Privacy policy

1. Introduction

AQR Law Advokat AB (“AQR Law”, the “Firm”, “we”, “us” or “our”) respects your privacy. This privacy notice explains how we collect, use, share and protect personal data in our business and what rights you have. We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the “General Data Protection Regulation” or “GDPR”), the Swedish Act (2018:218) containing supplementary provisions to the GDPR, and other applicable legislation. As members of the Swedish Bar Association, we are also bound by the Swedish Code of Judicial Procedure and the Swedish Bar Association’s Code of Professional Conduct, including our statutory duty of confidentiality.

This notice applies to personal data relating to clients and their representatives and employees, counterparties and other parties to matters, witnesses and experts, suppliers and business partners, visitors to our website, participants at seminars and events, newsletter recipients and job applicants.

2. Controller and contact details

AQR Law Advokat AB, Reg. No. 559600-4449, c/o United Spaces Group AB, Sveavägen 34, 111 34 Stockholm, Sweden, is the controller of the processing of personal data described in this notice.

If you have any questions about our processing of personal data or wish to exercise your rights, please contact us at privacy@aqrlaw.se or by post to the address above, marked “Data Protection”.

3. What personal data do we process?

The personal data we process depends on your relationship with us and on the specific matter. We typically process the following categories:

• Identity and contact details, such as name, personal identity number or date of birth, job title, employer, address, email address and telephone number.
• Customer due diligence information, such as a copy of an identity document, citizenship, information on beneficial owners, whether you are a politically exposed person (PEP) and information on the source of funds.
• Matter-related information, such as correspondence, agreements, documents and other information provided to us or obtained by us in the course of the engagement.
• Financial information, such as invoicing and payment details, bank account numbers and credit reports.
• Technical information, such as IP address, browser type and information on how you use our website (see our cookie policy).
• Job applicant information, such as CV, cover letter, grades, references and interview notes.

In certain matters we may need to process special categories of personal data (for example health data or trade union membership) or data relating to criminal offences. Such data is processed only when necessary for the establishment, exercise or defence of legal claims, when required by law, or as otherwise permitted under the GDPR and supplementary national legislation.

4. Where do we collect personal data from?

We primarily collect personal data directly from you or from the client we represent. Data may also be obtained from public registers (such as the Swedish Companies Registration Office, the Swedish Tax Agency, the Swedish Land Registry and the register of beneficial owners), credit reference agencies, providers of sanctions and PEP screening services, courts and authorities, counterparties and their counsel, and other publicly available sources such as websites and social media.

5. Purposes and legal bases

We process personal data only for specified and legitimate purposes and on a legal basis under Article 6 of the GDPR. Our main purposes are summarised below.

5.1 Engagement requests, conflict checks and customer due diligence

Before accepting an engagement, we carry out conflict checks in accordance with the Code of Professional Conduct and customer due diligence measures under the Swedish Act (2017:630) on Measures against Money Laundering and Terrorist Financing and, from 10 July 2027, Regulation (EU) 2024/1624 (AMLR). The processing is necessary to comply with legal obligations to which we are subject (Article 6(1)(c)). To the extent the processing follows from the Code of Professional Conduct, it is also based on our legitimate interest in conducting our legal practice in accordance with the rules applicable to members of the Bar (Article 6(1)(f)).

5.2 Performance and administration of engagements

We process personal data to provide legal advice, represent clients, prepare documents, communicate with parties and authorities, and administer the engagement. If you are our client, the processing is necessary for the performance of our contract with you (Article 6(1)(b)). If you are a representative or employee of a client, a counterparty, a witness or another person appearing in a matter, the processing is based on our and our client’s legitimate interest in the engagement being carried out (Article 6(1)(f)).

5.3 Invoicing, accounting and other legal obligations

We process personal data for invoicing and to comply with requirements under, among other things, the Swedish Accounting Act (1999:1078) and tax legislation, and, where applicable, to report suspected money laundering or terrorist financing to the Swedish Financial Intelligence Unit (Article 6(1)(c)).

