Description and purposes of the processing

When visiting our website, your browser will contact our webserver to retrieve the sites you wish to visit. In this context, personal data such as your IP address is transferred by your browser (i.e. by HTTP/S requests) to us. This connection data is processed by our webserver to enable access to and the display of our website.

Our webserver automatically saves a record of the pages you visited (so-called ‘logfiles’ or ‘session records’). We use these logfiles to ensure the security of our website, in particular to prevent unauthorised interference with it, and to enable us to exercise our legal rights and obligations in regard to such unauthorised interference.

Furthermore, we analyse session records to optimise our website. The results cannot be linked to your person.

Legal basis for the processing and legitimate interests for the processing

Generally, the processing activities in the context of your visit to and use of our website are based on our legitimate interests to operate an internet website for general information and communication purposes, to optimise our website and to protect it from attacks.

Exceptionally, we may process personal data to fulfil our legal obligations, in particular with regard to the relevant authorities in cases of unauthorised interference with our website.

Recipients

Our IT department has access to logfiles and will pass them on to other internal or external recipients including to the relevant authorities if necessary to exercise our legal rights regarding any unauthorised interference with our website.

Our website is hosted on our behalf by the hosting services provider Episerver Inc. (542 Amherst Street, Route 101A, Nashua, NH 03063, USA).

Retention period

Logfiles are normally erased after 90 days. They may be stored for a longer period if necessary for the above-mentioned purposes, including for the exercise of our legal rights.

All other data is erased immediately after processing the HTTP/S request.

Possible consequences of failure to provide personal data

Without processing the above mentioned personal data, you cannot display and visit our website.

Description and purposes of the processing

Our information hubs, collaborative platforms, legal technology solutions and third party applications (“Solutions”) offer a wide range of resources, and alternative ways to deliver our services on a particular Matter, primarily to our clients in the course of our business relationship with them but also to other parties. As a part of our delivery of legal services, we may use AI, where appropriate, including to support with document review, legal research and data analysis.

We will process personal data such as names and e-mail addresses to administer and monitor access to (and use of) these Solutions.  In order to tailor and further optimise the user experience, the functionalities and operation of these Solutions, and the information provided to you, we may also process information regarding your specified preferences, if any, and in some instances information regarding your use of our Solutions. We may also process this data for business development purposes and to troubleshoot, develop and improve our Solutions.

When you share information with us using certain Solutions in relation to a Matter, we will process that data, including Matter Data, for the purposes set out in section 3 of this Notice below.

We also use registration data for business development purposes and to troubleshoot, develop and improve our Solutions.

Legal basis for the processing and legitimate interests for the processing

The processing is based on our legitimate interests to provide you with certain resources, know-how and information in context of (or related to) our services and business initiatives, and generally to offer our clients an alternative, modern and efficient way to deliver or support our services, and in doing so to develop our business and promote client relationships. It serves the legitimate interests of users to access the know-how, resources, information and support provided to them (or the client) through the Solutions.

When you register to access our Solutions, and accept their terms of use, we will (also) process your personal data as necessary in relation to those terms of use (performance of a contract).    

Recipients

Our internal business development and IT departments have access to and process registration and usage data for the provision and maintenance of your user account, for authentication purposes, for the optimisation of our information resources and business development initiatives and to enable the provision of Solutions to you.

Transfer of personal data to third countries or international organisations

As a global law firm, we may share your data within Freshfields Bruckhaus Deringer. Appropriate safeguards for personal data transfers within Freshfields Bruckhaus Deringer will be ensured through standard contractual clauses.

Additionally, we have in place binding firm-wide data protection and information security policies which govern our internal data processing activities.

Solutions can be hosted in third-party managed IT environments (primarily cloud-based). Appropriate safeguards for personal data transfers to such third parties will be ensured: through standard contractual clauses; with your consent or on the basis that the transfer is otherwise compliant with Applicable Data Protection Laws.

Retention period

We retain personal data only for as long as there is a legitimate reason or other legal ground to do so, and will keep these legal bases under review. If there is no longer a legal ground for the data to be retained, we will erase personal data securely, or in some cases anonymise it.

Possible consequences of failure to provide personal data

Without our processing the above-mentioned personal data, you will not be able to access and use the Solutions or certain restricted areas of our website.

Data Controller

We do not control the processing of personal data in the context of social media plug-ins. We do not have any access to the data collected and transferred by the social media plug-in to the social network provider. Any data processing is determined solely by the network service provider.

In the interest of transparency, we would like to inform you about the processing of your personal data in this context.

