Énoncé de confidentialité

Key summary

We process your data in order to provide legal services and other services to you. We may also process your data as a result of your relationship with one or more of our clients or our volunteering programme, or where you apply for a job or work placement with us or our clients, or provide us with services. We also collect personal information when you contact us, subscribe to one of our mailing lists or attend one of our seminars or events, including webinars and other digital events.

Other service providers play an important role in this relationship as we instruct them to assist with other professional services and administrative requirements. We liaise with them to ensure efficiency in business support tasks such as security, delivery, technology, payment, insurance, litigation support and archiving and storage.

Your information will be treated securely and in strict confidence, in line with our ISO27001 accreditation.

This notice explains what data we process, why, how it is legal and your rights. In order to do our best to be transparent, this privacy notice will be updated on an ongoing basis.

We also have produced a video notice to tell you the relevant points of what we do with your personal data.

• About us
• Useful words and phrases
• What information do we collect?
• Why do we process your personal data?
• How is processing your personal data lawful?
• Who will have access to your personal data?
• When will we delete your data?
• Your rights

About us

Gowling WLG (UK) LLP is an independent entity and part of the Gowling WLG group. Other Gowling WLG group entities operate in different countries. We decide what to do with your data in a different way in each country and so each of our entities is a separate 'data controller'. The data controller is responsible for the processing of your personal data according to the data protection laws.

Please see the legal information page for information on the Gowling WLG structure, our group entities, and who your data controller is.

Each country has different Data Protection Laws. In Belgium, the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679, applies.

We take your privacy very seriously and we ask that you read this Privacy Notice carefully as it contains important information on:

• Your Rights
• The personal data we collect about you and why we collect the data;
• What we do with your data, and
• Who your information will be shared with.

If you need extra help

If you would like this notice in another format (for example: audio, large print, braille) please contact us.

How you can contact us

Please contact us if you have any questions about this Privacy Notice or the information we hold about you.

If you wish to contact our Belgium office please write to us at The Library, Square Ambiorix 10, BE-1000,  Brussels, Belgium or you can contact our UK offices by sending an email to data.enquiry@gowlingwlg.com or write to us at Gowling WLG (UK) LLP, Two Snowhill, Birmingham B4 6WR. If you wish to submit a complaint to the Belgium Supervisory Authority: Data Protection Authority, Rue de la Presse 35, 1000 Brussels, Belgium. http://www.privacycommission.be.

Changes to the Privacy Notice

We may change this Privacy Notice from time to time. You should check this Privacy Notice occasionally to ensure you are aware of the most recent version.

Useful Words and Phrases

Please familiarise yourself with the following words and phrases as they have particular meanings in the Data Protection Laws and are used throughout this Privacy Notice:

What information do we collect?

Personal data provided by you

To provide you with our services, we may collect your information including:

• Identity and contact data; such as your name,
• address,
• phone number,
• email address,
• date of birth, company you work for and your position financial data; such as payment related information,
• identification and background information provided by you or collected as part of our on-boarding process. We will process identification and background information as part of our onboarding process including anti-money laundering, conflict, reputational and financial checks, and to fulfil any other legal or regulatory requirements which apply to us.,
• video images/photographs/audio; in connection with identification checks, CCTV, providing/receiving training, remote meetings,
• location data; reception registration and/or visitor security pass where you attend our offices ie for legal services, insight day, consultancy support, an event or to provide IT support,
• financial information ie. for billing purposes,
• any other information relating to you or third parties which you give us so we may provide you with our service.

We will also collect Personal Data when you contact us, send feedback, subscribe to one of our mailing lists, wish to attend, or have attended, one of our events or seminars, attend one of our voluntary programmes or raise any complaint, enquiry or information request with us.

We will also collect information that you share with us to help us understand your situation, your preferences and to represent your best interests when you instruct us/become a client of Gowling WLG (UK) LLP, or as a result of your relationship with one or more of our clients, where you supply us or our clients with services, or where you apply for work experience, insight scheme or a  job or work placement with us or our clients.

We will also collect personal data where you are representing your organisation for example as part of procurement or tender. Where you provide third party technical support we may process your data where you provide us with technical support remotely by connecting to our systems or services.

Special category personal data personal data

If we ask you to provide us with your special category personal data, we will explain why we need that data and how we intend to use it and your rights. If necessary, we will ask you for your consent first.

You may provide us with yours or a third party's special category personal data where it is necessary in connection with services we provide, such as information about a person's physical or mental health, alleged criminal activities.

You may provide us with your special category personal data such as your health data to inform us of any dietary requirements or reasonable adjustments required where you are attending one of our offices or events.

We may need to process your special categories of personal data if processing is necessary to comply with laws that apply to us in relation to anti-money laundering or counter-terrorist financing obligations or the prevention, detection or prosecution of any crime.

Personal data about other individuals

If you give us information on behalf of someone else, you confirm that the other person has appointed you to act on their behalf and have agreed that you can. In addition, where you give us personal data belonging to someone else, you must ensure that you have the necessary grounds, consents or authorisations to provide it to us. In some cases, we may obtain Personal Data regarding you from other persons, including clients to whom we provide legal services. For example, we may obtain information regarding directors, officers, or employees of our clients or other parties, witnesses, beneficiaries, adverse parties, related parties, parties in interest, business partners, investors, shareholders, security holders, buyers, business partners, and customers of clients.

Children's data

We do not provide services directly to children or proactively collect their personal information. However, we are sometimes given information about children where it is necessary in connection to legal services we provide to our clients or in connection with our Probono initiatives.

We may also process children's data in connection with our HR and CSR programmes such as our Insight scheme. Children's personal data processed in connection with our Insight Scheme is usually limited to name, contact details, school/college name and CV.

Personal data provided by third parties

We will collect Personal Data directly from you, from clients or from authorised representatives and as otherwise permitted or required by applicable law. At times, we will also collect personal information from third parties such as regulatory and legal authorities, other organisations with whom you have dealings or who have a legal interest in such data, government agencies, credit reporting agencies, financial institutions, recruitment agencies and other people connected to recruitment, information or service providers, introducers and referrers and from publicly available records.

We may obtain information about you from third parties in order to verify your identity, carry out anti-money laundering, anti-terrorism, sanctions screening and other background and credit checks. In performing these checks, personal information provided by you may be disclosed to that third party which may keep a record of that information. All information provided by you will be treated securely and strictly in accordance with the Data Protection Laws.

Why do we process personal data?

We use your Personal Data for the following purposes listed in this section. We are allowed to do so on certain legal bases (please see section 'How is processing your data lawful' for further detail).

We collect your information so that we can:

• Deliver Legal Services - Provide legal and other services and products as instructed by you, answer your queries and provide you with information or materials you have asked to receive;
• Comply with our Legal and Regulatory obligations - such as establishing your identity in order to comply with anti-money laundering regulations and our other legal and regulatory obligations which may require you to provide name, address, employment/business and financial information, and/or other legally mandated forms of identification;
• Carry out administration - Bill for our work, carry out searches and checks, maintain internal records, which will include the collection of names, addresses, banking, financial details and creditworthiness; to maintain and develop our relationship with you; to carry out recruitment activities if you are applying for a job or work placement with us or our clients; to analyse and help us manage our practice; to maintain and update our records.
• Carry out Business Development and Marketing - to carry out market research; market our own products and services to you, including as may be permitted by the applicable law, by email or other means and to keep your information and preferences accurate. We may also use and analyse the Personal Data provided to us to track and manage your consent preferences, event reservations and any unsubscribe requests. From time to time, we may wish to send you legal updates; newsletters; press releases; information about our events and the legal services we provide and other communications that we think will be of interest to you and/or your business. You can review and update your contact details and preferences or unsubscribe from our e-marketing communications at any time via the links in our e-marketing messages or by e-mailing us at iaadmin@gowlingwlg.com
• If you have consented to receive marketing materials from us, you can opt out at any time. See 'Your Rights' for further information. You can also manage your preferences by sending a message to iaadmin@gowlingwlg.com
• Maintain Quality Standards - to meet high standards of quality and professional standards, and to obtain and maintain certification and accreditations which may involve audits of our internal processes;
• Manage Claims - pursue available remedies or limit any damages that we or our clients may sustain and to respond to any feedback or complaints that we may receive;
• Keep people and buildings safe - to help ensure security and for crime prevention; we may have CCTV cameras installed at the entrances to our premises and CCTV data is captured on cameras;
• To monitor our website usage to improve our services - please see our cookies policy which explains what cookies are and why we use them.

How is processing your data lawful?

We are allowed to process your Personal Data for the following reasons and on the following legal basis:

Consent

Where you have given consent - for example, where you have subscribed to a mailing list for us to send you legal alerts, information regarding updates/events or other information which may be of interest to you.

