Osborne Clarke values the privacy of those who provide personal information to us.  This privacy policy (the “Policy”) describes how and why we collect, store and use personal information, and provides information about individual’s rights.

This Policy applies to both personal information supplied to us either by an individual or by others.  We may use personal information supplied to us for any of the purposes as set out in this Policy, or as otherwise disclosed at the point of collection.

This Policy is an important document. We recommend that you read it carefully and print and keep a copy for your future reference.

In this Policy, we use the terms:

“we”, “us”, and “our” (and other similar terms) to refer to either:  the OC Member Firm contracting party as referred to in your Engagement Letter; or the OC Member Firm contracting party as referred to in any contract we enter into with you; or if you have not yet instructed an OC Member Firm, Osborne Clarke LLP (SRA reference: 619990) as owner of the Osborne Clarke website, osborneclarke.com.  In each of the above cases the relevant entity will be the data controller as prescribed in the entity’s local law (the “Data Controller”);

“OC Member Firm” refers to any entity, including Osborne Clarke Verein, which is a member of the international Osborne Clarke network (“Network Firm”) or which is a member firm of Osborne Clarke Verein, a Swiss Verein (“Osborne Clarke Verein Member Firm”);

“Network Firm” includes Osborne Clarke Services (company number: 3049484), Osborne Clarke Trustees Limited (SRA reference: 199769), Oval Nominees Limited (company number: 1865795), Ovalsec Limited (company number: 1379423), Open Trustees (company number 2679647) and Osborne Clarke International Services Ltd (company number: 8096377) – the registered office of each of the above companies is 2 Temple Back East, Temple Quay, Bristol, BS1 6EG, and Koh Vass & Co, a Hong Kong law firm;

“Osborne Clarke Verein Member Firm” are those firms listed on the Osborne Clarke website. Each Osborne Clarke Verein Member Firm is a separately constituted and regulated legal entity or partnership which provides legal and other client services in accordance with the laws of the jurisdictions in which it operates.  Osborne Clarke Verein is a Swiss verein which does not itself provide legal or other client services;

“Engagement Letter” refers to a written document which sets out the terms and conditions of the engagement of a specific OC Member Firm and which describes the services to be provided to you by the specific entity.  Such engagement terms should be relied upon in determining liability for the services provided.  Unless explicit written agreement is given by each OC Member Firm involved, no OC Member Firm is responsible for the acts or omissions of, nor has any authority to obligate or otherwise bind, any other OC Member Firm;

“Personal Information” is any information relating to an identified or identifiable natural person;

“identifiable natural person” is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors; and

“you” and “your” (and other similar terms) refer to our clients, individuals associated with our clients, contacts, suppliers, job applicants, staff and visitors to the Osborne Clarke website, www.osborneclarke.com.

Your rights in relation to Personal Information and how to exercise them

 Under certain circumstances you have the following rights:

  • the right to ask us to provide you, or a third party, with copies of the Personal Information we hold about you at any time and to be informed of the contents and origin, verify its accuracy, or else request that such information be supplemented, updated or rectified according to the provisions of local law;
  • the right to request erasure, anonymisation or blocking of your Personal Information that is processed in breach of the law;
  • the right to object on legitimate grounds to the processing of your Personal Information. In certain circumstances we may not be able to stop using your Personal Information, if that is the case, we’ll let you know why; and
  • withdrawal of consent – while we do not generally process Personal Information on the basis of consent when Personal Information is processed on the basis of consent an individual may withdraw consent at any time (this may apply to processing of special categories of Personal Information where you have instructed us to act on your behalf and includes the following: racial/ethnic origin, political opinions, religious or philosophical beliefs and trade union membership). In the event that you no longer want to receive any marketing material from us, please use the unsubscribe option (which is in all of our marketing emails to you), or contract the relevant Data Controller as set out below.

To exercise such rights (bar withdrawing from marketing emails – as described above) and if you have any questions about how we collect, store and use Personal Information, then please contact us using the details as set out in the “Data Controller contact information” section below.

What basis do we have for processing your Personal Information?

We will only process personal Information where we have a lawful reason for doing so.  The lawful basis for processing Personal Information by us will be one of the following:

  • the processing is necessary for the performance of a contract you are party to or in order to take steps at your request prior to you entering into a contract;
  • the processing is necessary in order for us to comply with our legal obligations (such as compliance with anti-money laundering legislation);
  • the processing is necessary for the pursuit of our legitimate business interests (including that of the delivery and the promotion of our services); and
  • processing is necessary for the establishment, exercise or defence of legal claims.

