Privacy Statement

This Privacy Statement explains how Duna International Arbitration, Mediation, and Dispute Resolution Limited (trading as “Duna ADR”) collects and uses personal data in accordance with the EU General Data Protection Regulation ((EU) 2016/679) (the “GDPR”), the Irish Data Protection Act 2018 and guidance issued by the Irish Data Protection Commission (“DPC”).

1. Introduction / Who We Are

Duna International Arbitration, Mediation, and Dispute Resolution Limited (company number 812591), trading as Duna ADR, is a private company limited by shares registered in Ireland. Our registered address is 77 Camden Street Lower, Dublin 2, D02 XE80, Ireland.

For the purposes of data protection law, Duna ADR is the “data controller” in respect of personal data that we collect through our website at dunaadr.com and in connection with the provision of our arbitration, mediation and dispute resolution services. This means that we are responsible for deciding how we hold and use such personal data.

This Privacy Statement should be read together with our Cookie Policy, which provides further information about our use of cookies and similar technologies on our website.

2. When Do We Process Your Personal Data?

We process personal data in a range of situations, including when:

• you visit or interact with our website (for example, through cookies, analytics and similar technologies, as described in our Cookie Policy);
• you contact us by email, telephone, post or via any contact form or enquiry form on our website;
• you engage Duna ADR to provide arbitration, mediation or other dispute resolution services, whether directly or as a party, representative, expert, witness, service provider or third party connected to those services;
• you subscribe to receive updates, newsletters or other communications from us;
• you attend, or register to attend, events, training sessions, webinars or other programmes organised or hosted by Duna ADR; or
• you interact with us in any other way in the course of our business.

3. Personal Data We Collect

The type and amount of personal data that we collect depends on your relationship with us and the context in which we obtain the data. We may collect and process the following categories of personal data:

• Identity data: such as your name, title, professional role, organisation, and where relevant, details of your relationship to a dispute or matter.
• Contact data: such as your postal address, email address, telephone number and other contact details.
• Professional and dispute-related data: such as information about the dispute or matter in which you are involved, the parties and representatives, background documents, correspondence, evidence, settlement discussions, procedural records and other information that is relevant to the provision of ADR services, including mediation and arbitration.
• Technical data: such as your IP address, browser type and version, device identifiers, time zone setting and location, browser plug-in types and versions, operating system and platform, and information about how you use our website (including pages visited, page response times, download errors and navigation paths), collected via cookies and similar technologies, as described in our Cookie Policy.
• Communications data: such as your communications and correspondence with us, including emails, notes of phone calls, messages sent via our website forms or other channels, and records of your preferences in receiving communications from us.
• Financial and billing data: where applicable, such as billing contact details, payment details provided to us or to our payment providers, invoices issued, records of payments made and related financial information that we require to administer our business relationship with you or your organisation.
• Sensitive / special category data: in certain dispute resolution matters, you or other parties may provide information that includes special categories of personal data (such as data concerning health, racial or ethnic origin, religious or philosophical beliefs, trade union membership or data relating to criminal convictions or offences). We only process such information where it is strictly necessary for the establishment, exercise or defence of legal claims or for the purposes of resolving disputes, and we treat it with the highest level of confidentiality.

We may obtain personal data directly from you, from your representatives, from other parties to a dispute, from publicly available sources (such as company registers or professional directories) and, where appropriate, from other third parties involved in a matter.

4. Legal Bases for Processing

We must have a legal basis under the GDPR to process personal data. Depending on the circumstances, we rely on one or more of the following legal bases under Article 6 GDPR:

• Consent (Article 6(1)(a)): where you have given us your clear and explicit consent to process your personal data for a specific purpose, for example, when you opt in to receive marketing communications or agree to the use of non-essential cookies. You may withdraw your consent at any time (see section 8 below).
• Contract (Article 6(1)(b)): where processing is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract. This includes the processing of personal data in order to provide ADR services that you or your organisation have engaged us to deliver.
• Legal obligation (Article 6(1)(c)): where we are required to process personal data to comply with legal or regulatory obligations to which we are subject, for example, accounting, tax, anti-money laundering or other statutory obligations.
• Legitimate interests (Article 6(1)(f)): where processing is necessary for our legitimate interests or those of a third party, and your interests and fundamental rights do not override those interests. These legitimate interests include operating and improving our website, analysing how our services are used, managing our business and relationships, maintaining accurate records, ensuring network and information security and defending our legal rights. Where we rely on legitimate interests, we balance our interests against your rights and expectations.

For special category personal data (such as health data or other sensitive information) that arises in the context of our ADR services, we rely on Article 9(2)(f) GDPR, which permits processing where it is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity. We may also rely on other Article 9 grounds where applicable, for example where processing is necessary for reasons of substantial public interest under applicable Irish law.

5. Confidentiality in ADR Proceedings

Confidentiality is a core principle of mediation, arbitration and other forms of alternative dispute resolution. Duna ADR recognises and upholds the confidential nature of information shared in connection with ADR proceedings.

Personal data and other information disclosed to us during ADR processes are treated as strictly confidential. Such information is used only for the purposes of administering, managing and conducting the relevant ADR proceedings, including any related settlement discussions, determinations or awards.