Contract

Where it is necessary for the performance of the contract you have agreed to enter with Gowling WLG (UK) LLP. For example, because you are using Gowling WLG (UK) LLP for legal advice, we are required to process your Personal Data for the purposes of performing our legal advice services appropriately and billing our services and by retaining us you agree that we may do so.

Legal obligation

Where we are subject to legal obligations to process your data for the purposes of compliance with applicable laws; for example, we are required to identify our clients in accordance with the anti-money laundering regulations in many countries and are required to gather and maintain records in compliance with health and safety legislation. We also have obligations pursuant to financial and tax legislation and reporting obligations in respect of tax administration.

Legitimate interest

Processing your Personal Data is also legal if it is based on our ‘legitimate interests’ which are not overridden by your data protection interests or fundamental rights and freedoms. To process on this basis, we have considered the impact on your interests and rights, and have placed appropriate safeguards to ensure that the intrusion on your privacy is reduced as much as possible.

The following are examples of the purposes for which we will process your Personal Data on this basis:

• Client administration - to enable us to maintain internal records
• To ensure regulatory compliance - for example that conflict checks are carried out before we start work and to erect information barriers to restrict access to certain information and to comply with all aspects of our regulatory obligations
• To enable us to maintain specific standards of quality in the professional services we provide and to obtain and maintain quality accreditations
• To permit us to pursue available remedies or limit any damages that we may sustain
• To permit us to manage and respond to any complaints
• To liaise with representatives of clients of corporates and other business clients
• To market our services
• To carry out recruitment and administer work experience and work placement activities

Please be aware that you have the right to object to the processing of your data for any of the legitimate interests identified.

Special Category Personal Data

In certain circumstances, we may process your special category personal data for the following reasons and subject to the following exceptions:

• Consent
  For example, you have given your explicit consent for us to process your health information for the purpose of providing you with legal advice.
• Vital Interests
  Because it is necessary for us to protect your vital interest e.g. It is necessary for us to process your medical/health information, for the purposes of following our health and safety procedures if you are attending an event or visiting our buildings, which in turn could assist us if we are required to protect your life.
• Manifestly public personal data
  The data has been manifestly made public and only when it is necessary for our purposes and permitted by the applicable Data Protection Laws. For example, we ask you to provide your dietary requirements when you attend an event at our offices. We consider that you have made this data manifestly public to our organisation to help us protect you and to ensure your health and safety. We will keep this information confidential and restrict it to only those who need to know.
• Legal claims
  We are establishing or defending a legal claim for you as a client or in our own right.

Who will have access to your personal data?

In the course of providing our services and operating our business, we may disclose your Personal Data to:

• Other Gowling WLG (UK) LLP offices, group entities, subsidiaries and affiliates, partnerships operating under the Gowling brand;
• Third party service providers whom we instruct to assist with the provision of legal or other services and products such as other professional advisors, and the administrative requirements associated with those services;
• Third party service providers of certain business support tasks to Gowling WLG (UK) LLP including security, delivery, technology, research, banking, payment, insurance, litigation support, translation, credit checking, archiving, recruitment agencies and storage;
• Charities and organisations in connection with our volunteering programmes
• External inspectors or auditors
• Providers of business development and marketing support services, in order to provide event and marketing support;
• Legal and or regulatory authorities including courts or public authorities who may compel disclosure, such as the Solicitors Regulation Authority (SRA), HMRC, Health & Safety Executive and National Crime Agency (NCA). This may be (i) in the event that we are required to make a disclosure under various legislation and regulation; or (ii) where we have a legal, regulatory or professional obligation to do so; or (iii) where we are required to protect the safety or rights or our clients, staff or others; (iv) or to exercise, establish or defend our legal rights;
• Personal Data may also be subject to transfer to another organisation in the event of corporate transaction such as a merger, combination or acquisition, or change of ownership of our firm. This will occur only if the parties have entered into an agreement under which the collection, use and disclosure of the information is restricted to those purposes that relate to the business transaction, including a determination whether or not to proceed with the business transaction, and is used by the parties to carry out and complete the business transaction.
• Persons whom you instruct us to disclose your information to in the course of providing legal services, for example a party involved in a legal claim or transaction.
• If you wish to know more about the parties with whom we share Personal Data, please contact us.

International transfers of data between our offices

Transfers of your information out of the UK and EEA

In the context of its global practice, Gowling WLG (UK) LLP and affiliated businesses or subsidiaries transfers Personal Data between its offices, the free flow of information being essential for the efficient conduct of its International business. A number of our offices and affiliates are located outside the European Economic Area. Where we transfer personal data outside the UK and EEA, to a country without adequacy regulation, we implement the EC and UK standard contractual clauses to require that personal data remains protected. We also implement EC and UK standard contractual clauses or an alternative transfer mechanism with our third party service providers and partners where there is an international transfer of personal data to a country without adequacy regulations. Any transfer of your personal data outside of the UK or EEA to a third party or another office of ours will be subject to appropriate data protection safeguards that protect your data privacy rights.

Gowling WLG (Canada) LLP ("Gowling WLG Canada") is an independent entity. Gowling WLG Canada has a separate privacy notice which describes how it processes personal information. For UK and European data protection law purposes, the European Commission and the ICO considers that Canada's federal privacy law offers adequate levels of protection to safeguard your privacy rights.

If you instruct us and if it is necessary, we will exchange information with law firms located in other jurisdictions.

How we keep your data secure

We have robust information security management systems in place to protect your personal information and are ISO27001 accredited. ISO27001 is an international information security standard which is widely recognised as an indication of best practice in information security and information risk management.

If you have any particular concerns about your information, please contact us (see 'How to contact us?' above).

When will we delete your data?

We retain personal data in line with our internal policies, contractual terms and where necessary for us to meet our legal, regulatory and professional obligations. Our default retention periods will differ, depending on the country which is providing your services. In any case, the criteria that we apply is to delete data when it is no longer necessary for us to hold it.

Your rights

As a data subject, you have the following rights under the Data Protection Laws:

• the right of access to Personal Data relating to you;
• the right to correct or update any mistakes in your information;
• the right to object to our processing of your personal data in certain circumstances such as where we are processing it for our legitimate interests
• the right to ask us to stop contacting you with direct marketing (opt-out/unsubscribe);
• rights in relation to know details of any automated decision making;  
• the right to restrict or prevent your Personal Data being processed;
• the right to have your Personal Data ported to another data controller (e.g. if you decide to contract with a different service provider);
•  the right to withdraw your consent where we are processing your personal data based on consent ;
• the right to erasure where you believe we have no good reason to continue processing it;
• right to lodge a complaint with a data protection authority.

These rights are explained in more detail below, but if you have any comments, concerns or complaints about the use of your Personal Data by us, please contact us (please refer to section "How to contact us").

We will respond to any rights that you exercise within a month of receiving your request, unless the request is particularly complex, in which case we will respond within three months.

Please be aware that there are exceptions and exemptions that apply to some of the rights which we will apply in accordance with the Data Protection Laws.

Right to access Personal Data relating to you

You may ask to see what Personal Data we hold about you and be provided with:

• a copy of your personal data;
• details of the purpose for which it is being or is to be processed;
• details of the recipients or classes of recipients to whom it is or may be disclosed, including if they are overseas and what protections are used for those oversea transfers;
• the period for which it is held (or the criteria we use to determine how long it is held);
• any information available about the source of that data; and
• whether we carry out an automated decision-making, or profiling, and where we do information about the logic involved and the envisaged outcome or consequences of that decision or profiling.

To help us find the Personal Data easily, please provide us as much information as possible about the type of Personal Data you would like to see.

Right to correct any mistakes in your information

You can require us to correct any mistakes in your Personal Data which we hold free of charge. If your Personal Data is incomplete, you can ask us to complete it by adding more details. If you would like to do this, please:

• email, call or write to us (see "How to contact us")
• let us have enough information to identify you, and
• let us know the Personal Data that is incorrect and what it should be replaced or supplemented with.

Right to ask us to stop contacting you with direct marketing

You can ask us to stop contacting you for direct marketing purposes. If you would like to do this, please:

• See "How can you contact us" above
• You can review and update your contact details and preferences or unsubscribe from our communications at any time via the links in our e-marketing messages or by e-mailing us at iaadmin@gowlingwlg.com.

Rights in relation to automated decision making

We do not make any automated decisions about you so this right does not apply.

Right to prevent processing of personal data

You may request that we stop or limit processing your personal data temporarily if:

• you do not think that your Personal Data is accurate. We will start processing again once we have checked whether or not it is accurate;
• the processing is unlawful but you do not want us to erase your Personal Data;
• we no longer need the Personal Data for our processing, but you need the Personal Data to establish, exercise or defend legal claims; or
• you have objected to processing because you believe that your interests should override our legitimate interests.

