Privacy Policy

This Privacy Policy applies to personal information collected online by Vorys, Sater, Seymour and Pease LLP, its subsidiaries, or affiliates (collectively, “Vorys” or “we” or “us” or “our”) through its websites, microsites, or mobile sites that expressly adopt, display or link to this Privacy Policy (collectively, the “Website”). “Social Media Pages” are the official social media pages we operate on Facebook, Twitter, LinkedIn, and other social media platforms.  If you have any questions about these definitions or anything else in this Privacy Policy, please contact us.

This Privacy Policy answers the following questions:

1. What information does Vorys collect about you on our Website?
2. How do we collect your information?
3. How do we use the information we collect about you?
4. How long do we keep your information?
5. How does Vorys share information with Service Providers and Third Parties and for what purposes?
6. What are my privacy choices?
7. How does Vorys address children’s privacy?
8. How does Vorys secure personal information on our Website?
9. How does our Website interact with third-party websites and content?
10. Where is personal information stored and processed?
11. What other terms govern my use of the Website?
12. Will this Privacy Policy change?
13. Your U.S. State Privacy Rights
14. Your EEA/UK Privacy Rights
15. Your Canadian Privacy Rights
16. How may I contact Vorys?

1. What information does Vorys collect about you on our Website?

We may collect different types of information about our Website visitors, including:

• Device Information: When you visit our Website, interact with our Social Media Pages or online ads, or open our emails, we learn about your browser, device type, IP address, internet service provider, and other technical information about your device.
• Location Information: We use various technologies to learn your geographic location, including by collecting your IP address or other device information, which may depend on your device’s settings for location services.
• Contact Information: We may collect contact information, which includes personal information like your name, email address, phone number, and home or business address.
• Call and Email Records: If you call or email us, we may keep records of those conversations.
• Website Interactions: We collect information about your interactions with our Website including pages visited, links clicked, buttons clicked, mouse movement, and scroll behavior. This information may then be used to replay your interaction, which may be used to troubleshoot Website issues, either individually or in the aggregate, to improve Website functionality and to analyze user interaction. This information could include personal information, depending on what information you provide.
• Submitted Content: We collect any content you submit to our Website, Social Media Pages, or to us in person including comments, photos, or videos.
• Demographic Information: We have access to demographic details about our customers like birthdate, gender, ZIP code, and other similar details.

• Job Applications: If you apply for employment, we have access to the content you provide such as your resume, cover letter, and any information contained therein.

• Social Media Usage: We receive aggregated information about people who visit and interact with our Social Media Pages. “Aggregated” means information that doesn’t include personal information associated with identified natural persons.

2. How do we collect your information?

We may collect the information described above directly from you, from third parties we partner with, or through cookies or other automated means. These sources may include:

• You: We collect information directly from you, whenever you: visit our Website; contact us with questions or comments; engage our services; upload content to our Website or Social Media Pages; complete forms for or provide information in connection with a job application; or fill out any forms on our Website or Social Media Pages.
• Your device or browser: Certain information is automatically collected from your device or browser and analyzed when you visit our Website, interact with our Social Media Pages or online advertising, or open our emails.
• Third parties: We work with third parties who provide services to us such as analytics, data collection, or advertising. Your information may be collected and processed independently in accordance with the third party’s own privacy notices. These third parties share information they have collected with us. We may combine this information with any information we collect.
• Social media platforms: Social media platforms share information, which is typically aggregated and doesn’t include personal information, with us. You can learn more about how social media platforms collect and use your information by reviewing their privacy policies and settings.
• Cookies: We use cookies (small data files stored on your device or browser) and other similar technologies to automatically collect information when you visit our Website or interact with our emails. Through the use of cookies, we may link information about your interactions with our Website or emails over time. Any information collected by us or by third parties through the use of cookies or similar technologies may be linked with other information we collect about you.  For more information about how we use cookies and what your options are regarding our use of cookies, you can view our cookie policy here.