5.4 Legal claims

We may process personal data to establish, exercise or defend legal claims, for example in a dispute regarding fees or a claim for damages (Article 6(1)(f)).

5.5 Marketing, newsletters and events

We process contact details to send newsletters and invitations to seminars and events and to administer participation, based on our legitimate interest in marketing the Firm and maintaining client relationships (Article 6(1)(f)) or, where required, your consent (Article 6(1)(a)). You may unsubscribe at any time.

5.6 Suppliers and business partners

We process contact details of representatives of suppliers and business partners to administer the contractual relationship, based on our legitimate interest (Article 6(1)(f)).

5.7 Recruitment

We process job applicant data to assess and manage applications, based on our legitimate interest in recruiting staff (Article 6(1)(f)). If we wish to retain your application for future recruitment, we will ask for your consent (Article 6(1)(a)).

5.8 Website, security and IT operations

We process technical data to provide and improve our website, maintain information security and prevent misuse, based on our legitimate interest (Article 6(1)(f)). Non-essential cookies are used only with your consent.

Where we rely on legitimate interest, we have carried out a balancing test and concluded that our interest outweighs your interest in the data not being processed. You have the right to object to such processing (see Section 9).

6. Who do we share personal data with?

We disclose personal data only to the extent consistent with our duty of confidentiality and applicable law. Recipients may include:

• courts, arbitral tribunals, authorities, counterparties and their counsel where necessary to perform the engagement;
• other advisers, such as foreign law firms, auditors, experts and translators, engaged in the course of the engagement;
• processors that process data on our behalf, such as providers of IT systems, cloud services, document management, e-signature, screening services and financial administration, with whom we have entered into data processing agreements;
• authorities where we are required by law, such as the Swedish Financial Intelligence Unit, the Swedish Tax Agency or the Swedish Bar Association in the exercise of its supervision; and
• a potential acquirer or new owner in the event of a transfer of all or part of the business.

We never sell personal data.

7. Transfers to third countries

We aim to process personal data within the EU/EEA. If data is transferred to a country outside the EU/EEA, for example where a matter has international elements or a supplier operates outside the EEA, we ensure that the transfer complies with the GDPR, for example on the basis of a European Commission adequacy decision (including the EU–US Data Privacy Framework) or the European Commission’s standard contractual clauses together with any supplementary safeguards. You may contact us for information on the applicable safeguards.

8. How long do we retain personal data?

We retain personal data for as long as necessary for the purposes for which it was collected and thereafter for as long as required by law or the Code of Professional Conduct. As a starting point:

• Case files and matter documents are retained for at least ten years from the conclusion of the engagement, or for such longer period as is justified by the nature of the matter, in accordance with the Code of Professional Conduct.
• Customer due diligence documents and information are retained for five years from the end of the business relationship, or for such longer period as follows from anti-money laundering legislation.
• Accounting records are retained for seven years after the end of the calendar year in which the financial year ended, under the Swedish Accounting Act.
• Conflict check data is retained for as long as necessary to carry out accurate conflict checks.
• Marketing data is retained until you unsubscribe or object to the processing.
• Job applicant data is retained for two years after the recruitment process ends in view of potential discrimination claims, unless you have consented to longer retention.

9. Your rights

Under the GDPR, you have the right to:

• request access to your personal data and obtain a copy of it;
• request rectification of inaccurate or incomplete data;
• request erasure of your personal data;
• request restriction of processing;
• object to processing based on legitimate interest, and object at any time to direct marketing;
• receive data you have provided in a structured, machine-readable format (data portability); and
• withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.

Please note that your rights may be limited by our duty of confidentiality, statutory retention requirements or secrecy. For example, under anti-money laundering legislation we may not disclose that an investigation or report to the Swedish Financial Intelligence Unit is taking place, and information covered by an advocate’s duty of confidentiality is not disclosed pursuant to Chapter 5, Section 1 of the Swedish Act (2018:218) containing supplementary provisions to the GDPR. We will respond to your request without undue delay and normally within one month.