Copies of your Personal Data (data portability)

You may ask for an electronic copy of your Personal Data which we hold electronically and which we process when we have entered into a contract with you. You can also ask us to provide this directly to another party.

Right to erasure

You can ask us to erase your Personal Data where:

• you do not believe that we need your Personal Data in order to process it for the purposes set out in this Privacy Notice;
• if you had given us consent to process your Personal Data, you withdraw that consent and we cannot otherwise legally process your Personal Data;
• you object to our processing and we do not have any legitimate interests that mean we can continue to process your data; or
• your Personal Data has been processed unlawfully or have not been erased when it should have been.

Right to withdraw consent

The circumstances in which we rely on consent are minimal but if the lawful basis for processing is based upon the provision of your consent, you are able to withdraw your previously given consent to the processing of the Personal Data at any time without giving reasons.

If you want to withdraw your consent:

• contact us by email, telephone or in writing (see "How can you contact us" above)
• give us enough information so that we can identify you and if necessary, let us know which consent you would like to withdraw.

Complaints to the regulator

It is important that you ensure you have read this Privacy Notice - and if you do not think that we have processed your data in accordance with this notice - you should let us know as soon as possible. Similarly, you may complain to the competent supervisory authority.

Data Protection Authority, Rue de la Presse 35, 1000 Brussels, Belgium. http://www.privacycommission.be.

February 2024

Key summary

We process your data in order to provide legal services and other services to you. We may also process your data as a result of your relationship with one or more of our clients, or where you apply for a job or work placement, or provide us with services. We also collect personal information when you contact us, subscribe to one of our mailing lists or attend one of our seminars or events.

Other service providers play an important role in this relationship as we instruct them to assist with other professional services and administrative requirements. We liaise with them to ensure efficiency in business support tasks such as security, delivery, technology, payment, insurance, litigation support and archiving and storage.

Your information will be treated securely and in strict confidence, in line with ISO27001 standards.

This notice explains what data we process, why, how it is legal and your rights. In order to do our best to be transparent, this privacy notice will be updated on an ongoing basis.

• About us
• Useful words and phrases
• What information do we collect?
• Why do we process your personal data?
• How is processing your personal data lawful?
• Who will have access to your personal data?
• When will we delete your data?
• Your rights

About us

Gowling WLG (UK) LLP (Gowling WLG UK) is an independent entity and part of the Gowling WLG group. Other Gowling WLG group entities operate in different countries. We decide what to do with your data in a different way in each country and so each of our entities is a separate 'data controller'. The data controller is responsible for the processing of your personal data according to the data protection laws.

Please see the legal information page for information on the Gowling WLG structure, our group entities, and who your data controller is.

Each country has different Data Protection Laws. In Dubai, in the Dubai International Financial Centre (DIFC) (a free zone where our Dubai office is located), the DIFC Data Protection Law N°1 of 2007 and Data Protection Regulations apply.

We take your privacy very seriously and we ask that you read this Privacy Notice carefully as it contains important information on:

• Your Rights
• The personal data we collect about you and why we collect the data;
• What we do with your data, and
• Who your information will be shared with.

If you need extra help

If you would like this notice in another format (for example: audio, large print, braille) please contact us.

How you can contact us

Please contact us if you have any questions about this Privacy Notice or the information we hold about you.

If you wish to contact our Dubai Office please write to us at Gowling WLG, Office 1701, Level 17, ICD Brookfield Place, Dubai International Financial Centre, PO Box 506503, Dubai, UAE or email reception.dubai@gowlingwlg.com or you may submit a complaint to the Commissioner of Data Protection.

Changes to the Privacy Notice

We may change this Privacy Notice from time to time. You should check this Privacy Notice occasionally to ensure you are aware of the most recent version.

Useful Words and Phrases

Please familiarise yourself with the following words and phrases as they have particular meanings in the Data Protection Laws and are used throughout this Privacy Notice:

What information do we collect?

Personal data provided by you

To provide you with our services, we may collect your information including:

• your name,
• address,
• phone number,
• email address,
• date of birth and other identity documentation that we need to collect to comply with legal and regulatory requirements

We will also collect Personal Data when you contact us, send feedback, subscribe to one of our mailing lists, attend one of our events or seminars or raise any complaint.

We will also collect information that you share with us to help us understand your situation, your hobbies and preferences and to represent your best interests when you instruct us/become a contact or client of Gowling WLG UK, or as a result of your relationship with one or more of our clients, where you supply us with services, or where you apply for a job or work placement.

Sensitive personal data

If we ask you to provide us with your sensitive personal data, we will explain why we need that data and how we intend to use it and your rights.

Personal data about other individuals

If you give us information on behalf of someone else, you confirm that the other person has appointed you to act on his/her behalf and has agreed that you can. In some cases, we may obtain Personal Data regarding you from other persons, including clients to whom we provide legal services. For example, we may obtain information regarding directors, officers, or employees of our clients or other parties, witnesses, beneficiaries, adverse parties, related parties, parties in interest, business partners, investors, shareholders, security holders, buyers, business partners, and customers of clients.

Personal data provided by third parties

We will collect Personal Data directly from you, from clients or from authorised representatives and as otherwise permitted or required by applicable law. At times, we will also collect personal information from third parties such as regulatory and legal authorities, other organisations with whom you have dealings or who have a legal interest in such data, government agencies, credit reporting agencies, financial institutions, recruitment agencies, information or service providers, introducers and referrers, and from publicly available records.

We may obtain information about you from third parties in order to verify your identity, carry out anti-money laundering, anti-terrorism, sanctions screening and other background and credit checks. In performing these checks, personal information provided by you may be disclosed to that third party which may keep a record of that information. All information provided by you will be treated securely and strictly in accordance with the Data Protection Laws.

Why do we process personal data?

We use your Personal Data for the following purposes listed in this section. We are allowed to do so on certain legal bases (please see section 'How is processing your data lawful' for further detail).

We collect your information so that we can:

• Deliver Legal Services - Provide legal and other services and products as instructed by you, answer your queries and provide you with information or materials you have asked to receive;
• Comply with our Legal and Regulatory obligations - such as establishing your identity in order to comply with anti-money laundering regulations and our other legal and regulatory obligations which may require you to provide name, address, employment/business information and financial information, and/or other legally mandated forms of identification;
• Carry out administration - Bill for our work, carry out searched and checks maintain internal records, which will include the collection of names, addresses, banking, financial details and creditworthiness; to maintain and develop our relationship with you, to carry out recruitment activities if you are applying for a job or placement with us; to analyse and help us manage our practice, to maintain and update our records.
• Carry out Business Development and Marketing - to carry out market research; market our own products and services to you, including as may be permitted by the applicable law, by email or other means and to keep your information and preferences accurate. We may also use and analyse the Personal Data provided to us to track and manage your consent preferences, event reservations and any unsubscribe requests. From time to time, we may wish to send you legal updates; newsletters; press releases; information about our events and the legal services we provide and other communications that we think will be of interest to you and/or your business. You can review and update your contact details and preferences or unsubscribe from our e-marketing communications at any time via the links in our e-marketing messages or by e-mailing us at iaadmin@gowlingwlg.com
• If you have consented to receive marketing materials from us, you can opt out at any time. See 'Your Rights' for further information. You can also manage your preferences by sending a message to iaadmin@gowlingwlg.com
• Maintain Quality Standards - to meet high standards of quality and professional standards, and to obtain and maintain certification and accreditations which may involve audits of our internal processes;
• Manage Claims - pursue available remedies or limit any damages that we or our clients may sustain and to respond to any feedback or complaints that we may receive;
• Keep people and buildings safe -to help ensure security and for crime prevention; we may have CCTV cameras installed at the entrances to our premises and CCTV data is captured on cameras;
• To monitor our website usage to improve our services - please see our cookies policy which explains what cookies are and why we use them.

How is processing your data lawful?

We are allowed to process your Personal Data for the following reasons and on the following legal basis:

Consent

Where you have given consent.

Contract

Where it is necessary for the performance of the contract you have agreed to enter with Gowling WLG UK. For example, because you are using Gowling WLG UK for legal advice, we are required to process your Personal Data for the purposes of performing our legal advice services appropriately and billing our services and by retaining us you agree that we may do so.

Legal obligation

Where we are subject to legal obligations to process your data for the purposes of compliance with applicable laws; for example, we are required to identify our clients in accordance with the anti-money laundering regulations in many countries and are required to gather and maintain records in compliance with health and safety legislation. We also have obligations pursuant to financial and tax legislation and reporting obligations in respect of tax administration.

If Necessary for the performance of a Task

If the processing is necessary for the performance of a task carried out in the interests of the DIFC, or in the exercise of the DIFCA, the DFSA, the Court and the Registrars' functions or powers vested in the Data Controller or in a Third Party to whom the data are disclosed.

