ALEMÁN, CORDERO, GALINDO & LEE (“Alcogal”) takes its data protection and information security responsibilities very seriously. The effective management of all personal data, including its security and confidentiality, lies at the heart of our business and underpins our policies and procedures. This in not only conditioned by data protection legislation, but is also driven by our commitment to our clients and to meet the expectations of having in place robust compliance and risk management policies and procedures.
As a firm with international affiliates and clientele, we may be subject to varying requirements of data protection legislation in different jurisdictions. Although our approach to data protection across our business aims to be as consistent as possible and to accord with all applicable laws, the specific requirements, rights and obligations relating to personal data and/or our data processing activities can be different. The following descriptions of data processing, rights and obligations, and in particular the limitations to data processing apply within the scope of applicability of the EU’s General Data Protection Regulations 2016/679 (“GDPR”). Where we operate in jurisdictions with data protection legislation which is substantially different to the GDPR (such as in the Republic of Panama), these descriptions, rights and obligations, and limitations to processing do not necessarily apply and nothing in this Policy may be interpreted to establish rights or obligations that go beyond what is mandated by the respective applicable data protection legislation.
This Policy is in addition to, and does not relieve, remove or replace, our rights and responsibilities under applicable laws. In case of a conflict between a provision or requirement of applicable laws and a provision of this Policy, the former shall take precedence.
Who we are
Alcogal is a law firm with its headquarters in the Republic of Panama. Alcogal controls the collection and processing of any personal information that you provide to us. Where services are provided to you by other entities within our group, the entity providing the service will be responsible for your personal information. This notice applies to all such entities.
Personal information we collect
“Personal information” is any information that relates to you and that identifies you either directly from that information or indirectly, by reference to other information that we have access to. The personal information that we collect, and how we collect it, depends upon how you interact with us. Categories of personal information that we collect include:
- Basic information, such as your name, the company you work for, your title or position and your relationship to a person
- Contact information, such as your postal address, email address and phone number(s)
- Billing and financial information, such as billing address, bank account and payment information
- Technical information, such as information from your visits to our website or applications or in relation to materials and communications we send to you electronically
- Information you provide to us for the purposes of attending meetings and events, including access and dietary requirements
- Identification and background information provided by you or collected as part of our business acceptance processes
- Personal information provided to us by or on behalf of our clients or generated by us in the course or providing services to them, which may include special categories of data
- Any other information relating to you which you may provide to us
How we obtain your personal information
- We collect information from you as part of our business acceptance processes and about you and others as necessary in the course of providing legal services
- We collect your personal information while monitoring our technology tools and services, including our websites and email communications sent to and from Alcogal
- We gather information about you when you provide it to us, or interact with us directly, for instance engaging with our staff or registering on one of our digital platforms or applications
- We may collect or receive information about you from other sources, such as keeping the contact details we already hold for you accurate and up to date using publicly available sources
How we use your personal information
We will only use your personal information fairly and where we have a lawful reason to do so.
We are allowed to use your personal information if we have your consent or if another legally permitted reason applies. These include to fulfil a contract with you, when we have a legal duty to comply with, or when it is in our legitimate business interest to use your personal information. We can only rely on our legitimate business interest, if it is fair and reasonable to do so.
Our use of your personal information may depend on how and where you interact with us.
We will only process special category data where the processing is necessary for the purposes of providing our client with advice regarding obligations or an individual with advice regarding their rights; or where we have a legal duty to do so; or where it is necessary to do so in order to establish, exercise or defend legal claims.
Sharing and transferring your data
We treat your personal information with respect and do not share it with third parties except as described below.
- We may disclose your personal information to other Alcogal entities for the purpose of our internal business processes (such as administration, due diligence and billing) and for the purpose of providing legal advice and services.
- We may disclose personal information relating to our clients, their employees and agents to other legal specialists including lawyers, mediators, arbitrators, consultants or experts engaged in a matter. We may also disclose personal information to third party law firms for the purpose of obtaining foreign legal advice.
- We may share personal information with our suppliers and service providers including event organizers and partners and document production and management services
- We may share personal information when necessary with law enforcement and regulatory authorities, and with other government entities
- We may also share your personal information when you have consented to us doing so.
If you are an individual whose personal data, and the processing of that personal data are subject to the application of the GDPR, we will only transfer your personal information outside of the European region under the following circumstances:
- where the transfer is to a country or other territory which has been assessed by the European Commission (or an equivalent UK body) as ensuring an adequate level of protection for personal information
- with your consent or
- on the basis that the transfer is compliant with the GDPR and other applicable laws.
How we protect your personal information
We implement reasonable appropriate technical and organizational security measures to protect your personal information against any unauthorized or unlawful processing and against any accidental loss, destruction, or damage
Please contact our Data Privacy team if you have any questions about how we collect, use, share, transfer or protect your personal information.
Keeping your personal information
We do not keep your personal information for any longer than is necessary to fulfil the purpose for which we collected it, or to comply with any legal, regulatory or reporting obligations or to assert or defend against legal claims.
Your rights regarding your personal information
You have certain rights regarding how we use and keep your personal information:
- you can require us, to update or correct any inaccurate personal information, or to complete any incomplete personal information, concerning you. If you do, we will take reasonable steps to check the accuracy of and correct the information if needed. Please let us know if any of your information changes so that we can keep it accurate and up to date;
- you can require us to stop processing your information for direct marketing purposes; if you withdraw your consent, we may not be able to provide certain products or services to you; and
- you have the right to object to our use of your personal information more generally.
You may also have the right, in certain circumstances to:
- be provided with a copy of any personal information that we hold about you, with certain related information. There are exceptions to this right; for example, where information is legally privileged or if providing you with the information would reveal personal information about another person
- to require us, without undue delay, to delete your personal information
- to “restrict” our use of your information, so that it can only continue subject to restrictions; and
- to require personal information which you have provided to us and which are processed by using automated means, based on your consent or the performance of a contract with you, to be provided to you in machine readable format so that they can be “ported” to a replacement service provider.
You can exercise the above rights, where applicable by contacting our Data Privacy team. We will require you to provide satisfactory proof of your identity in order to ensure that your rights are respected and protected. This is to ensure that your personal information is disclosed only to you.