Description and purposes of the processing

To improve your user experience, our website includes social media plug-ins of the large social media networks Twitter, LinkedIn Google+. These plug-ins allow you to directly post links to and other content from our websites on the relevant network.

Upon you opening a website on which a social media plug-in is embedded, the respective social network provider

• Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
• Twitter Inc., 1355 Market St, Suite 900, San Francisco, CA 94103, USA
• LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland

will collect and process information on your visit to our website for its own business purposes. This processing is not initiated or controlled by us, but is a built-in feature of the respective social media plug-in.

For further information on the processing of personal data, please contact the respective social media provider or refer to their respective privacy policy:

• Google: policies.google.com/privacy
• Twitter: twitter.com/privacy
• LinkedIn: linkedin.com/legal/privacy-policy

Legal basis for the processing and legitimate interests for the processing

The processing of personal data in this context by us, if any, is based on our legitimate interests to: (i) improve our website’s user experience thereby making it more attractive and thus increasing user traffic; and (ii) make our content more visible and thereby promote our business.

For information on the legal basis of processing by the social media provider, please contact the respective social media provider or refer to their respective privacy policy:

• Google: policies.google.com/privacy
• Twitter: twitter.com/privacy
• LinkedIn: linkedin.com/legal/privacy-policy

Recipients

We do not have access to, nor share, any personal data in this context.

For sharing of personal data by the social media provider, please contact the respective social media provider.

Transfer of personal data to third countries or international organisations

We do not transfer personal data to third countries. However, the social media plug-in will connect to the webserver of the social media network in the United States of America. For further information on transfers and relevant safeguards regarding them, please contact the respective social media provider or refer to their respective privacy policy:

• Google: policies.google.com/privacy
• Twitter: twitter.com/privacy
• LinkedIn: linkedin.com/legal/privacy-policy

Retention period

We do not store any personal data in this context.

For storage of personal data by the social media provider, please contact the respective social media provider or refer to their respective privacy policy:

• Google: policies.google.com/privacy
• Twitter: twitter.com/privacy
• LinkedIn: linkedin.com/legal/privacy-policy

Possible consequences of failure to provide personal data

Without processing the above mentioned personal data, you will not be able to post links to and other content from our website.

• Episerver Inc. (542 Amherst Street, Route 101A, Nashua, NH 03063, USA)
• Cloudflare Inc. (101 Townsend St., San Francisco, CA 94107, USA) as data processors based on data processing agreements between Episerver Inc. / Cloudflare Inc. and us.

• Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA),
• Episerver Inc. (542 Amherst Street, Route 101A, Nashua, NH 03063, USA)
• ShareThis, Inc. (4005 Miranda Avenue, Suite 100, Palo Alto, CA 94304-1227, USA) and
• Hotjar Ltd. (Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian's, STJ 3141, Malta, Europe) 

• AddThis: addthis.com/privacy/privacy-policy
• Twitter: twitter.com/privacy
• LinkedIn: linkedin.com/legal/privacy-policy
• Facebook: facebook.com/policy.php

Data Controller

The data processing in the context of providing legal advice on a given Matter will ordinarily be controlled by the Freshfields Entity that is instructed and provides its services on that Matter. Where several Freshfields Entities work together on a Matter, they normally act as individual controllers for the respective work done on that Matter by them, as they will ordinarily be providing their advice in respect of the relevant jurisdiction where they are based. If they should however act as joint controllers, the relevant Freshfields Entity that is instructed on that Matter is designated as a single point of contact for data subjects under the GDPR.

You can see here the Freshfields Entities through which we practise law in the relevant jurisdiction.

Description and purposes of the processing, categories of personal data processed

We process personal data in relation to a Matter (“Matter Data”) for certain specific purposes, including:

• to deliver legal services to our clients, and to handle the Matter;

• to comply with our applicable legal and regulatory obligations in the jurisdictions where we practise, including where applicable, to comply with any money laundering and terrorist financing obligations, and to carry out conflict and Know Your Customer (or KYC) checks;

• for internal operational purposes (e.g. internal record keeping, know how and precedent management, accounting, billing and tax compliance);

• for business development, marketing and improvement of our services;

• to fulfil certain legal obligations (e.g. where applicable, disclosure obligations and compliance with court orders).

Whose personal data do we process in the course of handling a Matter?

Depending on the nature of the Matter, we may process personal data of various categories of data subjects, including:

• clients and their respective officers, agents and staff;
  • counterparties / contractual partners of our clients and their respective officers, agents and staff;
  • other advisers, consultants and professional experts who are involved in the Matter and their respective officers, agents and staff;
    • our partners and staff;
    • third parties such as court officers, witnesses and other natural persons who are involved in the Matter.