Subject to our legal and regulatory obligations, we will only share information from ADR proceedings with individuals and organisations that have a direct need to know in relation to that matter, such as the parties, their legal or other representatives, co-mediators or co-arbitrators, expert advisers, witnesses, relevant service providers and, where appropriate, referring bodies or institutions. We will not disclose confidential ADR information to any other third party unless we have your consent or are required to do so by law, by a court or regulatory authority, or as otherwise permitted under applicable rules governing the proceedings.

6. Transfers of Personal Data

We are based in Ireland and do not routinely transfer personal data outside the European Economic Area (“EEE”). However, some of the third parties with whom we work may be located, or may store or access personal data, outside the EEA.

Where we use service providers or tools (such as cloud hosting services, email and document management systems or website analytics providers) that involve the transfer of personal data outside the EEA, we ensure that appropriate safeguards are in place to protect that data in accordance with Chapter V GDPR. These safeguards may include:

• an adequacy decision from the European Commission confirming that the country provides an adequate level of data protection; or
• the use of standard contractual clauses (SCCs) approved by the European Commission, together with any supplementary measures that may be required.

Certain third-party tools used on our website, including analytics and similar services, may process limited categories of personal data (such as IP address and technical data) outside the EEA. Further details are provided in our Cookie Policy and, where required, we seek your consent for such processing.

7. Data Retention

We retain personal data only for as long as is necessary for the purposes for which it was collected, including to meet any legal, accounting or reporting requirements. Retention periods may vary depending on the nature of the data and the context in which it is processed.

• Contact enquiries: we typically retain personal data relating to general enquiries or correspondence for up to 2 years from the date of the last meaningful contact, unless a longer period is necessary in connection with a dispute, potential claim or ongoing engagement.
• Client and matter files: records relating to ADR matters and client engagements are generally retained for up to 6 years from the closure of the relevant matter, or longer where required by applicable legal, regulatory or professional obligations, or where necessary in connection with actual or potential legal claims.
• Website analytics and cookies data: we retain data collected through cookies and similar technologies for the periods set out in our Cookie Policy.

When it is no longer necessary to retain personal data, we will securely delete, anonymise or otherwise dispose of it in accordance with our data retention and deletion procedures.

8. Your Rights Under GDPR

Under the GDPR, you have a number of rights in relation to your personal data, subject to certain conditions and exemptions. These rights include:

• Right of access (Article 15): you have the right to obtain confirmation as to whether we process your personal data and, if so, to request a copy of that data and certain other information about how we use it.
• Right to rectification (Article 16): you have the right to request the correction of inaccurate personal data about you and to have incomplete data completed.
• Right to erasure / “right to be forgotten” (Article 17): in certain circumstances, you have the right to request that we delete your personal data, for example, where it is no longer necessary for the purposes for which it was collected or where you withdraw consent and there is no other legal basis for the processing.
• Right to restriction of processing (Article 18): in certain circumstances, you have the right to request that we restrict our processing of your personal data, for example, while we verify the accuracy of the data or assess an objection you have raised.
• Right to data portability (Article 20): in certain circumstances, you have the right to receive the personal data that you provided to us in a structured, commonly used and machine-readable format and to request that we transmit that data to another controller, where technically feasible.
• Right to object (Article 21): you have the right to object, on grounds relating to your particular situation, to the processing of your personal data which is based on our legitimate interests. You also have the right to object at any time to the processing of your personal data for direct marketing purposes.
• Rights related to automated decision-making (Article 22): you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless certain conditions are met. Duna ADR does not currently carry out such automated decision-making in relation to individuals.
• Right to withdraw consent: where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

You can exercise any of these rights by contacting us using the details set out in section 12 below or by emailing info@dunaadr.com. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights).

You also have the right to lodge a complaint with the Irish Data Protection Commission if you consider that your personal data has been processed in a way that does not comply with data protection law. The DPC’s contact details are available at www.dataprotection.ie. We would, however, appreciate the opportunity to address your concerns before you contact the DPC, so please consider getting in touch with us in the first instance.

9. Security

We take the security of personal data seriously and implement appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These measures include access controls, user authentication, encryption or pseudonymisation where appropriate, secure storage, staff training and policies and procedures governing the handling of personal data.

While we use all reasonable efforts to safeguard personal data, no system or transmission of information via the internet can be guaranteed to be completely secure. You should be aware that sending information to us by email or via the internet is at your own risk.

10. Third-Party Links

Our website may contain links to websites, plug-ins or applications operated by third parties. If you follow a link to any of these websites, please note that they have their own privacy notices or policies and that we are not responsible for how they handle your personal data. We encourage you to read the privacy information provided on each third-party website you visit.

11. Changes to This Statement

We may update or amend this Privacy Statement from time to time to reflect changes in our practices, technologies, legal requirements or for other reasons. Any changes will be posted on this page, and where appropriate we will take reasonable steps to notify you of material changes (for example, by placing a notice on our website).

Please review this Privacy Statement periodically to stay informed about how we collect and use personal data.