Orrick Privacy Notice

1. OUR APPROACH TO PRIVACY

1. 1.1 Orrick, Herrington & Sutcliffe LLP and its affiliates (listed in the "Affiliates" section 14 below) ("Orrick", "we", "our", or "us") are committed to respecting your privacy.
2. 1.2 We collect data about users of our websites, blogs, mobile sites, or applications; about individuals that attend events organised or hosted by us; and about our clients (where these are natural persons) or their employees, agents and representatives (and these individuals about whom we collect data are referred to as "you" in this Privacy Notice).
3. 1.3 We may collect data that identifies or is associated with you ("personal information") when you access our websites, blogs, mobile sites, applications, widgets and other interactive features, when you register or attend an event organised or hosted by us, or when you otherwise contact us ("Public Services").
4. 1.4 We may also collect personal information about you when we provide legal services or market our legal services ("Legal Services") to you, your employer, or any other person that has authorised you to communicate with us regarding the provision of Legal Services to them in accordance with our client engagement agreement.
5. 1.5 This Privacy Notice sets out how we collect, store, process, transfer, share and use your personal information.
6. 1.6 Before accessing, using or receiving our Public Services or Legal Services, please ensure that you have read and understood how we collect, store, use and disclose your personal information as described in this Privacy Notice.

2. REGION-SPECIFIC DISCLOSURES

We may choose or be required by law to provide different or additional disclosures relating to the processing of personal information about residents of certain countries, regions or states. Please refer below for disclosures that may be applicable to you:

• If you are a resident of the State of California in the United States, please click here for additional California-specific privacy disclosures.
• If you are based in the European Economic Area (“EEA”), please click here for additional EEA-specific privacy disclosures.

4. PERSONAL INFORMATION WE COLLECT ABOUT YOU AND HOW WE USE IT

Information you provide to us
1. 4.1 We collect personal information about you when you voluntarily submit information directly to us when you access, use or receive the Public Services or the Legal Services. This can include information you provide to us when you submit an enquiry through our website, register for and/or attend an event, correspond with us by phone, email or otherwise, subscribe to our mailing lists, client alerts, newsletters or other forms of marketing communications, provide information requested by us to comply with our professional and legal obligations, or in connection with our provision of the Legal Services. We may also collect personal information from third parties, such as your employer, public databases or social media networks.
2. 4.2 If you choose not to provide personal information, we may not be able to provide some or all of the Public Services or Legal Services to you or respond to your other requests.
3. 4.3 When you use the Public Services, the categories of information we collect may include:
• contact information
• business information
• employment information
• location information
• information provided by third parties
• your comments and opinions that you express when you comment on a blog post, contact us by email, mail or phone.

We use this information to operate, maintain and provide to you the features and functionality of the Public Services, to address your questions and concerns, to personalize your content so that it is relevant to the city or country you are using your device in, to contact you, including sending you news, alerts and marketing communications, and to help us develop new products and services.

4. 4.4 When you use Legal Services, the categories of information we collect may also include:
• identification information
• instructions and information about
• payment and transaction information

We use this information to provide you with the Legal Services in accordance with our agreements; to communicate with you; to comply with our professional or legal obligations and to facilitate our internal business operations.

5. 4.5 The table at Annex 2 further sets out the categories of personal information we collect about you when you use the Public Services and how (for which purpose) we use that information. The table also lists the legal basis which we rely on to process the personal information.
6. 4.6 The table at Annex 3 further sets out the categories of personal information we collect about you when you use the Legal Services and how (for which purpose) we use that information. The table also lists the legal basis which we rely on to process the personal information.
Information we collect about you automatically
7. 4.7 We also automatically collect personal information about you indirectly about how you access and use our websites, blogs, mobile sites, applications, widgets and other interactive features (the "Online Services") and information about the device you use to access the Online Services. For example, we may collect:
• information about how you view the Online Services (e.g., the pages you view, the links you click);
• information about your browser and usage patterns (e.g., your IP address, browser type and language); and
• information about the device you use to access the Online Services (e.g., device identifier, device type, model and manufacturer)

We use this information to: present our Online Service to you on your device; determine news, alerts and other products and services that may be of interest to you for marketing purposes; and monitor and improve our Online Services and business, and to help us develop new products and services.