3. How do we use the information we collect about you?

We only use your information for purposes which are permitted by law, including:

• Providing Services: Providing our services to you or to our clients, promoting and marketing our services, improving our services, communicating with you about our services, providing client support, managing our relationship with you, managing payments, and complying with our legal obligations relating to those services.
• Online Advertising: Presenting advertising online and via email, or other communication channels, including through partnerships with social media platforms and internet search engines.
• Understanding Our Website Users: Analyzing your activity with us (including your interactions with our Website, Social Media Pages, emails, or other forms of communications). We keep track of the pages you visit and the manner in which you use the Website to determine whether to make changes to the Website. We may, from time to time, review your information and information of other Website users to help us analyze trends, preferences, and demographics.
• Communications: Communicating with you, including responding to your requests, updating you about our terms, policies and/or technical changes, asking for feedback through surveys or other messages, or sending you information that we think may be of interest to you.
• Website Experience: Serving content on our Website and Social Media Pages, developing our services and improving the Website to ensure that content is presented in the most effective manner for you.
• Performing a Contract: Processing your information in connection with pre-contract activities and discussions with you, or performing a contract that we have with you or your business.
• Recruitment: Recruiting and hiring, including, but not limited to, verifying your eligibility for employment and assessing your suitability for any position for which you may apply at Vorys.
• Security: Protecting Vorys, our clients and our Website users from fraud, security threats, and other illegal or harmful activity. We and our third party service providers may disclose specific individual information if we or they reasonably believe it is necessary to: (i) investigate any suspected misuse of a Website; (ii) protect or defend the rights, property and interests of Vorys, our Website users, or the interests of our third party service providers; or (iii) under exigent circumstances, to protect the personal safety of users of a Website or the public.
• Legal Obligations: Complying with legal and regulatory requirements and responding to requests from courts or other government bodies.
• Other Legitimate Interests: Processing your information for any of our other legitimate interests not described above.

4. How long do we keep your information?

We will retain your information for as long as is necessary to fulfill the purpose for which your information was collected and in accordance with our internal retention procedures, or as otherwise necessary to satisfy our legal obligations. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymize your information for research or statistical purposes in which case we may use such anonymized information indefinitely.

5. How does Vorys share information with Service Providers and Third Parties and for what purposes?

Vorys may share personal information with third parties for certain purposes. For example, we may share personal information with:

• Service Providers: We partner with third parties to assist with many aspects of our business, including our professional advisors and other service providers who help us communicate with you. These third parties may provide services related to any of the purposes described in How do we use the information we collect about you?, and we may share with them any types of information described in What information does Vorys collect about you?.  We may also receive information collected by these third parties and combine it with the information we have collected. Some of these third parties may be located outside the United States. Your information may also be collected and processed by third parties who will process your information independently in accordance with their own privacy notices.
• Marketing Providers: We partner with third parties to assist with the advertising and marketing of our business. We may share with them the types of information described in What information does Vorys collect about you?. We may also receive information collected by these third parties and combine it with the information we have collected.
• Operations: We operate our Website from the United States of America and store the information we collect through our Website in the United States of America. We market and provide legal services, however, in many countries throughout the world. Accordingly, we may disclose information collected through our Website, as well as other information, across offices and geographical boundaries, within and outside of the firm, for legal and legitimate purposes. 
• Other Third Parties: We will disclose information about you, including to government bodies or law enforcement agencies, when we believe it to be necessary for compliance with the law or to protect our Website users, our Website, or the public.

6. What are my privacy choices?

You can control the information we collect and use in the following ways:

• Location Information: You can disable location-based services on your mobile device or web browser by adjusting the settings on your device or browser. This will prevent our Website from accessing your location information. Note that some services may not be available if you disable location-based services.
• Marketing Emails: You may opt-out of our marketing emails by following the instructions listed in any email communications that you receive or by contacting us using the contact details provided under How may I contact Vorys?, below.
• Social Media: This Privacy Policy does not cover the privacy and security practices of social media platforms on which Vorys has Social Media Pages. Please review the terms, policies, and settings of those social media platforms if you have questions about how they collect and use your data.
• Online Advertising: For information about opting out of third party advertising, visit: NAI Opt-Out or DAA. You will leave this Website for a separately managed online site where you can specify your preferences. You can also click on the icon that may appear on some of our advertising served through this technology. We may use more than one third party company for placing this advertising, which would require you to opt out of each company.

