Privacy Statement

Last Updated: April 5, 2023

Gibson, Dunn & Crutcher LLP, having its registered office at 333 South Grand Avenue, Los Angeles, CA 90071-3197, United States (“Gibson Dunn” or “we” or “us” or “our”), is a global law firm with offices located in 20 major cities around the world. We are committed to safeguarding the privacy of our clients, business partners, contacts, job applicants, website visitors, and subscribers (collectively, “you”) and to protecting the personal information you share with us.

This Privacy Statement applies to the processing of personal information by Gibson Dunn, acting as a controller, in connection with:

your use of our website https://www.gibsondunn.com and any online services offered through the website (collectively, the “Site”);
the services offered by Gibson Dunn to its clients and business partners;
recruitment and hiring; and
communications with you, including to respond to your inquiries, inform you about our services and events, and to send you our newsletters (including blogs, client alerts, invitations to webcasts, or other materials).

This Privacy Statement explains our privacy practices, including the types of personal information collected by Gibson Dunn, and how such information may be collected, used, processed, utilized, maintained, or shared.

Collection of Personal Information

How We Use Your Personal Information

Disclosure of Personal Information

International Transfers

Security Procedures

Retention of Personal Information

Your U.S. State Privacy Rights

Your Rights under the GDPR/UK GDPR

Use of Cookies

Third-Party Links

Children’s Privacy

Revisions to this Privacy Statement

Contact

Collection of Personal Information

Gibson Dunn processes “Personal Information” regarding (i) its clients’ representatives when using any of our legal services, (ii) users of our Site, (iii) anyone who sends us an inquiry, registers for one of our events, or subscribes to our newsletters, as well as (iv) job applicants. Personal Information generally is information that includes a personal identifier like your name, email address or physical address, phone number, IP address or device identifier, or any data that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, back to a natural person, household, or device, subject to definitions and exceptions under applicable law.

Some of the Personal Information we receive may also fall under the sub-category of “Sensitive Personal Information,” or a similar term, as defined by certain laws. This information may include information such as your Social Security Number, driver’s license number, state identification card number, passport number, financial account and credit card information in combination with any required security or access code, geolocation data, and racial and/or ethnic information. We only collect and use Sensitive Personal Information in accordance with privacy laws, upon your consent where required and as necessary to fulfill business purposes. We do not use such information to infer characteristics about you, and do not sell or share Sensitive Personal Information.

We will only process your Personal Information when we have a legal basis to do so (see following section). Personal Information includes information that you provide to us, that we collect automatically, and that we obtain from third parties. This information may include the following:

Personal Information we collect to provide legal services:

Contact information, including first name, last name, email address, physical address, work and personal telephone numbers, and other similar identifiers.
Payment and transactional data needed to provide you with legal services, including billing information.
Professional or employment-related information, including title, company, and business phone number.
Other information as reasonably necessary for Gibson Dunn to provide legal services.

We will also collect Personal Information about you indirectly from other sources, namely from our clients and interested third parties in relation to our legal services. Such Personal Information could include contact details and any other categories of Personal Information provided to us and relevant to the matter at stake.

Personal Information we collect to respond to your inquiry, to inform you about our services and events, and to send you our newsletters:

Contact information, including first name, last name, email address, physical address, work and personal telephone numbers, and similar identifiers, and your areas of interest.
Professional or employment-related information, including job title, company name, and business phone number.
Other information as reasonably necessary for Gibson Dunn to respond to your inquiry, inform you about our services and events, or send you our newsletters.

Personal Information we collect when you use the Site:

Our system may collect information about your browser or mobile device automatically when you enter or utilize the Site. We may use cookies and similar technologies to help us understand your activity on our Site, as well as for email communications. Data we collect automatically includes your IP address, other device identifiers, access dates and times, and referring and exiting URLs.
With respect to the areas of the Site that requires entry of log-in credentials, we will collect and process the Personal Information provided to us when signing in with us, including your contact details, username, and password. For more information on how to manage your cookie preferences, please see our Cookie Notice.

Personal Information we collect to evaluate and process your application for employment with our firm:

Contact information, including first name, email address, physical address, work and personal telephone numbers, Social Security number, taxpayer identification information, state identification card number, driver’s license number, employee identification number, employee credentials and related passcode, emergency contacts, and dependents’ names.
Professional or employment-related information, including job title, employment history, and educational background, as well as information collected from the recruitment, hiring, and termination processes (for example, interview information, CV or resume, cover letters, references, reference letters, transcripts, pre-hire interactions, letters of reference, publicly available social media, letters of offer and acceptance, hire, start and end dates, resignation date, and reasons).
Education, work experience, certifications, registrations, professional license numbers, training, and language abilities, as well as acknowledgements relating to receipt of or agreement to Gibson Dunn policies and survey or feedback information.
Residency, citizenship, or work authorization status, visa number, military status, sponsorship requirement, nationality, and passport information.
Performance-related information (including reviews, references, disciplinary procedure information, attendance records) and content for certain job descriptions.
Characteristics of protected classifications under California or U.S. federal law (including sex, gender, marital status, ethnic origin, date of birth, age, sexual orientation, veteran status, and physical limitations and special accommodations, as needed).
Where permitted by law and as applicable, the results of (i) criminal background checks, (ii) drug testing, (iii) a general background search on the highest level of education obtained and employment history, (iv) SSN tracing, (v) a national sex offender registry search, and (vi) a driving record search.
Other information linked to the Personal Information above as reasonably necessary for Gibson Dunn’s business purposes.

How We Use Your Personal Information

To Provide Our Legal Services

Gibson Dunn processes Personal Information to perform a contract with you or to take precontractual steps at your request in order to:

provide you with our legal services;
manage our relationship with you and carry out any related administration; and
send you communications related to our legal services.

In addition, Gibson Dunn processes Personal Information based on its legitimate interests, which consist of:

providing our legal services to our clients, including to the company for which you are working, and managing our relationship with such clients;
complying with non-EEA or non-UK laws, as relevant, responding to requests from, and other communications with, competent public, governmental, judicial or other regulatory authorities and responding to valid legal process, investigating or participating in civil discovery, litigation, or other legal proceedings;
meeting our corporate and social responsibility commitments; and
protecting or defending your rights, property or security or ours.

If you wish to obtain further details regarding our legitimate interests, please contact us by sending a request using the contact details specified at the end of this Privacy Statement.

Finally, Gibson Dunn processes Personal Information to comply with the legal obligations to which it is subject, including anti-money laundering or anti-bribery checks.

To provide you with online services and improve our Site

Gibson Dunn processes Personal Information for the performance of the contract with you in order to provide you with our services through our Site.

We process Personal Information to store cookies on your device(s) upon your consent where required, as described in our Cookie Notice.

In addition, Gibson Dunn processes Personal Information based on its legitimate interests, which consist of complying with non-EEA or non-UK laws, as relevant; responding to requests from, and other communications with, competent public, governmental, judicial or other regulatory authorities and responding to valid legal process, investigating or participating in civil discovery, litigation, or other legal proceedings; as well as protecting or defending your rights, property or security or ours, including by investigating potential violations of or enforcing our terms of use. If you wish to obtain further details regarding our legitimate interests, please contact us by sending a request using the contact details specified at the end of this Privacy Statement.

To respond to your inquiry, to inform you about our services and events, and to send you our newsletters

Gibson Dunn processes Personal Information based on its legitimate interests, which consist of responding to your inquiries, including those sent to the contact details provided on the contact page of the Site and, where consent is not required, sending you marketing communications regarding our services and events.

In addition, users who have consented, including through the subscription form on the Site, may receive our newsletters (client alerts, invitations to webcasts and events, or other materials or activities). Individuals may opt out of receiving such direct marketing communications at any time by clicking on the opt-out link included in the marketing communications or sending a request using the contact details specified at the end of this Privacy Statement.

To evaluate and process your application for employment with our firm

Gibson Dunn processes Personal Information in order to take precontractual steps at your request for processing your application for employment at Gibson Dunn, including to evaluate your candidacy.

To comply with applicable legal obligations

Gibson Dunn also processes Personal Information in order to comply with applicable legal obligations to which it is subject, including employment law.

Disclosure of Personal Information

For the purposes referred to under this Privacy Statement, we may need to share certain Personal Information with certain recipients. Such recipients will either act as another independent controller or as a processor acting on our behalf and upon our instructions.

We do not sell, or share for cross-context behavioral or targeted advertising purposes, as defined by certain laws, your Personal Information to any third party. We may disclose your Personal Information in the following limited circumstances:

Authorized Third Parties and Service Providers: We may disclose your Personal Information to processors that provide us with the services necessary for the achievement of the purposes described above, i.e. our affiliates and offices, and our third-party services providers that provide various types of services, including IT services and companies that provide web analytics, advertising, email distribution, and other services. These third parties are only permitted to use your Personal Information to the extent necessary to enable them to provide their services to us. They are required to follow our instructions and to comply with appropriate security measures to protect your Personal Information.
Other Parties When Required by Law or as Necessary: We may disclose your Personal Information to our affiliates, offices and other entities acting as independent controllers, which may be legal or government authorities or third parties in connection with claims, disputes, litigation or investigations where we reasonably believe that disclosure is required by law or pursuant to legal process, or is necessary to establish, exercise or defend legal claims, including to protect or defend your rights, property or security or ours.
Other Parties With Your Consent: There may be instances where we disclose your Personal Information to other authorized third parties when you expressly consent to such sharing.
Other Parties In Connection With a Transfer of Assets: If we make a sale or transfer of assets, or are otherwise involved in a merger or transfer, we may transfer your information to one or more third parties as part of that transaction in a manner consistent with this Privacy Statement.

