1. Scope

This Notice describes how Freshfields Bruckhaus Deringer LLP and our related entities (collectively, “Freshfields, “Firm”, “us”, “we”) process personal data when you apply for a position with us, including traineeships, work experience or recruitment events and during any subsequent selection and onboarding process.  

As a firm with a global presence, we are subject to the varying requirements of Applicable Data Protection Laws within the jurisdictions where we operate. Although our approach to data protection and privacy across our business aims to be as consistent as possible and to accord with Applicable Data Protection Laws, the specific requirements, rights and obligations relating to personal data can be different.

In this Recruitment Privacy Notice, the descriptions of any rights and obligations will only apply where the processing is within the scope of the GDPR. Where we operate in jurisdictions with Applicable Data Protection Laws which are substantially different from the GDPR, the information below (in particular the rights and obligations described and limitations on processing) do not necessarily apply.

For candidates applying for roles in locations outside of the EU and UK, please also refer to our regional supplements below which provide further relevant information including office contact details and how to exercise your rights under Applicable Data Protection Laws. Where there is any inconsistency between a regional supplement and this Recruitment Privacy Notice, the regional supplement shall prevail.

2. Definitions

Where we use terms such as “processing”, “personal data”, “processor”, “controller”, “data subject”, these will take their meaning given in the GDPR and where applicable, the UK GDPR. Where other Applicable Data Protection Laws apply, the above expressions shall bear their respective meanings given under the relevant law or where no equivalent expression exists, be interpreted in a manner which is consistent withs such laws.

Freshfields Bruckhaus Deringer refers to the international legal practice operating through Freshfields Bruckhaus Deringer LLP, a limited liability partnership incorporated in England and associated entities and undertakings incorporated or formed in the USA (Freshfields Bruckhaus Deringer US LLP, a limited liability partnership incorporated in New York), in Hong Kong (Freshfields Bruckhaus Deringer, a partnership registered in Hong Kong), in Japan (Freshfields Bruckhaus Deringer Law Office and Freshfields Bruckhaus Deringer Foreign Law Office), in Singapore (Freshfields Bruckhaus Deringer Singapore Pte. Limited), in Italy (Studio Legale associato a Freshfields Bruckhaus Deringer) in Germany and Spain (Freshfields Bruckhaus Deringer Rechtsanwälte Steuerberater PartG mbB), in Austria (Freshfields Bruckhaus Deringer Rechtsanwälte PartG mbB) and by means of a number of other associated entities and undertakings (each a “Freshfields Entity”).

Applicable Data Protection Laws means any laws, regulations, requirements relating to the processing of personal data applying to Freshfields Entities including, where applicable within the U.K and Central Europe: the General Data Protection Regulation (Regulation (EU) 2016/679)(“GDPR”) and as it applies within the U.K, the UK GDPR, within China, the Personal Information Protection Law, within Hong Kong, the Personal Data (Privacy) Ordinance; within Japan, the Act on the Protection of Personal Information (Act No. 57 of 2003), within Singapore, the Personal Data Protection Act; within Vietnam, the Law on Cyber Information Security (Law No. 86/2015/QH13) and the Law on Cyber Security (Law No. 24/2018/QH14; within the Dubai International Financial District, the DIFC Data Protection Law No.5 of 2020; within Bahrain, the Law No.30 of 2018 with respect to Personal Data; and within the Abu Dhabi Global Market (ADGM) in the Emirate of Abu Dhabi in the UAE, the ADGM Data Protection Regulations 2021, and within our United States offices, California Consumer Privacy Act 2018 and as replaced as from 1 January 2023, the California Consumer Rights Act 2020.

3. Types of Personal Data We Process

We may process personal data when you register for an account with us and where you submit an application for a role with Freshfields. The type of personal data we process will depend on the type of role you apply for, the location of your role and whether you are successful with your application. We may process some limited personal data when you register an account but do not proceed with submitting your application. We may process the following types of data:

3.1. Identity data such as your name, address, email address, telephone number, and date of birth and other direct identifiers such as ID documentation, where this is permitted by Applicable Data Protection Laws;

3.2. Application data such as your professional experience and education including where relevant: university degrees, academic records, certifications, awards and achievements, employment history including details of current and previous employer, referees, date of admission, jurisdiction of qualification, professional regulatory history, language skills, your references and right to work information and any other information that you provide in support of your application;

3.3. Technical data such as your login information, your IP address, operating system or other meta-data which is automatically collected when you access the Workday application portal or our websites. For information on how we use cookies, plug-ins and similar technology, please refer to our Cookie Notice available here. For information on how cookies are used by Workday when you access their recruitment portal, please click here Cookie Notice | Workday. 