• Google Analytics: Depending on your location, we may utilize Google Analytics. You can opt out of Google Analytics across all websites you use.  To do so, visit this website.  You can also learn how we use Google Analytics here.

• Postal Marketing: To opt-out of other forms of marketing (such as postal marketing), please contact us using the contact details provided under the How may I contact Vorys? Section below.

7. How does Vorys address children’s privacy?

Our Website and Social Media Pages are not intended for children under 16. No one under 16 should share any personal information with us. We do not knowingly collect any personal information from children under 16. To request deletion of personal information relating to a child under 16, please contact us.

8. How does Vorys secure personal information on our Website?

We employ physical, technical, and administrative procedures to safeguard the personal information we collect online.  While we use these security measures on our Website, you should be aware that 100% security is not always possible.

9. How does our Website interact with third-party websites and content?

For your convenience, we may enable you to navigate to third-party sites through links on our Website.  We do not endorse these third-party sites, do not have any affiliation with these third-party sites, and we do not control and are not responsible for their Internet and web practices.  Whether the third-party content appears within our Website environment (like a map frame), or you leave our Website for another website to view it, the terms, conditions, and privacy policies of those other websites govern your online experience.  Please review their separate terms of service and privacy policies if you have any questions about their practices.

10. Where is personal information stored and processed?

We are an international law firm that provides cross-jurisdictional legal advice and related services to our clients. The global nature of our business means that your information may be transferred outside the jurisdiction in which you provide it, including, potentially, to countries that do not require organizations to protect your personal information in the way in which you have come to expect in your own country.

Where we receive personal data from the EEA or UK, to the extent that we are not subject to EU or UK data protection laws, United States privacy laws may not provide the same rights in connection with your personal data which you may have in your own country.

Where we transfer your personal information across national boundaries, we will protect your information by ensuring that those transfers are made in compliance with any applicable data protection laws.

11. What other terms govern my use of the Website?

Your use of the Website is also governed by the Terms of Use and Disclaimer.  Please ensure you have read and understood the Terms of Use and Disclaimer in addition to this Privacy Policy.

12. Will this Privacy Policy change?

We may make changes to this Privacy Policy at any time to take into account new or changing circumstances, so please review it periodically.  If we make a material change to our information collection, use, or disclosure practices specified in this Privacy Policy, it will be applied only to information collected on a going forward basis.  Material changes in our Privacy Policy will be communicated as Vorys determines appropriate, including, but not limited to, by posting on our Website or communicating by email.  We will update the effective date at the bottom of the page at the time a change is made.

13. Your U.S. State Privacy Rights

Certain U.S. states afford their residents rights with respect to their Personal Data.  The rights described herein are subject to exemptions under applicable law.  For purposes of this section, the term “Personal Data” includes both “Personal Information” and “Personal Data” as defined by applicable law.

If your Personal Data is subject to a privacy law in your state, you may have certain privacy rights with regard to that information.  You may have the right to:

• Know, access, and confirm your Personal Data.
• Delete the Personal Data we have about you, subject to exceptions under applicable law.
• Correct inaccuracies in your Personal Data.
• Obtain your Personal Data in a portable and readily usable format.
• Opt-out of the use or processing of your Personal Data for profiling or targeted advertising.
• Opt-out of the sale of your Personal Data.

Under certain state laws, you may also have the right not to receive discriminatory treatment for the exercise of any of these privacy rights.  We will not discriminate against you because you have exercised any of your rights.

Certain state laws may also provide you the right to appeal our decisions regarding your rights requests if we do not respond to your requests or do not take action regarding your requests. Additionally, if you are a resident of the state of California, you may have a right to pursue legal action for improper handling of your Personal Data.