What types of personal data are processed as Matter Data?

The Matter Data can include various types of personal data, depending on the nature of the Matter and the information that is provided to, or obtained by, us in the course of that Matter. The types of personal that we typically process in relation to a Matter include client contact and communication data. In addition, in the course of carrying out the KYC verification required by law, we may process a copy of an identity document (e.g. ID card), including any personal data specified therein.  

Depending on the Matter, we also process “special categories of personal data” according to Art. 9(1) GDPR (e.g. health data) and personal data relating to criminal convictions and offences or related security measures according to Art. 10 GDPR. We of course limit the processing of personal data and in particular sensitive personal data to the necessary minimum.

Legal basis for the processing and legitimate interests for the processing

• Our processing of Matter Data, is ordinarily based on our legitimate interests to provide our services and advice to our clients. This processing is necessary for the pursuit of our client’s legitimate interest to obtain legal advice and representation;
• We also have a legitimate interest to process Matter Data in order to comply with certain obligations related to the operation of our business such as maintaining our accounts, and for record keeping, billing and tax compliance purposes; and
• We also process Matter Data to meet our legal and regulatory obligations under Applicable Laws.

We process special categories of personal data  (as necessary): for the establishment, exercise or defence of legal claims; based on your consent;  for employment and social security law purposes; in relation to personal data which has been made public by a data subject; and/or  for reasons of public interest in connection with a statutory provision.

Sources of personal data

In the context of a Matter, our clients ordinarily provide us with the personal data that we need to handle the Matter in our capacity as their legal advisors.

If a client has registered to use one of our Solutions (see section 2.2 above), we may also gather personal data through use of those solutions. 

However, we may also obtain certain personal data from other sources (for example for KYC purposes) such as public registers and databases, court and public records, and our communication with third parties and other advisors involved in the Matter.

Recipients

In the course of our work on a Matter, as a global law firm we may, where necessary and subject to appropriate terms regarding confidentiality and data protection, share Matter Data:

• with our offices and associated undertakings that are part of Freshfields Bruckhaus Deringer across the world;
• if required, on a case-by-case basis, with other professional advisers including those working with us on a Matter (for example law firms from our “StrongerTogether” network);
• with other parties providing goods or services to us for the purpose of supporting our work on a Matter (e.g. providers of legal technology) or in connection with the administration of the activities of Freshfields Bruckhaus Deringer in the ordinary course of its business; and/or
• with our professional advisers and insurers where it is required for them to provide their services to us.

Transfer of personal data to third countries or international organisations

As a global law firm, we share Matter Data within Freshfields Bruckhaus Deringer (e.g. where multiple Freshfields Bruckhaus Deringer offices are involved in a Matter). Adequate safeguards for personal data transfers within Freshfields Bruckhaus Deringer (and where necessary with other third parties working with or for us on a Matter) will be ensured: through standard contractual clauses; with your consent; or on the basis that the transfer is otherwise compliant with Applicable Data Protection Laws. Additionally, within Freshfields Bruckhaus Deringer we have in place binding firm-wide data protection and information security policies which govern our internal data processing activities.

Retention period

We retain personal data only for as long as there is a legitimate reason or other legal ground to do so, and will keep these legal bases under review. If there is no longer a legal ground for the data to be retained, we will erase personal data securely, or in some cases anonymise it.

Data Controller

Data processing activities in the context of global business development initiatives are generally controlled by Freshfields Bruckhaus Deringer LLP.

Data processing activities in the context of local business development initiatives are ordinarily controlled by the respective Freshfields Entity.

If different Freshfields Entities act as joint controllers, Freshfields Bruckhaus Deringer LLP is designated as a single point of contact for data subjects under the GDPR.

Description and purposes of the processing

In the conduct of our business we engage in different business development and related activities with current and potential clients and other relevant third parties. For these purposes, we process certain “business development data” such as:

• contact information (e.g. name, work address, telephone numbers, e-mail, position), communication data, and other business-related information;
• data on (marketing) preferences and fields of interest; and/or
• data on past participation in marketing initiatives.

These data are provided directly by, or obtained from, the relevant data subject or other business contacts and sources (e.g. business information services, public sources or registers).

Legal basis for the processing and legitimate interests for the processing

The processing is based on our legitimate interest to pursue business development initiatives, or, as the case may be, in order to take steps at the request of a data subject prior to entering into a contract.

