Paul, Weiss is committed to protecting your privacy. This includes observing relevant legal and regulatory requirements and employing appropriate security measures in order to protect your personal information.

This Privacy Notice explains how and why we collect and use your personal information when you access our website, use our services and/or otherwise engage with us. It also explains certain legal rights that you have under the applicable data protection laws. If you have any questions, please contact us at privacy@paulweiss.com.

Personal Information We Collect and Use

For the purposes of this Notice, personal information is defined as any information, electronically or otherwise recorded, related to an identified or identifiable natural person within the People’s Republic of China (PRC). It does not include deleted information or anonymized information that cannot be used to identify a specific natural person. We may collect personal information from you:

• When you provide it to us or we collect it from third parties during the course of our providing legal advice, representation, or services to you;
• When you send us such information, such as when you submit forms on our websites or when you submit questions or requests to us;
• When you visit any of our websites, as part of general analytics on visitors to such sites (see notice on cookies for more information);
• When you contact us by any means, as we may keep a record of that correspondence;
• When you visit our offices or attend our events; and
• When you consent to provide your personal information, we may collect special categories of personal information in connection with registration for and access to our events or affinity groups.

The specific personal information that we may collect from you and our purpose for using it will depend on the nature of your relationship with us. For example, we may collect contact information, including name, phone number, and email address, as well as payment details from you when you engage us to provide legal services. We may collect your educational and employment information when you apply for a job with us.

In the course of providing you legal advice, representation, or services, you may provide us personal information about others, such as your employees, directors, or business contacts. It is your responsibility to ensure that you have a legal basis to process such information and transfer it to us. Once it is transferred to us, we may then process and disclose such personal information as described in this Privacy Notice.

How We Use Your Personal Information

We may use personal information we collect about and from you to:

• Provide you legal advice, representation, or services;
• Manage our business relationship with you, for example, as part of billing and collection;
• Respond to your requests;
• Enable your participation in events and affinity groups;
• Confirm your identity and allow us to carry out checks in the interest of security and to prevent fraud;
• Carry out our obligations under any contracts entered into between you and us;
• Notify you about any changes to our services or our websites;
• Comply with legal and regulatory requirements that apply to us, enforce our terms and conditions, and protect our rights, privacy, safety, or property, or that of our affiliates, you, or others; or
• Improve the services that we offer.

From time to time we may contact you to provide you with information on our services or events that we think may be of interest to you. We will not contact you with such marketing communications unless, in accordance with applicable laws, you have consented to such contact or we have a legitimate interest, for example, if our contact relates to services that we have already provided to you. You have the right to ask us not to process your personal information for marketing purposes at any time. You can exercise your right to prevent such processing by:

• Replying directly to the marketing message;
• Unsubscribing from marketing messages by clicking the appropriate link in any email you receive; or
• Contacting privacy@paulweiss.com.

We may use or otherwise process your personal information on the grounds of one or more of the following lawful bases for processing:

• Your consent (in which case we will tell you at the time our purposes for using your personal information);
• In the course of providing legal advice, representation, or services to you;
• For the performance of a contract with you or to take steps at your request prior to entering into such a contract;
• To comply with our legal obligations; or
• Because of our or your legitimate interests in:
  • Providing you legal advice, representation, or services,
  • Ensuring the quality of the services we provide to you, or
  • Communicating with you.

Please note that in accordance with the Personal Information Protection Law and other applicable laws and regulations, your personal information may be collected and used without your consent in the following circumstances:

• The processing is necessary for the conclusion or performance of a contract to which you are a party;
• The processing is necessary for our performance of statutory duties or obligations;
• The processing is necessary to respond to public health emergencies or for the protection of life, health, and property safety of natural persons in emergencies;
• The personal information is reasonably processed for news reporting, media supervision, and other activities conducted in the public interest;
• You have disclosed the personal information or it has been otherwise legally disclosed and it is reasonably processed in accordance with relevant laws and regulations;
• Other circumstances as provided by laws or administrative regulations.

When We Share Your Personal Information

We do not sell your personal information. We may share your personal information with others, under the following circumstances:

• We will provide your personal information to our service providers to allow them to assist us with delivering the legal and other services that you have requested, such as:
  • Accountants,
  • Auditors,
  • Credit reference agencies,
  • Information technology and information security providers,
  • Legal service and technology providers,
  • Other industry or subject-matter experts, or
  • Records management providers.
• We will share personal information with third parties as required in the course of providing you legal advice, representation, or services, including with respect to litigations, arbitrations, investigations, and transactions.
• We will share personal information with law enforcement agencies, governmental authorities, or regulators where we are under a duty to disclose or share such information in order to comply with any legal or regulatory obligation, or if we reasonably consider that this is necessary to help prevent or detect fraud or other crime or to protect the rights, property, or safety of Paul, Weiss, our clients, or others.
• We will disclose personal information if you have consented to any disclosure to a third party.

