Privacy policy information for Allen & Overy’s pre-hire recruitment processes

In this privacy policy we use the words ‘personal information’ to describe information that is about you and which identifies you. We collect and generate personal information about you as part of our pre-hire application and recruitment processes. This information includes:

• Contact information, such as your full name (including name prefix or title), postal address, email address and phone number(s).
• General information, such as your date of birth, gender, marital status, nationality, residency and work authorisation.
• Applicant information, such as your educational background, employer details and employment history, skills and experience, professional licenses, memberships and affiliates, CV , interview notes, outcome of application and, where you provide them, references and photographs.
• Information provided by your social media account where you sign in or register to apply for an actual or potential position using a social media account.
• Financial information, such as payment-related information in relation to the payment of recruitment-related expenses, where relevant.
• Technical information, to the extent that it constitutes personal information, such as information from your visits to our website, activity on the website or applications (such as IP address and other online identifiers) or in relation to materials and communications we send to you electronically.
• Passwords and security questions when you apply via our website.
• Information you provide to us for the purposes of attending our premises, including access and dietary requirements, or generated by us in connection with your attendance, such as CCTV and access records.
• Diversity-related information including in relation to disabilities, ethnicity, sexuality, religion and social background. The diversity data collected and processed will depend on, and only be collected in accordance with, applicable local laws. Where applicable, it will form part of the application process and will be apparent at the point of collection.
• Any other information relating to you which you may provide to us or a third party on your behalf (such as a reference).

We collect personal information as part of our recruitment, application and hiring processes:

• Directly from you when you apply for a role or otherwise submit your personal information to Allen & Overy, for instance via its website.
• From third parties, such as recruitment agencies acting on your behalf or referees nominated by you.
• From partners and staff of Allen & Overy as a result of an internal recommendation or referral or generated in the course of our recruitment processes.
• While monitoring our technology tools and services, including our websites and email communications sent to and from Allen & Overy.
• When you provide it to us, or interact with us directly, for instance engaging with our staff.

Allen & Overy collects and processes personal information about you in a number of ways. For each use described below, we have set out the legal basis on which we use your personal information.

Purpose:
To identify and process your application

Legal Basis:
To take steps at your request with a view to entering into a contract of employment

For our legitimate business purposes (the identification and consideration of appropriate candidates for appointment and keeping a record of that process)

Purpose:
For the purposes of recruitment and hiring

Legal Basis:

To take steps at your request with a view to entering into a contract of employment

For our legitimate business purposes (the identification and consideration of appropriate candidates for appointment and keeping a record of that process)

Purpose:
To communicate with you

Legal Basis:
To take steps at your request with a view to entering into a contract of employment

For our legitimate business purposes (the identification and consideration of appropriate candidates for appointment)

Purpose: 
To provide information requested by you

Legal Basis:
For our legitimate business purposes (the identification and consideration of appropriate candidates for appointment)

Purpose: 
To monitor and improve our recruitment systems and processes

Legal Basis:
For our legitimate business purposes (the identification and consideration of appropriate candidates for appointment and keeping a record of that process)

Purpose:
To repay approved expenses incurred as part of our recruitment processes

Legal Basis:
Contract (to fulfill the agreement between us to repay approved expenses)

Purpose:
In relation to your attendance at our offices, including special category data to meet any access requirements

Legal Basis: 
To meet the firm’s legal obligations to provide appropriate access to our buildings and facilities

For our legitimate business purposes (ensuring business continuity, health and safety and physical and system security)

Purpose:
To fulfil our legal, regulatory and risk management obligations, including establishing, exercising or defending legal claims

Legal Basis: 
For our legitimate business purposes  (such as establishing, exercising or defending legal claims)

For compliance with legal and regulatory obligations to which Allen & Overy is subject

Purpose:
Diversity data

Legal Basis:
To meet the firm’s legal obligations to comply with equality legislation and legal and regulatory requirements to monitor and report on equality and diversity

Consent where there is no such legal or regulatory obligation

A cookie is a small text file that a website or application can send to your computer's browser to collect and record information about your use of that site or application.

A number of facilities on our website, www.allenovery.com, invite you to provide us with personal information, such as registering to use, signing into and otherwise using the careers section of our website. Our website uses Google Analytics, a web-based analytics tool that tracks and reports on the manner in which the website is used to help us to improve it. Please click here for more information on the use of cookies on our website, including how to refuse the use of cookies or withdraw your consent.

Our recruitment system, Kenexa, only uses cookies that are necessary to enable you to effectively use the online application system and which are deleted when you log out.

To find out more about cookies, including how to manage and delete them, www.allaboutcookies.org.

Your personal information shall be retained in accordance with our global data retention policy which categorises all of the information held by Allen & Overy and specifies the appropriate retention period for each category of data. Those periods are based on the requirements of applicable data protection laws, depending on the country in which you are applying, and the purpose for which the information is collected and used. For instance, we will keep a record of your name, email address, the fact that you applied and the outcome of your application indefinitely to compare against future applications. For more information on the period for which we retain your applicant information please contact recruitmentdata@allenovery.com.

In setting the data retention period, we will also take into account legal and regulatory requirements to retain the information for a minimum period, limitation periods for taking legal action, good practice and Allen & Overy’s business purposes.

