Last Updated: March 3, 2020
About the Firm and This Privacy Statement
Cleary Gottlieb Steen & Hamilton LLP (“Cleary Gottlieb,” “Cleary” the “Firm,” “we” or “us”) is committed to safeguarding privacy and personal data. With a few exceptions, such as when we provide data room or e-discovery services (in the context of which our role is limited to that of a data processor), Cleary Gottlieb is generally the controller of personal data provided to us.
This Privacy Statement is intended to inform clients, prospective clients and more generally all visitors to this website about how we collect, use, share, protect or otherwise process personal data. Other policies may apply to recruitment and would be notified separately.
Cleary Gottlieb Steen & Hamilton LLP is an international law firm practicing in a number of jurisdictions around the world through affiliated legal entities and branch offices of those entities. More information about each of these entities and offices can be found here. While entities within the Firm may act as controllers (or joint controllers) regarding certain processing activities in connection with your personal data, your local office can act as your primary point of contact should you require assistance in connection with matters relating to your personal data. Alternatively, should you require additional information about the Firm’s processing of your personal data, or if you would like to exercise any of your rights (as further detailed below) you can contact us at email@example.com. We will then ensure that your request is directed to the appropriate departments internally.
When, How and What Personal Data We Collect
All personal data processed by us is necessary to fulfill the purposes for which they were collected (further explained below).
The processing of your personal data includes any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission or otherwise making available, alignment or combination, blocking, erasure or destruction of data, and such processing will always be carried out in compliance with data protection rules.
Where you provide information about third parties you must have provided the data subjects with information about such disclosures and established a legal basis for sharing the personal data with us, to the extent required by applicable law.
We collect, and may have collected in the preceding 12 months, personal data about you from various sources, including identifiers, commercial information, online activity, employment information and education information. We may collect such personal data from you directly, from your device (such as when you visit our website), from your colleagues who may provide us with your contact details so that we can provide our services directly to you, from vendors who provide services on our behalf, from professional services organizations (such as PR firms, other law firms, and pro bono organizations), from social networks and from government entities.
Additional detail about how we collect such information is further detailed below.
In general, you are not required to provide any personal data in order to consult our website. However, you may elect to contact us by completing the form provided on the Contact Us page of this website, in which case we ask you to provide your name and email address, and to submit specific questions to us. You may also elect to contact us voluntarily by telephone or email, in which case we will process the personal data in such communications (including identifiers such as your email address or name and commercial data such as the content of the communication).
When using the website for mere information purposes, we may also collect the personal data that your web browser transmits to our server, including internet or other electronic network activity such as your IP address, the date and time of your visit, and data relating to your operating system and web browser.
When you register for one or more of Cleary’s mailing lists, we will maintain and use your name, address and other personal information you provide to us for the purposes of sending you periodic updates on legal developments and information about our firm or the services that it offers that may be of interest to you.
Provision of Services.
During the course of an engagement, or when consideration is being given to such an engagement, we may collect and process personal data about our clients, prospective clients, counterparties and each of their affiliates or the relevant members of their personnel or representatives.
When visiting one of our locations or attending one of our firm-sponsored events, we may also collect personal data from you, including identifiers such as your name, address, the date of your visit or event and other personal or commercial information you provide to us such as educational information, bar admission information, dietary requirements and other information you intentionally communicate or provide to us.
Why Personal Data Is Used
We will use your personal data:
- to process your requests, to contact you and to provide you with the information or services that you have requested;
- to conduct pre-engagement assessments and formalities such as anti-money laundering checks, conflict checks, etc.;
- to perform the tasks entrusted to us by our clients and fulfill our engagement by you;
- for client relationship management purposes;
- for internal administrative or operational processes;
- to analyze the services you may be interested in (including through inquiries and statistical surveys);
- to send invitations and information from Cleary Gottlieb about events, publications, and services provided by the firm; and
- to satisfy any legal, regulatory, accounting or reporting requirements.
We also use your personal data to ensure security and successful navigation of our website and to compile statistical data on the use of our website.
We will process personal data if and to the extent applicable law provides a lawful basis for us to do so and in particular where the processing is necessary:
a) to perform the contract we have entered into with a data subject or in order to take steps at the data subject’s request prior to entering into a contract;
b) to comply with a legal obligation to which we are subject; or
c) for our (or a third party’s) legitimate interest which is not overridden by the data subjects’ interests or fundamental rights and freedoms. Such legitimate interests will be the provision of legal services by us, administrative or operational processes within Cleary Gottlieb, and direct marketing.
Additionally, we may process personal data for a specific purpose where we have obtained the data subject’s consent.
With Whom Personal Data May Be Shared
We do not sell personal data to third parties nor have we done so in the preceding 12 months.
Please note, however, that in order to process a query, deliver legal services, or to fulfill any of the purposes set out in the section above, personal data may have to be shared among different entities within the Firm around the world. Access to your personal data will therefore be available, in various offices of the Firm, to Firm employees (including our lawyers as well as our professional staff) for the purposes listed above but only on a strictly need-to-know basis.