3.4. Sensitive data such as your health, disability and age, criminal offence information;

3.5. Other information that you may provide to us voluntarily in the course of the recruitment process.

4. Sources of Personal Data

Most of the personal data we process is provided directly by you when you submit this information to us with your application or when you participate in the interview process. 

We may also receive personal data about you indirectly. For example, when you have been referred for a position at Freshfields or when we receive additional information from third parties such as your nominated referees or previous employers. We may also collect information about you from publicly available information in the course of pre-employment checks (as described in Section 5 (“Why do we process your personal data?”).

5. Why Do We Process Your Personal Data?

We may process your personal data to:

• assess your suitability and eligibility for a position or opportunity you have applied for;
• comply with immigration, employment or any other laws or regulations that apply to us;
• take steps prior to entry into an employment agreement with you if your application is successful;
• pursue our legitimate interests where permitted under Applicable Data Protection Laws, which are not overridden by your rights and freedoms, having regard to the safeguards we put in place such as those described in Section 10 (“International Transfers”);
• protect Freshfields’s systems, business information and employees, including where necessary for the exercise or defence of legal claims or other professional reporting requirements;
• we may contact you to ask for your consent as to whether you want to be contacted about future career opportunities with us;
• conduct pre-employment checks where permitted, which may include verification of information contained within your application, criminal history, financial history or other information that may be required to establish your education and/or qualifications.

6. What Are the Lawful Bases for Our Processing?

We may process your personal data because this is necessary for us to review your application or offer you future job opportunities with your consent.

By checking the box against the statement “I have read the Freshfields Recruitment Privacy Notice and I am happy to proceed”, you will indicate your consent to our processing of personal data for these purposes. You may withdraw your application and your consent at any time in the manner described below. However, if you do withdraw your consent, we may not be able to progress your application or make you an offer of employment, where we are considering this.

Where we are considering your application with a view to offering you a position, we may process your personal data at your request prior to entry into a contract with you.

We may also process your personal data in order for us to:

• comply with any Applicable Data Protection Laws including in respect of immigration, tax, professional or employment law obligations; and/or
• protect the security and integrity of our systems, assets, information, or colleagues and where permitted, we will rely on these as legitimate interests.

We may process sensitive data about you such as information concerning your physical or mental health to assess whether there are any reasonable adjustments that we may need to make in the recruitment process. If you are successful in your role, we may request further information concerning your health in order to provide you with any benefits to which you are entitled. In our UK and European offices, the legal basis on which we rely is to perform our legal obligations, to exercise or defend legal claims, where processing is necessary to carry out rights or obligations in the field of employment, social security, social protection law or in the case of discretionary benefits, with your explicit consent.

7. Diversity and Inclusion Data (Applicable to UK only)

We are very careful about how we use diversity and inclusion data and always, in an ethical, confidential and lawful manner, which is our top priority. Where you have opted to share diversity and inclusion data with us such as your nationality, racial and ethnic origin, gender, sexual orientation or religion, your personal data will be accessible to only a small number select individuals within the Global Diversity and Inclusion Team and HR.

We collect this data in order to identify and keep under review the existence or absence of equality of opportunity between specified groups of people in order to promote such equality.

Personal data which is collected from your responses to the “Voluntary Disclosure” section of the application may be used by Freshfields to comply with our regulatory reporting obligation in respect of diversity and gender pay gap reporting. In each case, your information will be aggregated with other colleagues’ data and will be shared with the regulatory authorities anonymously.

We may also process your personal data to create aggregated and anonymous statistics to inform our diversity and inclusion strategy and to track our progress against Freshfields targets. In some cases, we may share anonymised statistics on our diversity levels externally, such as on our website or with our clients.

If you opt in to provide responses in the “Voluntary Disclosure” section of the application, we may process any personal data in order to perform our legal obligations in respect of employment or for statistical purposes in the public interest where use such personal data to create aggregated and anonymous statistics for equal opportunities monitoring.

8. Who Will Receive My Personal Data?

We take great care to ensure your personal data is only processed where this is strictly necessary and for the purposes described above. Your personal data may be shared internally with certain members of the HR team, hiring managers and other individuals who have a need to know the information or who are actively participating in the recruitment process you are taking part in.

A number of Freshfields Entities may need to process your personal data. Ordinarily, the Freshfields Entity where you apply for a role will process your personal data as an independent data controller.

