Legal notices: Privacy policy
Last updated March 2023
Your privacy is important to us. This Privacy Policy explains how we handle and treat your data when you (i) register or visit our site, www.dlapiper.com or associated sites or pages (the "Site") or (ii) engage with us to use the products or services that DLA Piper provides through the Site (our "Services"). It also includes information about individuals whose personal information we may process as a result of providing the Services to third parties and individuals who apply to work at DLA Piper.
1. Purpose of this Policy
This Privacy Policy ("Privacy Policy") explains our approach to any personal information that we collect from you or which we have obtained about you from a third party and the purposes for which we process your personal information. It also sets out your rights in respect of our processing of your personal information.
This Privacy Policy will inform you of the nature of your personal information that is processed by us and how you can request that we delete, update, transfer and/or provide you with access to it.
This Privacy Policy is intended to assist you in making informed decisions when using the Site and our Services and/or to understand how your personal information may be processed by us as a result of providing the Services to third parties or when you apply to work at DLA Piper. Please take a moment to read and understand it.
Please also note that this Privacy Policy only applies to the use of your personal information obtained by us.
Back to top
2. Who are we and what do we do
DLA Piper is a global law firm operating through a number of separately constituted and regulated legal entities which provide legal and other client services in accordance with the relevant laws of the jurisdictions in which they respectively operate. Details of the different DLA Piper entities that provide legal services or other services to clients can be found here.
DLA Piper UK LLP and DLA Piper LLP (US) are the joint data controllers responsible for your personal information processed via the Site.
Back to top
3. How to contact us
If you have any questions about this Privacy Policy or want to exercise your rights set out in this Privacy Policy, please contact us by:
- sending an email to: privacyteam@dlapiper.com; or
- calling us on: +44 (0)20 7349 0296
Back to top
4. What personal information do we collect
We may collect personal information from you in the course of our business, through your use of our Site, when you contact or request information from us.
Our primary goal in collecting personal information from you is to help us:
- verify your identity;
- deliver our Services;
- improve, develop and market new Services;
- carry out requests made by you on the Site or in relation to our Services;
- investigate or settle inquiries or disputes deriving from the Services;
- comply with any applicable law, court order, other judicial process, or the requirements of a regulator;
- enforce our agreements with you;
- protect the rights, property or safety of us or third parties, including our other clients and users of the Site or our Services;
- with recruitment purposes, and
- use as otherwise required or permitted by law.
To undertake these goals we may process the following personal information:
- If you are a visitor to the Site:
- Name and job title.
- Contact information including the company you work for, email address and social media account where appropriate.
- Demographic information such as your address, preferences and interests.
- Other information relevant to the provision of Services.
- For clients and prospects, we also collect information to enable us to market our products and Services which may be of interest to you. For this purpose we collect:
- Name and contact details.
- Other business information such as job title and the company you work for.
- Areas or topics that interest you.
- Additional information may be collected such as events you attend and if you provide it to us, dietary preferences which may indicate data about your health or religious beliefs.
- If you are a potential recruit to join DLA Piper:
- Name and job title.
- Contact information including email address.
- Curriculum vitae, including your age and/or gender if you provide it to us, your education, employment history and similar matters and similar information that you may provide to us.
- Other information relevant to potential recruitment to DLA Piper.
Back to top
5. How do we use your personal information
We may use your information for the following purposes:
- Fulfilment of Services
We collect and maintain personal information that you voluntarily submit to us during your use of the Site and/or our Services to enable us to perform the Services.- What is our legal basis?
It is necessary for us to process your information to perform our obligations in accordance with any contract that we may have with you. It is in our legitimate interest or a third party's legitimate interest to use your personal information in such a way to ensure that we provide the very best client service we can to you or others.
- What is our legal basis?
- Client services
Our Site uses various user interfaces to allow you to request information about our Services including electronic enquiry forms and a telephone enquiry service. Contact information may be requested in each case, together with details of other personal information that is relevant to your Service enquiry. This information is used in order to enable us to respond to your requests.- What is our legal basis?
It is in our legitimate interest or a third party's legitimate interest to use your personal information in such a way to ensure that we provide the very best client service we can to you or others.
- What is our legal basis?
- Business administration and legal compliance
We use your personal information for the following business administration and legal compliance purposes:- to comply with our legal obligations ;
- to enforce our legal rights;
- to protect the rights of third parties; and
- in connection with a business transaction such as a merger, or a restructuring, or sale.
- What is our legal basis?
Where we use your personal information in connection with a business transition, to enforce our legal rights, or to protect the rights of third parties it is in our or a third party's legitimate interest to do so. For all other purposes described in this section, it is our legal obligation to use your personal information to comply with any legal obligations imposed upon us.
