Privacy Policy

Last updated: 29 September 2026

This Privacy Policy applies to the processing of personal data by Maarten Draye Advocaat BV, trading as Draye Law (“Draye Law”, “we”), within the meaning of Regulation (EU) 2016/679 (the General Data Protection Regulation) and the Belgian legislation supplementing it, in particular the Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data (together, the “GDPR”).

This Privacy Policy informs people outside Draye Law whose personal data we process about how we handle that data. This includes (i) our clients; (ii) their representatives and personnel; (iii) other lawyers, whether representing our client or other parties; (iv) prospective clients; (v) potential arbitrators to be appointed in a dispute in which we provide legal services (whether as counsel, as arbitrator or otherwise); (vi) staff of courts, arbitral institutions and other third parties; (vii) persons who have shown an interest in our services; (viii) job candidates; (ix) visitors to our offices; (x) attendees of events we may organise; (xi) service providers; (xii) users of our website; and (xiii) other persons with whom we come into contact in the course of our services.

In the course of our legal services, we may also receive personal data of people connected to a particular matter from third parties, including contractual counterparties and their personnel, advisors, consultants, experts, witnesses, personnel of courts and arbitral institutions, and persons identifiable from documents or evidence in legal advice or proceedings.

When we receive personal data indirectly, we often have no contact with the individuals concerned. In those circumstances, providing them with the information in this Privacy Policy is impossible, would involve disproportionate effort, would be contrary to an obligation of professional secrecy, or would otherwise be inappropriate in the context of dispute resolution proceedings. If you provide us with personal data about others, you should bring this Privacy Policy to their attention and ensure that they are informed of the disclosure as required by applicable law.

Controller

The controller of your personal data is Maarten Draye Advocaat BV, a private limited liability company (besloten vennootschap) under Belgian law, trading as Draye Law, registered with the Crossroads Bank for Enterprises (Kruispuntbank van Ondernemingen) under number 0719.445.832, RPR Leuven.
Office: Avenue Louise 231 / Louizalaan 231, 1050 Brussels, Belgium
E-mail: maarten.draye@drayelaw.com

For any question about this Privacy Policy or the processing of your personal data, please contact us at the e-mail address above.

Personal Data We Collect

We process the following kinds of personal data:

Identity and Contact Data: your name, e-mail address, postal address, telephone number, date of birth, gender, language, job title and nationality.
Legal Services Data: personal data related to or included in legal advice, disputes, litigation, arbitration or other legal proceedings.
Sensitive Data: where necessary for the legal services we provide, special categories of personal data within the meaning of Article 9(1) GDPR, namely data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data, data concerning health, and data concerning a person’s sex life or sexual orientation.
Financial Data: bank account details, payment card details, billing information and other personal data necessary to process payments to and by us.
Recruitment Data: educational and employment history, tax status, referees and other information included in a CV or application.
Marketing Data: marketing preferences, and attendance at or participation in events or other initiatives we may organise.
Other Communication Data: personal data included in any enquiry or other communication you send us.

Insofar as we process personal data relating to criminal convictions and offences or related security measures (Article 10 GDPR), usually as part of Legal Services Data, we do so in accordance with applicable law providing appropriate safeguards.

How We Collect Personal Data

We collect personal data directly from you when you provide it to us, for example in the context of our legal services, when you offer or provide services to us, when you apply for a position, when you give us your business card, when you attend an event we organise, or when you otherwise communicate with us.

We may also collect personal data indirectly from other sources in the course of our legal services, for example from our client, government agencies, public records or parties to legal proceedings, and from third parties in recruitment procedures.

If you choose not to provide personal data, we may, depending on the circumstances, be unable to provide a particular service or opportunity. We will tell you if this is the case.

How We Use Personal Data

We process personal data for the purposes set out below. For each purpose, we indicate the types of personal data concerned, the potential recipients and the legal basis for the processing.

Where we rely on our legitimate interests, we process personal data only insofar as those interests are not overridden by your interests or fundamental rights and freedoms. Where processing is necessary for a further purpose not described below, we will assess whether it is compatible with the purpose for which the data was collected and, where necessary, seek your consent.