Legitimate interest

Processing your Personal Data is also legal if it is based on our 'legitimate interests'. To process on this basis, we have considered the impact on your interests and rights, and have placed appropriate safeguards to ensure that the intrusion on your privacy is reduced as much as possible.

The following are examples of the purposes for which we will process your Personal Data on this basis:

• Client administration - to enable us to maintain internal records
• To ensure regulatory compliance - for example that conflict checks are carried out before we start work and to erect information barriers to restrict access to certain information
• To enable us to maintain specific standards of quality in the professional services we provide and to obtain and maintain quality accreditations
• To permit us to pursue available remedies or limit any damages that we may sustain
• To permit us to manage and respond to any complaints
• To liaise with representatives of clients of corporates and other business clients
• To market our services
• To carry out recruitment and administer work experience and work placement activities

Please be aware that you have the right to object to the processing of your data for any of the legitimate interests identified.

Sensitive Personal Data

In certain circumstances, we may process your sensitive personal data for the following reasons and subject to the following exceptions:

• Consent
  For example, you have given your written consent for us to process your health information for the purpose of providing you with legal advice.
• Vital Interests
  Because it is necessary for us to protect your vital interest e.g. It is necessary for us to process your medical/health information, for the purposes of following our health and safety procedures if you are attending an event or visiting our buildings, which in turn could assist us if we are required to protect your life.
• Manifestly public personal data
  The data has been manifestly made public and only when it is necessary for our purposes and permitted by the applicable Data Protection Laws. For example, we ask you to provide your dietary requirements when you attend an event at our offices. We consider that you have made this data manifestly public to our organisation to help us protect you and to ensure your health and safety. We will keep this information confidential and restrict it to only those who need to know.
• Legal claims
  We are establishing or defending a legal claim for you as a client or in our own right.

Who will have access to your personal data?

In the course of providing our services and operating our business, we may disclose your Personal Data to:

• Other Gowling WLG offices, group entities and affiliates;
• Service providers whom we instruct to assist with the provision of legal or other services and products such as other professional advisors, and the administrative requirements associated with those services;
• Providers of certain business support tasks to Gowling WLG UK including security, delivery, technology, research, banking, payment, insurance, litigation support, translation, credit checking, archiving and storage;
• Providers of business development and marketing support services, in order to provide event and marketing support;
• Legal and or regulatory authorities including courts or public authorities who may compel disclosure, such as the UAE Legal Affairs Department of the Ministry of Justice, the Dubai International Financial Centre Authorities (DIFCA) and the Dubai Financial Services Authority (DFSA) in the United Arab Emirates, the DIFC Registrar, in the event that we are required to make a disclosure under various legislation and regulation or where we have a legal, regulatory or professional obligation to do so or are required to protect the safety or rights of our clients, staff or others;
• Personal Data may also be subject to transfer to another organisation in the event of corporate transaction such as a merger, combination or acquisition, or change of ownership of our firm. This will occur only if the parties have entered into an agreement under which the collection, use and disclosure of the information is restricted to those purposes that relate to the business transaction, including a determination whether or not to proceed with the business transaction, and is used by the parties to carry out and complete the business transaction.
• Persons whom you instruct us to disclose your information to in the course of providing legal services, for example a party involved in a legal claim or transaction.
• If you wish to know more about the parties with whom we share Personal Data, please contact us.

International transfers of data between our offices

Transfers of your information out of the DIFC

In the context of its global practice, Gowling WLG UK transfers personal data between its offices, the free flow of information being essential for the efficient conduct of its International business. A number of our offices and affiliates are located outside the DIFC.

Any transfer of your Personal Data from Gowling WLG UK entities in the DIFC to Gowling WLG UK entities in any country outside, will be subject to a mechanism that will safeguard your privacy rights and give you remedies in the unlikely event of a security breach, and if necessary we will gather your written consent first.

Gowling WLG (Canada) LLP ("Gowling WLG Canada") is an independent entity. Gowling WLG Canada has a separate privacy notice which describes how it processes personal information.

How we keep your data secure

Gowling WLG is committed to its Information and Cyber security programme, ensuring that adequate security controls are in place to protect information and data from being accessed, corrupted, lost or stolen. The firm aligns to ISO27001 standards - an international information security standard which is widely recognised as an indication of best practice in information security and informational risk management. If you have any particular concerns about your information, please contact us (see 'How to contact us' above).

When will we delete your data?

We retain personal data in line with our internal policies, contractual terms and where necessary for us to meet our legal, regulatory and professional obligations. Our default retention periods will differ, depending on the country which is providing your services. In any case, the criteria that we apply is to delete data when it is no longer necessary for us to hold it.

Your rights

If you are in the DIFC you have the right to:

• Access to and Rectification, Erasure or Blocking of Personal Data
  
  A Data Subject has the right to obtain from the Data Controller upon request, at reasonable intervals and without excessive delay or expense:
  • confirmation in writing as to whether or not Personal Data relating to him is being Processed and information at least as to the purposes of the Processing, the categories of Personal Data concerned, and the Recipients or categories of Recipients to whom the Personal Data are disclosed;
  • communication to him in an intelligible form of the Personal Data undergoing Processing and of any available information as to its source; and
  • as appropriate, the rectification, erasure or blocking of Personal Data the Processing of which does not comply with the provisions of the Law.
• Object at any time on reasonable grounds relating to your particular situation to the processing of your Personal Data; and
• To be informed before your Personal Data is disclosed for the first time to third parties or used on their behalf for the purposes of direct marketing, and to be expressly offered the right to object such disclosures or uses.

Complaints to the regulator:

It is important that you ensure you have read this Privacy Notice - and if you do not think that we have processed your data in accordance with this notice - you should let us know as soon as possible. Similarly, you may complain to the competent supervisory authority.

Contact the Commissioner of Data Protection.

November 2019

Key summary

We process your data in order to provide legal services and other services to you. We may also process your data as a result of your relationship with one or more of our clients or our volunteering programme, or where you apply for a job or work placement with us or our clients, or provide us with services. We also collect personal information when you contact us, subscribe to one of our mailing lists or attend one of our seminars or events, including webinars and other digital events.

Other service providers play an important role in this relationship as we instruct them to assist with other professional services and administrative requirements. We liaise with them to ensure efficiency in business support tasks such as security, delivery, technology, payment, insurance, litigation support and archiving and storage.

This notice explains what data we process, why, how it is legal and your rights. In order to do our best to be transparent, this privacy notice will be updated on an ongoing basis.

• About us
• Useful words and phrases
• What information do we collect?
• Why do we process your personal data?
• How is processing your personal data lawful?
• Who will have access to your personal data?
• When will we delete your data?
• Your rights

About us

Our services from our office in France are provided by Gowling WLG (France) AARPI which is an Association d'Avocats à Responsabilité Professionnelle Individuelle - AARPI at the Paris Bar. Gowling WLG (France) AARPI is a party to a transnational agreement with Gowling WLG (UK) LLP and is more generally part of the Gowling WLG group. Other Gowling WLG group entities operate in different countries. We decide what to do with your data in a different way in each country and so each of our entities is a separate 'data controller'. The data controller is responsible for the processing of your personal data according to the data protection laws.

Please see the legal information page for information on the Gowling WLG structure, our group entities, and more details about your data controller: Gowling WLG (France) AARPI.

Each country has different Data Protection Laws. In France, the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679 as complemented by the Law No. 78-17 of 6 January 1978 as amended generally known as the loi Informatique et Libertés applies.

We take your privacy very seriously and we ask that you read this Privacy Notice carefully as it contains important information on:

• Your Rights
• The personal data we collect about you and why we collect the data;
• What we do with your data, and
• Who your information will be shared with.

If you need extra help

If you would like this notice in another format (for example: audio, large print, braille) please contact us.

How you can contact us

Please contact us if you have any questions about this Privacy Notice or the information we hold about you.

If you wish to contact our Paris office, please write to us at Gowling WLG (France), AARPI, 38 Avenue de l'Opera 75002, Paris, France or you may submit a complaint to the Commission Nationale de l'Informatique et des Libertés (CNIL).

Changes to the Privacy Notice

We may change this Privacy Notice from time to time. You should check this Privacy Notice occasionally to ensure you are aware of the most recent version.

Useful Words and Phrases

Please familiarise yourself with the following words and phrases as they have particular meanings in the Data Protection Laws and are used throughout this Privacy Notice:

What information do we collect?

Personal data provided by you

To provide you with our services, we may collect your information including:

• Identity and contact data; such as your name,
• address,
• phone number,
• email address,
• date of birth, company you work for and your position financial data; such as payment related information,
• identification and background information provided by you or collected as part of our on-boarding process. We will process identification and background information as part of our onboarding process including anti-money laundering, conflict, reputational and financial checks, and to fulfil any other legal or regulatory requirements which apply to us,
• Video images/photographs/audio; in connection with identification checks, CCTV, providing/receiving training, remote meetings,
• Location data; reception registration and/or visitor security pass where you attend our offices ie for legal services, insight day, consultancy support, an event or to provide IT support,
• Financial information i.e. for billing purposes,
• any other information relating to you or third parties which you give us so we may provide you with our service.

