Last Updated: May 2023
About the Firm and this Privacy Statement
Cleary Gottlieb Steen & Hamilton LLP (“Cleary Gottlieb,” “Cleary,” the “Firm,” “we” or “us”) is committed to safeguarding privacy and personal data. With a few exceptions, such as when we provide data room or e-discovery services to our clients (in the context of which our role is limited to that of a data processor), Cleary Gottlieb will be the controller of the personal data provided to or collected by us.
This Privacy Statement is intended to inform clients, prospective clients and all other non-Cleary persons whose personal data we may process about how we will collect, use, share or otherwise process their personal data. We provide separate privacy statements to job applicants and alumni.
Cleary Gottlieb is an international law firm practicing in a number of jurisdictions around the world through affiliated legal entities and branch offices of those entities. More information about each of these entities and offices can be found here. Irrespective of your location, should you have any questions about the Firm’s processing of your personal data, or if you would like to exercise any of your rights (as further detailed under “Your Rights” below) you can contact us at email@example.com. We will then ensure that your request is directed to the appropriate office and department.
When, How and What Personal Data We Collect
All personal data processed by us is necessary to fulfill the purposes for which it was collected (further explained below).
The processing of your personal data includes any operation or set of operations which is performed upon your personal data, whether or not by automated means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission or otherwise making available, alignment or combination, restriction, erasure or destruction, and such processing will always be carried out in compliance with data protection rules.
Where you provide personal data relating to third parties to us you must first provide those third parties with information about your disclosure to us and establish a lawful basis for such disclosure, to the extent required by applicable law.
We collect, and may have collected in the preceding 12 months, personal data about you from various sources, including identifiers, commercial information, online activity, employment information and education information. We may collect such personal data from you directly, from your device (such as when you visit our website), from your colleagues who may provide us with your contact details so that we can provide our services directly to you, from vendors who provide services on our behalf, from professional services organizations (such as PR firms, other law firms, and pro bono organizations), from social networks, search engines and external contact databases, from government entities and from other third parties.
Additional detail about how we collect such information is further detailed below.
- In general, you are not required to provide any personal data in order to consult our website. However, you may elect to contact us by completing the form provided on the “Contact Us” page of this website, in which case we ask you to provide your name and e-mail address, and to submit specific questions to us. You may also elect to contact us by telephone or e-mail, in which case we will process your name and contact details, and any other personal data you may provide in such communications.
- When using the website for mere information purposes, we may also collect the personal data that your web browser transmits to our server, including internet or other electronic network activity such as your IP address, the date and time of your visit, and data relating to your operating system and web browser.
- When you register for one or more of Cleary’s mailing lists, we will maintain and use your name, address and other personal data you provide to us for the purposes of sending you periodic updates on legal developments and information about our firm or the services that it offers that may be of interest to you.
Provision of services
- During the course of an engagement, or when consideration is being given to such an engagement, we may collect and use personal data about our clients, prospective clients, counterparties and each of their affiliates or the relevant members of their personnel or representatives. We may also collect and use personal data about other third parties involved in or connected with the engagement, such as experts. Such data will include names and contact details, and any other personal data provided to us in the course of the engagement, including any identity data we require for the purposes of carrying out our pre-engagement assessments.
- Where you are providing services to us, we may collect and use personal data about you or the persons who work for you.
- Where you sign up for Firm-affiliated or Firm-sponsored events including seminars, trainings, or presentations, we may collect personal data from you (including your name and e-mail address) as part of the sign-up process and in order to contact you with further information.
- At such events, we may take photographs, video, and/or voice recordings. You will be notified that photographs or recordings are being taken in advance.
- When you meet with us online, visit one of our locations or attend one of our firm-sponsored events, including our webinars, we may also collect personal data from you, including identifiers such as your name, address, the date and time of our meeting, your visit or the event, and any other personal data you may provide to us such as educational information, bar admission information or dietary requirements.
Closed Circuit Television (“CCTV”)
- CCTV cameras may be in operation on the Firm’s premises, as indicated by signage, in common areas, entry and exit points, and server rooms.