8. 4.8 The table at Annex 4 further sets out the categories of personal information we collect about you automatically and how (for which purpose) we use that information. The table also lists the legal basis which we rely on to process the personal information.

5. RECIPIENTS OF PERSONAL INFORMATION

1. As required in accordance with how we use it, we will share your personal information with the following:
   1. (a) Service providers and advisors. Third party vendors and other service providers that perform services for us, on our behalf, which may include providing mailing or email services, tax and accounting services, payments processing, data enhancement services, fraud prevention, web hosting, or providing analytic services.
   2. (b) Affiliates. Other affiliates of Orrick, Herrington & Sutcliffe LLP, so that they can provide you with legal updates, information and marketing messages about products or services that may interest you.
   3. (c) The public. When you use our Public Services, content and information that you post on message boards, blogs or other services on our website, or that you allow us to make public, may be available to other visitors to our websites and to the general public. When you use our Legal Services, to the extent you have given us consent to do so, we may also share your name and the company you work for together with comments and feedback on our Legal Services.
   4. (d) Legal directories and referees. When you use our Legal Services, we may share your contact details and limited information about the Legal Services provided to you or the client with legal directories or other promotional publications or communications, in order to promote our Legal Services. We will only share your personal information in this way to the extent that you have given us your consent to do so.
   5. (e) Social Media Networks. When you use our Public Services, content that you share through social media may be shared with your social media account provider and your friends, followers or contacts on the connected social network.
   6. (f) Purchasers and third parties in connection with a business transaction. We may, where permitted by our professional confidentiality obligations, disclose generic information about our current clients, such as limited client lists and/or brief descriptions of the Legal Services being provided, to third parties in connection with a transaction, such as a merger, sale of assets or shares, reorganisation, financing, change of control or acquisition of all or a portion of our business.
   7. (g) Law enforcement, regulators and other parties for legal reasons. Third parties as required by law or if we reasonably believe that such action is necessary to (a) comply with the law and the reasonable requests of law enforcement; (b) comply with legal process; (c) respond to requests from public or government authorities, including public or government authorities outside your country of residence; (d) enforce the terms of our agreement (being, as applicable, our Terms of Use Agreement for Public Services or the terms of our client engagement letter for Legal Services) and pursue available remedies or limit the damages that we might sustain; (e) protect the security or integrity of the Public Services or Legal Services (as applicable); and/or (f) exercise or protect our rights, privacy, safety or that of our affiliates, clients, you or others.

6. MARKETING AND ADVERTISING

1. 6.1 From time to time we may send you legal updates, alerts, news and mailings relating to seminars or events that we think may be of interest to you.
2. 6.2 Most messages we send will be by email. For some messages, we may use personal information we collect about you to help us determine the most relevant marketing information to share with you.
3. 6.3 If you are in the EEA, we will only send you marketing messages if you have given us your consent to do so. If you do not want to receive messages from us, you will be able to tell us by selecting certain boxes on forms we use when we first collect your contact details or by refusing or withdrawing your consent. You can also change your preferences at a later date by clicking on the unsubscribe link at the bottom of our messages, visiting our Marketing Preferences Center to adjusts your communication preferences, or by emailing us at [email protected].
4. 6.4 Please note that if you do opt-out of or do not grant consent to receiving marketing related messages from us, we may still send you non-marketing messages, such as communications relating to the provision of Legal Services.
5. 6.5 Your personal information may also be shared with any affiliates of Orrick, Herrington & Sutcliffe LLP, who may also use this information for the same purposes outlined in this Privacy Notice.

7. STORING AND TRANSFERRING YOUR PERSONAL INFORMATION

1. 7.1 Retention periods. We will store your personal information for no longer than necessary for the purposes set out in Annexes 2, 3 and 4, and in accordance with our legal obligations and legitimate business interests.
2. 7.2 Security. We implement appropriate technical and organisational measures to protect your personal information against accidental or unlawful destruction, loss, change or damage.
3. 7.3 International Transfers of your Personal Information. As an international legal practice, our affiliates and service providers are located around the world. The personal information we collect may therefore be transferred to and stored in countries outside of the jurisdiction you are in. Any international transfers of your personal information are made pursuant to appropriate safeguards, such as standard data protection clauses adopted by the European Commission. If you wish to enquire further about these safeguards used, please contact us using the details set out at the end of this Privacy Notice.