We will also collect Personal Data when you contact us, send feedback, subscribe to one of our mailing lists, wish to attend, or have attended, one of our events or seminars, attend one of our voluntary programmes or raise any complaint, enquiry or information request with us.

We will also collect information that you share with us to help us understand your situation, your hobbies and preferences and to represent your best interests when you instruct us/become a contact or client of Gowling WLG (France), AARPI , or as a result of your relationship with one or more of our clients, where you supply us or our clients with services, or where you apply for work experience, insight scheme or a  job or work placement with us or our clients.

We will also collect personal data where you are representing your organisation for example as part of procurement or tender. Where you provide third party technical support we may process your data where you provide us with technical support remotely by connecting to our systems or services.

Special category personal data personal data

 If we ask you to provide us with your special category personal data, we will explain why we need that data and how we intend to use it and your rights. If necessary, we will ask you for your consent first.

You may provide us with your or a third party's special category personal data where it is necessary in connection with services we provide, such as information about a person's physical or mental health, alleged criminal activities.

You may provide us with your special category personal data such as your health data to inform us of any dietary requirements or reasonable adjustments required where you are attending one of our offices or events.

We may need to process your special categories of personal data if processing is necessary to comply with laws that apply to us in relation to anti-money laundering or counter-terrorist financing obligations or the prevention, detection or prosecution of any crime.

Personal data about other individuals

If you give us information on behalf of someone else, you confirm that the other person has appointed you to act on their behalf and have agreed that you can. In addition, where you give us personal data belonging to someone else, you must ensure that you have the necessary grounds, consents or authorisations to provide it to us. In some cases, we may obtain Personal Data regarding you from other persons, including clients to whom we provide legal services. For example, we may obtain information regarding directors, officers, or employees of our clients or other parties, witnesses, beneficiaries, adverse parties, related parties, parties in interest, business partners, investors, shareholders, security holders, buyers, business partners, and customers of clients.

Children's data

We do not provide services directly to children or proactively collect their personal information. However, we are sometimes given information about children where it is necessary in connection to legal services we provide to our clients or in connection with our Probono initiatives.

We may also process children's data in connection with our HR and CSR programmes such as our Insight scheme. Children's personal data processed in connection with our Insight Scheme is usually limited to name, contact details, school/college name and CV.

Personal data provided by third parties

We will collect Personal Data directly from you, from clients or from authorised representatives and as otherwise permitted or required by applicable law. At times, we will also collect personal information from third parties such as regulatory and legal authorities, other organisations with whom you have dealings or who have a legal interest in such data, government agencies, credit reporting agencies, financial institutions, recruitment agencies and other people connected to recruitment, information or service providers, introducers and referrers, and from publicly available records.

We may obtain information about you from third parties in order to verify your identity, carry out anti-money laundering, anti-terrorism, sanctions screening and other background and credit checks. In performing these checks, personal information provided by you may be disclosed to that third party which may keep a record of that information. All information provided by you will be treated securely and strictly in accordance with the Data Protection Laws.

Why do we process personal data?

We use your Personal Data for the following purposes listed in this section. We are allowed to do so on certain legal bases (please see section 'How is processing your data lawful' for further detail).

We collect your information so that we can:

• Deliver Legal Services - Provide legal and other services and products as instructed by you, answer your queries and provide you with information or materials you have asked to receive;
• Comply with our Legal and Regulatory obligations - such as establishing your identity in order to comply with anti-money laundering regulations and our other legal and regulatory obligations which may require you to provide name, address, employment/business and financial information, and/or other legally mandated forms of identification;
• Carry out administration - Bill for our work, keep accounting records, carry out searches and checks, maintain internal records, which will include the collection of names, addresses, banking, financial details and creditworthiness; to maintain and develop our relationship with you, manage any panel relationship; to carry out recruitment activities if you are applying for a job or work placement with us or our clients; to analyse and help us manage our practice; to maintain and update our records.
• Carry out Business Development and Marketing - to carry out market research; market our own products and services to you, including as may be permitted by the applicable law, by email or other means and to keep your information and preferences accurate. We may also use and analyse the Personal Data provided to us to track and manage your consent preferences, event reservations and any unsubscribe requests. From time to time, we may wish to send you legal updates; newsletters; press releases; information about our events and the legal services we provide and other communications that we think will be of interest to you and/or your business. You can review and update your contact details and preferences or unsubscribe from our e-marketing communications at any time via the links in our e-marketing messages or by e-mailing us at iaadmin@gowlingwlg.com
• If you have consented to receive marketing materials from us, you can opt out at any time. See 'Your Rights' for further information. You can also manage your preferences by sending a message to iaadmin@gowlingwlg.com
• Maintain Quality Standards - to meet high standards of quality and professional standards, and to obtain and maintain certification and accreditations which may involve audits of our internal processes;
• Manage Claims - pursue available remedies or limit any damages that we or our clients may sustain and to respond to any feedback or complaints that we may receive;
• Keep people and buildings safe -to help ensure security and for crime prevention; we may have CCTV cameras installed at the entrances to our premises and CCTV data is captured on cameras;
• To monitor our website usage to improve our services - please see our cookies policy which explains what cookies are and why we use them.

How is processing your data lawful?

We are allowed to process your Personal Data for the following reasons and on the following legal basis:

Consent

Where you have given consent - for example, where you have subscribed to a mailing list for us to send you legal alerts, information regarding updates/events or other information which may be of interest to you.

Contract

Where it is necessary for the performance of the contract you (as an individual) have agreed to enter with Gowling WLG (France), AARPI . For example, because you are using Gowling WLG (France), AARPI  for legal advice, we are required to process your Personal Data for the purposes of performing our legal advice services appropriately and billing our services and by retaining us you agree that we may do so.

Legal obligation

Where we are subject to legal obligations to process your data for the purposes of compliance with applicable laws; for example, we are required to identify our clients in accordance with the anti-money laundering regulations in many countries and are required to gather and maintain records in compliance with health and safety legislation. We also have obligations pursuant to financial and tax legislation and reporting obligations in respect of tax administration.

Legitimate interest

Processing your Personal Data is also legal if it is based on our 'legitimate interests' which are not overridden by your data protection interests or fundamental rights and freedoms. To process on this basis, we have considered the impact on your interests and rights, and have placed appropriate safeguards to ensure that the intrusion on your privacy is reduced as much as possible.

The following are examples of the purposes for which we will process your Personal Data on this basis:

• Client administration - to enable us to maintain internal records
• To take steps aimed at facilitating regulatory compliance - for example that conflict checks are carried out before we start work and to erect information barriers to restrict access to certain information
• To enable us to maintain specific standards of quality in the professional services we provide and to obtain and maintain quality accreditations
• To permit us to pursue available remedies or limit any damages that we may sustain
• To permit us to manage and respond to any complaints
• To liaise with representatives of clients of corporates and other business clients
• To market our services
• To carry out recruitment and administer work experience and work placement activities

Please be aware that you have the right to object to the processing of your data for any of the legitimate interests identified.

Special Category Personal Data

In certain circumstances, we may process your special category personal data for the following reasons and subject to the following exceptions:

• Consent
  For example, you have given your explicit consent for us to process your health information for the purpose of providing you with legal advice.
• Vital Interests
  Because it is necessary for us to protect your vital interest e.g. It is necessary for us to process your medical/health information, for the purposes of following our health and safety procedures if you are attending an event or visiting our buildings, which in turn could assist us if we are required to protect your life.
• Manifestly public personal data
  The data has been manifestly made public and only when it is necessary for our purposes and permitted by the applicable Data Protection Laws. For example, we ask you to provide your dietary requirements when you attend an event at our offices. We consider that you have made this data manifestly public to our organisation to help us protect you and to ensure your health and safety. We will keep this information confidential and restrict it to only those who need to know.
• Legal claims
  We are establishing or defending a legal claim for you as a client or in our own right.

Who will have access to your personal data?