Recipients

As a global firm in the conduct of our business, we share certain business development data within Freshfields Bruckhaus Deringer.

On a case-by-case basis, we may also share certain business development data with our business partners (for example law firms from our “StrongerTogether” network) and certain other parties that assist us with our business development activities in the ordinary course of our business (e.g. marketing services providers).

Transfer of personal data to third countries or international organisations

As a global law firm, we may share business development data within Freshfields Bruckhaus Deringer and with certain third parties supporting us with the administration of our activities in the ordinary course of our business. Adequate safeguards for personal data transfers within Freshfields Bruckhaus Deringer (and where necessary with certain other third parties) will be ensured: through standard contractual clauses; with your consent; or on the basis that the transfer is otherwise compliant with Applicable Data Protection Laws. Additionally, within Freshfields Bruckhaus Deringer we have in place binding firm-wide data protection and information security policies which govern our internal data processing activities.

Retention period

We retain personal data only for as long as there is a legitimate reason or other legal ground to do so, and will keep these legal bases under review. If there is no longer a legal ground for the data to be retained, we will erase personal data securely, or in some cases anonymise it.

Possible consequences of failure to provide personal data

Where we collect business development data directly from you, you continue to retain full discretion over how and what you disclose to us. There are no negative consequences if you do not provide us business development data.

Data Controller

Generally, data processing activities in the context of newsletters and update services (e.g. RSS news feeds and social media news feeds) are ordinarily controlled by Freshfields Bruckhaus Deringer LLP.

Data processing in the context of local newsletters or other update services are ordinarily controlled by the respective Freshfields Entity.

If different Freshfields Entities act as joint controllers, Freshfields Bruckhaus Deringer LLP is designated as a single point of contact for data subjects under the GDPR.

Description and purposes of the processing

If you have signed up or otherwise agreed to receive newsletters or other update services, we will process your contact data (e.g. name, e-mail) to provide those services to you.

To further optimise the user experience and in particular to tailor the information provided to you, we process information on your specified preferences, if any, and in some instances, follow your consumption of material (user statistics).

All newsletter activities and other update services serve marketing purposes and business development.

Legal basis for the processing and legitimate interests for the processing

The processing is based on our legitimate interests to pursue business development activities, or, as the case may be, for the performance of a contract according.

In other cases, we may ask you for your explicit consent for the processing.

Recipients

As a global firm in the conduct of our business, we share certain business development data within Freshfields Bruckhaus Deringer.

On a case-by-case basis, we may also share certain business development data with our business partners (for example law firms from our “StrongerTogether” network) and certain other parties that assist us with our business development activities in the ordinary course of our business (e.g. marketing services providers).

Transfer of personal data to third countries or international organisations

As a global law firm, we share data within Freshfields Bruckhaus Deringer. Adequate safeguards for personal data transfers within Freshfields Bruckhaus Deringer will be ensured: through standard contractual clauses; with your consent; or on the basis that the transfer is otherwise compliant with Applicable Data Protection Laws. Additionally, within Freshfields Bruckhaus Deringer we have in place binding firm-wide data protection and information security policies which govern our internal data processing activities.

Retention period

We retain personal data only for as long as there is a legitimate reason or other legal ground to do so, and will keep these legal bases under review. If there is no longer a legal ground for the data to be retained, we will erase personal data securely, or in some cases anonymise it.

Possible consequences of failure to provide personal data

There are no negative consequences if you do not provide us the above mentioned personal data. However, without providing your personal data, you cannot receive our newsletter or other update services.

Controller

Data processing in the context of seminars, webinars and events is ordinarily controlled by the relevant Freshfields Entity offering the seminar, webinar or event.

Description and purposes of the processing

We offer seminars, webinars and events on a wide range of topics primarily to our clients in the course of our business relationship with them, but also to other registered parties. Seminars, webinars and events are part of our business development endeavours.

When you sign up for a seminar, webinar or event, we will process the registration data you provide, such as your name, role and contact details, to administer access to and present the respective seminar, webinar or event. We may also use registration and attendance data for purposes of business development and, where required to do so, to facilitate contact tracing in relation to COVID-19.

Legal basis for the processing and legitimate interests for the processing

The processing is based on our legitimate interests to develop our business and promote client relationships. It also serves the legitimate interests of users and attendees to receive training in legal matters and know-how. Additionally, processing contact details and attendance data is in the interests of public health efforts to help tackle COVID-19.

