Davis Polk Privacy Notice

Davis Polk & Wardwell LLP and associated entities that are authorized to carry the name Davis Polk (together, “Davis Polk”, “we”, “our” or “us”) (a link to all Davis Polk offices is available at https://www.davispolk.com/offices) are committed to protecting your privacy and that of your business and employees, while providing you with the opportunity to receive our services. Davis Polk may collect information relating to you as an individual (including certain sensitive personal information, where permitted by law) (your “personal information”). See “Data controllers” below for more information on the entities that control and process your personal information.

This privacy notice (the “Privacy Notice”) describes the ways in which we collect information from you, including specifically when you use our website (the “Website”), and what we may use it for. This Privacy Notice also applies to our collection and use of information in the normal course of business. This Privacy Notice is at all times subject to any applicable requirements of local law and regulation.

This Privacy Notice describes:

• What personal information we collect about you
• How we obtain your personal information
• How we use your personal information
• On what basis we use your personal information
• How long we keep your personal information
• Who we share your personal information with
• How we protect your personal information
• Which countries we transfer your personal information to
• Your rights regarding your personal information

Contact 

If you have any questions or comments regarding this Privacy Notice or the processing of your personal information by Davis Polk, please contact privacy.team@davispolk.com.

What personal information do we collect about you?

We may collect personal information from you in the course of our business, including through your use of our website, by our use of cookies, when you contact or request information from us, when you engage our legal or other services or as a result of your relationship with one or more of our staff and clients. Much of that data comprises business information, but some of that data may inevitably comprise your personal information. The personal information we may collect and use includes:

• name and contact details (including addresses, telephone numbers, email addresses, titles and other business information);
• logs of emails and internet use, including your use of the Website;
• financial information, such as payment-related information;
• technical information, such as information from your visits to our website or applications or in relation to materials and communications we send to you electronically;
• information you provide to us for the purposes of attending meetings and events, including access and dietary requirements;
• identification and background information provided by you or collected as part of our business acceptance processes;
• personal information provided to us by or on behalf of our clients or generated by us in the course or providing services to them, which may include special categories of data;
• information submitted through our career or alumni websites or our other digital platforms or applications; and
• any other information relating to you which may be provided to us.

How we obtain your personal information 

We collect information or data from you in various ways, including:

• during the course of your use of the Website (this will include any and all material you send or submit either to the Website or to any email address provided on the Website);
• by our use of “cookies” (see “Use of cookies”);
• information which you provide to us and when we request further information from you from time to time;
• as part of our business acceptance processes and about you and others as necessary in the course of providing legal services;
• while monitoring our technology tools and services, including our websites and email communications sent to and from Davis Polk;
• when monitoring our technology tools and services, including our websites and email communications sent to and from Davis Polk;
• when you provide it to us, or interact with us directly, for instance engaging with our staff or registering on one of our digital platforms or applications;
• from providers of compliance-related information or credit-related information; and
• from other sources, such as keeping the contact details we already hold for you accurate and up to date using publicly available sources.

How we use your personal information 

We collect and use data collected from you (however collected), including any personal information, for the following legitimate business purposes of Davis Polk:

• administration and functionality of our Website, digital platforms and applications;
• to process your requests and answer your inquiries;
• the continuation of Davis Polk’s business and the provision of legal services;
• to fulfill the purpose for which you provided the information;
• provision of information regarding Davis Polk and our offices, and on our services, seminars and publications, our marketing information and all other information or materials offered by us;
• sending of newsletters, legal updates and all other information or materials offered by us;
• consolidation of information relating to our clients and vendors among Davis Polk offices;
• for our dedicated careers and alumni services; and
• matters incidental to the purposes of use set out above, where permitted by applicable local law and regulation.

Your personal information may also be used by Davis Polk for compliance with legal, regulatory and other good governance obligations, including responding to requests from legal or regulatory authorities (in any location where such authorities would have jurisdiction over Davis Polk), dispute resolution and pursuing our legal rights.