In the course of providing our services and operating our business, we may disclose your Personal Data to:

• Other Gowling WLG offices, group entities, subsidiaries and affiliates, partnerships operating under the Gowling brand;
• Third party service providers whom we instruct to assist with the provision of legal or other services and products such as other professional advisors, and the administrative requirements associated with those services;
• Third party service providers of certain business support tasks to Gowling WLG (France) AARPI and/or Gowling WLG (UK) LLP including security, delivery, technology, research, banking, payment, insurance, litigation support, translation, credit checking, archiving, recruitment agencies and storage;
• Charities and organisations in connection with our volunteering programmes
• External inspectors or auditors
• Providers of business development and marketing support services, in order to provide event and marketing support;
• Legal and or regulatory authorities including courts or public authorities who may compel disclosure, such as the Ordre des avocats de Paris. This may be (i) in the event that we are required to make a disclosure under various legislation and regulation; or (ii) where we have a legal, regulatory or professional obligation to do so; or (iii) where we are required to protect the safety or rights or our clients, staff or others; (iv) or to exercise, establish or defend our legal rights;
• Personal Data may also be subject to transfer to another organisation in the event of corporate transaction such as a merger, combination or acquisition, or change of ownership of our firm. This will occur only if the parties have entered into an agreement under which the collection, use and disclosure of the information is restricted to those purposes that relate to the business transaction, including a determination whether or not to proceed with the business transaction, and is used by the parties to carry out and complete the business transaction.
• Persons whom you instruct us to disclose your information to in the course of providing legal services, for example a party involved in a legal claim or transaction.
• If you wish to know more about the parties with whom we share Personal Data, please contact us.

International transfers of data between our offices

Transfers of your information out of the UK and EEA

In the context of its global practice, Gowling WLG (France), AARPI  and affiliated businesses or subsidiaries transfer Personal Data between their offices, the free flow of information being essential for the efficient conduct of its International business. A number of our offices and affiliates are located outside the European Economic Area, including in the United Kingdom and Canada. Where we transfer personal data outside the EEA, to a country without adequacy regulation, we implement the third-country-transfer standard contractual clauses approved by the European Commission to require that personal data remains protected. We also implement saidstandard contractual clauses or an alternative transfer mechanism with our third party service providers and partners where there is an international transfer of personal data to a country for which no adequacy decision of the European Commission avails. Any transfer of your personal data outside of the EEA to a third party or another office of ours will be subject to appropriate data protection safeguards that protect your data privacy rights.

Gowling WLG (Canada) LLP ("Gowling WLG Canada") is an independent entity. Gowling WLG Canada has a separate privacy notice which describes how it processes personal information. For UK and European data protection law purposes, the European Commission and the ICO considers that Canada's federal private-sector privacy law offers adequate levels of protection to safeguard your privacy rights.

If you instruct us and if it is necessary, we will exchange information with law firms located in other jurisdictions.

How we keep your data secure

Gowling WLG (UK) LLP is committed to its Information and Cyber security programme, ensuring that adequate security controls are in place to protect information and data from being accessed, corrupted, lost or stolen.  The firm's non-UK offices are aligned to ISO 27001 with centrally managed services provided in Birmingham and London certified to ISO 27001. This certification is an international information security standard which is widely recognised as an indication of best practice in information security and information risk management.

The firm's centrally managed IT services are also certified to the Cyber Essentials Plus scheme – this is a UK Government backed scheme that will help to protect the organisation against a whole range of the most common cyber-attacks.

If you have queries regarding these certifications or particular concerns about your information, please contact us (see 'How to contact us?' above).

When will we delete your data?

We retain personal data in line with our internal policies, contractual terms and where necessary for us to meet our legal, regulatory and professional obligations. Our default retention periods will differ, depending on the country which is providing your services. In any case, the criteria that we apply is to delete data when it is no longer necessary for us to hold it.

Archived personal data will be deleted or anonymised within the year following the end of the applicable retention period.

Your rights

As a data subject, you have the following rights under the Data Protection Laws:

• the right of access to Personal Data relating to you;
• the right to correct or update any mistakes in your information;
• the right to object to our processing of your personal data in certain circumstances such as where we are processing it for our legitimate interests
• the right to ask us to stop contacting you with direct marketing (opt-out/unsubscribe);
• rights in relation to know details of any automated decision making;  
• the right to restrict or prevent your Personal Data being processed;
• the right to have your Personal Data ported to another data controller (e.g. if you decide to contract with a different service provider);
•  the right to withdraw your consent where we are processing your personal data based on consent ;
• the right to erasure where you believe we have no good reason to continue processing it;
• right to lodge a complaint with a data protection authority;
• right to define directives in respect of the processing of personal data after your death.

These rights are explained in more detail below, but if you have any comments, concerns or complaints about the use of your Personal Data by us, please contact us (please refer to section "How to contact us").

We will respond to any rights that you exercise within a month of receiving your request, unless the request is particularly complex, in which case we will respond within three months.

Please be aware that there are exceptions and exemptions that apply to some of the rights which we will apply in accordance with the Data Protection Laws.

Right to access Personal Data relating to you

You may ask to see what Personal Data we hold about you and be provided with:

• a copy of your personal data;
• details of the purpose for which it is being or is to be processed;
• details of the recipients or classes of recipients to whom it is or may be disclosed, including if they are overseas and what protections are used for those oversea transfers;
• the period for which it is held (or the criteria we use to determine how long it is held);
• any information available about the source of that data; and
• whether we carry out an automated decision-making, or profiling, and where we do information about the logic involved and the envisaged outcome or consequences of that decision or profiling.

To help us find the Personal Data easily, please provide us as much information as possible about the type of Personal Data you would like to see.

Right to correct any mistakes in your information

You can require us to correct any mistakes in your Personal Data which we hold free of charge. If your Personal Data is incomplete, you can ask us to complete it by adding more details. If you would like to do this, please:

• email, call or write to us (see "How to contact us")
• let us have enough information to identify you, and
• let us know the Personal Data that is incorrect and what it should be replaced or supplemented with.

Right to ask us to stop contacting you with direct marketing

You can ask us to stop contacting you for direct marketing purposes. If you would like to do this, please:

• See "How can you contact us" above
• You can review and update your contact details and preferences or unsubscribe from our communications at any time via the links in our e-marketing messages or by e-mailing us at iaadmin@gowlingwlg.com

Rights in relation to automated decision making

We do not make any automated decisions about you so this right does not apply.

Right to prevent processing of personal data

You may request that we stop or limit processing your personal data temporarily if:

• you do not think that your Personal Data is accurate. We will start processing again once we have checked whether or not it is accurate;
• the processing is unlawful but you do not want us to erase your Personal Data;
• we no longer need the Personal Data for our processing, but you need the Personal Data to establish, exercise or defend legal claims; or
• you have objected to processing because you believe that your interests should override our legitimate interests.

Copies of your Personal Data (data portability)

You may ask for an electronic copy of your Personal Data which we hold electronically and which we process when we have entered into a contract with you. You can also ask us to provide this directly to another party

Right to erasure

You can ask us to erase your Personal Data where:

• you do not believe that we need your Personal Data in order to process it for the purposes set out in this Privacy Notice;
• if you had given us consent to process your Personal Data, you withdraw that consent and we cannot otherwise legally process your Personal Data;
• you object to our processing and we do not have any legitimate interests that mean we can continue to process your data; or
• your Personal Data has been processed unlawfully or have not been erased when it should have been.

Right to withdraw consent

The circumstances in which we rely on consent are minimal but if the lawful basis for processing is based upon the provision of your consent, you are able to withdraw your previously given consent to the processing of the Personal Data at any time without giving reasons.

If you want to withdraw your consent:

• contact us by email, telephone or in writing (see "How can you contact us" above)
• give us enough information so that we can identify you and if necessary, let us know which consent you would like to withdraw.

Complaints to the regulator

It is important that you ensure you have read this Privacy Notice - and if you do not think that we have processed your data in accordance with this notice - you should let us know as soon as possible. Similarly, you may complain to your lead supervisory authority.

Contact the Commission Nationale de l'Informatique et des Libertés (CNIL) www.cnil.fr

Instructions for after your death

You can communicate your instructions, revocable at any time, regarding the conservation, erasure, communication of your personal data after your death by designating a person in charge of their execution:

• for general instructions, you may address them to a trusted digital third party certified by the CNIL;
• for specific directives, you may address them directly to the firm.

March 2024

Key summary

We process your data in order to provide legal services and other services to you. We may also process your data as a result of your relationship with one or more of our clients or our volunteering programme, or where you apply for a job or work placement with us or our clients, or where you provide us with services. We also collect personal information when you contact us, subscribe to one of our mailing lists or attend one of our seminars or events, including webinars and other digital events.

Other service providers play an important role in this relationship as we instruct them to assist with other professional services and administrative requirements. We liaise with them to ensure efficiency in business support tasks such as security, delivery, technology, payment, insurance, litigation support and archiving and storage.

Your information will be treated securely and in strict confidence, in line with our ISO27001 accreditation.

This notice explains what data we process, why, how it is legal and your rights. In order to do our best to be transparent, this privacy notice will be updated on an ongoing basis.

We also have produced a video notice to tell you the relevant points of what we do with your personal data.