What Personal Information do we collect and process?

We aim to be transparent about why and how we process Personal Information.  For further information on our processing activities please review the relevant section below:

Business contacts

Collection

We and other OC Member Firms process Personal Information about contacts using a client relationship management tool (“InterAction”).  Personal Information is collected and added to InterAction by OC Member Firm staff, and includes:  name, email address, job title, telephone number, area of business, job role, jurisdiction, language, seniority and other business contact information.  The Personal Information may also be collected by virtue of us providing our services to you or at a networking event.  In addition Personal Information may also be collected via the Osborne Clarke website, www.osborneclarke.com.

Use

  • For contact and communication purposes: we may use your contact information to send you legal updates that we may circulate from time to time, news about any events we are organising or participating in, and/or other information about us and the services that we or another OC Member Firm provides that we believe may be of interest to you.  You can specify your contact preferences when registering online to receive communications from us (for example, through the Osborne Clarke website, www.osborneclarke.com) or by subsequently advising us of your contact preferences using options provided on all of our marketing emails or the contact details as set out in the “Data Controller contact information” section below.
  • Making contact details available to OC Member Firm staff.
  • Performing analytics – such as trends, sales intelligence, marketing effectiveness (such as click and open rates) uptake and progress.

Retention

Personal Information is retained on InterAction for as long as it is necessary for the purposes set out above (being the length of the business relationship).  If a business contact requests to be forgotten their contact details will be deleted from InterAction.  If a business contact opts out of receiving marketing materials their details will still be retained (as our lawyers may still be in contact) but marketing materials will no longer be sent.

Clients and individuals associated with clients

Collection

We request that our clients only provide Personal Information which is necessary for us to carry out our services.

If we need Personal Information in respect of individuals associated with clients in order to provide legal services we ask our clients to provide this Policy to the data subjects.

In the majority of circumstances we will collect Personal Information from our clients or from third parties acting on behalf of our clients.

Use 

  • Providing legal services: we will use and disclose Personal Information in such a manner as we believe is reasonably necessary to provide our services, for example we may need to instruct overseas counsel on your behalf (including correspondence with you), to liaise with other professional service providers in relation to matters that we are handling, or because we need to liaise with the opposing party on a matter you have instructed us on.
  • Administration: to collect our fees or costs in connection with other legal enforcement, we will use Personal Information to agree payment arrangements, and to collect our fees and costs owing to us in connection with legal enforcement.
  • Managing client relationships: providing clients with information on our services and legal updates that we consider may be relevant to them; arranging and hosting events; and identifying where we may make improvements in service delivery.
  • Client engagement: as part of our client on – boarding process we carry out certain background searches to verify whether or not there are any potential issues that may mean we cannot work with a particular person (to identify criminal convictions, politically exposed persons, sanctions or other potential reputation issues).
  • Compliance with anti-money laundering regulation: we may use your Personal Information (e.g. evidence of your identity) in order to fulfil our obligations to check the identity of our clients in compliance with anti-money laundering law and regulations, this information will be shared with any relevant OC Member Firm required to support that instruction.

Retention

Our general retention period for documentation created for the purpose of providing legal services is 12 years.  In some instances there are legal and regulatory exceptions which may require documentation to be held for longer or shorter periods.  If you require further information please contact us using the details as set out in the “Data Controller contact information” section below.

Job applicants

Please refer to information made available when applying online for further details as to how Personal Information is collected, processed and how long it is retained for.

Journalists

Collection

Personal Information, including name, email address, telephone number and other business contact information, may be collected from PR agencies or from databases that we subscribe to.

Use

  • Press releases and joint press releases from our clients/organisations that we are working with.
  • Invitations to meet OC Member Firm staff.
  • Press party.
  • To highlight any spokespeople who may be of interest on a specific industry theme or topic relevant to the journalist.
  • Business trips may require the use of the Personal Information to assist us with travel arrangements.
  • Internal communications.

Retention

Personal Information will be retained for as long as it is necessary for the purposes of the above, or if you advise us you no longer wish to be contacted your Personal Information will be removed from our contact lists.

Suppliers (including individual contractors)

Collection

Personal Information, including name, email address, telephone number and other business contact information, is collected to receive services from suppliers, to manage the relationship with the supplier, and for the provision of services to our clients.

