Allen & Overy values your privacy and cares about the way in which your personal information is treated.
This policy describes:
- what personal information we collect about you
- how we obtain your personal information
- how and on what basis we use your personal information
- how long we keep your personal information
- who we share your personal information with
- how we protect your personal information
- which countries we transfer your personal information to
- your rights regarding your personal information
- who are the data controllers
- who to contact with questions or concerns
- How we obtain your personal information
- What personal information do we collect about you?
- Who are the data controllers
- How we use analytics and cookies
- How we use your personal information
- How long we keep your personal information
- Who we share your personal information with
- How we protect your personal information
- Which countries we transfer your personal information to
- Your rights regarding your personal information
- Who to contact with questions or concerns
How we obtain your personal information
- We collect personal information from you when you submit an application and other material to Allen & Overy during the recruitment and application process
- We collect your personal information during interviews and assessment exercises
- We collect personal information from partners and staff of Allen & Overy as a result of an internal recommendation or referral or generated in the course of our recruitment processes
- We collect personal information from you when you contact or communicate with us (including through the website, the Graduate app, by email or otherwise)
- We collect your personal information while monitoring the Graduate website and our other technology tools (such as email)
- We gather personal information about you when you provide it to us, or interact with us directly, for instance engaging with our staff at a recruitment fair or other event
- We may collect or receive personal information about you from other sources, such as from your referees or, if you are offered and accept a Training Contract, we will also receive information about you from our law school partner (BPP) in connection with your studies on the Graduate Diploma in Law (if applicable to you) and the Allen & Overy MA Legal Practice Course (LPC) with Business.
What personal information do we collect about you?
We collect and generate personal information during the course of our recruitment processes, including:
- Basic information about you, such as your name (including name prefix or title), date of birth, gender, marital and family status, maiden name, place of birth, residency, nationality, immigration status and work authorisation
- Contact information, such as your postal address, email address and phone number(s)
- Educational and experience information, such as education/academic history, CV, place of study, subject of study, years of study, records of qualifications and/or training, results, extracurricular interests and activities, language skills, personal statements, work experience, and answers to questions relevant for the role you have applied for, and other applicant/recruitment information (such as interview notes and outcome of application)
- Payment information, including bank account information (for instance, where we require this information to reimburse expenses or, if you are offered and accept a Training Contract with the firm, to pay any financial support we agree to pay to you)
- Health-related information, as permitted or required by applicable law, for instance where we need to know this information to make adjustments to our recruitment processes
- Diversity-related information including in relation to disabilities, ethnicity, sexuality, religion and social background. The diversity data collected and processed will depend on, and only be collected in accordance with, applicable local laws. Where applicable, it will form part of the application process and will be apparent at the point of collection
- Information you provide to us for the purposes of attending Allen & Overy seminars, training and other events, including access and dietary requirements, and information generated by us in connection with your attendance, such as CCTV and access records
- Technical information to the extent that it constitutes personal information, including your IP address and other online identifiers, and information about your access to and use of the Graduate website (such as your access dates/times or what areas of the website you have visited)
We use the Graduate app to collect personal information of students and potential applicants when the Allen & Overy graduate recruitment team attend recruitment fairs and other events. The personal information we collect from you via the Graduate app includes your name and contact information as set forth in the section above.
If we do not collect, or you do not provide, your personal information to us, you will not be able to take part in our recruitment processes and we will not be able to respond to your communications or requests for information.
Who are the data controllers
In most cases, the controller of your personal information in relation to our application and recruitment processes will be the Allen & Overy entity to which you apply. Please visit here for details of the Allen & Overy entity through which we practise law in each jurisdiction and, where necessary having regard to local applicable data protection or privacy laws, a country-specific privacy notice.
In certain circumstances, Allen & Overy LLP or another Allen & Overy entity may also be a controller of your personal information. For example, Allen & Overy LLP will also be a data controller in relation to certain personal data accessible via global systems, such as our recruitment application website, IBM Kenexa.
How we use analytics and cookies
Our website uses Google Analytics, a web-based analytics tool that tracks and reports on the manner in which the Graduate website is used to help us to improve it. Google Analytics does this by placing small text files called ‘cookies’ on your device. Cookies enable a website to recognise and remember your device when you visit the site. The information that the Google Analytics cookies collect, such as the number of visitors to the site, the pages visited and the length of time spent on the site, is aggregated and anonymous.
How we use your personal information
Allen & Overy collects and processes personal information about you in a number of ways, including through your use of our Graduate website and the Graduate app. We have set out below the principal purposes for which we use your personal information and the legal basis (as set out in data protection law) that we rely on to justify this use of your information.
