Privacy Notice

Baker McKenzie Resource Hub Privacy Notice

This Privacy Notice ("Notice") is issued by the member firms and affiliates of Baker McKenzie International (the "Firm", "Baker McKenzie", "we", "our") in relation to the use of Resource Hub as a digital library of legal content for Participants (defined below) ("Resource Hub"). The Notice describes how the Firm will collect, use, share, and otherwise process Personal Data (defined below) about:

employees or personnel of the Firm ("Personnel");
clients of the Firm and any personnel of such clients using Resource Hub ("Clients");
upon written request of Clients, other parties ("Client Partners") (collectively, "you" or "Participants"); and
third parties referred to in comments, documents or other materials which you upload to Resource Hub, (collectively "Third Parties").

The controller of Personal Data processed on Resource Hub is the Baker McKenzie member firm or affiliate with whom you have a direct relationship for the provision of legal services. References to the "Firm", "Baker McKenzie", "we" and "our" shall be deemed to include the controller. The Firm uses affiliates, including our global services company Baker & McKenzie Global Services LLC, of 300 E. Randolph Dr., Suite 5000, Chicago, Illinois 60601, USA to processes Personal Data on behalf of the Firm in connection with the provision of Resource Hub.

You can find a list of member firms of Baker McKenzie International and their contact details here: http://www.bakermckenzie.com/ by clicking All Locations in the upper right corner of the site.

In this Notice, "Personal Data" means personal data (as defined by applicable data protection laws) relating to Participants and Third Parties which is shared on or in connection with Resource Hub.

Overview

Unless we specifically state otherwise, the Firm is the data controller of the Personal Data we process, and is therefore responsible for ensuring that the systems and processes we use are compliant with data protection laws, to the extent applicable to us.

Firm personnel are required to comply with this Notice and associated Firm policies when dealing with Personal Data and must also complete data protection training where appropriate to their role.

The Firm provides Resource Hub and the information and collaboration services provided therewith for the exclusive use of the Participants.

Resource Hub is made available by the Firm using Resource Hub which will be used to facilitate communications and collaboration between Participants as related to client matters and the wider operation of the Firm's business matters.

Resource Hub facilitates the provision of general legal content across practices and industries prepared by or under the direction of, unless otherwise indicated, the Firm for the exclusive use of Participants.

This Notice should be read in conjunction with the Firm's Privacy and Cookie Statement here which provides further detail as to how the Firm processes Personal Data.

The Firm and Participants are independent data controllers. Participants, including you, may upload documents containing personal data onto Resource Hub in order to make use of the services. Participants shall comply with their respective obligations as controllers under applicable data protection legislation. This includes ensuring you have a legitimate legal basis to share the personal data with the Firm and have provided all necessary notices or obtained any necessary consent.

Summary of Key Points

Collection	We collect in particular, the following Personal Data when you upload it to Resource Hub and from other publicly available sources in connection with the legal services provided: Your name and other identification data, contact details, information related to your employment, education and work experience and information related to your usage of Resource Hub. Click here to learn more.
Use	We use Personal Data to provide our services and respond to inquiries, to maintain business operations and to fulfil other business and compliance purposes. Click here to learn more.
Sharing	We share Personal Data with other member firms and affiliates of Baker McKenzie International and third parties worldwide (e.g. regulators, governmental bodies or enforcement agencies, Participants) as necessary to provide our services and respond to requests, and to fulfil other business and compliance purposes. Click here to learn more.
Retention Period	Your Personal Data will be deleted once they are no longer needed for the purposes for which they were collected or as otherwise required by applicable law or regulation or other legitimate business purpose permitted by law. Click here to learn more.
Data Subject Rights	You have certain rights to request access, rectification, deletion, objection, or other actions regarding your Personal Data where required by applicable law or for another legitimate business purpose. Click here to learn more.
Data Security	We maintain technical and organizational measures to protect Personal Data from loss, misuse, alteration, or unintentional destruction of Personal Data. Click here to learn more.
Cross-Border Data Transfers	We share your data internationally with member firms and affiliates of Baker McKenzie International and third parties as needed and those data transfers are appropriately protected where specified by law. Click here to learn more.
Other Issues	We provide other information in this Notice about: (i) the possible consequences for not providing Personal Data, (ii) how we do not engage in automated decision-making that has substantial effects on individuals, (iii) links to third party websites; and (iv) changes to this Notice. Click here to learn more.
Contact Us	Please contact us as detailed below with any question. Click here to learn more.

