Privacy policy

1. Introduction

This is the privacy statement of Asteriq B.V., a law firm based at Weena 505, Rotterdam (3013 AL).

The Firm acts as a data controller within the meaning of the General Data Protection Regulation (GDPR).

Through this privacy statement, we inform you about what personal data we process, on what basis, what rights data subjects have in relation to this data processing, and how you can contact us. We also inform you about how Asteriq handles your personal data. This includes, amongst other things, the processing of personal data relating to our clients (and their contacts), third parties involved in the cases we handle (opposing parties, experts and other legal professionals), website visitors, suppliers, job applicants and other individuals who provide personal data to us in the course of our services or from whom we receive personal data.

2. Why do we process personal data

We use your personal data for various purposes, including:

Providing legal services to our clients;
Complying with legal obligations, such as record-keeping obligations and the Money Laundering and Terrorist Financing (Prevention) Act (Wwft);
Maintaining contact and communication with you;
Marketing activities, such as sending newsletters;
To ensure the security, use and improvement of our website. In this regard, we also refer you to our Cookie Policy;
Improving the quality of our own services.

3. On what legal basis do we process personal data

Asteriq processes your personal data on the basis of one or more of the following legal grounds:

where this is necessary for the performance of a contract to which you are a party or for taking pre-contractual steps at your request;
where this is necessary to comply with a legal obligation;
if this is necessary to pursue our legitimate interests or the interests of third parties;
with your consent.

Where we process personal data with your consent, we will ask for this separately. You may withdraw your consent at any time. Withdrawing your consent does not affect the lawfulness of the processing of your personal data prior to the withdrawal of your consent.

4. What personal data do we process?

We may process personal data relating to the categories listed in the table below. We do not process any personal data that is not necessary or relevant to the provision of our services.

Clients, counterparties and third parties:

Name, address and contact details;
Details of counterparties or third parties;
Extracts from the Chamber of Commerce, the Land Registry and other public registers;
Information about the case;
A copy of proof of identity (personal identification number (BSN) redacted);
Payment and bank details;
Any other personal data that you provide to us or the processing of which is required or necessary.

Suppliers:

Name, address and contact details;
Chamber of Commerce number;
VAT number;
Payment and bank details;
Details of orders or the procurement of services;
Where required, a certificate of good conduct (VOG) and/or proof of identity (with the BSN number redacted);
Other data that you provide to us or the processing of which is required or necessary in accordance with applicable laws or regulations.

Visitors to the office:

First name and surname;
Contact details;
Details of your role / the organisation you work for;
Vehicle registration number;
Date and time of arrival and departure.

Website visitors:

Details of the device you use to visit our website and your location;
Your IP address
etails of your visit to our website.

Social media:

Social media profile details

Job applicants:

Name, address and contact details;
Date of birth;
Gender;
CV and cover letter containing information about education, work experience and skills;
Details of current employment and the date of termination;
Qualifications / grades;
Details of the role you have applied for;
References and other information you provide;
Information we collect from public sources (such as LinkedIn);
Other data that you provide to us or the processing of which is required or necessary in accordance with applicable laws or regulations.

5. Duty of confidentiality

Our solicitors are bound by a statutory duty of confidentiality. This means that, in certain cases, we cannot grant access to or disclose information from a file, even in response to a legitimate request from a data subject. Furthermore, statutory retention periods may prevent us from fully complying with a request for erasure. We will inform you of this if it applies.