You may use the Website without providing us with your personal information. However, some features on the Website allow you to provide us voluntarily with personal information.  All practicable steps will be taken to ensure that you are informed at the time of asking for your personal information as to whether the provision/collection of the personal information (including sensitive personal information, subject to applicable local laws and regulations) is mandatory or voluntary. If the provision of your personal information is mandatory for a specified purpose, we will let you know that this is the case and inform you of the consequences of failure to provide such personal information.

Subscriptions to newsletters

In order to subscribe to a newsletter or view webcasts, the following information must be provided: first name; last name; email address; company name, title, city and country. If the required data is not supplied, the newsletter or webcast will not be made available to you.

Meetings, events and seminars

We will collect and process personal information about you in relation to your attendance at our offices or at an event or seminar organized by Davis Polk or its business partners. We will only process and use special categories of personal information about your dietary or access requirements in order to cater for your needs and to meet any other legal or regulatory obligations we may have. We may share your information with IT and other service providers or business partners involved in organizing or hosting the relevant event.

Legal and other services

We collect, create, hold and use personal information in the course of and in connection with the services we provide to our clients. We will process identification and background information as part of our business acceptance, finance, administration and marketing processes, including anti-money laundering, conflict, reputational and financial checks. We will also process personal information provided to us by or on behalf of our clients for the purposes of the work we do for them. The information may be disclosed to third parties to the extent we think it is reasonably necessary in connection with that work. Please also see “Who we share your personal information with” and “Which countries we transfer your personal information to” below.

Marketing and related communications

If you have already registered to receive any materials from us, we may use your personal information in order to send you in electronic or paper form marketing and other materials relating to Davis Polk, our products and services and to update records held by us. If you are not already registered to receive marketing information from us and wish to do so please click this link.

You may withdraw your consent to the receipt of marketing materials at any time and free of charge by clicking on the “unsubscribe” link in the email, or by sending an e-mail to client.communications@davispolk.com.

Recruitment

If you submit personal information to us via the Careers section of the Website or to an e-mail address specified in the Careers section for applying for a position at Davis Polk, we will process such personal information solely for the purposes of considering applications and recruitment, not for marketing purposes. If you commence work for Davis Polk, your personal information will be processed according to the terms of Davis Polk’s Employee Privacy Notice.

Business re-organization

Davis Polk may in the future re-organize or transfer all or part of its business which may result in the transfer of your personal information to new entities (which will be subsidiaries or affiliates of Davis Polk) or third parties through which the whole or part of the business of Davis Polk will be carried out. If Davis Polk ceases to trade, or becomes insolvent, enters into receivership or any similar or equivalent event occurs,  those acting on behalf of Davis Polk may sell the business or parts of it to a third party, in fulfilment of legal or business requirements. This may result in the transfer of your personal information to a third  party through which the business or parts of it will be carried out.

On what basis we use your personal information

We use your personal information on the following bases:

• to perform a contract, such as engaging with an individual to provide legal or other services;
• for the establishment, exercise or defense of legal claims or proceedings;
• to comply with legal and regulatory obligations; and
• for legitimate business purposes. Please see “How we use your personal information” for more details.

How long we keep your personal information 

Davis Polk endeavors to ensure that personal information is kept up-to-date and that irrelevant, excessive or out-of-date personal information is updated or deleted. To determine the appropriate retention period for your personal information, we will consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process the personal information and whether we can achieve such purposes through other means, the applicable legal and regulatory requirements (including requirements to retain the personal information for a minimum period), limitation periods for taking legal action, good practice and Davis Polk’s business purposes.

Who we share your personal information with

Transfers of data to other Davis Polk offices and to third parties

We are an international law firm, and we may disclose and transfer data, including your personal information, relating to you to other Davis Polk offices or entities (a link to all Davis Polk offices is available at https://www.davispolk.com/offices) and all Davis Polk offices or entities may hold, process, use, disclose and transfer to other Davis Polk offices such personal information for purposes set out in this Privacy Notice. The Davis Polk office which collects such personal information is the responsible party to administer and manage such personal information.

