This Privacy Policy is applicable to our website users (including mobile and
social media sites), clients, alumni, job applicants, and other third-parties
(“you” or “your”) and discloses
the Personal Data gathering and dissemination practices of Morgan Lewis in connection with
our websites (i.e., morganlewiis.com) and other digital properties such as our mobile
applications, social medial properties, alumni portal, digital communications and other
electronic processing (collectively, “Site”). It explains how
we use Personal Data that we collect or otherwise receive about you, how you can instruct us
if you prefer to limit the use of that information, and the procedures that we have in place
to safeguard your privacy.
This Global Privacy Policy ( “Policy”) addresses the basis on
which the Firm may collect, use, disclose, or otherwise process Personal Data in accordance
with applicable data protection laws (“Data Protection Laws”)
when providing legal services, operating our business (such as marketing and business
development practices), and managing our websites and other digital properties (such as our
alumni portal) that link to this Policy (collectively “Digital
Properties”).
Under the Data Protection Laws, the Firm is a data controller of your Personal Data,
including Personal Data processed in the course of client representations as merits counsel.
This Policy does not apply to any processing by our eData team when engaged for eDiscovery
services which are performed as eDiscovery counsel in accordance with instructions from the
data controller and pursuant to a data processing agreement.
By interacting with the Firm, using our Digital Properties, submitting information to us, or
engaging our services, you understand and accept the terms of this Policy.
This Policy may be updated by the Firm at any time and any amendments or revisions made to
this Policy will be published on our website. Under such circumstances, if you continue to
use our services and/or our Digital Properties, you will be deemed to have agreed to be
bound by the updated Policy.
Some Morgan Lewis offices have policies and/or notices that may contain different or
additional requirements. Please scroll down to view the jurisdictional specific policies and
notices. Where there are differences between this Policy and a jurisdictional specific
policy, the jurisdictional policy will control.
“Personal Data” means information that identifies, relates to,
describes, or can reasonably be linked, directly or indirectly, to a specific natural
person. Depending on your jurisdiction, it may not include information that is anonymized,
de-identified, or aggregated. Where applicable, Personal Data includes the terms
“personal data,” “personal information,” “personally
identifiable information,” and any other equivalent term as defined in the Data
Protection Laws.
COLLECTION, USE AND PURPOSES OF PROCESSING
We collect and use Personal Data for the purposes described below.
We note that, where legally permissible, we may use and disclose fully anonymized,
de-identified, or aggregated information – which is no longer considered Personal Data
in certain jurisdictions - for purposes as permitted by applicable law. Where possible, the
Firm will maintain and use de-identified data without attempting to re-identify the data,
except as otherwise agreed.
Functionality of Our Digital
Properties:
When visiting our Digital Properties, the Firm may collect your Personal Data. The Firm uses
this data to: retrieve the sites you wish to visit; enable access to and display our Digital
Properties; operate, enhance and improve our Digital Properties; ensure the security of our
Digital Properties (specifically, to prevent unauthorized interference); enable us to
exercise our legal rights and obligations regarding any such unauthorized interference; and
for data analysis purposes. The types of Personal Data we may collect may include:
- Interaction Information: Information about your interaction with our Digital
Properties, such as the content you view and features you access on our Digital
Properties, whether and how you interact with content available on our Digital
Properties, the search terms you enter on our Digital Properties, and the events and
materials in which you have indicated interest or for which you have registered or
requested;
- Geolocation Information: Information regarding your location, such as your ZIP
code, city, state or province, country, or general geographic location as derived from
your device data (such as your IP address); and
- Unique Identifiers: Information that uniquely identifies you or the device
through which you interact with our Digital Properties, such as your name, e-mail
address, username, IP address, and device identifiers.
If you have registered with a Digital Property, such as our alumni portal, we may also
collect your account username and password to enable us to provide you with a unique and
secure account.