• About us
• Useful words and phrases
• What information do we collect?
• Why do we process your personal data?
• How is processing your personal data lawful?
• Who will have access to your personal data?
• When will we delete your data?
• Your rights

About us

Gowling WLG (UK) LLP is an independent entity and part of the Gowling WLG group. Other Gowling WLG group entities operate in different countries. We decide what to do with your data in a different way in each country and so each of our entities is a separate 'data controller'. The data controller is responsible for the processing of your personal data according to the data protection laws.

Please see the legal information page for information on the Gowling WLG structure, our group entities, and who your data controller is.

Each country has different Data Protection Laws. In the UK, the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 apply.

We take your privacy very seriously and we ask that you read this Privacy Notice carefully as it contains important information on:

• Your Rights
• The personal data we collect about you and why we collect the data;
• What we do with your data, and
• Who your information will be shared with.

If you need extra help

If you would like this notice in another format (for example: audio, large print, braille) please contact us.

How you can contact us

Please contact us if you have any questions about this Privacy Notice or the information we hold about you.

If you wish to contact our UK offices, please send an email to data.enquiry@gowlingwlg.com or write to us at Gowling WLG (UK) LLP, Two Snowhill, Birmingham, B4 6WR or you may submit a complaint to the Information Commissioner's Office (ICO).

Changes to the Privacy Notice

We may change this Privacy Notice from time to time. You should check this Privacy Notice occasionally to ensure you are aware of the most recent version.

Useful Words and Phrases

Please familiarise yourself with the following words and phrases as they have particular meanings in the Data Protection Laws and are used throughout this Privacy Notice:

What information do we collect?

Personal data provided by you

To provide you with our services, we may collect your information including:

• Identity and contact data ; such as your name, address, phone number, email address, date of birth, company you work for and your position,
• financial data; such as payment related information
• identification and background information provided by you or collected as part of our on-boarding process. We will process identification and background information as part of our onboarding process including anti-money laundering, conflict, reputational and financial checks, and to fulfil any other legal or regulatory requirements which apply to us.
• Video images/photographs/audio; in connection with identification checks, CCTV, providing/receiving training, remote meetings
• Location data; reception registration and/or visitor security pass where you attend our offices i.e. for legal services, insight day, consultancy support, an event or to provide IT support
• Financial information i.e. for billing purposes
• any other information relating to you or third parties which you give us so we may provide you with our service

We will also collect Personal Data when you contact us, send feedback, subscribe to one of our mailing lists, wish to attend, or have attended, one of our events or seminars, attend one of our voluntary programmes or raise any complaint, enquiry or information request with us.

We will also collect information that you share with us to help us understand your situation, your preferences and to represent your best interests when you instruct us/become a client of Gowling WLG (UK) LLP, or as a result of your relationship with one or more of our clients, where you supply us or our clients with services, or where you apply for work experience, insight scheme or a job or work placement with us or our clients.

We will also collect personal data where you are representing your organisation for example as part of procurement or tender. Where you provide third party technical support we may process your data where you provide us with technical support remotely by connecting to our systems or services.

Special category personal data

If we ask you to provide us with your special category personal data, we will explain why we need that data and how we intend to use it and your rights. If necessary, we will ask you for your consent first.

You may provide us with yours or a third party's special category personal data where it is necessary in connection with services we provide, such as information about a person's physical or mental health, alleged criminal activities.

You may provide us with your special category personal data such as your health data to inform us of any dietary requirements or reasonable adjustments required where you are attending one of our offices or events.

We may need to process your special categories of personal data if processing is necessary to comply with laws that apply to us in relation to anti-money laundering or counter-terrorist financing obligations or the prevention, detection or prosecution of any crime.

Personal data about other individuals

If you give us information on behalf of someone else, you confirm that the other person has appointed you to act on their behalf and have agreed that you can. In addition, where you give us personal data belonging to someone else, you must ensure that you have the necessary grounds, consents or authorisations to provide it to us. In some cases, we may obtain Personal Data regarding you from other persons, including clients to whom we provide legal services. For example, we may obtain information regarding directors, officers, or employees of our clients or other parties, witnesses, beneficiaries, adverse parties, related parties, parties in interest, business partners, investors, shareholders, security holders, buyers, business partners, and customers of clients.

Children's data

We do not provide services directly to children or proactively collect their personal information. However, we are sometimes given information about children where it is necessary in connection to legal services we provide to our clients or in connection with our Probono initiatives.

We may also process children's data in connection with our HR and CSR programmes such as our Insight scheme. Children's personal data processed in connection with our Insight Scheme is usually limited to name, contact details, school/college name and CV.

Personal data provided by third parties

We will collect Personal Data directly from you, from clients or from authorised representatives and as otherwise permitted or required by applicable law. At times, we will also collect personal information from third parties such as regulatory and legal authorities, other organisations with whom you have dealings or who have a legal interest in such data, government agencies, credit reporting agencies, financial institutions, recruitment agencies and other people connected to recruitment, information or service providers, introducers and referrers and from publicly available records.

We may obtain information about you from third parties in order to verify your identity, carry out anti-money laundering, anti-terrorism, sanctions screening and other background and credit checks. In performing these checks, personal information provided by you may be disclosed to that third party which may keep a record of that information. All information provided by you will be treated securely and strictly in accordance with the Data Protection Laws.

Why do we process personal data?

We use your Personal Data for the following purposes listed in this section. We are allowed to do so on certain legal bases (please see section 'How is processing your data lawful' for further detail).

We collect your information so that we can:

• Deliver Legal Services - Provide legal and other services and products as instructed by you, answer your queries and provide you with information or materials you have asked to receive;
• Comply with our Legal and Regulatory obligations - such as establishing your identity in order to comply with anti-money laundering regulations and our other legal and regulatory obligations which may require you to provide name, address, employment/business and financial information, and/or other legally mandated forms of identification;
• Carry out administration - Bill for our work, carry out searches and checks, maintain internal records, which will include the collection of names, addresses, banking, financial details and creditworthiness; to maintain and develop our relationship with you; to carry out recruitment activities if you are applying for a job or work placement with us or our clients; to analyse and help us manage our practice; to maintain and update our records.
• Carry out Business Development and Marketing - to carry out market research; market our own products and services to you, including as may be permitted by the applicable law, by email or other means and to keep your information and preferences accurate. We may also use and analyse the Personal Data provided to us to track and manage your consent preferences, event reservations and any unsubscribe requests. From time to time, we may wish to send you legal updates; newsletters; press releases; information about our events and the legal services we provide and other communications that we think will be of interest to you and/or your business. You can review and update your contact details and preferences or unsubscribe from our e-marketing communications at any time via the links in our e-marketing messages or by e-mailing us at iaadmin@gowlingwlg.com
• If you have consented to receive marketing materials from us, you can opt out at any time. See 'Your Rights' for further information. You can also manage your preferences by sending a message to iaadmin@gowlingwlg.com
• Maintain Quality Standards - to meet high standards of quality and professional standards, and to obtain and maintain certification and accreditations which may involve audits of our internal processes;
• Manage Claims - pursue available remedies or limit any damages that we or our clients may sustain and to respond to any feedback or complaints that we may receive;
• Keep people and buildings safe -to help ensure security and for crime prevention; we may have CCTV cameras installed at the entrances to our premises and CCTV data is captured on cameras;
• To monitor our website usage to improve our services - please see our cookies policy which explains what cookies are and why we use them.

How is processing your data lawful?

We are allowed to process your Personal Data for the following reasons and on the following legal basis:

Consent

Where you have given consent - for example, where you have subscribed to a mailing list for us to send you legal alerts, information regarding updates/events or other information which may be of interest to you.

Contract

Where it is necessary for the performance of the contract you have agreed to enter with Gowling WLG (UK) LLP. For example, because you are using Gowling WLG (UK) LLP for legal advice, we are required to process your Personal Data for the purposes of performing our legal advice services appropriately and billing our services and by retaining us you agree that we may do so.

Legal obligation

Where we are subject to legal obligations to process your data for the purposes of compliance with applicable laws; for example, we are required to identify our clients in accordance with the anti-money laundering regulations in many countries and are required to gather and maintain records in compliance with health and safety legislation. We also have obligations pursuant to financial and tax legislation and reporting obligations in respect of tax administration.

Legitimate interest

Processing your Personal Data is also legal if it is based on our 'legitimate interests' which are not overridden by your data protection interests or fundamental rights and freedoms. To process on this basis, we have considered the impact on your interests and rights, and have placed appropriate safeguards to ensure that the intrusion on your privacy is reduced as much as possible.

The following are examples of the purposes for which we will process your Personal Data on this basis:

• Client administration - to enable us to maintain internal records
• To ensure regulatory compliance - for example that conflict checks are carried out before we start work and to erect information barriers to restrict access to certain information and to comply with all aspects of our regulatory obligations
• To enable us to maintain specific standards of quality in the professional services we provide and to obtain and maintain quality accreditations
• To permit us to pursue available remedies or limit any damages that we may sustain
• To permit us to manage and respond to any complaints
• To liaise with representatives of clients of corporates and other business clients
• To market our services
• To carry out recruitment and administer work experience and work placement activities

Please be aware that you have the right to object to the processing of your data for any of the legitimate interests identified.