All processing of personal data by us is necessary to fulfill the purposes for which they were collected (further explained below).
Why Personal Data Is Used
We may use your personal data:
- to process your requests, to contact you and to provide you with the information or services that you have requested;
- to ensure the security and successful navigation of our website and to compile statistical data on the use of our website;
- to conduct pre-engagement assessments and formalities such as anti-money laundering checks, conflict checks, etc.;
- to perform the tasks entrusted to us by our clients and fulfil our client engagements;
- for internal administrative or operational processes;
- to maintain a safe and secure working environment for our staff and visitors and protect the Firm’s property and premises;
- to enable us to keep our contact database accurate and up-to-date. For example, when you e-mail one of our senior attorneys we may collect your name, job title and business contact details from the e-mail for these purposes;
- to analyze and manage our client relationships;
- to analyze the services you may be interested in (including through inquiries and statistical surveys);
- to send invitations and information from Cleary Gottlieb about events, publications, and services provided by the firm;
- to memorialize meetings, seminars, presentations, and training events and for future training purposes;
- to publicize Firm events and activities, including on our website, as part of future event invitations, via social media, and within recruitment publications; and
- to satisfy any legal, regulatory, accounting, accreditation, or reporting requirements.
We will process personal data if and to the extent applicable law provides a lawful basis for us to do so, and in particular where the processing is necessary:
- to perform the contract we have entered into with a data subject or in order to take steps at the data subject’s request prior to entering into a contract;
- to comply with a legal obligation to which we are subject; or
- for our (or a third party’s) legitimate interests which are not overridden by the data subjects’ interests or fundamental rights and freedoms. Such legitimate interests include the provision of legal services by us, administrative or operational processes within Cleary Gottlieb, direct marketing, the safety and security of our staff, visitors, property, and premises, and promotion of the Firm and Firm events.
Additionally, we may process personal data for a specific purpose where we have obtained the data subject’s consent.
Where we process special category data, such as data relating to race, sexual orientation, religion and health, we will do so on the basis that we have obtained the data subject’s explicit consent or the processing is necessary for the establishment, exercise or defence of legal claims.
Who Personal Data May Be Shared With
We do not sell personal data to third parties nor have we done so in the preceding 12 months.
Please note, however, that in order to process a query, deliver legal services, or fulfill any of the purposes set out above, personal data may have to be shared among different entities within the Firm around the world. Access to your personal data may therefore be available, in various offices of the Firm, to Firm employees (including our lawyers as well as our professional staff) if required for the purposes listed above.
Additionally, we may need to disclose, and in the preceding 12 months may have disclosed, your personal data (including identifiers, internet or other electronic network activity, and commercial information you have communicated or provided to us) for a business purpose, with third party service providers with which we work. Such third party service providers may include:
- word processing;
- accountants, management and tax consultants, intermediaries with public authorities;
- credit institutions;
- regulatory bodies and law enforcement agencies;
- information technology and telecommunications providers;
- local or specialist legal counsel; or
- legal counsel appointed by a counter-party in a legal matter.
We may also disclose, and in the preceding 12 months may have disclosed, your personal data (including identifiers and commercial information) for business purposes as described above under “Lawful Basis” and according to your general instructions, with your other advisors, your counter-parties and their legal representatives and, generally, all those individuals to whom transmission is required for one of the purposes described above.
In addition, we may share your personal data with persons or entities outside of Cleary Gottlieb for the purposes of obtaining feedback or references in relation to client services provided to you. For example, we may share your corporate contact details with legal directories for the purpose of obtaining a reference in relation to client services provided to you. Where appropriate, we will confirm with you that you are willing to be contacted for this purpose.
Consequences Of Failure To Provide Your Personal Data
Your provision of personal data to us (including personal data of third parties) is voluntary, and refusal to provide personal data will not result in denial or change in the price or quality of our services. However, any refusal on your part to provide any such data could prevent us, depending upon the circumstances, from providing certain services to you.