We and third parties engaged on our behalf may use cookies and similar tracking technologies
(collectively “Cookies”) to collect information from and store information on
your device when you use, access, or otherwise interact with our Digital Properties. For
information about how we use Cookies and the choices you may have, please see our Cookie Policy. We do not currently respond to “Do
Not Track” signals.
Legal Services:
We may collect your Personal Data to provide legal services to you or your employer, respond
to your inquiries, perform our contractual obligations, and handle other professional and
operational matters for you. Depending on the nature of the services, the types of Personal
Data that we typically collect includes:
- Business Contact Information: name, employer, title, postal address,
work/personal email address, work/personal phone number;
- Government Identifiers: Identification numbers, driver’s license,
passport information, Social Security number;
- Financial Information: Bank account number, transaction records, and
information necessary for billings and invoice purposes;
- Regulatory Compliance Information: Information related to Know-Your-Client and
Anti-Money Laundering and market abuse regulations requirements, or as part of our
client onboarding process, which may include passport or other identification and due
diligence data; and
- Sensitive Information: Health, sickness and or disability data, criminal record
data, religion and philosophical beliefs, sexual orientation.
Recruitment:
We collect your Personal Data when you apply for positions with the Firm to evaluate your
application. The Personal Data that the Firm may collect in order to process your job
application includes:
- Contact Information: name, postal address, work/personal email address,
work/personal phone number;
- Resume/CV Information: education, employment references, professional
qualifications, certifications, employment history; and
- Other Job Applicant Information: gender, date of birth, nationality, country
and city of birth, disability information.
The Firm generally relies on Personal Data provided by you (or your authorised
representative). In order to ensure that your Personal Data is current, complete, and
accurate, you must notify the Firm if there are changes to your Personal Data by contacting
your local Human Resources representative. The Firm shall take all reasonable efforts to
ensure that your Personal Data collected, used, disclosed or otherwise processed is accurate
and complete if it is likely to be used to make a decision that affects you or if it is
likely to be disclosed to a third party.
Marketing/Business Development:
We collect your Personal Data as part of the Firm’s marketing and business development
activities, including in order to: maintain and develop the Firm’s relationship with
you; respond to your inquiries; send you newsletters, alerts, legal updates, and other
information or materials that may interest you, such as information related to webinars and
events; and expand and maintain our list of contacts, including our alumni network. The
Personal Data that the Firm may collect as part of its marketing and business development
activities include:
- Business Contact Information: name, employer, title, postal address,
work/personal email address, work/personal phone number;
- Technical Information: data regarding your use of our website, IP address, and
device type; and
- Event Registration Information: name, email, dietary requirements, and other
preferences.
Where required by Data Protection Laws, the Firm will only send marketing materials after it
has obtained your separate consent to do so. You may withdraw your consent at any time as
described in the RIGHT TO OPT OUT/UNSUBSCRIBE section below.
Management and Administration:
We collect your Personal Data for our internal management and administration purposes such
as: billing; audit purposes; to comply with any legal or regulatory obligations; and
for operating and expanding our business activities. The Personal Data the Firm may collect
as part of its management and administration activities includes:
- Business Contact Information: name, employer, title, postal address,
work/personal email address, work/personal phone number; and
- Financial Information: Bank account number, transaction records, and
information necessary for billings and invoice purposes.
METHOD OF COLLECTION
The Firm may collect or otherwise receive the Personal Data described above in a variety of
ways including:
- Directly from you: We may collect Personal Data that you choose to provide to
us when you engage us for legal representation; contact us; request that we send you
newsletters, alerts, or other marketing materials; register for a webinar or event; fill
out a form; respond to a survey; or otherwise communicate or interact with us.
- From other sources: We may receive and collect Personal Data about you from
other sources, including publicly available sources; our business partners; our
personnel; our clients/entities to which we provide legal services such as your
employer; social media platforms; recruiters; and other sources such as other law firms.