- Recruitment
We use your personal information for the following recruitment purposes:- To assess your suitability for any position for which you may apply at DLA Piper including partner level positions, associate positions, training contract or summer placements and also any business support or services role whether such application has been received by us online, via email or by hard copy or an in-person application.
- To review DLA Piper's equal opportunity profile in accordance and within the limits of applicable legislation to ensure that DLA Piper does not discriminate on the grounds of gender, race, ethnic origin, age, religion, sexual orientation, disability or any other basis covered by local legislation. All employment related decisions are made entirely on merit.
- What is our legal basis?
Where we use your personal information in connection with recruitment it will be in connection with us taking steps at your request to enter a contract we may have with you or it is in our legitimate interest to use personal information in such a way to ensure that we can make the best recruitment decisions for DLA Piper. We will not process any special category data except where we are able to do so under applicable legislation or with your explicit consent. - View the Recruitment-specific Privacy Notice
- Marketing communications
We carry out the following marketing activities using your personal information:- Email marketing
We use information that we observe about you from your interactions with our Site and/or with Services (see the Client Insight and Analysis section below for more details of the information collected and how it is collected) to send you marketing communications. - What is our legal basis?
It is in our legitimate interest to use your personal information for marketing purposes.
We will only send you marketing communications where you have consented to receive such marketing communications, or where we have a lawful right to do so.
- Email marketing
- Client insight and analysis
We analyse your contact details with other personal information that we observe about you from your interactions with our Site, and/or with our Services such as the Services you have viewed.
Where you have given your consent (where lawfully required), we use cookies, log files and other technologies to collect personal information from the computer hardware and software you use to access the Site, or from your mobile. This includes the following:- an IP address to monitor Site traffic and volume;
- a session ID to track usage statistics on our Site;
- information regarding your personal or professional interests, demographics, experiences with our products and contact preferences.
-
Our web pages contain "cookies" "web beacons" or "pixel tags" ("Tags"). Tags allow us to track receipt of an email to you, to count users that have visited a web page or opened an email and collect other types of aggregate information. Once you click on an email that contains a Tag, your contact information may subsequently be cross-referenced to the source email and the relevant Tag.
In some of our email messages, we use a "click-through URL" linked to certain website administered by us or on our behalf.
Please see our cookie policy for further information.By using this information, we are able to measure the effectiveness of our content and how visitors use our Site and our Services. This allows us to learn what pages of our Site are most attractive to our visitors, which parts of our Site are the most interesting and what kind of offers our registered users like to see.
We also use this information for marketing purposes (see the marketing section above for further details).
- What is our legal basis?
Where your personal information is not in an anonymous form, it is in our legitimate interest to use your personal information in such a way to ensure that we provide the very best products and services to you and our other clients.
Any other purposes for which we wish to use your personal information that are not listed above, or any other changes we propose to make to the existing purposes will be notified to you using your contact details, where available.
- What is our legal basis?
Back to top
6. What is our legal basis to use or process your personal information
It is necessary for us to use your personal information;
- To perform our obligations in accordance with any contract that we may have with you.
- It is in our legitimate interest or a third party's legitimate interest to use personal information in such a way to ensure that we provide the Services in the best way that we can.
- It is our legal obligation to use your personal information to comply with any legal obligations imposed upon us.
Back to top
7. Who do we share your personal information with
DLA Piper is a global law firm and any information that we collect or that you provide to us may be shared and processed by any DLA Piper entity. You can find out more about the DLA Piper entities and locations here.
We may also share personal information with a variety of the following categories of third parties as necessary:
- Our professional advisers such as lawyers and accountants.
- Government or regulatory authorities.
- Professional indemnity or other relevant insurers.
- Regulators/tax authorities/corporate registries.
- Third parties to whom we outsource certain services such as, without limitation, document processing and translation services, confidential waste disposal, IT systems or software providers, IT Support service providers, document and information storage providers.
- Third parties engaged in the course of the services we provide to clients such as counsel, arbitrators, mediators, clerks, witnesses, cost draftsmen, court, opposing party and their lawyers, document review platforms and experts such as tax advisors or valuers.
- Third party service providers to assist us with client insight analytics, such as Google Analytics.
- Third party postal or courier providers who assist us in delivering our postal marketing campaigns to you, or delivering documents related to a matter.
- Please note this list is non-exhaustive and there may be other examples where we need to share with other parties in order to provide the Services as effectively as we can.