Collection of Personal Data

We will collect the following categories of Personal Data about the specified data subject below:

Data Subject

Personal Data

Participant

Data collected during your registration for and the use of Resource Hub:

· Identification data: name and name of current company.

· Contact details: email address.

· Automatically collected data: Computer Internet Protocol (IP) address, unique device identifier (UDID), cookies and other data linked to a device, and data about usage of our Sites.

After registration, you may choose to provide us with the following optional categories of Personal Data:

· Personal information: job title, language and country.

. Contact details: business address, telephone number, alternate email address, and fax number.

Use of Personal Data

The purposes for which we process Personal Data and the legal bases for such processing, are as follows:

To coordinate legal projects, conduct due diligence and document review as part of our provision of general legal content to Participants, we may use any and all of the types of Personal Data you provide. We need to process your information in this way in order to perform our obligations under our contracts with our Clients.
To facilitate the completion of legal documents and regulatory forms on behalf of Clients, we may use any and all of the types of Personal Data you provide. This processing is necessary for the purposes of complying with legal requirements to which we and our Client are subject.
To process requests or inquiries from Clients relating to the provision of general legal content, we may use any and all of the types of Personal Data you provide. It is necessary for our legitimate interests to process this information in order to respond to inquiries.
To authenticate your log-in to Resource Hub, we may use your password and log-in details. It is necessary for our legitimate interests to monitor how Resource Hub is used to detect and prevent fraud, other crimes and the misuse of our sites. This helps us to ensure that you can safely use Resource Hub.
To help improve the experience of Participants on Resource Hub, we may use Personal Data automatically collected as well as name, phone number and work address. It is necessary for our legitimate interests to monitor how Resource Hub is used to help us improve the layout and information available on our sites and provide a better service to Participants.
To analyse and run reports in respect of your use of Resource Hub in order to assist the provision of general legal content to Participants we may use automatically collected data as well as name and email address. We may process your information in this way in order to perform our obligations under our contracts with our Clients and we may share this information with our Clients.
To identify and protect against the misuse of Resource Hub by Participants we may use data automatically collected by tracking technologies as well as your name and email address. It is necessary for our legitimate interests to monitor and protect against the misuse of Resource Hub by Participants.

Sharing of Personal Data

We may share Personal Data with the following categories of recipients:

Affiliates. Baker McKenzie operates under the umbrella of Baker McKenzie International, a Swiss Verein, with member law firms around the world. Each member firm may share Personal Data with other member law firms in order to provide you with legal services and in order to administer our relationship with you (e.g. invoicing) or otherwise as necessary for the purposes described above. We may also share Personal Data with our global services companies in Belfast, Buenos Aires, Chicago, Manila and Tampa. A list of Baker McKenzie member firms and their contact details is provided here.
Mandatory disclosures and legal claims. We share Personal Data in order to comply with any subpoena, court order or other legal process, to comply with a request from our regulators, governmental request or any other legally enforceable demand. We also share Personal Data to establish or protect our legal rights, property, or safety, or the rights, property, or safety of others, or to defend against legal claims.
Between Participants. As agreed with the Client in order to provide legal services and any related business services, Personal Data may be shared between Participants as appropriate.

If you have questions about the parties with which we share Personal Data, please contact us as specified below.

Retention Period

For Personal Data that we collect and process for the purpose of providing Resource Hub, we will typically retain such Personal Data for as long as it is necessary to fulfil the purposes outlined in this Notice and as otherwise specified in applicable record retention policies and procedures. When the Firm no longer needs to use your Personal Data, we will remove it from our systems and records and/or take steps to properly anonymize it so that you can no longer be identified from it (unless we need to keep your Personal Data to comply with legal or regulatory obligations to which the Firm is subject or other legitimate business purposes permitted by law). For more information regarding the Firm's record retention policies or procedures please contact us as below.