Use

  • To receive services from our suppliers: please note that we will use and disclose their Personal Information in such manner as we believe is reasonably necessary to receive and to review the provision of those services from suppliers.
  • Services to clients: if a supplier is assisting us in delivering services to our clients we will process Personal Information to manage that relationship.
  • Administration: to agree payment arrangements with our suppliers, and to make payments to them.

Retention

A general retention period of 12 years will be applied unless there are any legal and or regulatory exceptions which may require documentation to be held for shorter or longer periods.  If you require further information please contact us using the details as set out in the “Data Controller contact information” section below.

Staff

Personal Information in relation to staff will be held on various internal systems and applications.  A privacy notice which sets out the purposes for which Personal Information will be processed and contains information on data subject rights is provided to staff at the commencement of employment.  If further information is required please contact your local Human Resources department.

Visitors to the Osborne Clarke website

Collection

 Personal Information will be collected if you sign up to attend any of our events and/or to receive our marketing literature.

Use

  • Business contacts: if you have signed up to attend one of our events or to receive our marketing literature please see the paragraph above headed ‘Business contacts’.

 

Who else may have access to your Personal Information?

On occasion, we may need to share your Personal Information with third parties.  We will only share Personal Information where we are legally permitted to do so.

Where you supply us with Personal Information as a client, we will assume, unless you instruct us otherwise in writing, that we can disclose your Personal Information in such manner as we believe is reasonably necessary to provide our services (including as described in this Policy), or as is required under applicable law. This might be because, for example, we may pass your Personal Information to third parties such as:

  • credit-checking agencies for credit control reasons;
  • events: we may need to pass on your Personal Information (e.g. name, company, occupation) to a third party in connection with management of an event, in which case the details will only be used by the third party for that specific purpose;
  • business partners, service providers and other affiliated third parties: to enable us to provide our services to you, we may need to share your Personal Information with another OC Member Firm, our business partners (including other professional advisers such as accountants or auditors), external service providers and/or overseas counsel. Our arrangements with external service providers currently cover the provision of support services including IT, AML/CDD checks, events management, document production, business and legal research, secretarial services, marketing and business development and facilities management;
  • OC Member Firms: to provide services to you and also so that they may contact you (including by email) if you have expressly agreed to receive marketing communications about legal developments, services or events which may be of interest to you; through the joint use of centralised IT tools; to manage our international client relationships; and to respond to your requests concerning access, rectification, objection and cancellation as regards the processing of your Personal Information; and
  • disclosures required by law or regulation: in certain circumstances, please note that we may be required to disclose Personal Information under applicable law or regulation, including to law enforcement agencies or in connection with proposed or actual legal proceedings.

International transfers of Personal Information (including to outsourced service providers)

From time to time, we may need to transfer your Personal Information to other OC Member Firms, who may have offices that are located in territories outside of the European Economic Area (“EEA”), including in the USA, in order to provide you with the services required.

Please note that the legal regimes of some territories outside of the EEA do not always offer the same standard of data protection as those inside the EEA, although we will ensure that your Personal Information is only ever treated in accordance with this Policy.

Where necessary, we have entered into standard European Commission approved form model data protection clauses with other OC Member Firms who have offices that are located in territories outside of the EEA (if a transfer is to the United States a service provider must either enter into the standard European Commission form approved data protection clauses or be Privacy Shield certified), to provide you with the service required and with our external service providers and business partners in relation to services that they may provide that involve processing data from locations outside of the EEA for which we are Data Controller.

How we look after your Personal Information

We have in place appropriate technical and organisational security measures to protect your Personal Information against unauthorised or unlawful use, and against accidental loss, damage or destruction.

We put in place strict confidentiality agreements (including data protection obligations) with our third party service providers.

Links to other websites

 The Osborne Clarke website, www.osborneclarke.com, may link to other, unaffiliated third party websites.  Please note that Osborne Clarke is not, and cannot, control or be responsible for the content or privacy and confidentiality practices of any third party websites.  You must always carefully review the privacy and confidentiality policy of any third party website that you may visit in order to understand how the operators of that website may collect, store and use your Personal Information.

Updates to this Policy

This Policy was last updated in May 2018.  Please check back regularly to keep informed of updates to this Policy.