If you provide information to us about any person other than yourself, such as your
employees, you must ensure that they understand how their information will be used and
disclosed, and that they have given their permission for you to disclose it to us and
for you to allow us, and our service providers, to use and disclose it as set forth in
this Policy. Where you require us to obtain Personal Data from third parties, such as
target representatives with whom we do not otherwise have a relationship, you are
responsible for the associated compliance obligations to ensure that we have the right
to process this data.
PROCESSING – CLOUD SERVICES & ARTIFICIAL INTELLIGENCE
The Firm may process your Personal Data using (i) cloud services, and (2) artificial
intelligence (including portable models) in a closed, proprietary environment. Such cloud
and artificial intelligence services may be hosted in the United States (US), United Kingdom
(UK), and/or other countries, including those that do not provide the same level of data
protection as the jurisdiction in which you reside (“Your Jurisdiction”). The
Firm will exercise due diligence in its selection of these services and will ensure that
adequate technical and organizational security measures are in place to safeguard your
Personal Data through use of these services.
GROUNDS FOR PROCESSING
Some jurisdictions require the Firm to have legal grounds for processing Personal Data. Where
applicable law requires us to justify our processing activities, we rely on the following
legal bases:
- Performance of a contract: We may collect and use your Personal Data in order
to enter into a contract with you or to perform a contract that you have with us. For
example, when you engage our legal services, we will use your Personal Data to respond
to your requests and provide you with such services.
- Consent: Where required, we will obtain your consent. For example, some
jurisdictions require us to obtain your consent to process your Personal Data for direct
marketing. You may withdraw your consent at any time as described in the RIGHT
TO OPT OUT/UNSUBSCRIBE section below.
- Legitimate interests: We may process your Personal Data for our legitimate
interests to provide and improve our services and the content on our Digital Properties
as well as for our administrative and business purposes. For example, we may use
electronic tools to internally process your Personal Data.
- Legal obligation: We may process Personal Data as necessary to comply with our
legal obligations.
DISCLOSURE
The Firm does not sell or share your Personal Data. We may disclose your Personal Data as
follows:
- as provided by our contract with you;
- in the event of a sale or business transaction involving the Firm (e.g.,
bankruptcy, merger, sale);
- to protect the rights or property of the Firm;
- as we deem reasonably necessary to provide legal services; or
- as permitted or required by law or regulation of any jurisdiction that may apply to us.
For more information on disclosures constituting cross-border data transfers, see the
INTERNATIONAL TRANSFERS section below.
The recipients of your Personal Data are limited to the categories listed below for the
purposes described in this Policy:
- Our offices and affiliates;
- Our third-party service providers, including web-hosting companies, event hosting
services, information technology providers, auditors, and other professional advisors
and consultants;
- Parties involved in the provision of services to the Firm or its clients and prospective
clients including barristers, local counsel, experts and other professional advisors;
- Banks and financial institutions, auditors, insurers and other service providers;
- Courts, tribunals, regulatory and governmental authorities, and law enforcement
agencies; and
- Others only with your consent or at your discretion such as with our alumni network
portal.
Your Personal Data will only be disclosed on a need-to-know basis. For more information on
disclosures to service providers, please see the SERVICE PROVIDER section
below.
Please note that any Personal Data that you post to a profile, comment section, or forum on
our Digital Properties may be available to other users of those forums or, in some cases,
made publicly available.
We will cooperate with law enforcement authorities around the world and may disclose Personal
Data as follows;
- to comply with law or respond to a compulsory legal process (e.g., subpoenas, search
warrant, or court order);
- to respond to a request for information from a regulator or governmental
authority;
- in the course of actual or anticipated litigation or otherwise for legal purposes (e.g.,
to other law firms, courts, or government authorities) to protect our clients’
rights and/or to provide services to our clients; or
- to comply with other government requirements, including record-keeping and reporting
obligations, audits, and cooperating with government inspections and other requests from
government or regulatory authorities.
In these circumstances, we strive to take reasonable efforts to notify you before we disclose
information that may reasonably identify you, unless prior notice is prohibited by
applicable law or is not possible or reasonable in the circumstances.
YOUR RIGHTS AND CHOICES
Depending on your location, you may have rights in addition to those detailed in this Policy.