International Transfers

Gibson Dunn is an international law firm, with clients, affiliates and offices located throughout the world. As we are based in the United States, your Personal Information needs to be transferred to the Unites States for the purposes referred to under this Privacy Statement.

In addition, when we share your Personal Information with the entities mentioned above, it may imply transfers of your Personal Information overseas, which may include transfers to countries outside of the EEA or the UK whose laws provide levels of protection for Personal Information that are not always equivalent to the level of protection that may be provided in your own country.

Gibson Dunn has procedures in place to ensure that Personal Information is transferred, processed, and stored with appropriate safeguards and in accordance with applicable laws. Such appropriate safeguards may include standard contractual clauses issued by the European Commission (as amended by the UK Addendum issued by the UK Information Commissioner, where relevant) and we will provide you with details on the applicable safeguards and transfers upon request, to the contact details specified at the end of this Privacy Statement.

Security Procedures

Gibson Dunn maintains appropriate technical and organizational security procedures in order to protect your Personal Information from loss, misuse, unauthorized access, disclosure or alteration, in accordance with applicable data protection and privacy laws.

In addition to such measures, Gibson Dunn maintains confidentiality policies that govern all information that any attorney or other personnel of Gibson Dunn receives in the course of their employment or association with Gibson Dunn. All attorneys and personnel are made aware of these policies and Gibson Dunn has in place procedures to train all attorneys and personnel to implement these policies. Despite our efforts, we cannot guarantee that Personal Information may not be accessed, disclosed, or altered by breach of our safeguards. You should take adequate precautions to protect your Personal Information.

Retention of Personal Information

General principles

Gibson Dunn will retain your Personal Information for no longer than is necessary for the purposes identified under this Privacy Statement, and as permitted by applicable law.

Please note that the data retention period actually applied by Gibson Dunn may vary, depending on the relevant purpose as described hereinafter. In any event, Gibson Dunn may keep your Personal Information for a longer time as those described below as part of its legal obligations. In such case, we will keep your Personal Information for the duration of such legal obligations.

On the expiration of the applicable data retention periods, Gibson Dunn will delete or anonymize the relevant Personal Information.

For legal services

Gibson Dunn will keep your Personal Information for the whole duration of our legal services, extended by the applicable limitation period or as long as may be required by applicable statutory or professional retention obligations.

For online services and our Site improvements

With respect to the services provided to you through our Site, Gibson Dunn will keep your Personal Information during the period of our contractual relationship, extended by the applicable statute limitation period.

For responding to your inquiries, informing you about our services and events and sending you our newsletters

Gibson Dunn will keep your Personal Information for communication purposes until you withdraw your consent or, if you are in the EEA or the UK, for three (3) years after the last contact with you.

For your recruitment and employment

For the applicants who are hired, Gibson Dunn will keep your Personal Information in accordance with the employee notice applicable to you.

If you are in the EEA or the UK, if you do not receive an employment offer, Gibson Dunn will ask you if you want us to keep your information in order to give you the opportunity to apply for future positions. If you are a U.S. resident, information collected from applicants who do not receive an employment offer will be deleted unless required by applicable law, or unless the prospective employee has requested that Gibson Dunn keep their application on file for consideration for future positions.

Your U.S. State Privacy Rights

Depending on the jurisdiction in which you live, you may have the following rights subject to the exceptions allowed by law, including under the California Consumer Privacy Act of 2018 (“CCPA”), the California Privacy Rights Act of 2020 (“CPRA”), the Colorado Privacy Act, the Virginia Consumer Data Protection Act, the Utah Consumer Privacy Act, and Connecticut’s Act Concerning Personal Data Privacy and Online Monitoring:

Transparency: Businesses that collect Personal Information subject to the above listed laws are required to provide you with notice regarding the categories of Personal Information to be collected, the purposes for which the categories of Personal Information are collected or used, whether that information is sold or shared, and the length of time we intend to retain each category of Personal Information, or if that is not possible, the criteria used to determine that period, among other information.
Access / know the categories and specific pieces of Personal Information Gibson Dunn has collected about you, the categories of sources from which the Personal Information is collected, the business purpose for collecting the Personal Information, and the categories of third parties with whom Gibson Dunn shares Personal Information.
Correct inaccurate or obsolete Personal Information that Gibson Dunn may maintain.
Delete Personal Information under certain circumstances.
Not to be discriminated against on the basis of your exercising any of your rights afforded by state law.
Limit the use and disclosure of Sensitive Personal Information. Gibson Dunn does not use your Sensitive Personal Information in any matter that requires the right to limit because Gibson Dunn only collects, uses, or discloses Sensitive Personal Information as necessary to provide you with good or services, and does not sell or share Sensitive Personal Information.