1. Legal Services: Representation and Advice

We process personal data to provide legal services, including advice to and representation of our clients, and to handle enquiries made in contemplation of such services.

Types of personal data: Identity and Contact Data, Legal Services Data, Sensitive Data, Financial Data, Other Communication Data.

Potential recipients: depending on the matter and where there is a legal basis, other parties to legal proceedings and their representatives, other lawyers, courts, members of arbitral tribunals, arbitral institutions, regulatory bodies, government agencies, consultants, experts, witnesses, external service providers, external advisors, financing institutions or funders, professional indemnity insurers and professional regulatory bodies.

Legal basis:

the processing is necessary for the performance of a contract with you, or to take steps at your request prior to entering into a contract;
the processing is necessary for our legitimate interest in providing legal services to our clients; or
the processing is necessary for our legitimate interest in the conduct and administration of arbitration and other dispute resolution proceedings.

We process Sensitive Data (i) where necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity, (ii) where the data has manifestly been made public by you, or (iii) with your explicit consent.

2. Legal Services: Arbitrator Appointments

We process personal data when acting as arbitrator or other decision-maker in dispute resolution proceedings, and to handle enquiries made in contemplation of such appointments.

Types of personal data: Identity and Contact Data, Legal Services Data, Sensitive Data, Financial Data, Other Communication Data.

Potential recipients: depending on the matter and where there is a legal basis, other members of the tribunal, parties and their representatives, other lawyers, arbitral institutions, external service providers, courts, consultants, experts, witnesses, professional indemnity insurers and professional regulatory bodies.

Legal basis:

the processing is necessary for the performance of a contract with you, or to take steps at your request prior to entering into a contract; or
the processing is necessary for our legitimate interest in the conduct and administration of arbitration and other dispute resolution proceedings.

3. Conflicts Checks

To provide our legal services and comply with our professional obligations, we keep records of past matters and conduct checks to identify potential conflicts of interest and matters requiring disclosure.

Types of personal data: Identity and Contact Data, Legal Services Data.

Potential recipients: where necessary, our clients, prospective clients, other lawyers or arbitral institutions, on the basis of our conflicts checks. Such information is provided in anonymised form where appropriate.

Legal basis:

the processing is necessary for compliance with our legal obligations; or
the processing is necessary for our legitimate interest in complying with our professional obligations and ensuring that all relevant parties are informed of potential conflicts of interest.

4. Business Management

We process personal data to operate and manage our business, including record-keeping, administration, legal and regulatory compliance, client identification (“know your client”) checks, sanctions and other screening, billing, accounting, tax compliance, audit, payments, recovery of amounts due, engagement of service providers, any contemplated assignment or sale of our business, the handling of disputes arising out of our business or services, and as otherwise required by a court, tribunal or other authority or by a legal obligation.

Types of personal data: Identity and Contact Data, Legal Services Data, Financial Data, Recruitment Data, Other Communication Data.

Potential recipients: where there is a legal basis, government and regulatory authorities or agencies, service providers, insurers, external professional advisors including accountants and lawyers, potential assignees or purchasers of our business or assets, professional indemnity insurers and professional regulatory bodies.

Legal basis:

the processing is necessary for the performance of a contract with you, or to take steps at your request prior to entering into a contract;
the processing is necessary for compliance with a legal obligation to which we are subject; or
the processing is necessary for our legitimate interest in the operation and management of our business.

5. Marketing

We process personal data to promote our practice in the context of business development, for example through a communication or an invitation to an event. You may opt out of such communications at any time, using the mechanism provided in the communication or by contacting us.

Types of personal data: Identity and Contact Data, Marketing Data.

Potential recipients: where there is a legal basis, service providers assisting us with a marketing or promotional initiative.

Legal basis: the processing is necessary for our legitimate interest in business development. Where required by law, in particular for electronic marketing communications, we will ask for your consent before sending them. Where no other legal basis applies, we will seek your consent.

6. Recruitment

We process personal data of job candidates in the course of recruitment, including the selection of and communication with candidates and the verification of their credentials.

Types of personal data: Identity and Contact Data, Recruitment Data, Other Communication Data.