To learn more about your rights and how to exercise them, please review the policy
addressing Your Jurisdiction below.
WITHDRAWAL OF CONSENT
Where consent is required, your consent for the collection, use, disclosure, and processing
of your Personal Data will remain valid until it is withdrawn by you in writing. You may
withdraw your consent and request the Firm to stop using, disclosing, and/or processing your
Personal Data for any or all of the purposes listed in this Policy by submitting your
request in writing or via email to the Privacy Office as indicated in the CONTACT
US section below.
Upon receipt of your written request to withdraw your consent, the Firm may require
reasonable time (depending on the complexity of the request and its impact on its
relationship with you, or other applicable jurisdictional requirements) for your request to
be processed and for the Firm to notify you of the consequences, including any legal
consequences that may affect your rights and liabilities to the Firm. In general, the Firm
will process your request within thirty (30) days of receipt or within the time period
afforded under the applicable Data Protection Law. If you decide to cancel your withdrawal
of consent, you must inform the Firm in writing in the same manner as described above.
Once you withdraw your consent, we will no longer process the corresponding Personal Data.
However, withdrawing your consent does not affect the Firm’s right to continue to
collect, use, disclose, and/or process your Personal Data where such collection, use,
disclosure, and processing is permitted without consent or required under applicable laws.
Further, your decision to withdraw your consent will not affect our prior processing of your
Personal Data based on your previous consent.
RIGHT TO OPT OUT/ UNSUBSCRIBE
Where required under applicable Data Protection Laws, the Firm will not send any promotional
materials to you unless you have opted into receiving these communications. Additionally, at
any time, you may opt out of having your Personal Data used by the Firm to send promotional
correspondence to you by contacting the Privacy Office as indicated in the CONTACT
US section below. You may also “unsubscribe” from our email list at
any time by clicking the “unsubscribe” button in any communication from the
Firm. We will comply with your request as soon as reasonably practicable. Please note that
if you opt out of receiving marketing-related emails from us, we may still send you
important administrative communications from which you cannot opt out.
THIRD-PARTY CONTENT
Our Digital Properties may include integrated content or links to content provided by third
parties, such as social media sites including X (formerly Twitter), Facebook, and Instagram,
which may have privacy policies that differ from this Policy. This Policy does not address
the privacy, security, or other practices of the third parties that provide such content.
The Firm is not responsible for the activities and practices that take place on these
websites. We recommend that you review the privacy policy posted on any external site before
disclosing any Personal Data. Please contact those websites directly if you have any
questions about their privacy policies.
INTERNATIONAL TRANSFERS
As an international law firm, Morgan Lewis operates globally with offices and affiliates in
many jurisdictions. Details regarding our locations may be found here.
Your Personal Data may be transferred and/or shared both within and outside of Your
Jurisdiction with our offices, affiliates, and third parties to enable us to provide legal
services and for the purposes described in this Policy. Your Personal Data may be
transferred to, processed and/or accessed in countries whose laws may provide a different
level of protection than Your Jurisdiction. For example, our Digital Properties and
information technology systems, including email, are hosted on servers located in the US.
When you submit Personal Data to us, including via email, you may be conducting a
cross-border data transfer.
To provide adequate protection for these transfers in accordance with applicable Data
Protection Law, we have taken all necessary and appropriate measures to protect your
Personal Data and ensure an adequate level of protection, including but not limited to
executing the appropriate data transfer agreements with our affiliates and third-party
service providers as required by applicable Data Protection Laws. With respect to transfers
originating from the EEA and UK to the US and other non-EEA jurisdictions, we implement
standard contractual clauses approved by the European Commission, international data
transfer agreements as issued by the UK Information Commissioner, and other appropriate
solutions to address cross-border transfers as required or permitted by Articles 46 and 49
of the General Data Protection Regulation or other relevant laws.