We are an international business and any information that you provide to us may be shared with and processed by any entity in the worldwide network of Allen & Overy and our associated firms.  See ‘Data controllers’ below for more information on the Allen & Overy group.

We may also share your personal information with certain trusted third parties in accordance with contractual arrangements in place with them, including:

• Your recruitment agent, where you have engaged one, relating to the conduct and outcome of the application.
• IT and other service providers to Allen & Overy. For instance, our recruitment system, Kenexa, is powered by our service provider Infinite Talent. Infinite Talent’s servers will process personal data on behalf of Allen & Overy in the course of providing software and support for our recruitment system.
• Your nominated referees for the purposes of obtaining references for you.
• Our professional advisers and auditors.

You can login to our recruitment website using social media sites Facebook, LinkedIn and Twitter.  If you use these services, you should review their privacy policy for more information on how they deal with your personal information.

Where necessary, or for the reasons set out in this policy, personal information may also be shared with regulatory authorities, courts, tribunals, government agencies and law enforcement agencies.  While it is unlikely, we may be required to disclose your information to comply with legal or regulatory requirements. We will use reasonable endeavours to notify you before we do this, unless we are legally restricted from doing so.

If in the future we re-organise or transfer all or part of our business, we may need to transfer your information to new Allen & Overy entities or to third parties through which the business of Allen & Overy will be carried out.

We use a variety of technical and organisational measures to help protect your personal information from unauthorised access, use, disclosure, alteration or destruction consistent with applicable data protection laws.  

Allen & Overy LLP holds the internationally recognised security standard BS ISO/IEC 27001:2013 in respect of its document management and email systems and the supporting infrastructure for Allen & Overy’s offices globally. This is an independently verified certification that information security is managed in line with international best practice.

When we engage a third party service provider to collect or otherwise process personal information on our behalf, the third party is selected carefully and will be required to have appropriate security measures in place.

In order to administrate your application, we may need to transfer your personal information to locations outside the jurisdiction in which you submit it or where you are viewing the website for the purposes set out in this privacy policy. This may entail a transfer of your information from a location within the European Economic Area (the ‘EEA’) to outside the EEA, or from outside the EEA to a location within the EEA. Please see section on ‘Who we share your personal information with’ for more detail on how the information may be shared with Allen & Overy offices and third party service providers. 

The level of information protection in countries outside the EEA may be less than that offered within the EEA. Where this is the case, we will implement appropriate measures to ensure that your personal information remains protected and secure in accordance with applicable data protection laws. EU standard contractual clauses (as contemplated by Article 46(2) of the European Union’s General Data Protection Regulation) are in place between all Allen & Overy entities that share and process personal data. Where our third party service providers process personal data outside the EEA in the course of providing services to us, our written agreement with them will include appropriate measures, usually standard contractual clauses. 

Please contact us using the details at the end of this privacy notice if you would like to see a copy of the safeguards applied to the export of your personal data.

The European Union’s General Data Protection Regulation and other applicable data protection laws provide certain rights for data subjects.

You are entitled to request a copy of the information we hold about you and information about how we process it. You may also have a right in accordance with applicable data protection law to have it rectified or deleted, to restrict or suspend our processing of that information, to object to our processing of your information and, in some circumstances, to request receipt or transmission to another organisation, in a machine-readable form, of personal information relating to you that you have provided to us. You also have the right to lodge a complaint in relation to Allen & Overy’s processing of your personal information with a local supervisory authority. 

If you object to the processing of your personal information, or if you have provided your consent to processing and you later choose to withdraw it, we will respect that choice in accordance with our legal obligations. 

Your objection (or withdrawal of any previously given consent) could mean that we are unable to perform the actions necessary to achieve the purposes set out above (see section entitled ‘How we use your personal information’) or that you may not be able to make use of the services and products offered by us. Please note that even after you have chosen to withdraw your consent we may be able to continue to process your personal information to the extent required or otherwise permitted by law, in particular in connection with exercising and defending our legal rights or meeting our legal and regulatory obligations.

We must ensure that your personal information is accurate and up to date. If you wish to update any aspect of your current application, please communicate this to your Allen & Overy recruitment team contact. After that, please advise us of any changes to your information by emailing us at recruitmentdata@allenovery.com.

In most cases, the controller of your personal information in relation to our application and recruitment processes will be the A&O entity to which you apply. Please click here for details of which Allen & Overy entity will be the data controller in each country and, where necessary having regard to local applicable data protection or privacy laws, a country-specific privacy notice.

In certain circumstances, Allen & Overy LLP or another A&O entity may also be a controller of your personal information. For example, Allen & Overy LLP will also be a data controller in relation to certain personal data accessible via global systems, such as our recruitment system, Kenexa.

Any changes we make to this privacy policy in the future will be posted on this page. The updated privacy policy will take effect as soon as it has been updated or otherwise communicated to you.

This privacy policy was last updated in [April] 2023.

If you need further information or have any questions or complaints about our privacy policy or practices, please contact our Chief Privacy Officer using the details below:

Chief Privacy Officer
Allen & Overy
68 Donegall Quay
Belfast
Northern Ireland
BT1 3NL

Email: DataPrivacy@allenovery.com

Tel: +44 (0) 28 9060 7500