Baker & McKenzie Limited ("Baker McKenzie", "we", "us", or "our") has prepared this Privacy Notice (herein also referred to as "Privacy Notice" or "Notice") to outline our practices regarding the collection, use, disclosure, and/or cross-border transfer of any individually identified or identifiable information about you ("Personal Data"). Baker McKenzie will collect, use, disclose and/or cross-border transfer any Personal Data fairly and lawfully in good faith and in accordance with applicable laws.
This Notice applies to our current and prospective clients, be it individual clients or personnel of corporate clients which may include, but not limited to, employees, authorized person, directors, shareholders, contact persons of our corporate clients, visitors and users of our websites and our online properties, and any other individuals about whom we obtain Personal Data in connection with our services (hereinafter collectively referred to as "you" or "your"). However, this Notice does not form part of your contract with us.
Unless we specifically state otherwise, Baker McKenzie is the data controller of the Personal Data we collect, use, disclose and/or cross-border transfer, and is, therefore, responsible for ensuring that the systems and processes we use are in compliant with data protection laws, to the extent applicable to us.
Our personnel are required to comply with this Notice and associated Firm policies when dealing with Personal Data and must also complete data protection training where appropriate to their role.
1. Personal Data collected
1.1 General Personal Data
Subject to this Notice, Baker McKenzie will treat as confidential the Personal Data that Baker McKenzie collects directly from you, or indirectly from other sources, such as through our affiliates, subsidiaries, other companies, business partners, and/or other applicable channels of communication. The specific type of Personal Data collected by Baker McKenzie will depend on the communication and interaction between you and Baker McKenzie, your scope of work or the service to be provided, including but not limited to:
(1) General information: such as, name, surname and nickname, gender, title, organization, occupation, position, job title and responsibilities, authority, marital status, government issued documents or information (e.g., national identification card, passport, work permit, visa, entry card, house registration, tax identification number, and/or other governmental document/number), photo, signature, curriculum vitae (CVs/resume), assets, working experiences, educational background, family background, and stills or moving footages from CCTV in our office areas;
(2) Contact information: such as, personal address, work address, facsimile number, personal and business telephone number, email address, extension number, and instant message application identification (e.g., Line ID);
(3) Financial data: such as, bank account information, fees worked, fees billed, fees collection, profit margin, billed, unbilled, or outstanding amounts, contingent liability (if any), and billing’s narratives;
(4) Corporate information: such as, shareholder information, capital investment information, corporate information, and company’s families;
(5) Client service data: such as, client matter number, activity recording client's document deposit (e.g., deeds, wills, contract, and original cheque), beneficial ownership, proof of residence (e.g., utilities bill), time and date that our personnel (e.g., principals/partners) and you know each other, agreements/contracts, correspondences (e.g., emails, and minutes of meeting), your Personal Data as may be appeared in the relevant agreements, feedbacks, company announcements and policies, disciplinary action records, social security fund, workmen's compensation fund, skills training fund, fund for disabled persons, labour ruling case against an individual, safety records and evidence, bankrupt information, and legal content in documents;
(6) Device data: such as, computer Internet Protocol (IP) address, unique device identifier (UDID), cookies and other data linked to a device, and data about usage of our websites and our online properties (Usage Data);
(7) Event and participation data: such as, newsletter requests, event/seminar registrations, dietary preferences (excluding sensitive data), subscriptions, downloads, and username/passwords, data about individual participation in conferences and in-person seminars, credentials, associations, product interests, and preferences;
(8) Other information you provide to us: such as, information collected, used, or disclosed in connection with the relationship with us, or in connection with the relationship between us and our corporate clients in which you work for or associated with, such as, required documents containing your Personal Data attached to contracts with us or information contained in tax document, or data collected when you interact with us, which may include signatures, and your correspondence with us, and information as part of our prospective or existing relationship with you in the course of us providing you with our services and otherwise; and
(9) Personal Data of other persons: such as, details of your spouse, children, dependent, parent, reference person, emergency contact and/or other related person information, which may include, but is not limited to name, relationship, address, and telephone number.
1.2 Sensitive Personal Data
For Personal Data which is classified by law as sensitive personal data ("Sensitive Data"), we will only collect, use, or disclose it on the basis of your explicit consent, or other legal basis permitted by law where it is applicable.
Sensitive Data which we may collect includes:
(1) Religious Belief included in official identification document(s) or their copy(ies) if necessary;
(2) Health Data included chronic disease and screening information for COVID-19;
(3) Labour Union Information; and
(4) Criminal Records.
