DATA PROTECTION NOTICE

Introduction

Shortall Law is a firm of solicitors with an address at 13 Adelaide Road, Dublin 2, D02P950,

Ireland. We are regulated by the Law Society of Ireland (Firm No. F11480) and the Legal

Services Regulatory Authority.

The following is a statement of our policies in accordance with the Data Protection Act 2018 and

the General Data Protection Regulation (GDPR).

We are the data controller for the purposes of the GDPR. This notice sets out the basis on which

we process personal data collected in connection with the provision of legal services and the

operation of a regulated legal practice.

Personal Data Collected

The categories of personal data that we may process include, but are not limited to, contact

details, identification data, financial and tax information, billing records, correspondence, and

information and documentation relating to your legal matter.

Purpose and Legal Basis for Processing

We process personal data in order to provide legal services and to comply with our legal and

regulatory obligations. The legal bases relied upon for processing are that processing is

necessary for the performance of a contract to which you are party, for compliance with legal

obligations to which we are subject, and for the legitimate interests of the practice, including

practice administration, record-keeping, billing, and the establishment, exercise or defence of

legal claims. Where processing is based on consent, consent may be withdrawn at any time

without affecting the lawfulness of processing carried out prior to withdrawal.

Special Category and Criminal Offence Data

Where a matter involves the processing of special categories of personal data, including medical

or health data, or criminal offence data, such data will be processed only where necessary for the establishment, exercise or defence of legal claims and in accordance with applicable law.

Confidentiality

We keep confidential any personal data, information and documents relating to you or your

business, except where disclosure is required or permitted by law or is necessary in the course

of carrying out your instructions.

Disclosure to Third Parties

In the normal course of operating a legal practice and acting on your behalf, we may disclose

personal data to third parties, including the Courts Service, tribunals, barristers, expert

witnesses, public bodies, regulators, the Law Society of Ireland, and the Legal Services

Regulatory Authority. We also use professional advisers and service providers, including

accountants and IT service providers, who may require limited access to personal data. We seek

to ensure that such service providers provide appropriate safeguards for the protection of

personal data.

Storage and Security

Where files are stored off-site, whether electronically or in hard copy, we take reasonable steps

to ensure that personal data is kept secure and confidential.

Retention of Personal Data

Personal data is retained only for as long as necessary for the purposes for which it is

processed. Client files and related records are generally retained for a period consistent with

legal, regulatory, professional and insurance requirements, and may be retained for longer where necessary for the establishment, exercise or defence of legal claims. The retention period is determined by reference to applicable limitation periods, regulatory requirements, professional obligations, and the need to retain records for the defence of potential legal claims.

Transfers Outside the EEA

We do not transfer personal data outside the European Economic Area unless appropriate

safeguards are in place in accordance with the GDPR.

Automated Decision-Making

We do not carry out automated decision-making or profiling.

Data Subject Rights

Subject to the GDPR and applicable legal and professional obligations, you have the right to

access personal data we hold about you, to require the rectification of inaccurate personal data,

to request restriction of processing in certain circumstances, to object to processing carried out

on the basis of legitimate interests, to receive personal data in a portable format where the right applies, and to request erasure of personal data, subject to legal and regulatory retention

obligations.

Provision of Personal Data

The provision of personal data is necessary in order for us to provide legal services and to

comply with legal and regulatory obligations. Failure to provide required information may prevent

us from acting.

Contacts and Complaints

If you have any questions about this Privacy Policy, wish to exercise your data protection rights,

or believe that personal data held by us is inaccurate or has been processed unlawfully, you may contact us at: roman@shortall.law. We will respond without undue delay and in any event within one month, subject to the GDPR. If you are dissatisfied with how we process personal data, you may lodge a complaint with the Data Protection Commission. Further information about the Data Protection Commission is available at www.dataprotection.ie.