Back to top
8. Our use of cookies and similar technologies
Our Site use certain Tags, log files and other technologies of which you should be aware. Please see our Cookie Policy to find out more about the cookies we use and how to manage and delete cookies.
Back to top
9. Third party contractors and other controllers
As mentioned above, we may appoint sub-contractor data processors as required to deliver the Services, such as, without limitation, IT systems or software providers, IT Support service providers, who will process personal information on our behalf and at our direction. We conduct an appropriate level of due diligence and put in place contractual documentation in relation to any sub-contractor to ensure that they process personal information appropriately and according to our legal and regulatory obligations.
Further, we may identify external data controllers where necessary to deliver the Services (for example, but without limitation, accountants, barristers or other third party experts including but without limitation DLA Piper LLP (US) and other DLA Piper firms or entities). When doing so we will comply with our legal and regulatory obligations in relation to the personal information, including but without limitation, putting appropriate safeguards in place.
- What is our legal basis?
It is necessary for us to perform our obligations in accordance with any contract that we may have with you.
It is in our legitimate interest or a third party's legitimate interest to use personal information in such a way to ensure that we provide the Services in the best way that we can.
Back to top
10. Where do we transfer your data to
In order to provide the Services we may need to transfer your personal information to locations outside the jurisdiction in which you provide it.
If you are based within the European Economic Area (EEA), please note that where necessary to deliver the Services we will transfer personal information to countries outside the EEA (including to DLA Piper LLP (US) and other DLA Piper entities).
All the DLA Piper entities have signed a data sharing agreement which is based on the EU standard contractual clauses to ensure we will comply with our legal and regulatory obligations in relation to personal information, including having a lawful basis for transferring personal information and putting appropriate safeguards in place to ensure an adequate level of protection for the personal information.
Back to top
11. How long do we keep your personal information for
For visitors to the Site, we will retain relevant personal information for at least three years from the date of our last interaction with you and in compliance with our obligations under the EU General Data Protection Regulation or similar legislation around the world, or for longer if we are required to do so according to our regulatory obligations or professional indemnity obligations.
If personal information is only useful for a short period e.g. for specific marketing campaigns we may delete it.
Back to top
12. Confidentiality and the security of your personal information
We are committed to keeping the personal information provided to us secure and we have implemented appropriate information security policies, rules and technical measures to protect the personal information that we have under our control from unauthorised access, improper use or disclosure, unauthorised modification and unlawful destruction or accidental loss.
All of our partners, employees, consultants, workers and data processors (i.e. those who process your personal information on our behalf, for the purposes listed above), who have access to, and are associated with the processing of personal information, are obliged to respect the confidentiality of such personal information.
Back to top
13. How to access your information and your other rights
You have the following rights in relation to the personal information we hold about you:
- Your right of access
If you ask us, we'll confirm whether we're processing your personal information and, if necessary, provide you with a copy of that personal information (along with certain other details). If you require additional copies, we may need to charge a reasonable fee. - Your right to rectification
If the personal information we hold about you is inaccurate or incomplete, you are entitled to request to have it rectified. If you are entitled to rectification and if we've shared your personal information with others, we'll let them know about the rectification where possible. If you ask us, where possible and lawful to do so, we'll also tell you who we've shared your personal information with so that you can contact them directly. - Your right to erasure
You can ask us to delete or remove your personal information in some circumstances such as where we no longer need it or if you withdraw your consent (where applicable). If you are entitled to erasure and if we've shared your personal information with others, we'll let them know about the erasure where possible. If you ask us, where it is possible and lawful for us to do so, we'll also tell you who we've shared your personal information with so that you can contact them directly. - Your right to restrict processing
You can ask us to 'block' or suppress the processing of your personal information in certain circumstances, such as where you contest the accuracy of that personal information or you object to us. If you are entitled to restriction and if we've shared your personal information with others, we'll let them know about the restriction where it is possible for us to do so. If you ask us, where it is possible and lawful for us to do so, we'll also tell you who we've shared your personal information with so that you can contact them directly. - Your right to data portability
You have the right, in certain circumstances, to obtain personal information you've provided us with (in a structured, commonly used and machine readable format) and to reuse it elsewhere or to ask us to transfer this to a third party of your choice. - Your right to object
You can ask us to stop processing your personal information, and we will do so, if we are:- relying on our own or someone else's legitimate interests to process your personal information, except if we can demonstrate compelling legal grounds for the processing; or
- processing your personal information for direct marketing purposes.
- Your right to withdraw consent
If we rely on your consent (or explicit consent) as our legal basis for processing your personal information, you have the right to withdraw that consent at any time. - Your right to lodge a complaint with the supervisory authority
If you have a concern about any aspect of our privacy practices, including the way we've handled your personal information, you can report it to the relevant Supervisory Authority.