Personal information may be shared with other non-affiliated third parties, including:

• service providers which perform certain services on behalf of Davis Polk, pursuant to our direction, or as directed or consented to by you, including providers of word processing, translation, photocopying and document review;
• third parties engaged in the course of the services we provide to clients, such as barristers, local counsel and technology service providers like data room and case management services;
• third parties involved in hosting events or seminars;
• auditors and professional advisors; and
• regulatory authorities, courts and tribunals, government agencies and law enforcement agencies (such as the police).

Davis Polk may use social media sites such as Facebook, LinkedIn and Twitter. If you use these services, you should review their privacy policies for more information on how they deal with your personal information.

We will not sell, rent, distribute or otherwise make personal information commercially available to any third party except with your prior permission.

How we protect your personal information

We use a variety of technical and organizational measures to help protect your personal information from unauthorized access, use, disclosure, alteration or destruction consistent with applicable data protection laws.

Davis Polk & Wardwell LLP holds the internationally recognized security standard BS ISO/IEC 27001:2013 in respect of its document management and email systems and the supporting infrastructure for Davis Polk’s offices globally. This is an independently verified certification that information security is managed in line with international best practice.

Which countries we transfer your personal information to

The Internet is a global environment and Davis Polk’s headquarters are in the United States of America. In order to provide our services, we may need to transfer personal information to locations outside the local jurisdiction in which you are viewing the Website and process personal information outside that jurisdiction for the purposes set out in this Privacy Notice.

International transfers between Davis Polk offices

The Davis Polk office or entity which collects such personal information is the responsible party to administer and manage such personal information although it may transfer personal information to other Davis Polk offices or entities for the purposes described above. Please note that personal information sent to us or submitted via the Website may therefore be controlled and processed by any of Davis Polk’s offices, some of which are outside your local jurisdiction and specifically outside the European Economic Area (the “EEA”) and United Kingdom. The location of our offices or entities may change from time to time and we may establish offices or entities in any number of countries or territories at any time, any one or more of which may act as controllers of, or processors of, such personal information. (A link to all current Davis Polk offices is available at https://www.davispolk.com/offices.)

Please be aware that the data protection and privacy laws in those jurisdictions may not provide for the same level of protection of your personal information as exists in your home country or in the EEA. To ensure a sufficient level of personal information protection, Davis Polk and our various offices and entities have entered into an agreement: (i) for transfers from the EEA,  incorporating the 4 June 2021 standard contractual clauses as published by the European Commission; and (ii) for transfers from the United Kingdom, incorporating the international data transfers addendum approved by the UK Information Commissioner in March 2022.

International transfers to third parties

In addition to transfers to other Davis Polk offices or entities, some of the third parties to whom we may transfer your personal information for the purposes described above may also be located in countries or territories which are outside your local jurisdiction and specifically outside the EEA and the United Kingdom. The data protection and privacy laws in those jurisdictions may not provide for the same level of protection of your personal information as exists in your home country or in the EEA. Where this is the case, Davis Polk will take reasonable measures to ensure that your personal information is treated securely and in accordance with the requirements of applicable data protection laws and regulations.

These measures include data transfer agreements: (i) for transfers from the EEA, incorporating the 4 June 2021 standard contractual clauses as published by the European Commission; or (ii) for transfers from the United Kingdom, incorporating the international data transfers addendum approved by the UK Information Commissioner in March 2022 (as for transfers to other Davis Polk offices and entities). You can request a copy of any data transfer agreement we rely on to transfer your personal data internationally by emailing privacy.team@davispolk.com.

Before we transfer your personal data to a third country or territory, we will perform an assessment of the risks involved in transferring your personal data to that jurisdiction. Where necessary, we will implement additional safeguards on top of the transfer agreement to ensure the protection of your data to a level sufficiently similar to that offered in the EEA and United Kingdom. If we find that we cannot provide this level of protection even with these additional safeguards, we will not make the transfer.

Security of electronic communications

Please note that any electronic communication made between you and us, including via the Website, may not be secure and, unless you are already a client, may not be treated as privileged or confidential. While we welcome your enquiries, please do not send us any electronic communication that contains any confidential or sensitive personal information or data.

