This privacy statement explains how Novex Advocaten processes personal data and what rights you have in that respect. It applies to clients, to anyone who contacts us, to other persons whose data we process in a case file and to visitors to this website.
We process personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”), the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, and with due regard for the lawyer’s duty of professional secrecy.
Who is the data controller?
The controller is Mr Mohamed Asfour, lawyer (advocaat / avocat) at the Brussels Bar, practising as a sole proprietorship under the name Novex Advocaten (“we” or “us”).
- Office: Avenue Louise (Louizalaan) 379, 1050 Brussels
- Company and VAT number: BE 0793.995.973
- Telephone: 0484 99 22 72
- Email: asfour@novexadvocaten.be
For any question about the processing of your personal data, you can reach us using these contact details.
What personal data do we process?
We only process the data needed for the purpose for which we obtain it. Depending on your situation, this includes:
- identification and contact details, such as your name, address, email address and telephone number, as well as the details of your identity document where the law requires us to verify your identity;
- the data you provide through the contact form (name, email address, telephone number and your message) or send us by email or telephone;
- case data: the facts, documents, correspondence and procedural documents needed to advise, assist or represent you;
- billing and payment data, such as your company or VAT number and details of your payments;
- technical data necessarily processed when you visit this website, such as your IP address and information about your browser.
Depending on the case, this may also include special categories of data, such as health data (for example in a personal injury case), or data relating to criminal convictions and offences (for example in a criminal or traffic case). We process such data only insofar as necessary for the establishment, exercise or defence of legal claims, and within the limits the law sets for lawyers.
Where do we obtain your data?
We obtain most data directly from you. Data about other persons, such as an opposing party, witnesses or others involved in a case, may also come from our client, from the opposing party or their lawyer, from courts, bailiffs (gerechtsdeurwaarders / huissiers de justice) and other authorities, or from public sources such as the Crossroads Bank for Enterprises (KBO / BCE) and the Belgian Official Gazette (Belgisch Staatsblad / Moniteur belge).
For what purposes and on what legal basis?
We process personal data only for the following purposes, each on the legal basis indicated:
- Answering your enquiry. When you contact us through the contact form, by email or by telephone, we use your data to answer your question and to assess whether we can assist you. Legal basis: steps taken at your request prior to entering into a contract (Art. 6.1(b) GDPR) and our legitimate interest in answering enquiries (Art. 6.1(f) GDPR).
- Handling your case. Legal advice, assistance and representation, including correspondence, proceedings, invoicing and the collection of fees. Legal basis: performance of our contract with you (Art. 6.1(b) GDPR).
- Processing data of other persons involved. To protect our client’s interests, we also process data of opposing parties, witnesses and other persons involved in a case. Legal basis: our client’s legitimate interest and our own in the establishment, exercise or defence of legal claims (Art. 6.1(f) GDPR). In this context, special categories of data are processed only on the basis of Art. 9.2(f) GDPR.
- Complying with our legal and professional obligations. For example, verifying the identity of clients and the duty of vigilance under anti-money laundering legislation where it applies, checking for conflicts of interest, and our accounting and tax obligations. Legal basis: a legal obligation (Art. 6.1(c) GDPR).
- Defending our rights. For example in a fee dispute or a liability claim. Legal basis: our legitimate interest (Art. 6.1(f) GDPR).
- Operating and securing the website. Legal basis: our legitimate interest in offering a secure, properly functioning website (Art. 6.1(f) GDPR).
We do not use your data for other purposes that are incompatible with those listed above.
As a rule, you are not obliged to provide us with data, but without certain data we cannot answer your enquiry or handle your case. Where the law requires us to verify your identity, we cannot act for you without that information.
Professional secrecy
As a lawyer, Mr Mohamed Asfour is bound by professional secrecy, which is protected by criminal law (Article 352 of the Criminal Code). What you entrust to him in connection with your case remains confidential. It is shared only insofar as necessary to handle your case or where the law permits or requires it.
Professional secrecy also affects other persons whose data we process. Where data is covered by professional secrecy, we are not required to inform the person concerned separately, for example an opposing party (Art. 14.5(d) GDPR). The right of access may also be restricted where exercising it would adversely affect the rights and freedoms of others, such as our client’s right to confidentiality.
Who do we share your data with?