10. Security

We take appropriate technical and organisational security measures to protect personal data against unauthorised access, loss and destruction, including access controls, encryption, multi-factor authentication, logging, backups and staff training. All staff are bound by confidentiality. In the event of a personal data breach, we take action in accordance with the GDPR, including notifying the Swedish Authority for Privacy Protection and informing affected individuals where required.

11. Cookies

Our website uses cookies. Information on the cookies we use and how you can manage them is available in our cookie policy at www.aqr-law.com.

12. Complaints

If you are dissatisfied with our processing of your personal data, please contact us in the first instance. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, SE-104 20 Stockholm, www.imy.se.

13. Changes to this notice

We may update this privacy notice. The latest version is always available on our website. In the event of material changes, we will inform you in an appropriate manner.

Cookie policy

What personal data this website collects, why, how long it is kept and who else handles it.

When you contact us

The contact form asks for your name, your email address and your message and, if you want to give them, your company and phone number. We also note the time and the page you wrote from. We use this to answer you and to find out whether we can take on the matter. Please don't send confidential details through the form until we have confirmed that we can.

Legal basis: our legitimate interest in answering the people who contact us, or, when you ask us to take on a matter, the steps before an agreement. After 24 months we remove your name, company, email address, phone number and message; what remains is that an enquiry came in, when and from which page. Messages our spam checks hold back are deleted after 30 days. A copy of each enquiry is emailed to us when it arrives.

When you ask about your data

The data request form asks for your email address, what you want (to see, correct or erase your data) and, if you like, a message. We send a link to that address to make sure the request is yours.

Legal basis: our legal obligation to handle your request and to be able to show that we did. A request that is never confirmed is deleted after 30 days; for the others, your email address and message are removed after 24 months.

Your cookie choice

When you choose in the cookie banner, we record the choice with a random consent ID (the same one kept in your browser), the categories you accepted, the version of the cookie text and the time. We never store your IP address or anything else about you with it.

Legal basis: our legal obligation to be able to show that consent was given. Each record is deleted after 24 months.

Statistics, only with your consent

If you accept analytics, Google Analytics records how the site is used: the pages you visit, roughly where you are, and the kind of device and browser. Google states that it does not log or store IP addresses from users in the EU. Nothing is sent to Google Analytics before you accept, and you can change your mind at any time.

Legal basis: your consent. Google keeps the data for 14 months.

Keeping the site running and safe

Like every website, the servers log each request: your IP address, your browser, the page and the time. These logs are kept for 30 days to find faults and stop misuse. If the site itself has an error, a report goes to our error monitoring with personal data removed before it leaves the site; reports are kept for 90 days.

Legal basis: our legitimate interest in a secure, working website.

Cookies

A cookie is a small file the site keeps in your browser. Necessary cookies are set without asking, because the site does not work without them, or because you asked for what they do. The others are set only if you accept them.

You can change your choice at any time under "Cookie settings" at the bottom of every page. If you switch analytics off, its cookies are deleted.

Who else handles the data

A few suppliers run parts of the website for us and handle data only on our instructions:

• Our web agency builds and runs the site.
• Google Cloud hosts it in Sweden (Stockholm).
• Postmark sends its emails, such as the copy of your enquiry to us.
• Sentry receives error reports, with personal data removed.
• Google Analytics measures visits, only if you accept it.

Some of them are in the United States. Where data goes there, they are certified under the EU–US Data Privacy Framework, and their agreements also include the EU's standard contractual clauses.

Good to know

You do not have to give us any personal data, but without a name and an email address we cannot answer an enquiry. We make no automated decisions about you and build no profiles. The website is served over an encrypted connection, and only the people who need the data can reach it.

When the cookie text changes, the banner asks you again.