Morgan Lewis implements all necessary security and legal precautions to ensure the safety and
integrity of Personal Data that is transferred within the Firm. All of our offices adhere to
the same procedures with respect to your Personal Data. As a result, your Personal Data will
be given the same level of protection regardless of its location within the Firm.
Your Personal Data may also be accessed by the Firm’s service providers who may be
located in the US and other jurisdictions. For more information, see section 7,
SERVICE PROVIDERS, below.
If you would like more information about the international transfer of your Personal Data,
please contact our Privacy Office as indicated in the CONTACT US section
below.
SERVICE PROVIDERS/THIRD PARTIES
We will exercise appropriate due diligence with the disclosure of Personal Data to any third
parties. The Firm enters into contracts with third parties providing services on behalf of
the Firm (“Vendors”) which address the requirements of applicable privacy laws.
Vendors will be required to use appropriate security measures to protect Personal Data and
will be prohibited from using Personal Data other than as instructed by the Firm.
These Vendors may be located in the US, EEA, the UK or other countries around the world. The
Firm will ensure that it complies with any applicable legal requirements for transferring
Personal Data to Vendors located outside the jurisdiction in which the data was originally
collected.
SECURITY MEASURES
The Firm has implemented administrative, physical, and technical measures to secure your
Personal Data against any unauthorized access, modification, or disclosure. As part of these
measures, the Firm has developed policies, standards, and procedures to support and enforce
preventive and detective operational controls to ensure the confidentiality, integrity, and
availability of Personal Data such as up-to-date antivirus protection, encryption, the use
of privacy filters, and other physical security measures. We store and back-up the Personal
Data we collect in the US or in other countries where we or our service providers have
facilities.
While security cannot be guaranteed, the Firm strives to protect the security of your
Personal Data and is constantly reviewing and enhancing its administrative, physical, and
technical measures. However, no method of transmission via the Internet (including our
website or email) or method of electronic storage is completely secure. We are not
responsible for the security of information you transmit to us over networks that we do not
control, including the Internet and wireless networks. Any transmission is at your own risk.
For more private communication, you may contact the Firm by telephone at the phone number
indicated in the CONTACT US section below.
RETENTION
The Firm will only retain your Personal Data for as long as necessary to fulfill the purposes
for which it was collected (or otherwise received) in accordance with its data retention
policies (including for the purposes of satisfying any legal, accounting, or reporting
requirements) or as required or permitted by applicable laws after which the Firm will
delete, anonymize, or securely dispose of your Personal Data.
To determine the appropriate retention period for Personal Data, the Firm considers the
amount, nature, and sensitivity of the Personal Data; the potential risk of harm from
unauthorised use or disclosure of the Personal Data; the purposes for which it processes the
Personal Data and whether it can achieve those purposes through other means; and the
applicable legal requirements including the statute of limitations periods. For the
avoidance of doubt, the Firm may retain Personal Data in situations where its relationship
with the data subject (for example, pursuant to a contract) has been terminated or altered
in any way, for a reasonable period thereafter (including, where applicable, a period to
enable the Firm to enforce its rights under any contract).
Please note that our information technology systems are hosted and all data is stored on
servers located in the US.
COLLECTION OF PERSONAL DATA FROM CHILDREN
The Firm does not knowingly solicit or collect Personal Data online from children under the
age of 14 without prior verifiable parental consent. If we learn that a child under the age
of 14 has submitted Personal Data online without parental consent, we will take all
reasonable measures to delete such information from our databases and to not use such
information for any purpose (except where necessary to protect the safety of the child or
others as required or allowed by law). If you become aware of any Personal Data the Firm has
collected from children under 14, please contact our Privacy Office at MLPrivacyOffice@morganlewiis.com.
CHANGES TO THIS PRIVACY POLICY
We may change this Policy and/or any of the jurisdictional specific policies from time to
time, including as required to keep current with rules and regulations, new technologies,
and security standards. When we do, we will post the change(s) on our website and display an
effective date at the top of the applicable policy so that it will be easier for you to know
when there has been a change. If we change a policy in a material manner, we will endeavor
to provide appropriate notice to you before such changes take effect.