8. EEA-Specific Disclosures

8.1 If you are resident in the European Economic Area, or if you are receiving Public Services or Legal Services from, or otherwise engaging with an Orrick affiliate in the European Economic Area, under European law you have the following rights in respect of your personal information that we hold:
1. (a) Right of access. You have the right to obtain:
1. (i) confirmation of whether, and where, we are processing your personal information;
2. (ii) information about the categories of personal information we are processing, the purposes for which we process your personal information and information as to how we determine applicable retention periods;
3. (iii) information about the categories of recipients with whom we may share your personal information; and
4. (iv) a copy of the personal information we hold about you.
2. (b) Right of portability. You have the right, in certain circumstances, to receive a copy of the personal information you have provided to us in a structured, commonly used, machine-readable format that supports re-use, or to request the transfer of your personal data to another person.
3. (c) Right to rectification. You have the right to obtain rectification of any inaccurate or incomplete personal information we hold about you without undue delay.
4. (d) Right to erasure. You have the right, in some circumstances, to require us to erase your personal information without undue delay if the continued processing of that personal information is not justified.
5. (e) Right to restriction. You have the right, in some circumstances, to require us to limit the purposes for which we process your personal information if the continued processing of the personal information in this way is not justified, such as where the accuracy of the personal information is contested by you.
6. (f) Right to object. You have a right to object to any processing based on our legitimate interests where there are grounds relating to your particular situation. There may be compelling reasons for continuing to process your personal information, and we will assess and inform you if that is the case. You can object to marketing activities for any reason.
1. 8.2 If you are resident in France, you also have the right to set guidelines for the retention and communication of your personal information after your death.
2. 8.3 If you wish to exercise one of these rights, please contact us at [email protected]. You may also review and edit the personal information you have submitted to us through the Public Services by logging into your account at https://respond.orrick.com/5/12/forms/subscribe.asp.
3. 8.4 You also have the right to lodge a complaint to your local data protection authority. Further information about how to contact your local data protection authority is available at http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.
4. 8.5 Residents in other jurisdictions may also have similar rights to the above. Please contact us at [email protected] if you would like to exercise one of these rights, and we will comply with any request to the extent required under applicable law.

9. INTEREST BASED ADVERTISING

1. 9.1 We permit third party online advertising networks, social media companies and other third party services to collect information about your use of our Online Services over time so that they may play or display personalized or interest-based ads on our Online Services, on other websites, apps or services you may use, and on other devices you may use. Typically, though not always, the information used for interest-based advertising is collected through cookies or similar data collection technologies. We and our third party partners use this information to make the advertisements you see online more relevant to your interests, as well as to provide advertising-related services such as reporting, attribution, analytics and market research. Depending on your location as detected from your IP address, we may offer you a “Cookie Banner” through which you can exercise certain control over the use of cookies on the Online Services.  As an alternative, or if the Banner is not displaying, you may exercise control by following the opt-out instructions below.
2. 9.2 We also may use certain forms of display advertising and other advanced features through Google Universal Analytics, such as Remarketing with Google Analytics, Google Display Network Impression Reporting, the DoubleClick Campaign Manager Integration, and Google Analytics Demographics and Interest Reporting. These features enable us to use first-party cookies (such as the Google Analytics cookie) and third-party cookies (such as the Doubleclick advertising cookie) or other third party cookies together to inform, optimize, and display ads based on your past visits to the Online Services. You opt-out of certain Google advertising products by visiting the Google Ads Preferences Manager, currently available at https://google.com/ads/preferences. You may learn more about Google’s practices with Google Analytics by visiting Google’s privacy policy at http://www.google.com/policies/privacy/partners. You can also view Google’s currently available opt-out options at https://tools.google.com/dlpage/gaoptout.
3. 9.3 We support the self-regulatory principles for online behavioral advertising (Principles) published by the Digital Advertising Alliance (DAA). This means that we allow you to exercise choice regarding the collection of information about your online activities over time and across third-party websites for online interest-based advertising purposes. More information about these Principles can be found at https://youradchoices.com/. If you want to opt out of receiving online interest-based advertisements on your internet browser from advertisers and third parties that participate in the DAA program and perform advertising-related services for us and our partners, please follow the instructions:
   