Opt out of the sale or sharing of Personal Information: Gibson Dunn does not sell or share your Personal Information, and therefore does not, and is not required to, provide this option.

To exercise your rights, please contact us at [email protected], or call us at 1-800-266-0943.

We will first acknowledge receipt of your request within 10 business days and then provide a substantive response within 45 calendar days after its receipt. If we require more time (up to 90 days or the permitted timeframe), we will inform you of the reason and extension period in writing. If you are a Virginia, Colorado, or Connecticut resident and we deny your request, you may appeal our decision by emailing your request to [email protected] or calling us at 1-800-266-0943. Within 45 calendar days of receipt of an appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decision.

Only you or your authorized agent may make a verifiable consumer request related to your Personal Information. To respond to your requests, we must verify your identity.

How to Authorize an Agent: You may designate an authorized agent to submit your verified consumer request on your behalf, but only if the authorized agent has your written permission to do so and you have taken steps to verify your identity directly with us.
How We Verify Your Request: We will only use the Personal Information provided in the context of your request to verify your identity or the authority of your authorized agent to make the request. Depending on how you interact with us, we may require that you provide at least two pieces of Personal Information, such as your name, email address, client number, or other information that we already have in our possession. We will verify your request by comparing the information you provide to information already in our possession to minimize the risk of fraud.

Your Rights under the GDPR/UK GDPR

If you are in the EEA or the UK, you have various rights in relation to the processing of your Personal Information, depending on the relevant situation. These include the following rights:

Right of Access: right to request confirmation as to whether or not your Personal Information is being processed by Gibson Dunn and, if so, the right to receive a copy of it;
Right to rectification: right to request the rectification of your Personal Information if you find that it is inaccurate and the right to have incomplete personal data completed;
Right to erasure: right to request the erasure or deletion of your Personal Information depending on the circumstances. For example, this right does not apply if the processing is necessary to establish, exercise, or defend legal claims;
Right to restriction: right to request the restriction of processing of your Personal Information;
Right to data portability: for processing carried out by automated means,right to request a copy of your Personal Information provided to us, in a structured, commonly used, and machine-readable format;
Right to object: right to object, on grounds relating to your particular situation, to the processing of your Personal Information. For example, you can object at any time to the processing of your Personal Information for direct marketing communications.

In order to exercise any of your rights, or if you have any other questions about our use of your Personal Information, including if you wish to obtain further details regarding our legitimate interests, please send a request using the contact details specified at the end of this Privacy Statement. Please note that we may ask you to provide us with additional information in order to verify your identity.

In any case, you also have the right to lodge a complaint with the competent data protection authority, in particular in the country of your habitual residence, place of work, or place of an alleged infringement if you consider that the processing of your Personal Information carried out by us infringes any applicable privacy laws.

Use of Cookies

Gibson Dunn uses “cookies” (small data files) on the Site. For detailed information about “cookies” and how they are used on the Site, please refer to the Cookie Notice.

Third-Party Links

The Site may contain hyperlinks to websites of third parties. This Privacy Statement does not apply to such third-party content or websites. If individuals decide to follow such links, they must be aware that Gibson Dunn does not take any responsibility for the third-party content or compliance of the third-party website with data privacy laws. Individuals are encouraged to make themselves aware of applicable privacy policies before they submit Personal Information to third-party websites.

Children’s Privacy

Gibson Dunn does not knowingly collect, use, or disclose Personal Information from children. If Gibson Dunn is made aware that it has collected Personal Information from a child in a manner that is inconsistent with applicable laws, Gibson Dunn will delete this information as soon as possible.

We do not sell or share the Personal Information of any individuals and, therefore, necessarily do not sell or share the information of children of any age.

Revisions to this Privacy Statement

Gibson Dunn reserves the right to change or update this Privacy Statement at any time. The applicable version of this Privacy Statement is available on the Site. If such change to the Privacy Statement requires your consent, you will have a choice to consent as to whether or not Gibson Dunn may use your Personal Information in the revised manner.

Contact

For any requests, questions or comments about this Privacy Statement or the collection, processing, or storage of your Personal Information by Gibson Dunn, please contact us via e-mail at: [email protected].

or in writing to:

Gibson Dunn & Crutcher LLP
Attn.: Office of the General Counsel
1050 Connecticut Ave., NW
Washington, DC 20036
United States of America

The local representatives for our offices in Europe are provided at: https://www.gibsondunn.com/legal-notices/.