Additionally, we may disclose, and in the preceding 12 months may have disclosed, your personal data (including identifiers, internet or other electronic network activity, and commercial information you have communicated or provided to us) for a business purpose, with service providers with which we work. Such third party service providers may include:
- accountants, management and tax consultants, intermediaries with public authorities;
- credit institutions;
- information technology and telecommunications providers;
- local or specialist legal counsel; or
- legal counsel appointed by a counter-party in a legal matter.
We may also disclose, and in the preceding 12 months may have disclosed, your personal data (including identifiers and commercial information), for business purposes as described above under “Legal Basis” and according to your general instructions, with your other advisors, your counter-parties and their legal representatives and, generally, all those individuals to whom transmission is required for one of the purposes described above.
Consequences of Failure to Provide Your Personal Data
Your provision of personal data to us (including personal data of third parties) is voluntary, and refusal to provide personal data will not result in a denial or change in the price or quality of our services. However, any refusal on your part to provide any such data could prevent us, depending upon the circumstances, from providing certain services to you.
How Long Personal Data Is Retained
We will retain your personal data for as long as necessary to fulfill the purposes for which it was collected and processed in compliance with this Privacy Statement. To determine the retention period for personal data, we will take into consideration the purposes for which they were collected, as well as the nature and sensitivity of the information and the applicable legal requirements. We conduct periodic reviews of the data we retain and will safely delete data to the extent it is no longer required to be retained by us.
During the retention of your personal data, we take technical and organizational security measures to protect your data from accidental or intentional manipulation, partial or complete loss, destruction or unauthorized access by third parties. Our security measures are continuously improved in line with technological developments. Additional information about our security measures is available on request.
Whether Personal Data Is Transferred Internationally
The Firm operates on a worldwide integrated basis and we may need to transfer personal data to other offices in the Firm. This may include the transfer of personal data from a location within the European Economic Area (the “EEA”) to outside the EEA. For a complete list of the Firm’s offices, please see the Firm’s website in the Locations section.
Transfers from the EEA to locations outside of the EEA are governed by contractual arrangements which incorporate the European Commission’s standard contractual clauses. You can request a copy of these clauses by contacting us at the following email address: firstname.lastname@example.org.
What Rights You Have
- Access: you may contact us at any time to request access to your personal data, and we will confirm to you whether we are processing your personal data and for what purposes, as well as provide details of the categories of personal data concerned, the specific pieces of data concerned, the recipients of the personal data, the retention periods (where possible) and your rights.
- Rectification: if any of your personal data that we hold appears to be inaccurate or incomplete, you may ask us to correct or complete it at any time.
- Erasure: you may ask us to have your personal data erased if it is no longer necessary for us to keep it in connection with the purposes for which it was collected or if the processing/storing of such personal data is otherwise unlawful. However, we must keep track of certain information in order to comply with legal obligations, and/or to handle any claims or litigation.
- Restriction: you may ask us to limit the way in which we process your personal data (i.e., require us to continue to store your personal data but not to process it without your consent), for example where you think the personal data we hold is inaccurate, for a period enabling us to verify the accuracy of personal data, or where you have objected to our processing.
- Objection: you may object to our processing of your personal data on grounds relating to your specific situation, where we are processing your personal data to pursue our legitimate interests.
- Portability: you may ask us to send you your personal data in an electronic, structured, commonly-used and machine-readable format and have your personal data transmitted directly from us to another data controller, where technically feasible without hindrance where the processing is carried out by automated means and is based on your consent or is necessary for the performance of a contract to which you are party.
Withdrawal of Your Consent: you may withdraw your consent at any time, where the processing is based on your consent. Withdrawal of consent does not affect the lawfulness of processing based on consent before it was withdrawn. You also have the right to contact us at any time if you wish to complain about our processing of your personal data and you may lodge a complaint at any time with a supervisory authority.
No Discrimination: you have the right not to receive discriminatory treatment by us for the exercise of your privacy rights.
Furthermore, you have the right to have us remove you from our marketing distribution lists at any time. If you currently receive marketing information from us that you would prefer not to receive in the future, please email us at: email@example.com
Subject to applicable law, an authorized agent may exercise the various rights under this policy on behalf of a consumer by using the contact information below. Authorized agents exercising rights on behalf of a consumer may be required to verify their own identity and submit proof that they have been authorized by the consumer to act on the consumer’s behalf, in addition to the other requirements for requests of a similar nature.
Automated Individual Decision-Making, Including Profiling
Your personal data are not subject to any decisional process based solely on automated processing, including profiling.
Changes to the Privacy Statement
Any changes we make to this Privacy Statement in the future will be posted on this page. Please check back periodically to see any updates or changes to our Privacy Statement.
How to Contact Us/Exercise Your Rights
- Contact: Cleary Gottlieb Steen & Hamilton LLP
- Email: firstname.lastname@example.org
- Toll-free phone number: 833-560-0482
You may also contact the Firm’s local Data Protection Officer where one has been appointed by any one of our offices. Please contact your local office for more information.
When contacting us in connection with any of your rights described above (directly, or through an authorized agent as permitted under applicable law), you may be asked to provide certain identifying information before your request can be processed. We may limit or deny access to personal data where and as permitted by law.
If we are unable to verify your identity to the degree of certainty required under applicable law through any reasonable method, we will state that in a written response to you along with a reason as to why there is no reasonable method by which we can verify your identity.