Special Category Personal Data

In certain circumstances, we may process your special category personal data for the following reasons and subject to the following exceptions:

• Consent
  For example, you have given your explicit consent for us to process your health information for the purpose of providing you with legal advice.
• Vital Interests
  Because it is necessary for us to protect your vital interest e.g. It is necessary for us to process your medical/health information, for the purposes of following our health and safety procedures if you are attending an event or visiting our buildings, which in turn could assist us if we are required to protect your life.
• Manifestly public personal data
  The data has been manifestly made public and only when it is necessary for our purposes and permitted by the applicable Data Protection Laws. For example, we ask you to provide your dietary requirements when you attend an event at our offices. We consider that you have made this data manifestly public to our organisation to help us protect you and to ensure your health and safety. We will keep this information confidential and restrict it to only those who need to know.
• Legal claims
  We are establishing or defending a legal claim for you as a client or in our own right.

Who will have access to your personal data?

In the course of providing our services and operating our business, we may disclose your Personal Data to:

• Other Gowling WLG (UK) LLP offices, group entities, subsidiaries and affiliates, partnerships operating under the Gowling brand ;
• Third party service providers whom we instruct to assist with the provision of legal or other services and products such as other professional advisors, and the administrative requirements associated with those services;
• Third party service providers of certain business support tasks to Gowling WLG (UK) LLP including security, delivery, technology, research, banking, payment, insurance, litigation support, translation, credit checking, archiving, recruitment agencies and storage;
• Charities and organisations in connection with our volunteering programmes
• External inspectors or auditors
• Providers of business development and marketing support services, in order to provide event and marketing support;
• Legal and or regulatory authorities including courts or public authorities who may compel disclosure, such as the Solicitors Regulation Authority (SRA), HMRC, Health & Safety Executive and National Crime Agency (NCA). This may be (i) in the event that we are required to make a disclosure under various legislation and regulation; or (ii) where we have a legal, regulatory or professional obligation to do so; or (iii) where we are required to protect the safety or rights or our clients, staff or others; (iv) or to exercise, establish or defend our legal rights;
• Personal Data may also be subject to transfer to another organisation in the event of corporate transaction such as a merger, combination or acquisition, or change of ownership of our firm. This will occur only if the parties have entered into an agreement under which the collection, use and disclosure of the information is restricted to those purposes that relate to the business transaction, including a determination whether or not to proceed with the business transaction, and is used by the parties to carry out and complete the business transaction.
• Persons whom you instruct us to disclose your information to in the course of providing legal services, for example a party involved in a legal claim or transaction.
• If you wish to know more about the parties with whom we share Personal Data, please contact us.

International transfers of data between our offices

Transfers of your information out of the UK and EEA

In the context of its global practice, Gowling WLG (UK) LLP and affiliated businesses or subsidiaries transfers Personal Data between its offices, the free flow of information being essential for the efficient conduct of its International business. A number of our offices and affiliates are located outside the European Economic Area. Where we transfer personal data outside the UK and EEA, to a country without adequacy regulation, we implement the EC and UK standard contractual clauses to require that personal data remains protected. We also implement EC and UK standard contractual clauses or an alternative transfer mechanism with our third party service providers and partners where there is an international transfer of personal data to a country without adequacy regulations. Any transfer of your personal data outside of the UK or EEA to a third party or another office of ours will be subject to appropriate data protection safeguards that protect your data privacy rights.

Gowling WLG (Canada) LLP ("Gowling WLG Canada") is an independent entity. Gowling WLG Canada has a separate privacy notice which describes how it processes personal information. For UK and European data protection law purposes, the European Commission and the ICO considers that Canada's federal privacy law offers adequate levels of protection to safeguard your privacy rights.

If you instruct us and if it is necessary, we will exchange information with law firms located in other jurisdictions.

How we keep your data secure

We have robust information security management systems in place to protect your personal information and are ISO27001 accredited. ISO27001 is an international information security standard which is widely recognised as an indication of best practice in information security and information risk management.

If you have any particular concerns about your information, please contact us (see 'How to contact us?' above).

When will we delete your data?

We retain personal data in line with our internal policies, contractual terms and where necessary for us to meet our legal, regulatory and professional obligations. Our default retention periods will differ, depending on the country which is providing your services. In any case, the criteria that we apply is to delete data when it is no longer necessary for us to hold it.

Your rights

As a data subject, you have the following rights under the Data Protection Laws:

• the right of access to Personal Data relating to you;
• the right to correct or update any mistakes in your information;
• the right to object to our processing of your personal data in certain circumstances such as where we are processing it for our legitimate interests
• the right to ask us to stop contacting you with direct marketing (opt-out/unsubscribe);
• rights in relation to know details of any automated decision making;
• the right to restrict or prevent your Personal Data being processed;
• the right to have your Personal Data ported to another data controller (e.g. if you decide to contract with a different service provider);
• the right to withdraw your consent where we are processing your personal data based on consent ;
• the right to erasure where you believe we have no good reason to continue processing it;
• right to lodge a complaint with a data protection authority.

These rights are explained in more detail below, but if you have any comments, concerns or complaints about the use of your Personal Data by us, please contact us (please refer to section "How to contact us").

We will respond to any rights that you exercise within a month of receiving your request, unless the request is particularly complex, in which case we will respond within three months.

Please be aware that there are exceptions and exemptions that apply to some of the rights which we will apply in accordance with the Data Protection Laws.

Right to access Personal Data relating to you

You may ask to see what Personal Data we hold about you and be provided with:

• a copy of your personal data;
• details of the purpose for which it is being or is to be processed;
• details of the recipients or classes of recipients to whom it is or may be disclosed, including if they are overseas and what protections are used for those oversea transfers;
• the period for which it is held (or the criteria we use to determine how long it is held);
• any information available about the source of that data; and
• whether we carry out an automated decision-making, or profiling, and where we do information about the logic involved and the envisaged outcome or consequences of that decision or profiling.

To help us find the Personal Data easily, please provide us as much information as possible about the type of Personal Data you would like to see.

Right to correct any mistakes in your information

You can require us to correct any mistakes in your Personal Data which we hold free of charge. If your Personal Data is incomplete, you can ask us to complete it by adding more details. If you would like to do this, please:

• email, call or write to us (see "How to contact us")
• let us have enough information to identify you, and
• let us know the Personal Data that is incorrect and what it should be replaced or supplemented with.

Right to ask us to stop contacting you with direct marketing

You can ask us to stop contacting you for direct marketing purposes. If you would like to do this, please:

• See "How can you contact us" above
• You can review and update your contact details and preferences or unsubscribe from our communications at any time via the links in our e-marketing messages or by e-mailing us at iaadmin@gowlingwlg.com.

Rights in relation to automated decision making

We do not make any automated decisions about you so this right does not apply.

Right to prevent processing of personal data

You may request that we stop or limit processing your personal data temporarily if:

• you do not think that your Personal Data is accurate. We will start processing again once we have checked whether or not it is accurate;
• the processing is unlawful but you do not want us to erase your Personal Data;
• we no longer need the Personal Data for our processing, but you need the Personal Data to establish, exercise or defend legal claims; or
• you have objected to processing because you believe that your interests should override our legitimate interests.

Copies of your Personal Data (data portability)

You may ask for an electronic copy of your Personal Data which we hold electronically and which we process when we have entered into a contract with you. You can also ask us to provide this directly to another party.

Right to erasure

You can ask us to erase your Personal Data where:

• you do not believe that we need your Personal Data in order to process it for the purposes set out in this Privacy Notice;
• if you had given us consent to process your Personal Data, you withdraw that consent and we cannot otherwise legally process your Personal Data;
• you object to our processing and we do not have any legitimate interests that mean we can continue to process your data; or
• your Personal Data has been processed unlawfully or have not been erased when it should have been.

Right to withdraw consent

The circumstances in which we rely on consent are minimal but if the lawful basis for processing is based upon the provision of your consent, you are able to withdraw your previously given consent to the processing of the Personal Data at any time without giving reasons.

If you want to withdraw your consent:

• contact us by email, telephone or in writing (see "How can you contact us" above)
• give us enough information so that we can identify you and if necessary, let us know which consent you would like to withdraw.

Complaints to the regulator

It is important that you ensure you have read this Privacy Notice - and if you do not think that we have processed your data in accordance with this notice - you should let us know as soon as possible. Similarly, you may complain to the competent supervisory authority.

Contact the Information Commissioner's Office. Information about how to do this is available on his website at www.ico.org.uk.

February 2024