Recipients

Registration and attendance data is processed by the relevant departments of the respective Freshfields Entity hosting and/or performing the seminar or webinar. It may also be processed by the internal business development departments of other Freshfields Entities. Lists of attendees may be provided to other attendees and, if required, to a contact tracing scheme in order to support efforts to help tackle COVID-19.

Transfer of personal data to third countries

As an organisation with a global presence, we share registration and usage data with Freshfields Entities in third countries. Adequate safeguards for personal data transfers within Freshfields Bruckhaus Deringer will be ensured through standard contractual clauses. Additionally, we have in place binding firm-wide data protection and information security policies which govern our internal data processing activities.

Retention period

We retain personal data only for as long as there is a legitimate reason or other legal ground to do so, and will keep these legal bases under review. If there is no longer a legal ground for the data to be retained, we will erase personal data securely, or in some cases anonymise it.

Possible consequences of failure to provide personal data

Without us processing the above mentioned personal data, you cannot participate in our seminars, webinars or events.

Controller

The processing of personal data in the context of our social media tool for alumni (the “Freshfields Alumni Network”) on our website is generally controlled by Freshfields Bruckhaus Deringer LLP.

Data processing in the context of local alumni networks and newsletters are ordinarily controlled by the respective Freshfields Entity.

Description and purposes of the processing

The Freshfields Alumni Network is a network of valuable business contacts and enables you to keep in contact with us and your former colleagues. You may sign up to our Freshfields Alumni Network by filling out our registration form. We ask you to provide your contact information (name, private address and e-mail), current employment information (such as current company name, job title, business contact details) and information regarding your time at Freshfields (such as office and department at departure, role title). The Freshfields Alumni Network also serves recruiting purposes.

The registration form also provides the possibility to subscribe to different newsletters and updates. For further information on data processing activities in the context of these newsletters and updates, please see above under 4.2.

Legal basis for the processing and legitimate interests for the processing

The processing in the context of our Freshfields Alumni Network is based on our legitimate interests to pursue our business interest of developing and maintaining a network of business contacts and to recruit highly skilled employees.

Recipients

We share the above-mentioned personal data, in particular contact data, with other Freshfields Entities.

Transfer of personal data to third countries or international organisations

As a global law firm, we may share your data within Freshfields Bruckhaus Deringer. Appropriate safeguards for personal data transfers within Freshfields Bruckhaus Deringer will be ensured through standard contractual clauses.

Additionally, we have in place binding firm-wide data protection and information security policies which govern our internal data processing activities.

Possible consequences of failure to provide personal data

There are no negative consequences if you do not provide us the above mentioned personal data. However, without processing the above mentioned personal data, you cannot use our social media tool for alumni.

Retention period

We retain personal data only for as long as there is a legitimate reason or other legal ground to do so, and will keep these legal bases under review. If there is no longer a legal ground for the data to be retained, we will erase personal data securely, or in some cases anonymise it. Generally, we erase your personal data in regard to our Freshfields Alumni Network as soon as possible after your withdrawal from this network.

Controller

If you use the contact options on our website, the respective data processing is controlled by the relevant Freshfields Entities if you contact them directly.

If different Freshfields Entities act as joint controllers, Freshfields Bruckhaus Deringer LLP is designated as a single point of contact for data subjects under the GDPR.

Description and purposes of the processing

We offer you the possibility to contact us via e-mail or our contact form. We will process your personal data (such as your name, address, telephone number) to respond to you request and save them for potential further inquiries. Also, the content of the communication will be processed by us for the purpose of responding to your request.

Legal basis for the processing and legitimate interests for the processing

The processing of your data in the context of our communications with you (e.g. via a contact form or by e-mail) is based on our legitimate interests to respond to your requests or queries, or otherwise to communicate with you.

Recipients

We share the above-mentioned personal data, in particular contact data, with those Freshfields Entities, offices or departments your request is aimed at.

Transfer of personal data to third countries or international organisations

As a global law firm, we may share your data within Freshfields Bruckhaus Deringer. Appropriate safeguards for personal data transfers within Freshfields Bruckhaus Deringer will be ensured through standard contractual clauses.

Additionally, we have in place binding firm-wide data protection and information security policies which govern our internal data processing activities.

Possible consequences of failure to provide data

You are not obliged to provide us with your personal data. However, we need the relevant data to contact you and respond to your request or query.

Retention period

We retain personal data only for as long as there is a legitimate reason or other legal ground to do so, and will keep these legal bases under review. If there is no longer a legal ground for the data to be retained, we will erase personal data securely, or in some cases anonymise it.