   
   
   • In the United States, please visit: https://youradchoices.com/, or https://optout.networkadvertising.org/
   • In the European Economic Area, please visit: http://www.youronlinechoices.com/
   • In Canada, please visit: https://youradchoices.ca/
     
     
   When you elect to opt-out through these sites, they will place an opt-out cookie on your device indicating that you do not want to receive interest-based advertisements.  Opt-out cookies only work on the internet browser and device they are downloaded onto. If you want to opt out of interest-based advertisements across all your browsers and devices, you will need to opt out on each browser on each device you actively use. If you delete cookies on your device generally, you will need to opt out again.  And some of these opt-outs may not be effective unless your browser is set to accept cookies. If you delete cookies, change your browser settings, switch browsers or computers, or use another operating system, you will need to opt-out again.
4. 9.4 If you want to opt out of receiving online interest-based advertisements on mobile apps, please follow the instructions at https://youradchoices.com/appchoices.
5. 9.5 Please note that when you opt-out of receiving interest-based advertisements, this does not mean you will no longer see advertisements from us or on our online services.  It means that the online ads that you do see from DAA program participants should not be based on your interests.  We are not responsible for the effectiveness of, or compliance with, any third-parties’ opt-out options or programs or the accuracy of their statements regarding their programs. In addition, third parties may still use cookies to collect information about your use of our online services, including for analytics and fraud prevention as well as any other purpose permitted under the DAA’s Principles.

10. LINKS TO THIRD PARTY SITES

The Public Services may, from time to time, contain links to and from third party websites, including those of other users and news publications. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for their policies. Please check the individual policies before you submit any information to those websites.

11. OUR POLICY TOWARDS CHILDREN

Our Public Services and Legal Services are not directed at persons under 16 and we do not knowingly collect personal information from children under 16. If you become aware that your child has provided us with personal information, without your consent, then please contact us using the details below so that we can take steps to remove such information and terminate any account your child has created with us.

12. CHANGES TO THIS NOTICE

We may update this Privacy Notice from time to time and so you should review this page periodically. When we change this Privacy Notice in a material way, we will update the "Last Updated" date at the top of this Privacy Notice. Changes to this Privacy Notice are effective when they are posted on this page.

13. NOTICE TO YOU

If we need to provide you with information about something, whether for legal, marketing or other business related purposes, we will select what we believe is the best way to get in contact with you. We will usually do this through email or by placing a notice on the Online Services. The fact that we may send notices to you will not stop you from being able to opt out of certain types of contact as described in this Privacy Notice.

14. AFFILIATES

The following entities are "affiliates" of Orrick, Herrington & Sutcliffe LLP:

• Orrick, Herrington & Sutcliffe (Europe) LLP, a United Kingdom limited liability partnership
• Orrick, Herrington & Sutcliffe (UK) LLP, a United Kingdom limited liability partnership
• Orrick, Herrington & Sutcliffe SAS, a French corporate entity
• OHS Secretaries Limited, a UK private limited company
• Orrick (CIS) LLC, a Delaware limited liability company
• Orrick Tokyo Law Offices, a joint venture between Orrick Tokyo Law Offices and the Firm
• Orrick Foreign Legal Affairs Attorneys-at-Law, a foreign legal affairs partnership existing under the laws of the Republic of China
• BLX Group LLC (formerly known as Bond Logistix LLC), a Delaware limited liability company
• Orrick Global Operations LLC
• The Orrick, Herrington & Sutcliffe Foundation, a registered Section 501(c)(3) public charity

15. CONTACTING US

1. Questions, comments and requests regarding this Privacy Notice are welcome and should be addressed to [email protected] or to the partner with whom you entered into an engagement for the provision of Legal Services. If you are in Germany, you can also contact our Data Protection Officer at [email protected].