Data Controller contact information

Each OC Member Firm and each Network Firm is a Data Controller:

UK, USA & Network Firms

Osborne Clarke LLP
One London Wall
London
EC2Y 5EB
Email:  Privacy.UK@osborneclarke.com

Germany

Osborne Clarke Rechtsanwälte Steuerberater Partnerschaft mit beschränkter Berufshaftung
Innere Kanalstr. 15
D-50823 Köln
Email:  DPO.Germany@osborneclarke.com

Spain

Osborne Clarke Espana S.L.P
Av. Diagonal 477
planta 20
08036 Barcelona
Email:  DPO.Spain@osborneclarke.com

Italy

Osborne Clarke Studio Legale
Corso di Porta Vittoria 9
20122 Milan
Email:  Privacy.Italy@osborneclarke.com

Belgium

Osborne Clarke cvba
Marnixlaan 23 Avenue Marnix
1000 Brussels
Email:  Privacy.Belgium@osborneclarke.com

France

Osborne Clarke SELAS
163 boulevard Malesherbes
75017 Paris
Email:  Privacy.France@osborneclarke.com

Hong Kong

Osborne Clarke
Suite 3002
30/F Prosperity Tower 39 Queen’s Road Central
Hong Kong
Email:  Privacy.HK@osborneclarke.com

 

Koh Vass & Co
Suite 3002
30/F Prosperity Tower 39 Queen’s Road Central
Hong Kong
Email:  Privacy.HK@kohvassandco.com

Netherlands

Osborne Clarke N.V.
IJdok 29
1013 MM Amsterdam
Email:  Privacy.Netherlands@osborneclarke.com

Sweden

Osborne Clarke Advokatfirma AB
Grev Turegatan 30
114 38 Stockholm
Email:  Privacy.Sweden@osborneclarke.com

Singapore

OC Queen Street (Singapore)
1 Raffles Place #04-61
One Raffles Place Tower 2
Singapore 048616
Email:  DPO.Singapore@osborneclarke.com

China

Zhang Yu & Partners
Suite 708
West Wing
Shanghai Centre
1376 Nanjing Road West
Shanghai
PRC 200040
Email: Privacy.China@oclegalchina.com

 

Complaints

While we hope that you will not need to, if you want to complain about our use of Personal Information please send an email detailing your complaint to the relevant Privacy Officer (or DPO if the complaint is in relation to the use of Personal Information in Osborne Clarke Germany, Spain or Singapore) at the above email address.

You also have the right to lodge a complaint with the relevant supervisory authority. Please see further details below:

UK Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow
Cheshire
SK9 5AFwww.ico.org.uk
Tel: 0303 123 1113
Tel:  029 2067 8400 (calls in Welsh)
Email: casework@ico.org.uk
Germany  German Data Protection Regulators
Spain

Spanish Data Protection Agency, either physically at:

Calle Jorge Juan, 6
28001
Madrid

or via https://sedeagpd.gob.es/sede-electronica-web/.

Italy Garante per la protezione dei data personali
Piazza di Monte Citorio n. 121
00186
Romawww.gpdp.it –  www.garanteprivacy.it
E-mail: urp@gpdp.it
Fax: (+39) 06.69677.3785
Centralino telefonico: (+39) 06.69677.1
Belgium Commission for the Protection of Privacy
Rue de la Presse 35
1000 BrusselsTel: +32 (0)2 274 48 00
Fax: +32 (0)2 274 48 35
commission@privacycommission.be
France  Commission Nationale de l’Informatique et des Libertés
3 Place de Fontenoy
TSA 80715 – 75334
PARIS CEDEX 07Tél : 01 53 73 22 22(du lundi au jeudi de 9h à 18h30 / le vendredi de 9h à 18h)
Fax : 01 53 73 22 00
Online form for complaints: https://www.cnil.fr/fr/plaintes
Hong Kong Privacy Commissioner for Personal Data, Hong Kong
12/F, Sunlight Tower
248 Queen’s Road East
Wanchai
Hong KongTelephone: 2827 2827
Fax: 2877 7026
Email: enquiry@pcpd.org.hk
Netherlands Autoriteit Persoonsgegevens
Postbus 93374
2509 AJ DEN HAAGTel: (+31) – (0)70 – 888 85 00
Fax: (+31) – (0)70 – 888 85 01
Sweden Datainspektionen
Box 8114
SE-104 20 StockholmSweden Office address:

Drottninggatan 29, 5th floor
Stockholm

E-mail: datainspektionen@datainspektionen.se

Tel:  +46 8 657 61 00

Singapore Personal Data Protection Commission
460 Alexandra Road
#10-02 PSA Building
Singapore
119963T +65 6377 3131
F +65 6273 7370
Email:  info@pdpc.gov.sg
China Cyberspace Administration of China