Potential recipients: where there is a legal basis, referees, third parties verifying candidates’ credentials, government and regulatory authorities or agencies, and service providers.

Legal basis:

the processing is necessary to take steps at the candidate’s request prior to entering into a contract; or
the processing is necessary for our legitimate interest in the operation of our business, including verifying the credentials of and engaging personnel.

Where no other legal basis applies, we will seek your consent.

7. IT Management

We process personal data to ensure the proper management and security of our IT systems, including audits, monitoring, troubleshooting, responding to information security incidents, and the optimisation and maintenance of those systems.

Types of personal data: Identity and Contact Data, Legal Services Data, Sensitive Data, Financial Data, Recruitment Data, Other Communication Data.

Potential recipients: IT service providers engaged to manage our IT systems on our behalf.

Legal basis: the processing is necessary for our legitimate interest in information security and in the operation and management of our business. We process Sensitive Data (i) where necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity, (ii) where the data has manifestly been made public by you, or (iii) with your explicit consent.

Our Website

Our website does not use analytics, advertising or tracking tools, and does not place cookies other than those strictly necessary for its technical operation. When you visit the website, our hosting provider in the EU processes technical data, such as your IP address, browser type and the pages requested, in server logs, for the purposes of the website’s security and proper functioning. The legal basis is our legitimate interest in operating a secure website. If you contact us by e-mail through the website, we process your message as Other Communication Data, as described above.

Our website contains links to third-party websites, such as LinkedIn and publishers. Those websites have their own privacy policies, for which we are not responsible.

International Transfers

Personal data under our control is hosted by providers within the EU or under appropriate safeguards. In the course of the processing described in this Privacy Policy, in particular in international arbitration and litigation, it may be necessary to transfer personal data to recipients outside the European Economic Area, including to jurisdictions not recognised by the European Commission as ensuring an adequate level of protection, or to international organisations. In those circumstances, we ensure that the transfer is based on an adequacy decision, on appropriate safeguards such as the standard contractual clauses adopted by the European Commission, or on a derogation provided by the GDPR, in particular where the transfer is necessary for the establishment, exercise or defence of legal claims (Article 49(1)(e) GDPR). You may obtain a copy of the relevant safeguards by contacting us.

Retention

We retain personal data for as long as necessary for the purposes for which it was collected. For personal data processed in the context of our legal services, this means for the duration of the matter and thereafter for the applicable limitation periods and the periods during which we are required to retain records under our professional, anti-money laundering, accounting and tax obligations. Records needed for conflicts checks are kept for as long as they are needed for that purpose. Subject to any specific agreement in a particular matter, personal data is deleted or anonymised when it is no longer needed.

Security and Confidentiality

We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access or disclosure. As lawyers, we are bound by professional secrecy, and in arbitration proceedings we are also bound by the applicable confidentiality obligations.

Your Rights

Under the GDPR, and depending on the circumstances, you have the following rights in relation to your personal data:

a right of access to your personal data and to information about our processing of it;
a right to have inaccurate or incomplete personal data rectified;
a right to have certain personal data erased;
a right to restrict the processing of certain personal data;
a right to withdraw your consent, where we rely on consent;
a right to receive a copy of your personal data (data portability);
a right to object to certain processing of your personal data (see below); and
a right not to be subject to a decision based solely on automated processing. We do not use automated decision-making, including profiling.

Right to object. Where we process your personal data on the basis of our legitimate interests, you have the right to object at any time, on grounds relating to your particular situation. We will then no longer process the data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims. You may object at any time to the processing of your personal data for marketing purposes, in which case we will no longer process it for those purposes.

The extent of these rights depends on applicable law, the nature of the personal data and the type of processing. In particular, to the extent provided by applicable law, these rights may be limited where the personal data is covered by professional secrecy, or where exercising them would affect the confidentiality of legal or arbitral proceedings or the rights of others.

You can exercise your rights by contacting us at maarten.draye@drayelaw.com. You also have the right to lodge a complaint with a data protection supervisory authority, such as the Belgian Data Protection Authority (www.dataprotectionauthority.be, contact@apd-gba.be).

Changes to This Privacy Policy

We may amend this Privacy Policy from time to time. The version published on this website, with the date of its last update, applies.