To provide the Graduate website, Graduate app and application process to you
For our legitimate business purposes (ie the provision of the Graduate website, Graduate app and application process) and, depending on the circumstances, to perform a contract between you and us
For recruitment purposes if you apply for a career opportunity with us, such as a vacation scheme, Training Contract or other schemes or opportunities we offer, including to process and assess your application and consider your suitability for the career opportunity
For our legitimate business purposes (ie to assess and consider your application for a career opportunity with us) and, depending on the circumstances, to take steps prior to entering into a contract between you and us To comply with any legal obligations that apply to us in relation to this purpose, such as to establish eligibility to work
For diversity and equality monitoring purposes
We may process diversity information for our legitimate interests (ie to ensure the diversity of our workforce) and for compliance with legal obligations to which we are subject We will request your consent in circumstances where it is required by applicable law
For remuneration and reimbursement purposes, in particular to reimburse expenses and, if you are offered and accept a Training Contract with the firm, to pay any financial support we agree to pay to you
For our legitimate business purposes (ie to reimburse expenses of those who wish to pursue a career opportunity with the firm) and, depending on the circumstances, to perform a contract between you and us
If you are offered and accept a Training Contract, for training purposes and otherwise in preparation for you joining Allen & Overy
For our legitimate business purposes (ie to ensure our future trainees receive appropriate training and experience) and, depending on the circumstances, to take steps prior to entering into a contract between you and us or to perform a contract between you and us
To audit and monitor the use of the Graduate website and Graduate app, and our other technology tools
For our legitimate business purposes (ie the provision of the Graduate website, Graduate app and application process, as well as to improve and ensure the security of these resources)
We may request your consent in circumstances where a legal justification over and above legitimate interests is required by applicable law (eg in relation to our use of certain cookies)
To provide information requested by you and to communicate with you
For our legitimate business purposes (ie to provide information that you request and otherwise communicate with you in connection with Allen & Overy graduate recruitment)
We may request your consent in circumstances where a legal justification over and above legitimate interests is required by applicable law
To organize and host seminars, training and other events that you attend (including vacation schemes)
For our legitimate business purposes (for example, we run events to enable applicants to better understand the recruitment process and what it is like to work for Allen & Overy; we will also collect data to facilitate your visit to our premises and maintain the security of our premises)
We may also process personal information to ensure compliance with the firm's legal obligations to provide appropriate access to its premises and comply with health and safety requirements
To improve the Graduate website, Graduate app and application process
For our legitimate business purposes (ie the provision and improvement of our Graduate website, Graduate app and application process)
To provide information about our users and related usage information to third parties providing support for the Graduate website, Graduate app and application process
For our legitimate business purposes (ie the provision and support of the Graduate website, Graduate app and application process)
To fulfil our legal, regulatory and risk management obligations, including establishing, exercising or defending legal claims
For our legitimate business purposes and for compliance with legal obligations to which we are subject
How long we keep your personal information
Who we share your personal information with
We are an international law firm and any information that you provide to us may be shared with and processed by any entity in the worldwide network of Allen & Overy and our associated firms. You can see a list of our offices here.
Allen & Overy’s careers application website is powered by the IBM® Kenexa® BrassRing. IBM serves as a processor for Allen & Overy and will have access to personal information.
If you are offered and accept a Training Contract, we will also share your information with our law school partner (BPP). For example, we will share your information with BPP so that they can enroll you on the Graduate Diploma in Law (if applicable to you) and the Allen & Overy MA Legal Practice Course (LPC) with Business.
We also share your personal information with certain trusted third parties in accordance with contractual arrangements in place with them, including:
- Our professional advisers and auditors
- IT and other service providers
- Third parties involved in hosting or organising seminars, training and other events
Where necessary, or for the reasons set out in this policy, personal information may also be shared with regulatory authorities, courts, tribunals, government agencies and law enforcement agencies. While it is unlikely, we may be required to disclose your information to comply with legal or regulatory requirements. We will use reasonable endeavours to notify you before we do this, unless we are legally restricted from doing so.
If in the future we re-organise or transfer all or part of our business, we may need to transfer your information to new Allen & Overy entities or to third parties through which the business of Allen & Overy will be carried out.
We do not sell, rent or otherwise make personal information commercially available to any third party, except with your prior permission.
How we protect your personal information
We use a variety of technical and organisational measures to help protect your personal information from unauthorised access, use, disclosure, alteration or destruction consistent with applicable data protection laws. Allen & Overy LLP holds the internationally recognised security standard BS ISO/IEC 27001:2013 in respect of its document management and email systems and the supporting infrastructure for Allen & Overy’s offices globally. This is an independently verified certification that information security is managed in line with international best practice.
When we engage a third party service provider to collect or otherwise process personal information on our behalf, the third party is selected carefully and will be required to have appropriate security measures in place.
Which countries we transfer your personal information to
The level of information protection in countries outside the EEA may be less than that offered within the EEA. Where this is the case, we will implement appropriate measures to ensure that your personal information remains protected and secure in accordance with applicable data protection laws. EU standard contractual clauses (as contemplated by Article 46(2) of the European Union’s General Data Protection Regulation) are in place between all Allen & Overy entities that share and process personal data. Where our third party service providers process personal data outside the EEA in the course of providing services to us, our written agreement with them will include appropriate measures, usually standard contractual clauses. For more information about the measures in place, please contact us (see section below 'Who to contact with questions or concerns').
Your rights regarding your personal information
The European Union’s General Data Protection Regulation and other applicable data protection laws provide certain rights for data subjects.
You are entitled to request a copy of the information we hold about you and information about how we process it. You may also have a right in accordance with applicable data protection law to have it rectified or deleted, to restrict or suspend our processing of that information, to object to our processing of your information and, in some circumstances, to request receipt or transmission to another organisation, in a machine-readable form, of personal information relating to you that you have provided to us. Where we rely on your consent to process your personal information, you have the right to withdraw your consent at any time. You also have the right to lodge a complaint in relation to our processing of your personal information with a local supervisory authority.
If you object to the processing of your personal information, or if you have provided your consent to processing and you later choose to withdraw it, we will respect that choice in accordance with our legal obligations.
Your objection (or withdrawal of any previously given consent) could mean that we are unable to perform the actions necessary to achieve the purposes set out above (see section entitled ‘How we use your personal information’). Please note that even after you have chosen to withdraw your consent we may be able to continue to process your personal information to the extent required or otherwise permitted by law, in particular in connection with exercising and defending our legal rights or meeting our legal and regulatory obligations.
We must ensure that your personal information is accurate and up to date. Therefore, please advise us of any changes to your information by emailing us at firstname.lastname@example.org. You may also update certain categories of information using your account on our careers application website.
Who to contact with questions or concerns
Application questions: If you have questions about or need additional assistance with the Graduate website or recruitment and application process, please contact email@example.com.