6. To whom do we disclose your personal data?

We share your personal data with third parties only to the extent necessary for the provision of our services, in accordance with the purposes set out above. We may share your personal data with the following categories of recipients:

a. Third parties involved in the provision of our services: such as courts, arbitration bodies, opposing parties and their advisers, notaries, bailiffs, medical or forensic experts, and other legal or financial advisers, to the extent necessary for the performance of the assignment.
b. Data processors: IT service providers, cloud providers, software suppliers and other service providers who process personal data on our behalf and at our instruction. We enter into a data processing agreement with all these parties within the meaning of Article 28 of the GDPR.
c. Supervisory authorities and government bodies: where we are legally obliged to do so, such as to the Dutch Data Protection Authority, FIU-Netherlands, the Tax and Customs Administration or the Netherlands Bar Association (NOvA).
d. Other law firms and advisers: in the context of international collaboration on a case, to the extent necessary for the performance of the assignment.
e. Parties involved in digital signing: when using a digital signing platform (such as DocuSign), the signing details are accessible to all parties on whose behalf the document has been signed. These parties may be located outside the EU/EEA.

Third parties who receive your personal data and who are themselves independent data controllers (such as courts, banks and government bodies) are themselves responsible for complying with the applicable data protection legislation. We are not responsible for their processing activities.

7. Transfer outside the EU/EEA

In order to provide our services, it may be necessary for us to transfer your personal data to a recipient in a country outside the European Union. In such cases, we ensure that such data transfers comply with the GDPR.

8. Retention periods

We do not retain your personal data for longer than is necessary for the purposes for which it was collected, or for as long as is required by law.

Files (clients and cases):

20 years after the file is closed, or longer if required by law (up to a maximum of 30 years in certain cases)

Client due diligence (WWFT):

5 years after the termination of the relationship or completion of the transaction

Financial records (invoices):

7 years (statutory tax retention obligation)

CRM / customer data:

For as long as the relationship is active; thereafter on the basis of legitimate interest or following unsubscription / objection

Marketing communications / newsletter:

Until consent is withdrawn or the customer unsubscribes

9. Security

We attach great importance to the security and protection of your personal data and, taking into account the state of the art, implement appropriate technical and organisational measures to ensure a level of security commensurate with the risk. These measures include, amongst other things, access control, encryption of devices and connections, firewall protection and virus scanning. We set out adequate security measures contractually in a data processing agreement with third parties who process personal data on our behalf.

10. Your rights as a data subject

Under the GDPR, you have the following rights:

a. Information: you have the right to be informed about the processing of your personal data, which we do through this privacy statement.
b. Access: you may at any time request details of the personal data we process about you.
c. Rectification / correction: you may have inaccurate or incomplete data corrected or supplemented.
d. Data erasure (right to be forgotten): in certain cases, you may request that your data be erased.
e. Restriction of processing: in certain circumstances, you may request that the processing of your data be restricted.
f. Data portability: you may request to receive your data in a structured, commonly used and machine-readable format.
g. Objection: You may object to the processing of your data on the grounds of legitimate interest.
h. Withdrawal of consent: if the processing is based on consent, you may withdraw your consent at any time, without this affecting the lawfulness of the processing prior to withdrawal.

You may submit a request for access, rectification, restriction, objection, data portability, erasure or withdrawal of consent to us by email at firm@asteriq.nl. We aim to respond to your request within four weeks of receipt.

To verify your identity, we may ask you to provide a copy of a valid passport, driving licence or identity card, ensuring that the passport photograph and National Insurance number are obscured. We will only process requests relating to your own personal data.

There may be circumstances in which we are unable to comply with your request, either in full or at all, for example due to our statutory duty of confidentiality or applicable statutory retention periods. We will inform you of this in writing.

If you have a complaint about the way in which we process your personal data, you have the right to lodge a complaint with the Dutch Data Protection Authority (www.autoriteitpersoonsgegevens.nl).

11. Version and amendments

This privacy statement was drawn up on 25 August 2026. We reserve the right to amend the content of this privacy statement from time to time. We therefore advise you to consult this statement regularly. Amendments will be published on our website www.asteriq.nl. In the event of substantial changes, we will actively inform you of these where reasonably possible.

12. Questions and contact

If you have any questions or comments regarding the processing of your personal data or this privacy statement, please contact us at firm@asteriq.nl.