Your rights regarding your personal information

Subject to the provisions of local laws and regulations from time to time, you may be entitled:

• to object, on grounds relating to your particular situation and subject to certain conditions, to the processing of your personal information;
• to request confirmation as to whether Davis Polk has personal information relating to you;
• to access the personal information about you being processed by Davis Polk and to obtain certain information about the processing of that personal information;
• to require Davis Polk to rectify any inaccurate or incomplete personal information about you;
• to require Davis Polk to erase personal information about you in certain circumstances, subject to compliance with any applicable data retention obligation;
• to restrict Davis Polk from processing personal information about you in certain circumstances;
• to receive personal information relating to you in a format that can be processed by a device and the right to have personal information relating to you transferred to another data controller in certain circumstances;
• to stop unauthorized transfers of your personal information to a third party; and
• if you are subject to French data protection laws, to establish guidelines for the preservation, deletion and transmission of your personal information after your death.

Should you wish to discuss your entitlement to, or exercise of any such rights, please contact privacy.team@davispolk.com.

You may also have the right to lodge a complaint in relation to Davis Polk’s processing of your personal information with a local supervisory authority.

Data controllers

There are a number of entities through which Davis Polk provides legal services. Our main IT systems are located in the United States of America and controlled by Davis Polk & Wardwell LLP. Depending on the location where legal or other services are provided, another office or entity in the Davis Polk group may be the data controller in relation to your personal information. Please visit /disclaimer-notices for details of the Davis Polk entities through which we practice law in each jurisdiction.

Davis Polk supplemental notice of collection of personal information and privacy notice under the California Consumer Privacy Act (CCPA)

Effective: January 1, 2020

Last Updated: January 1, 2020

This Supplemental Notice of Collection Of Personal Information and Privacy Notice (the “CCPA Notice”) applies to the collection of personal information from California residents on and after January 1, 2020. The CCPA Notice supplements our “Privacy Notice” set forth above to provide California residents with information and rights required by the California Consumer Privacy Act (the “CCPA”).

The CCPA Notice describes the types and categories of personal information we collect, the business purposes for which we collect, use and share your personal information, with whom we share it, and your rights in personal information under the CCPA.

For purposes of this CCPA Notice, we refer to personal information according to the following definition given in the CCPA: “personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a California resident or household. Personal information does not include publicly available information, information that is de-identified or aggregate consumer information, or information or rights that are outside the scope of the CCPA. By accessing our website, using our services or submitting personal information to us, you consent to the collection, use and sharing of such information as set forth in this CCPA Notice, as it may be updated from time to time.

What categories of personal information do we collect about you?

We may collect personal information from you in the course of our business, including through your use of our website, by our use of cookies” when you contact or request information from us, when you engage our legal or other services or as a result of your relationship with one or more of our staff and clients. Much of that data comprises business information, but some of that data may inevitably comprise your personal information. The categories of personal information we may collect and use includes:

• Identifiers: this information may include name and contact details (including addresses, telephone numbers, email addresses, IP address, titles and other identifying information).
• Customer Information under California Civil Code §1798.80(e): this information comprises any information that identifies, relates to, describes or is capable of being associated with you in our records. Examples include financial, banking and payment-related information, your signature, identification and background information provided by you or collected as part of our business acceptance processes, including identifying numbers, personal information provided to us by or on behalf of our clients or generated by us in the course of providing legal services. Some personal information in this category may overlap with other categories.
• Characteristics of protected classifications under California or federal law: such as race, color, national origin, gender, citizenship, ethnicity, disability, sexual orientation, veteran or military status, religion, or marital status collected in the course of providing legal services to you.
• Commercial Information: information and records concerning the nature and type of legal services we provide to you as a client, including billing information.
• Internet and electronic history: logs of emails and internet use, including your use of the Website, technical information, such as information from your visits to our website or applications or in relation to materials and communications we send to you electronically.
• Professional or Employment Related Information: employment related and professional background information may be collected in connection with the legal services we provide to you as a client. In addition, we may use the professional or employment related information of job applicants, including information submitted through career websites or other digital platforms or applications, for purposes of considering suitability for employment.
• Education information: educational records and related information may be collected in connection with the services we provide to you as a client. We may also collect and use the educational information of job applicants for purposes of considering suitability for employment.
• Inferences drawn from information you provide to create a personal profile concerning your preferences, characteristics, behavior, abilities and aptitudes. We may accumulate the information you provide in the normal course of the legal services we provide to clients to make inferences concerning your preferences, characteristics, behavior, abilities and aptitudes. This may include information you provide to us for the purposes of obtaining legal advice and attending meetings and events, including access and dietary requirements. Similarly, we may develop and communicate marketing and other educational materials concerning our legal services based on information you provide (e.g., requests to subscribe to certain blogs).