Personal Data of third parties
If you provide Personal Data of any third party to us (e.g., information of your spouse, children, or dependent, or information of the company’s shareholders and directors), you are responsible to ensure that such third party individual is notified of the information of this Notice, including how we may collect, use, disclose and/or cross-border transfer their Personal Data, and that you have obtained any required consent or rely on applicable legal basis from such third party individual, and that you have the permission to provide such Personal Data, and to permit us to lawfully collect, use, disclose and/or cross-border transfer such Personal Data in accordance with this Notice.
Personal Data of minors, quasi-incompetent persons and incompetent persons
Our services and this Notice do not target children, quasi-incompetent persons, and incompetent persons. We only collect the information of children, quasi-incompetent persons, and incompetent persons where the persons exercising parental power, curators, or guardians have given their consent, or where we can rely on other legal basis as permitted by laws. We do not knowingly collect information from individuals under the age of 20 without the consent of the persons exercising parental power when it is required by law, or from quasi-incompetent persons and incompetent persons without the consent from their legal guardians/curators when it is required by law. In the event we learn that we have unintentionally collected Personal Data from anyone under the age of 20 without the consent of a person exercising parental power when it is required by law, or from quasi-incompetent person and incompetent person without the consent of their legal guardian/curator when it is required by law, we will delete it in a timely manner or collect, use, disclose and/or cross-border transfer only if we can rely on other legal bases as permitted by law, apart from consent.
2. Purposes of Use of Personal Data
2.1 Purposes for which Baker McKenzie rely on consent
(1) Baker McKenzie collects, uses, and/or discloses your Sensitive Data for the following purposes:
- Religious Belief included in official identification document(s) or their copies if due to verification of identity processes (if necessary).
If we rely on your consent as a legal basis, you have the right to withdraw consent at any time. The withdrawal of consent will not affect the lawfulness of the collection, use and disclosure of your Sensitive Data based on your consent before it was withdrawn.
Consent refusal or withdrawal of consent may results in us not being able to provide our services, or perform all or any of the duties or obligations owed to you.
2.2 Purposes for which Baker McKenzie rely on other legal grounds:
Apart from the purposes where we may seek your consent, Baker McKenzie may rely on the following legal bases for the processing of your Personal Data:
(1) contractual basis, for our initiation and fulfilment of our employment contract/work relationship with you;
(2) legal obligation, for the fulfilment of our legal obligations;
(3) legitimate interest, for the purpose of our legitimate interests, and the legitimate interests of third parties;
(4) vital interest, for preventing or suppressing a danger to a person's life, body or health;
(5) public interest, for the performance of a task carried out in the public interest or for the exercising of official authorities; and/or
(6) for the purpose of establishment, compliance, and exercise of legal claims.
We may collect, use and disclose your Personal Data for the following purposes:
- To manage our business operations and administer our client relationships: proposing fee/quotation; checking conflicts; opening and administering clients and matters records; contacting relevant clients' personnel; managing and maintaining relationship with clients; maintaining service quality; maintaining database of clients and contact persons (including in trust fund report); issuing bills; processing invoices; collecting payment; completing auditor letter; maintaining and administering client credit information; preparing reconciliation reports; tax filing and submission; requesting certificate of residence; monthly financial review past growth performance review; future potential revenue assessment; analyzing and determining the appropriate fees proposal; internal recordkeeping; event invitation and administration; providing legal update alerts and newsletter; providing information about our events or services, client conferences, seminars or networking events, and reference for firm awards submission;
- To provide legal services and respond to inquiries: performing our obligations under our contracts with our clients; providing legal services client’s inquiry responding, client’s legal obligation/compliance advisory; service providing in accordance to client’s request; client's due diligence; non-client’s due diligence; providing lecture/training course; client’s intellectual property protection, enforcement; and exploitation submission of corporate change to authorities as per the client’s instruction; tax audit; evidence finding and submission; investigation; dispute, legal proceeding and litigation; tax refund; tax filing, application, notification and registration; opening foreign bank account; translation of documents; English review; providing supportive information as per request; maintaining a list of client’s deposit; keeping of client's significant assets in safe deposit box; for submission of application as instructed by client; litigation search; and preparation of cases in court and/or arbitration institution;
- To protect the security and effective functioning of our websites and our online properties, and information technology systems: managing access right for our system; administering IT systems and security; monitoring how our websites and our online properties are used to detect and prevent fraud, other crimes and the misuse of our websites and our online properties to ensure that you can safely use our websites and our online properties;
- To address compliance and legal obligations: complying with the applicable local law requirements (e.g., tax filing), legal obligations, legal proceeding, or government authorities' orders; cooperating with courts and government authorities, and law enforcement bodies when we reasonably believe we are legally required to do so and when the disclosure of your Personal Data is strictly necessary to comply with the said legal obligations, proceedings, or government orders; and checking the identity of new clients and to prevent money laundering and/or fraud;
- To make our websites and our online properties more intuitive and easy to use: monitoring how our websites and our online properties are used to help us improve the layout and information available on our websites and our online properties and provide a better service to the users of our websites and our online properties;
- To ensure security in the office area: preventing or suppressing a danger to a person's life, body, or health; overseeing visitor access to our office area and maintaining the security and safety of our personnel, visitors, and office area; and
- COVID-19 screening: to check and screen for COVID-19 for onsite visit.