Please note that some of these rights may be limited where we have an overriding interest or legal obligation to continue to process the data or where data may be exempt from disclosure due to reasons of legal professional privilege or professional secrecy obligations.
Back to top
14. Collection of information by third-party sites and sponsors
The Site contains links to other sites whose information practices may be different than ours. Visitors should consult the other sites' privacy notices as DLA Piper has no control over information that is submitted to, or collected by, these third parties
Back to top
15. Changes to this Privacy Policy
We may make changes to this Privacy Policy from time to time. To ensure that you are always aware of how we use your personal information we will update this Privacy Policy from time to time to reflect any changes to our use of your personal information. We may also make changes as required to comply with changes in applicable law or regulatory requirements. Where it is practicable, we will notify you by email of any significant changes. However, we encourage you to review this Privacy Policy periodically to be informed of how we use your personal information.
Back to top
Privacy policy relating to firm services
DLA Piper Studio Legale Tributario Associato (hereinafter the "Firm" or "DLA Piper") with registered office in Via della Posta 7, 20123 Milano, and that can be contacted at the email address privacyitaly@dlapiper.com, in its capacity of data controller, processes personal data provided directly or indirectly, also through collaborators, of clients of the Firm (hereinafter the "Clients") in compliance with this privacy policy. This privacy policy does not apply to the processing of personal data by way of the website www.dlapiper.com (the "Website"). The processing carried out through the Website is carried out in compliance with the privacy policy as available here.
Back to top
1. Personal Data as processed by DLA Piper
DLA Piper processes the following categories of personal data:
- (a) Client’s contact details or Client’s employees contact details if the Client is a corporate entity;
- (b) Client’s identification data that are necessary for compliance with applicable laws, including antimony laundering laws; and
- (c) Information provided by the Client with regard to the professional engagement with DLA Piper;
(hereinafter Personal Data).
Back to top
2. Purpose of processing
DLA Piper processes Personal Data for the following purposes:
- (a) Execution of the professional engagement with DLA Piper both in case of judicial as well as extrajudicial matters;
- (b) For administrative and accounting purposes;
-
(the purposes as per letters (a) and (b) are jointly defined as Contractual Purposes)
- (c) Comply with obligations deriving from applicable laws;
-
(the purpose as per letter (c) is defined as "Purpose of Law");
- (d) Protect the rights of the Firm and defends its legal rights, also during debt collection procedures, also by way of third parties;
- (e) For segmentation of Clients based on areas of law or sector interest;
-
(the purposes as per letters (d) and (e) are jointly defined as Legitimate Interest Purposes);
- (f) In case the Client has enjoyed the services of the Firm, in order to send email marketing communications regarding services as provided by DLA Piper, including the organization of events, provided that the Client will always have the possibility to request not to receive such marketing communications;
-
(purpose as per letter (f) is defined as Marketing Purpose).
Back to top
3. Legal Basis of data processing
The processing of Personal Data is necessary with regard to Contractual Purposes and Purpose of Law as essential in order to:
- Execute the professional engagement with the Client in cases as per section 2 letters (a) and (b);
- Comply with applicable laws in case as per section 2, letter (c).
Should the Client not provide its Personal Data for Contractual Purposes and Purpose of Law, DLA Piper will not be in a position to provide the relevant services.
Legitimate Interest Purposes is performed in compliance with article 6 letter f) of the EU General Data Protection Regulation 2016/679 (the "GDPR") for the pursuit of the legitimate interest of the Firm which is fairly balanced with the interest of the Client, in that the processing of Personal Data is limited to what is strictly necessary for the performance of such activities and segmentation is carried out only to the extent indicated above. Processing for the Purposes of Legitimate Interest is not compulsory and the Client may object to such processing in the manner set forth in this policy and in such case the Firm may not process the Personal Data for such purpose unless the Firm demonstrates the presence of overriding legitimate reasons.
Finally the processing for Marketing purposes is on a voluntary basis. If the Client, in compliance with article 130 of the Legislative Decree No. 196/2003, asks not to receive marketing communications by the Firm, then the Client will not receive communications relating to initiative and services as provided by DLA Piper.
Back to top
4. Modalities of data processing
Personal Data can be processed through both electronic and manual means, and is protected through appropriate technical, physical and organizational security measures against loss, theft and unauthorized use disclosure or modifications.
