts, or newsletters written by the lawyer, conferences at which the lawyer spoke, information on promotions; – assessment of professional performance.	– obtaining an insight into the performance and recent activities of our competitors. – informing legal directories about the developments in the relevant legal area and about the leading practitioners.	– BDK Advokati’s legitimate interest: creating an insight into the performance and recent activities of our competitors; – legitimate interests of third parties (legal directories): obtaining information about the developments in the relevant legal area and about the leading practitioners.	– two years from the collection of personal data.

SUPPLIERS

a) Contact persons of the entities and entrepreneurs which supply goods and services to BDK Advokati

Personal data	Purpose	Legal basis	Retention period
– name and surname; – company; – position; – professional contact details (postal address, email address and telephone number); and – emails sent/received to/from you.	– business communication connected with the relevant commercial relationship and with BDK Advokati’s procurements, which includes sending orders and responding to offers.	– BDK Advokati’s legitimate interest: exercising its rights and performing its obligations towards the suppliers.	– for the duration of contractual relationship with the supplier, and while BDK Advokati considers potential renewal of cooperation with the supplier, but no longer than six months after the previous contractual relationship ends.

b) Signatories of contracts entered into between the entities and entrepreneurs which supply goods and services to BDK Advokati

Personal data	Purpose	Legal basis	Retention period
– name and surname; – capacity in which you act; and – contracts signed by you.	– preparing and formalizing the contractual relationship with the supplier.	– BDK Advokati’s legitimate interest: exercising its rights and performing its obligations towards the suppliers.	– for the duration of contractual relationship with the supplier, and while BDK Advokati considers potential renewal of cooperation with the supplier, but no longer than six months after the previous contractual relationship ends.

PRIVACY NOTICE