We share personal data only where necessary for the purposes set out above, and always with due regard for professional secrecy. Possible recipients are:
- courts, bailiffs, experts, translators and mediators, insofar as your case requires it;
- the opposing party and their lawyer, in the course of handling the case;
- authorities and bodies, where the law obliges us to do so, for example a report under anti-money laundering legislation, which lawyers make through the President of the Bar (stafhouder / bâtonnier);
- the Bar (Orde van advocaten / Ordre des avocats) and our professional indemnity insurer, where the professional rules or a claim require it;
- service providers acting on our behalf (processors), such as the external hosting provider of this website and providers of email and IT services. They may process your data only on our instructions and for our purposes.
Messages sent through the contact form on this website are forwarded to the office by email.
Transfers outside the European Economic Area
We only transfer personal data to a country outside the European Economic Area (EEA) where necessary, for example in a case with an international dimension or where a service provider processes data outside the EEA. Such transfers take place only with the safeguards required by the GDPR, such as an adequacy decision of the European Commission or standard contractual clauses adopted by the Commission, or on another ground permitted by the GDPR, such as the need for a legal claim.
How long do we keep your data?
We do not keep personal data longer than necessary for the purpose for which it was collected. We apply the following criteria:
- enquiries that do not lead to a case: as long as necessary to answer your question and allow any follow-up;
- case files: while the case is being handled and thereafter for as long as we are required to keep the data under legal or professional obligations, or need it to defend ourselves against a possible claim, taking into account the applicable limitation periods;
- accounting and tax records and data we must keep under anti-money laundering legislation: for the periods laid down by the applicable legislation.
At the end of the retention period, the data is deleted or anonymised.
Security
We take appropriate technical and organisational measures to protect personal data against loss, unlawful access, alteration or disclosure. Access is limited to those who need the data to handle your enquiry or case.
An ordinary email or a message sent through the contact form does not offer a complete guarantee of confidentiality. When you first contact us, we therefore recommend that you share only the information needed to outline your question.
Cookies and the Google Maps map
This website does not use analytics cookies or any advertising or tracking technology. Only strictly necessary and functional cookies are used, for example for logged-in administrators, for your language choice and for caching. Cookies that are strictly necessary for the website to function or to provide a service you have expressly requested do not require consent (Article 10/2 of the Act of 30 July 2018).
The Google Maps map on the contact page is loaded only after you yourself click the button to display it. From that moment, your browser connects to Google, which receives, among other things, your IP address and may place its own cookies. For the further processing of this data, Google acts as a separate controller and processes it under its own privacy policy, possibly also outside the EEA. As long as you do not click, the map is not loaded and does not transmit any data to Google.
More information can be found in our cookie policy.
Your rights
You have the following rights, subject to the conditions of Articles 15 to 22 GDPR:
- the right of access to your data and to obtain a copy of it;
- the right to rectification of inaccurate or incomplete data;
- the right to erasure, except where we must keep the data to comply with a legal obligation or need it for the establishment, exercise or defence of legal claims;
- the right to restriction of processing, for example while the accuracy of your data is being verified;
- the right to data portability for data you have provided to us yourself, where the processing is based on your consent or on a contract and is carried out by automated means;
- the right to object to processing based on legitimate interest, on grounds relating to your particular situation; we will then stop that processing unless we demonstrate compelling legitimate grounds or need the data for a legal claim;
- the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
- the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you. We do not take any such decisions.
To exercise a right, send an email to asfour@novexadvocaten.be or a letter to our office address. We may ask you to prove your identity if we have reasonable doubts about who is making the request. We will respond within one month of receipt. This period may be extended by two months for complex or numerous requests; in that case we will tell you why within the first month.
Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive. Your rights may be limited by professional secrecy and by the rights of others, as explained above.
Complaints
If you have a question or comment about how we handle your data, you can always contact us first. You also have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données) in Brussels: www.gegevensbeschermingsautoriteit.be (Dutch-language site) or www.autoriteprotectiondonnees.be (French-language site). You may also bring an action before the courts.
Changes and further information
We may amend this privacy statement, for example following a change in the law or in our working methods. The most recent version is always available on this page. Please also read our disclaimer and our cookie policy.
Questions about this privacy statement? Contact us on 0484 99 22 72, by email at asfour@novexadvocaten.be or through the contact page.
Last updated: 27 September 2026