Privacy Policy
Last revised: 9 October 2026
This Privacy Policy applies to Advokatfirmaet Melø AS and has been prepared in accordance with the Norwegian Bar Association’s standard.
Advokatfirmaet Melø AS is the data controller for the processing of personal data described in this Privacy Policy. You can find our contact information here.
1. Whose personal data we process
This Privacy Policy covers our processing of personal data relating to the following individuals:
- — Private individuals
- — Contact persons at business clients
- — Contact persons at our suppliers and business partners
- — Individuals involved in matters in which we provide assistance
- — Other individuals referred to in case documents to which we have access
- — Visitors to our website
2. Purposes, types of personal data and legal basis
The following provides an overview of the purposes for which we process personal data, the types of personal data we process, and the legal basis for such processing.
Establishment of client relationships: When we are contacted by someone requesting that we undertake an assignment, we conduct an internal independence check (conflict check) before deciding whether to accept the assignment. The conflict check serves a legitimate purpose and is based on Article 6(1)(f) of the GDPR (legitimate interests assessment). Conflict checks involving private individuals generally include their full name, the subject matter of the case and, in certain cases, their creditworthiness. Conflict checks involving businesses will not normally involve the processing of personal data.
In connection with establishing a client relationship, we conduct customer due diligence in accordance with the Norwegian Anti-Money Laundering Act. This due diligence is necessary to comply with our legal obligations under that Act, cf. Article 6(1)(c) of the GDPR.
If we are able to accept the assignment, contact details are recorded in our client register, including name, address, telephone number and email address. For private clients, recording contact details is necessary to enter into an agreement with the individual, cf. Article 6(1)(b) of the GDPR. For business clients, the recording of contact details is based on a legitimate interests assessment, cf. Article 6(1)(f) of the GDPR.
Case handling: Certain legal assignments require us to access personal data concerning parties or other individuals affected by a matter. Such information may appear in documents provided by the client or in other correspondence relating to the matter. The processing of personal data in connection with assignments for business clients is based on Article 6(1)(f) of the GDPR (legitimate interests assessment). In some cases, we also gain access to special categories of personal data, such as health data, or personal data relating to criminal convictions and offences. In such cases, the processing is authorised under Article 9(2)(f) of the GDPR (processing necessary for the establishment, exercise or defence of legal claims), cf. Section 11 of the Norwegian Personal Data Act.
Client administration: Separate case files are created for assignments carried out on behalf of clients. Time spent and costs incurred in a matter are recorded in our accounting system. For business clients, our client administration activities are based on Article 6(1)(f) of the GDPR (legitimate interests assessment). For private clients, such activities are considered necessary for the performance of the agreement with the individual, cf. Article 6(1)(b) of the GDPR.
Storage and retention of case documents: We retain case documents for 10 years after the assignment has been completed. Retention for this period has been deemed necessary in the interests of both the client and ourselves, as questions or disputes may arise at a later date in which the information stored in a case may once again become relevant. The legal basis for processing personal data is Article 6(1)(f) of the GDPR (legitimate interests assessment, based on the legitimate interest described above) and Article 9(2)(f) of the GDPR (the establishment, exercise or defence of legal claims), cf. Section 11 of the Norwegian Personal Data Act.
Invoicing: Contact details received from business clients are used to address invoices sent to the relevant business. For private clients, the individual's personal email or postal address is used to send invoices. The legal basis for processing is Article 6(1)(f) of the GDPR (legitimate interests assessment) for business clients and Article 6(1)(b) of the GDPR (processing necessary for the performance of the agreement with the data subject) for private clients.
IT operations and security: Personal data stored in our IT systems may be accessible to us or our service providers in connection with system updates, the implementation or monitoring of security measures, troubleshooting or other maintenance activities. The legal basis for processing is Article 6(1)(f) of the GDPR (legitimate interests assessment, based on our legitimate interest in carrying out the activities described above) and our legal obligation to ensure an appropriate level of information security, cf. Articles 32 and 6(1)(c) of the GDPR.
Website: For information about the processing of personal data when you use our website, see Section 6.
3. Who we share personal data with
Our IT service providers may have access to personal data if such data is stored by the provider or is otherwise accessible to the provider under our agreement with them. The providers act under data processing agreements and in accordance with our instructions. Providers may only use personal data for the purposes determined by us and described in this Privacy Policy.
Lawyers are subject to a duty of confidentiality enforceable by criminal sanctions. All information entrusted to us in connection with an assignment is handled confidentially.
We do not disclose personal data in any circumstances or by any means other than those described in this Privacy Policy, unless the client explicitly requests or consents to such disclosure, or disclosure is required by law.
4. Your rights
You have rights in relation to personal data concerning you.
Withdraw consent: If you have consented to the processing of personal data, you may withdraw your consent to that processing at any time by contacting us to that effect.
Request access: You have the right to access the personal data we have registered about you, insofar as this is not restricted by our duty of confidentiality. To ensure that personal data is disclosed to the correct person, we may require access requests to be submitted in writing or require your identity to be verified by other means.
Request rectification or erasure: You may ask us to correct inaccurate information we hold about you or request that we erase your personal data. We will accommodate requests to erase personal data to the extent possible, but we cannot do so where there are compelling reasons for retaining the information, for example, where we are required to retain it for documentation purposes.
Lodge a complaint with the supervisory authority: If you disagree with how we process your personal data, you may lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).
5. Security
We have established procedures to ensure that personal data is handled securely. These measures are both technical and organisational in nature. We regularly assess the security of all key systems used to handle personal data, and we have entered into agreements requiring providers of such systems to ensure an appropriate level of information security.
Access to personal data (and client and case information) is restricted to personnel who need such access to perform their duties.
6. Website and cookies
Our website is hosted by Cloudflare, which processes technical information such as IP addresses and browser types to deliver the website and protect it against attacks. Fonts are provided by Adobe Fonts, and search functionality is provided by Algolia; these services therefore also receive your IP address.
When you contact us through the contact form, we use the information you provide to respond to your enquiry. The form is protected against bots by Cloudflare Turnstile. See Cloudflare’s Turnstile Privacy Addendum.
With your consent, we use Google Analytics and cookies to collect website usage statistics. You can change or withdraw your consent at any time through the consent banner.
7. Changes to this Privacy Policy
We may make minor changes to this Privacy Policy. The latest version will always be available on our website. We will notify you of any material changes.
8. Contact us
If you have any questions or comments about our Privacy Policy, or if you wish to exercise your rights, you can contact us here.