If you fail to provide us with your Personal Data that is necessary for us, we may not be able to perform certain processing activities described in this Notice. In some instances, we may not be able to continue your business relationship with us.
3. Disclosure of Personal Data
For the purposes as described in the previous section, Baker McKenzie may disclose or transfer your Personal Data to the following third parties.
(1) Baker McKenzie group companies: Baker McKenzie may disclose your Personal Data to our regional and global Baker McKenzie International team/network.
(2) Service providers: Baker McKenzie share Personal Data with suppliers and service providers to provide services, perform on behalf or to assist with Baker McKenzie's business operations under our instructions. Baker McKenzie may share your Personal Data to service providers including, but is not limited to the following: (1) bank and financial institutions; (2) telecommunication and/or mobile service providers; (3) data storage and cloud service providers; (4) IT system service providers or software vendors; (5) printing service providers; (6) auditing and accounting service providers; (7) event organizers; and (8) other operational service providers.
Where the processing of Personal Data is delegated to a third party data processor, such as those listed above, Baker McKenzie will ensure that the processor acts on our behalf and under our instructions.
(3) Business partners: Baker McKenzie may disclose your Personal Data to business partners (such as associated firms, agents, advisors, etc.), cooperating to provide services to you or for other purposes as listed under this Notice.
(4) Third parties with whom you request Baker McKenzie to share your Personal Data to: Baker McKenzie may disclose your Personal Data with your consent or at your direction (such as your counterparty).
(5) Third parties required by law or legal claims: under certain circumstances, we may be required to disclose your Personal Data in order to comply with legal or regulatory obligations. This includes various law enforcement agencies, courts, arbitration institutions, Office of Attorney-General, regulators, government authorities or other third party where we believe it is necessary to comply with a legal or regulatory obligation; or otherwise to protect our rights, the rights of any third party or individuals' personal safety, or to detect, prevent, or otherwise address fraud, security, or safety issues.
(6) Professional advisors: such as auditors, accountants, or other consultants who assist in running our business.
(7) Assignee of rights and/or obligations: third parties as our assignee, in the event of any reorganization, merger, business transfer, or other similar nature of transactions whether in whole or in part, will comply with this Notice to respect your Personal Data.
4. International transfer of your Personal Data
We may disclose or transfer your Personal Data to other member offices/network of Baker McKenzie International or to other third parties, or servers, in connection with provision of services located in the United States, Hong Kong or other jurisdictions. Those destination countries may or may not have been announced by the competent authority as having the required data protection standards as Thailand. We take steps and measures to ensure that your Personal Data is securely transferred and that the receiving parties have in place suitable data protection standards or other derogations as allowed by law. We will request your consent where consent to cross-border transfer is required by law.
5. Our Retention Period
Baker McKenzie will retain your Personal Data for as long as it is reasonably necessary to fulfil the purposes for which we obtained it, and to comply with our legal and regulatory obligations. However, Baker McKenzie may have to retain your Personal Data for a longer duration, as required by applicable law.
6. Cookies
We use and engage certain service providers to use cookies, web beacons, and similar tracking technologies (collectively, "cookies") on our websites and our online properties.
(1) What are cookies?
Cookies are small amounts of data that are stored on your browser, device, or the page you are viewing. Some cookies are deleted once you close your browser, while other cookies are retained even after you close your browser so that you can be recognized when you return to websites. More information about cookies and how they work is available at www.allaboutcookies.org.
(2) How do we use cookies?
We use cookies to provide the websites and our online properties, and services, gather information about your usage patterns when you navigate the websites and our online properties in order to enhance your personalized experience, and to understand usage patterns to improve our websites and our online properties, products, and services. We also allow certain third parties to place cookies on our websites and our online properties in order to collect information about your online activities on our websites and our online properties over time and across different websites you visit.
This information is used to provide advertising tailored to your interests on websites you visit, also known as interest based advertising, and to analyse the effectiveness of such advertising.
(3) Cookies on our websites and our online properties are generally divided into the following categories:
- Operational Cookies: These are required for the operation of our websites and our online properties. They include, for example, cookies that enable you to log into secure areas. These cookies are session cookies that are erased when you close your browser.