Where different Freshfields Entities act as joint controllers, Freshfields Bruckhaus Deringer LLP is designated as sole point of contact to respond to any questions you may have about how we process your personal data and to exercise your rights. For more information or if you would like to contact us, please find the relevant contact details below or in the event you apply for a role outside the UK and EU, within the relevant Regional Supplement.

We may share your personal data with third parties who process data on our behalf, including where we engage external recruitment agencies to assist us with the recruitment process or data processors such as IT service providers that store data on our behalf. We use Workday as our provider for all recruitment activities, which securely stores your personal data for us once you have created an account with them.

We may also share your personal data with our third-party provider, First Advantage in order to carry out necessary pre-employment checks, in the event that you accept an offer of employment from us.

We may also share your personal data to the extent that we are required by law, with certain public authorities such as law enforcement or professional or regulatory authorities. If this is necessary for our exercise or defence of legal claims, we may also share your personal data with our insurers or professional advisors.

9. Retention

We will not retain your personal data for longer than is necessary to fulfil the purposes described above. If we no longer have a legal ground to retain your personal data, we will erase the information securely, or in some cases anonymise it.

If your application is successful, your personal data may be further processed in relation to your future employment with us, and to allow us to comply with any legal requirements required of us as employer (Please see Section 12 (“Processing at Offer Stage”)).

If you are unsuccessful, we will retain your data for a period of 6 months after the completion of the application process and the last communication relating to the outcome of your application has been sent. In the case of training contract applicants, this period is 12 months. 

Where you have consented for us to contact you about future career opportunities at Freshfields, we may retain your personal data for an additional period of 24 months. We may contact you again from time to time, to check if you would like to continue to be contacted by us about future career opportunities.

10. International Transfers

As a global law firm, we may need to share your personal data to other Freshfields Entities or third parties in other locations. Adequate safeguards for personal data transfers within Freshfields (and where necessary with other third parties working with or for us in respect of your application) will be ensured through standard contractual clauses; with your consent; or on the basis that the transfer is otherwise compliant with Applicable Data Protection Laws. Additionally, within Freshfields we have in place binding firm-wide data protection and information security policies which govern our internal data processing activities.

Any personal data you provide to us through Workday will be securely stored within Workday’s cloud servers located in the UK.

11. Possible Consequences

There are no negative consequences if you do not wish to provide us your personal data in the context of submitting an application. However, without providing your personal data it will not be possible to progress your application and your application will be closed. Incomplete or incorrectly completed applications cannot be considered.

12. Processing at Offer Stage

If you accept an offer from us, we will process further personal data preparatory to our contract with you.

Where you have been successful with an application, it will be necessary for us to verify certain details you have submitted. We will also conduct pre-employment background checking. Depending on the nature of your role and where local law requires and/or permits this (for example where it is required to meet certain professional regulatory standards), we may request our third-party screening provider to undertake criminal and/or financial history checks as a part of the final screening process. Where such checks are conducted, we will ensure that appropriate safeguards are in place to protect your personal data, including minimising access to such data.

Our Staff Privacy Notice which will be provided with you prior to your employment, will apply to any processing of personal data we conduct whilst you are an employee. If you have accepted an offer for a student vacation scheme or graduate placement, you will be provided with a separate notice at a later point.

13. Automated Decision Making

We do not currently use any automatic decision making as part of our recruitment processes.

14. Your Rights

If you wish to exercise your rights, you can get in touch with us by contacting:

Global Data Protection Officer

(Legal Department)

Freshfields Bruckhaus Deringer LLP

100 Bishopsgate, London EC2P 2SR

Telephone: +44 20 7716 4000

Email: dataprivacy@freshfields.com

For processing conducted by Freshfields Bruckhaus Deringer Rechtsanwälte Steuerberater PartG mbB in Germany and Freshfields Bruckhaus Deringer Rechtsanwälte PartG mbB in Austria, a Data Protection Officer has been appointed who may be contacted as follows:

Dr. Karsten Kinast, LL.M.

KINAST Rechtsanwaltsgesellschaft mbH

Hohenzollernring 54

50672 Cologne

Germany

Phone: +49 (0)221 - 222 183 0

Fax: + 49 (0)221 - 222 183 10

E-mail: FBD@kinast.eu

Website: https://www.kinast.eu/en/

For all other Freshfields Entities in Europe you can find contact details of the relevant data controller on our Legal Notices page here.

You also have the right to lodge a complaint:

• by using the contact details above; and/or
• with a competent supervisory authority.