How Long Personal Data Is Retained For
We will retain your personal data for as long as necessary to fulfill the purposes for which it was collected and used in compliance with this Privacy Statement. To determine the retention period for personal data, we will take into consideration the purposes for which it was collected, as well as the nature and sensitivity of the information and the applicable legal requirements. We conduct periodic reviews of the data we retain and will safely delete data to the extent we no longer need to retain it.
CCTV images will be retained long enough for any incident to come to light (e.g., for a theft to be noticed) and for such incident to be investigated, after which CCTV images will be securely erased.
During the retention of your personal data, we take technical and organizational security measures to protect your data from accidental or intentional manipulation, partial or complete loss, destruction or unauthorized access by third parties. Our security measures are continuously improved in line with technological developments. Additional information about our security measures is available on request.
Whether Personal Data Is Transferred Internationally
The Firm operates on a worldwide integrated basis and we may need to transfer your personal data to other offices in the Firm. This may include the transfer of personal data from a location within the European Economic Area (the “EEA”) or UK to outside the EEA or UK. For a complete list of the Firm’s offices, please see the Firm’s website in the “Locations” section.
We may also need to transfer your personal data to a third party service provider in another jurisdiction. For example, our word processing provider is located in the U.S.
Transfers from the EEA or UK to jurisdictions outside of the EEA or UK which are not considered to have adequate personal data protections by the European Commission or UK Government as appropriate are governed by contractual arrangements which incorporate the European Commission’s standard contractual clauses. You can request a copy of these clauses by contacting us at the following e-mail address: firstname.lastname@example.org.
- Access: you may contact us at any time to request access to your personal data, and we will confirm to you whether we are processing your personal data and for what purposes, as well as provide details of the categories of personal data concerned, the specific pieces of data concerned, the recipients of the personal data, the retention periods (where possible) and your rights.
- Rectification: if any of your personal data that we hold appears to be inaccurate or incomplete, you may ask us to correct or complete it at any time.
- Erasure: you may ask us to have your personal data erased if it is no longer necessary for us to keep it in connection with the purposes for which it was collected or if the processing/storing of such personal data is otherwise unlawful. However, we must keep track of certain information in order to comply with legal obligations, and/or to handle any claims or litigation.
- Restriction: you may ask us to limit the way in which we process your personal data (i.e., require us to continue to store your personal data but not to process it without your consent), for example where you think the personal data we hold is inaccurate, for a period enabling us to verify the accuracy of personal data, or where you have objected to our processing.
- Objection: you may object to our processing of your personal data on grounds relating to your specific situation, where we are processing your personal data to pursue our legitimate interests.
- Portability: you may ask us to send you your personal data in an electronic, structured, commonly-used and machine-readable format and have your personal data transmitted directly from us to another data controller, where technically feasible without hindrance where the processing is carried out by automated means and is based on your consent or is necessary for the performance of a contract to which you are party.
Withdrawal of your consent: you may withdraw your consent at any time, where the processing is based on your consent. Withdrawal of consent does not affect the lawfulness of processing based on consent before it was withdrawn.
You also have the right to contact us at any time if you wish to complain about our processing of your personal data and you may lodge a complaint at any time with the relevant supervisory authority.
No discrimination: you have the right not to receive discriminatory treatment by us for the exercise of your privacy rights.
Furthermore, you have the right to have us remove you from our marketing distribution lists at any time. If you currently receive marketing information from us that you would prefer not to receive in the future, please e-mail us at: email@example.com.
When contacting us in connection with any of your rights (describe above), you may need to provide sufficient identifying information, before your request can be processed. This information may include your name, address, birth date or other means of identification as appropriate in each case. We may limit or deny access to personal data where permitted by law.
Automated Individual Decision-Making, Including Profiling
Your personal data are not subject to any decisional process based solely on automated processing, including profiling.
Changes To The Privacy Statement
Any changes we make to this Privacy Statement in the future will be posted on this page. Please check back periodically to see any updates or changes to our Privacy Statement.