Data Subject Rights

If you are in the European Economic Area (EEA) or the UK you have the following rights:

Objection. Where the legal justification for our processing of your Personal Data is our legitimate interest, you have the right to object to such processing on grounds relating to your particular situation. We will abide by your request unless we have compelling legitimate grounds for the processing which override your interests and rights, or if we need to continue to process the data for the establishment, exercise or defence of a legal claim.
Withdrawing Consent. If you have consented to our processing of your Personal Data, you have the right to withdraw your consent at any time, free of charge.
Instructions for the management of Personal Data after death. In some jurisdictions (e.g. France and Italy) you have the right to provide instructions regarding the storage, deletion or disclosure of your Personal Data after your death.

If you are in the EEA or UK you also have the right to lodge a complaint with the local data protection authority if you believe that we have not complied with applicable data protection laws. Access a list of local data protection authorities in EEA countries and UK.

Data Security

We have implemented technical and organisational measures in an effort to safeguard the Personal Data in our custody and control. Such measures include:

restricting access to Personal Data to staff and service providers on a need-to-know basis;
a formal Information Security Management System (ISMS) aligned with ISO 27001 and 27002:2013. The ISMS is a comprehensive set of policies and procedures for deploying, managing and securing the Firm's Information Technology infrastructure; utilizing a defense-in-depth approach to protecting our internal Firm and Client data.

While we endeavour to always protect our systems, sites, operations and information against unauthorized access, use, modification and disclosure, due to the inherent nature of the Internet as an open global communications vehicle and other risk factors, we cannot guarantee that any information, during transmission or while stored on our systems, will be absolutely safe from intrusion by others.

You also have an important role in protecting Personal Data. You should not share any username, password or other authentication data provided to you with anyone, and we recommend that you do not re-use passwords across more than one website or application. If you have any reason to believe that your username or password has been compromised, please contact us as detailed below.

Cross-Border Data Transfers

We transfer Personal Data to jurisdictions as necessary for the purposes described above, including to jurisdictions that may not provide the same level of data protection as your home country. Our data centres are based in Hong Kong, Chicago and Frankfurt. Your site will be hosted in a geographic location which is most appropriate to the Client's location and the location will be indicated on Resource Hub. As you may expect, some of the recipients we may share Personal Data with may be located outside the European Union, UK and/or European Economic Area ("EEA").

With respect to transfers originating from the EEA or UK to the United States and other non-EEA jurisdictions, we implement standard contractual clauses approved by the European Commission, and other appropriate solutions to address cross-border transfers as required or permitted by Articles 46 and 49 of the General Data Protection Regulation. Where required by such laws, you may request a copy of the suitable mechanisms we have in place by contacting us as detailed below.

Other Issues

What are the consequences of not providing Personal Data?
You are not required to provide all Personal Data identified in this Notice to use Resource Hub or to interact with us offline, but certain functionality will not be available if you do not provide certain key Personal Data, such as your name and email address. If you do not provide this Personal Data, we may not be able to provide access to Resource Hub, respond to your request or provide general legal content to you.
Do we engage in automated decision-making without human intervention?
We do not use automated decision-making without human intervention, including profiling, in a way that produces legal effects concerning you or otherwise significantly affects you.
Are third party websites governed by this Notice?
Resource Hub may contain links and references to other websites administered by unaffiliated third parties. This Notice does not apply to such third party sites. When you click a link to visit a third party website, you will be subject to that website's privacy practices. We encourage you to familiarize yourself with the privacy and security practices of any linked third party websites before providing any Personal Data on that website.
How will we handle any changes to this Notice?
We may update this Notice from time to time as our services and privacy practices change, or as required by law. The effective date of this Notice is posted below, and we encourage you to visit Resource Hub periodically to stay informed about our privacy practices. We will post the updated version of the Notice on Resource Hub, and ask for your consent to the changes if legally required.
California Consumer Privacy Act 2018
For information about the Firm's data processing practices as required by the California Consumer Privacy Act 2018, please view our CCPA Disclosures page https://www.bakermckenzie.com/en/ccpa-disclosures.