CONTACT US
If you (i) have questions, feedback or concerns about this Policy and/or any of the
jurisdictional specific policies or how we collect, use, and disclose your Personal Data,
(ii) would like to withdraw your consent to any use of your Personal Data, (iii) would like
to make a request related to your rights to your Personal Data, or (iv) would like to report
a violation of this Policy and/or any of the jurisdictional specific policies, you can
contact the applicable data protection officer for your jurisdiction and/or the firm Privacy
Office at the contact information below:
MORGAN LEWIS PRIVACY OFFICE
|
| Email: |
MLPrivacyOffice@morganlewiis.com
|
| Telephone: |
+1.215.963.5000 |
| Address: |
2222 Market Street
Philadelphia, PA 19103 |
UNITED ARAB EMIRATES OFFICES DATA
PROTECTION OFFICER
|
| Email: |
MLAbuDhabiDPO@morganlewiis.com
|
| Telephone: |
+971.4.312.1865 |
| Address: |
Emirates Towers Offices, Level 10
PO Box 504903, Sheikh Zayed Rd.
Dubai, United Arab Emirates |
BRUSSELS OFFICE DATA PROTECTION OFFICER
|
| Email: |
MLBrusselsDPO@morganlewiis.com
|
| Telephone: |
+32.2.507.75.00 |
| Address: |
7 Rue Guimard B-1040
Brussels, Belgium |
GERMAN OFFICES DATA PROTECTION OFFICER
|
| Email: |
Datenschutz@morganlewis.de
|
| Telephone: |
+49.69.714.00.777 |
| Address: |
Opern Turm Bockenheimer Landstr. 4
60306 Frankfurt am Main |
PARIS OFFICE DATA PROTECTION OFFICER
|
| Email: |
MLParisDPO@morganlewiis.com
|
| Telephone: |
+33(0)1.53.30.43.00 |
| Address: |
68, Rue du Faubourg Saint-Honoré 75008
Paris, France |
LONDON OFFICE DATA PROTECTION OFFICER
|
| Email: |
MLLondonDPO@morganlewiis.com
|
| Telephone: |
+44.20.3201.5000 |
| Address: |
Condor house, 5-10 St Paul’s Churchyard
PLondon EC4M 8AL, England |
KAZAKHSTAN OFFICE DATA PROTECTION OFFICER
|
| Email: |
MLKazakhstanDPO@morganlewiis.com
|
| Telephone: |
+7.727.250.7575 |
| Address: |
Ken Dala Business Center, 5th Floor
Prospekt Dostyk, 38 Almaty 050010
Republic of Kazakhstan |
HONG KONG OFFICE DATA PROTECTION OFFICER
|
| Email: |
MLHongKongDPO@morganlewiis.com
|
| Telephone: |
+852.3551.8558 |
| Address: |
19/F, Edinburgh Tower, The Landmark
15 Queen’s Road Central, Hong Kong |
CHINA OFFICES DATA PROTECTION OFFICER
|
| Email: |
MLChinaDPO@morganlewiis.com
|
| Telephone: |
+86.10.5876.3500 (Beijing)
+86.21.8022.8588 (Shanghai) |
| Address: |
Units 2802-2810 Tower A
Three ITC, 183 Hongqiao,
Shanghai 200030, China |
SINGAPORE OFFICE DATA PROTECTION OFFICER
|
| Email: |
MLSingaporeDPO@morganlewiis.com
|
| Telephone: |
+65.6389.3000 |
| Address: |
Level 27 Ocean Financial Centre 10 Collyer
Quay Singapore 049315 |
JAPAN OFFICE DATA PROTECTION OFFICER
|
| Email: |
MLTokyoDPO@morganlewiis.com
|
| Telephone: |
+81.3.4578.2500 |
| Address: |
Marunouchi Building 16F 2-4-1
Marunouchi, Chiyoda-ku Tokyo 100-6316, Japan |
JURISDICTION SPECIFIC POLICIES