- Analytical/Performance Cookies: These allow us to recognize and count the number of users of our websites and our online properties and understand how such users navigate through our websites and our online properties. This helps to improve how our websites and our online properties works, for example, by ensuring that users can find what they are looking for easily. These cookies are session cookies which are erased when you close your browser. We use Google Analytics, and you can see below for how to control the use of cookies by Google Analytics.
- Functional Cookies: These improve the functional performance of our websites and our online properties and make it easier for you to use. For example, cookies are used to remember that you have previously visited the websites and our online properties and asked to remain logged into it. These cookies qualify as persistent cookies, because they remain on your device for us to use during a next visit to our websites and our online properties. You can delete these cookies via your browser settings.
(4) What are your options if you do not want cookies on your computer?
You can review your Internet browser settings, typically under the sections "Help" or "Internet Options," to exercise choices you have for certain Cookies. If you disable or delete certain Cookies in your Internet browser settings, you might not be able to access or use important functions or features of our websites and our online properties, and you may be required to re-enter your log-in details.
To learn more about the use of cookies for Google analytics and to exercise choice regarding such cookies, please visit Google Analytics Opt-out Browser Add-on.
7. Your Rights as a Data Subject
Subject to applicable laws and exception thereof, you may have the following rights to:
(1) Access: You may have the right to access or request a copy of the Personal Data Baker McKenzie collect, use, and disclose about you. For your own privacy and security, Baker McKenzie may request a proof of your identity before providing the requested information to you;
(2) Rectification: You may have the right to have incomplete, inaccurate, misleading, or not up-to-date Personal Data that Baker McKenzie collect, use, and disclose about you rectified;
(3) Data Portability: You may have the right to obtain Personal Data Baker McKenzie hold about you, in a structured, electronic format, and to send or transfer such Personal Data to another data controller, where this is (a) Personal Data which you have provided to Baker McKenzie, and (b) if Baker McKenzie process such Personal Data on the basis of your consent or to perform contract with you;
(4) Objection: You may have the right to object to certain collection, use, and disclosure of your Personal Data;
(5) Restriction: You may have the right to restrict the use of your Personal Data in certain circumstances;
(6) Withdraw Consent: For the purposes you have consented to the collection, use, and disclosure of your Personal Data, you have the right to withdraw your consent at any time;
(7) Deletion: You may have the right to request that Baker McKenzie delete, destroy or de-identity Personal Data that we collect, use, and disclose about you. However, Baker McKenzie are not obliged to do so if we need to retain such data in order to comply with legal obligations or to establish, exercise, or defend legal claims; and
(8) Lodge a com plaint: You may have the right to lodge a complaint to the competent authority where you believe the collection, use, and disclosure of your Personal Data is unlawful or noncompliant with applicable data protection law.
8. About this Privacy Notice
This Notice does not form part of any contract you might enter into and does not create contractual rights or obligations.
We may amend/update this Notice from time to time in accordance with our processing activities. We may also make significant changes to this Privacy Notice as required by applicable laws. On some occasions, we may provide an additional Privacy Notice to inform you of our specific data processing activities.
Updates to this Notice will be posted on our website and/or notified to you as appropriate.
9. Security measures standard
Baker McKenzie has arranged for appropriate security measures, which cover administrative, technical and physical safeguards in relation to access control, to protect Personal Data against any unauthorized or unlawful loss, alteration, correction, use, disclosure, or access, for example: restricting access to Personal Data as well as storage and processing equipment; imposing access rights or permission; implementing user access management to limit access to Personal Data to only authorized persons; implementing user responsibilities to prevent unauthorized access, disclosure, knowledge acquisition or unlawful duplication of Personal Data or theft of device used to store and process Personal Data; and enabling the re-examination of unauthorized, alteration, erasure, or transfer of Personal Data. These measures are in place to protect the confidentiality, integrity, and availability of Personal Data as required by law.
10. External Links
Where applicable for website and our online properties users, our services may contain links to other websites/platforms that are operated and controlled by third parties. While we try to link only to websites/platforms that share our high standards and respect for privacy, we do not take responsibility for the content or the privacy practices employed by other websites/platforms. Unless otherwise stated, any Personal Data you provide to any such third party website/platforms will be collected by that party and not by us, and will be subject to that party's privacy policy/notice (if any), rather than this Notice. In such a situation, we will have no control over, and shall not be responsible for, that party's use of the Personal Data you provide to them.
11. Contact Details
For any questions about this Notice, or if you wish to contact us in relation to your Personal Data processing and/or related rights, please contact our Data Privacy Team or our office at the contact details set forth below:
Data Privacy Team at Baker & McKenzie Limited
Email: BKK-Privacy@bakermckenzie.com
Address: Baker & McKenzie Limited
5th, 10th and 21st - 25th Floors
990 Abdulrahim Place
Rama IV Road, Silom, Bangrak
Bangkok 10500, Thailand