Contact Us

If you have questions or comments regarding this Notice or our privacy practices, please contact us here:

Office of General Counsel - Data Privacy

Baker McKenzie Global Services NI Limited
City Quays One
7 Clarendon Road
Belfast
N. Ireland
BT1 3BG

dataprivacy@bakermckenzie.com

Please contact us, using the 'Contact Us' section of the Firm's website (available here), if you have any issues related to the use of Resource Hub.

Effective date: October 2022

Local Law Addendum

Australia

In addition to the Notice, in relation to Baker McKenzie and its affiliates in Australia:

we are required by law in some cases to collect your information, such as where we are required to verify a person's identity;
we may use your information in other ways you have consented to; and
the countries outside Australia that your personal information may be disclosed to also include, but are not limited to, the United Kingdom, United States Hong Kong, Germany, the Philippines, Singapore and Canada.

What to do if you want to seek access or correction

If at any time you want to know what personal information we hold about you, you may request access to your record by contacting our Australian Privacy Officer at privacy.australia@bakermckenzie.com. We will respond within a reasonable period from the date your application is received.

If at any time you want to change personal information that is inaccurate or out of date, please contact our Australian Privacy Officer (see above) and we can amend the record. If you want to have your personal information deleted, please let us know and we will take reasonable steps to delete it unless we need to keep it for legal or regulatory purposes.

What to do if you have a question or problem

If we become aware of any ongoing concerns or problems concerning our privacy practices, we will take these issues seriously and work to address these concerns. If you have a question or a complaint about our handling of your personal information, please contact our Australian Privacy Officer (see above). We will respond to your complaint within a reasonable time. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner.

Canada

In addition to the Notice, in relation to Baker McKenzie and its affiliates in Canada:

we are required by law in some cases to collect your information, such as where we are required to verify a person's identity; and
we may use your information in other ways you have consented to.

What to do if you want to seek access or correction

If at any time you want to know what personal information we hold about you, you may request access to your record by contacting us as outlined in the Contact Us section above. We will respond within a reasonable period from the date your application is received.

If at any time you want to change personal information that is inaccurate or out of date, please contact us as outlined in the Contact Us section above and we can amend the record. If you want to have your personal information deleted, please let us know and we will take reasonable steps to delete it unless we need to keep it for legal or regulatory purposes.

What to do if you have a question or problem

If we become aware of any ongoing concerns or problems concerning our privacy practices, we will take these issues seriously and work to address these concerns. If you have a question or a complaint about our handling of your personal information, please contact us as outlined in the Contact Us section above. We will respond to your complaint within a reasonable time. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner.

Singapore

In addition to the Notice, in relation to Baker McKenzie.Wong & Leow and its affiliates in Singapore:

we may collect, use or disclose your information without your consent, where permitted or required by law to do so; and
we may use your information in other ways you have consented to.

What to do if you want to seek access or correction or withdraw consent

You may request access to information we hold about you or information about the ways in which we use or disclose your information. You may also request that we correct or update any information which we hold. Please make your request to our Singapore Data Protection Officer at Tel: +65 6338 1888.

We will respond to your request as soon as reasonably possible. If we are unable to provide you with any information or to make a correction requested by you, we shall generally inform you of the reasons why we are unable to do so (except where we are not required to do so under law).You may withdraw your consent to our use or disclosure of your information. Please make your request to our Singapore Data Protection Officer (see above). Even if you withdraw your consent, we may still use or disclose your information where permitted or required by law to do so.

What to do if you have a question or problem

If we become aware of any ongoing concerns or problems concerning our privacy practices or breach of the Singapore Personal Data Protection Act 2012, we will take these issues seriously and work to address these concerns. If you have a question or a complaint about our handling of your information, please contact our Singapore Data Protection Officer (see above). We will respond to your complaint within a reasonable time.