In the past twelve (12) months, depending on the individual circumstances, we have collected the following categories of personal information: Identifiers, Customer Information under section 1798.80(e) of the California Civil Code, Protected Characteristics, Commercial Information, Internet History, Professional or Employment Related Information, Education Information, and Personal Profile. 

Our business reasons for collecting and using your personal information

Depending on the individual circumstances, we collect and use personal information collected from you (however collected), including any personal information, for the legitimate business purposes of Davis Polk as set forth above. See the sections: How We Use Your Personal Information, Subscriptions to newsletters, Meetings, events and seminars, Legal and other services, Marketing, Recruitment, Business re-organization, and Use of Cookies.

Who we share your personal information with

We will not sell, rent, distribute or otherwise make personal information commercially available to any third party except with your prior permission. Our data sharing practices are detailed above. See the section: Transfers of data to other Davis Polk offices and to third parties.

In the past twelve (12) months, depending on the individual circumstances, we have shared the following categories of personal information: Identifiers, Customer Information under section 1798.80(e) of the California Civil Code, Protected Characteristics, Commercial Information, Internet History, Professional or Employment Related Information, Education Information, and Personal Profile with the following categories of third parties: service providers and third party businesses.

Your rights regarding your personal information

Under the California Consumer Privacy Act, you have the following rights in personal information held by us:

• You have the right to request that we disclose the personal information we collect, use, disclose and share. You may request (i) the categories of personal information that we have collected about you;
• (ii) the categories of sources from which the personal information is collected; (iii) the business or commercial purpose for collecting or sharing personal information; (iv) the categories of third parties with whom we share your personal information; and (v) the specific pieces of personal information that we have collected about you.
• You have the right to receive your personal information in a portable format that allows you to transmit the information to another entity.
• You have the right to request deletion of personal information under certain circumstances. For example, we may not be required to delete personal information if we need to retain the information to complete the transaction for which the personal information was collected, perform on a contract with us, or to comply with a legal obligation.
• You have the right not to receive discriminatory treatment for the exercise of any of these rights. We will not discriminate against you because you have exercised your rights.

You may submit verifiable requests concerning any of your rights by contacting us by telephone (800-274- 3125) or email (privacy.team@davispolk.com). We will use reasonable methods for verifying that the person making a request to know, data portability or a request to delete is the individual about whom we have collected personal information. This may involve, depending on the nature of the request, confirming that the email address provided corresponds with our records concerning the individual. Additional reasonable measures may also be required to verify the identity of the person making the request depending on the circumstances. For online requests to delete, you will be required to submit the request to delete, and then separately confirm that you want your personal information deleted. To the extent that you wish to use an authorized agent to make requests concerning the rights set forth above, you will need to provide us either with a power of attorney or, alternatively, with written authorization to communicate with your authorized agent.

We will (i) confirm receipt of requests to know, data portability or to delete within 10 days of the request; and (ii) generally respond to requests to know, data portability or to delete within 45 days of the request. If we need additional time to respond to your request beyond the 45 days, we will provide you with notice explaining the reasons we need more time, and we will then take up to an additional 45 days to respond to your request.

Access by persons with disabilities

Persons with disabilities who need assistance accessing this CCPA Notice may contact us as provided for above, and depending on your individual needs, the company will grant reasonable requests to furnish this policy in an alternative format.

Children

We do not knowingly collect Personal Information from children under the age of 13.