Back to top
5. Data communication
For Contractual Purposes, Personal Data can be transferred to the following categories of recipients located within and, within the limits set forth in Section 8 below, outside the European Union: (a) employees or collaborators of the entities indicated below, as data processors within the scope of their respective duties and within the limits established by law, (b) third party service providers and consulting services providers for the Firm with reference to activities in the areas of (but not limited to) technology, accounting, administrative, legal, insurance, IT, debt collection and assignment; (c) counterparties and their advocates; (d) other law firms belonging to the DLA Piper Firm as indicated on the Site (jointly referred to as the DLA Piper Offices); (e) individuals and authorities whose right to access Personal Data is expressly recognized by law, regulations or orders issued by the competent authorities.
A complete list of data processors can be found, upon request, through the methods indicated in this Policy.
Back to top
6. Transfer of data abroad
Personal Data can be transferred outside the national territory to countries located in the European Union, but also outside the European Union and in particular to countries where DLA Piper Offices are located. With respect to transfers outside the territory of the European Union to countries that are not considered adequate by the European Commission, the Firm takes suitable and appropriate security measures to protect Personal Data. Consequently, any transfer of Personal Data to countries outside the European Union will, in any event, take place in accordance with the appropriate and adequate safeguards for the purposes of such transfer, such as the standard data protection contractual clauses, pursuant to the applicable legislation and in particular Articles 45 and 46 of the Privacy Regulation.
In any case, the Client has the right to obtain reference to the appropriate or adequate safeguards adopted for the transfer of Personal Data and the means to obtain a copy of such Personal Data or the place where it has been made available.
Back to top
7. Data subjects rights
The Client can, at any time and free of charge, by sending an email to privacyitaly@dlapiper.com, exercise the following rights:
- (a) obtain from the Firm confirmation of the existence or non-existence of data concerning him/her and to be informed about the content and source of the data, to verify their accuracy and to request their integration, updating or modification;
- (b) obtain the cancellation, transformation into anonymous form or blocking of any data processed in violation of the applicable law;
- (c) object in whole or in part, for legitimate reasons, to the processing; and
- (d) withdraw, at any time, consent to the processing of the data (in relation to the processing for which such consent may be necessary), without in any way affecting the lawfulness of the processing based on the consent given before the withdrawal.
In addition to the these rights, the client also has the right, exercisable at any time, to:
- (i) Request the Firm to limit the processing in the event that:
- The Client disputes the accuracy of personal data, for the period necessary for the Firm to verify the accuracy of such data;
- The processing is unlawful and the Client objects to the deletion of Personal data and instead requests that its use be restricted;
- Although the Firm no longer needs the data for processing purposes, the Personal Data is necessary for the Firm to establish, exercise of defend a legal claim; or
- The Client has objected to the processing pursuant to article 21 (1) of the GDPR pending verification as to whether the Firm’s compelling legitimate grounds for continuing processing prevail.
- (ii) Object to the processing of Personal Data;
- (iii) Request the deletion of Personal Data without undue delay;
- (iv) Receive an electronic copy of Personal Data, where the Client wishes to transfer the data to itself or to a different service provider, in cases where the Firm processes the data on the basis of the Client’s consent or on the basis that the processing is necessary for the provision of the services referred to in the professional engagement and the data are processed through automated means; and
- (v) File a compliant with the the Garante per la protezione dei dati personali.
Back to top
8. Data retention time limits
Personal data will be retained only for the time strictly necessary to fulfil the purposes for which the data are collected as outlined in this privacy policy. In any case, the following retention periods shall apply to the processing of personal data for the purposes indicated below:
- For Contractual Purposes and Legitimate Interest Purposes as per section 2, from letter (a) to (e), Personal data are retained for the duration of the professional engagement (including renewals) plus 10 years following the termination or withdrawal, except in cases where retention of personal data is required for an additional period of time, litigations, requests by competent authorities or in compliance with applicable laws;
- For Purpose of Law, data is stored for the period necessary to comply with applicable laws;
- For Marketing Purposes with regard to the delivery of commercial communications as per Section 2 letter (f) of this privacy policy, Personal data are retained until 24 months from the interaction with DLA Piper, to be considered as law professional engagement, participation to events or other initiatives as organized by the Firm o opening of commercial communications as delivery by the Firm, notwithstanding the right to withdraw consent provided or object to the processing at any time.
Back to top
9. DPO
DLA Piper appointed a DPO who can be contacted, at any time, for doubts or requests relating to personal data. The DPO can be contacted at the following email address: privacyitaly@dlapiper.com.
Back to top
10. Amendments and updates
This privacy policy may be subject to changes and modifications, including as a consequence of updates to applicable data processing legislations. Changes will be notified in advance and Clients can view the constantly updated text of this policy on this page.