Where We Transfer, Use, and Store Your Personal Information

We provide services based on our resources and servers worldwide. Personal information about you collected by our Hong Kong office during the provision of legal services will be stored in the Hong Kong SAR, China. Personal information collected in other circumstances set forth in this Notice will be stored within mainland China and will not be transferred overseas. If it becomes necessary to transfer your personal information overseas—for example, where you require an opinion for a foreign law expert—we will do so in strict compliance with relevant laws and regulations, such as by obtaining your prior consent, redacting sensitive personal information, signing agreements with receiving parties, and/or conducting cross-border data transfer security assessments.

As discussed, we may also transfer your personal information to third party service providers that may be located within or outside of the PRC, to enable them to use and store your personal information on our behalf. We have in place a program to contractually obligate our third party service providers to provide your personal information with an essentially equivalent level of protection as that provided by us pursuant to this notice. With service providers located outside of the PRC, we have contracts in place that are consistent with the standard contract provisions promulgated by the Cyberspace Administration of China (CAC) under the Guidelines for Filing the Standard Contract for Outbound Transfer of Personal Information. This program also ensures that, where your information is transferred to any jurisdiction outside of your home country, the transfer is done in compliance with relevant data protection legislation, regulations, and guidelines issued by relevant supervisory authorities. The specific names and contact information of these third parties and the types of personal information that we will provide depend on the circumstances of each engagement. You can request further details by contacting privacy@paulweiss.com.

How Long We Keep Your Personal Information

We will keep your personal information only for as long as necessary depending on the purpose for which it was provided and the periods specified in relation to the relevant system in our data protection policies.

When determining how long we will keep your personal information, we will take into account various factors, including:

• Legal obligations under applicable law to retain data for a certain period of time;
• Our legal and ethical obligations as lawyers;
• Statute of limitations under applicable law(s);
• Status of ongoing legal engagements;
• Your withdrawal of consent (where applicable);
• Potential disputes; and
• Guidelines issued by relevant supervisory authorities.

How We Protect the Security of Your Personal Information

We have put in place measures to protect the security of your personal information.

These measures are intended to prevent your personal information from being accidentally lost, altered, disclosed, or used or accessed in an unauthorized way. In addition, we limit access to your personal information to only those employees, agents, contractors, and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

We have procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Unfortunately, the transmission of information via email is not secure. Therefore, if you use email for communicating with us, we cannot guarantee that it will remain confidential while in transit.

Your Rights

According to the relevant laws, regulations and standards in China, you have the following rights:

• Accessing, copying and correcting your personal information
  • You are entitled to access, copy, and correct your personal information, unless otherwise stipulated by laws and regulations.
• Deletion of your personal information
  • You can request the deletion of your personal information under certain circumstances according to relevant laws and regulations. Please be aware that, pursuant to applicable laws and regulations, if the statutory retention period has not expired or if it is technically difficult to delete your personal information, we will securely store your personal information, take necessary security measures, and isolate it from any further processing.
• Restricting or objecting to processing
  • Please understand that the provision of all our services requires certain basic personal information. You can restrict or object to the processing of additional personal information, which may affect your use of certain of our services.
• Modifying consent
  • You can also modify your consent for the collection, use, and disclosure of your personal information.
• Conditional right to transfer personal information
  • You may transfer your personal information to other platforms, enterprises, or organizations if the transfer complies with relevant laws and regulations. We will review your request and if you pass the review, we will provide you with channels to transfer the corresponding personal information.

While you will usually not have to pay a fee to exercise these rights, in some cases, we may charge a reasonable fee if your request for access is clearly unfounded or excessive, or if you request multiple copies of the same information. Alternatively, we may refuse to comply with the request in such circumstances. We may need to request specific information from you to help us confirm your identity and ensure your right to access the information or to exercise any of your other rights.

We may also reject your request to exercise the above rights under the following circumstances:

• Related to our compliance with the applicable laws, regulations, and ethical rules and obligations;
• Directly related to national security;
• Directly related to public security, public health, or major public interests;
• Directly related to criminal investigations, prosecutions, trials, or the enforcement of court decisions;
• Responding to your request will cause serious harm to your legitimate rights and interests, or those of other individuals or organizations.

Please contact us at privacy@paulweiss.com if you wish to exercise any of these rights, if you wish to designate an authorized agent to exercise any of these rights on your behalf, if you wish to request further information about any of the above rights, or if you are unhappy with how we have handled your personal information. We will respond to your inquiry within the timeframes required by applicable laws and regulations.

If you are not satisfied with our response or believe our processing of your information does not comply with data protection law, you can make a complaint to the CAC: http://www.cac.gov.cn/ or relevant supervisory authorities.

Changes to Our Privacy Notice

We keep our Privacy Notice under regular review, and last updated it on November 14, 2023. Any future changes will be reflected within an updated version of this "Privacy Notice" and will be available on our website. Where appropriate, we may directly notify you of changes by email.

Contacting Us

It is important that the personal information that we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with us.

If you ever have any questions, comments, or complaints about this notice or any of its contents, please contact us at privacy@paulweiss.com and we will be pleased to assist you.