How to Submit a Request

If you wish to exercise the rights listed above, and are a resident of a state that provides such privacy rights, you may submit a request by emailing privacy@vorys.com, by calling us toll-free at 1-833-525-2097, or by using this form. We will provide your Personal Data to you in writing in a readily usable format.  If you choose to submit your request via email, you must include “Privacy Rights Request” in the subject line and clearly provide us with the following information: what type of request you are making, your full name, email address, and valid physical address.  You may only make one request per email. 

We are required to provide you with access to your Personal Data or delete your Personal Data only in response to verifiable consumer requests. We will compare the information you provide to us in your request to any information we may have in our possession in order to verify your request. You may be asked to provide us with information such as your home address, email address, and telephone number. We may also contact you to request additional information in relation to your request. Please promptly respond to any follow-up inquiries so that we may verify your identity. If you request that we provide you with specific pieces of information about you, or that we delete sensitive Personal Data, we may apply heightened verification standards than what we would apply to other types of requests. The information you provide must match the information we have in our possession. This measure is in place to help ensure that Personal Data is not disclosed to any person who does not have the right to receive it. The information collected through this process will be used for verification purposes only.

Authorized Agent

Please note that you may authorize an agent to exercise any of these rights on your behalf by contacting us toll-free at 1-833-525-2097 or by submitting the request via this form. If you use an agent, we will take measures to verify your agent’s authorization similar to the verification described above for fulfilling any access or deletion requests. We may require more information to ensure proper verification of you and your agent’s identity and authorization.

Categories of Personal Data Collected and Disclosed for a Business Purpose

We collect and disclose the categories of Personal Data that are indicated in the chart below.  Note that the specific pieces of Personal Data we collect about you may vary depending on the nature of your interactions with us and may not include all of the examples listed. 

We may also collect Personal Data about you that does not directly fit within one of the categories listed above, which information is described in What information does Vorys collect about you on our Website?

We share Personal Data about you with service providers and third parties for business purposes, such as operational purposes and other purposes related to providing you with the services you seek from us.  For more information about the business purposes for which we disclose Personal Data, see How do we use the information we collect about you?

Sources of Personal Data

We may collect your information from the categories of sources listed under How do we collect your information?

“Do Not Sell” Rights; Sharing for Cross-Context Behavioral Advertising, Profiling, or Targeted Advertising

We may disclose your Personal Data for the following purposes, which are not a sale: (i) for reasons mentioned above; (ii) if you direct us to share Personal Data; (iii) to comply with your requests under applicable law; and (iv) as otherwise required or permitted by applicable law.

We do not sell Personal Data or share Personal Data about you for purposes of cross-context behavioral advertising, profiling, or targeted advertising.

Deletion Rights

You may request that we delete your Personal Data that we have collected directly from you.  Under applicable law, we may decline to delete your Personal Data under certain circumstances, for example, if we need the Personal Data to complete transactions or provide services you have requested or that are reasonably anticipated, for security purposes, for internal business purposes (including maintaining business records), to comply with law, or to exercise or defend legal claims.  Note also that we are not required to delete your Personal Data that we did not collect directly from you.  We require a reasonable or high degree of certainty that the requester is the consumer for which a deletion request is applicable, depending on the sensitivity of the Personal Data.

Additional California Privacy Rights

We do not share Personal Data as defined by California Civil Code Section 1798.83 (“Shine the Light Law”) with third parties for their direct marketing purposes absent your consent. If you are a California resident, you may request information about our compliance with the Shine the Light Law by contacting us through this form or sending a letter to Vorys, Sater, Seymour and Pease LLP at 52 E Gay St, Columbus, OH 43215, (Attention: Privacy Inquiry).  Any such request must include “California Privacy Rights Request” in the first line of the description and include your name, street address, city, state, and ZIP code.  Please note that we are only required to respond to one request per individual each year, and we are not required to respond to requests made by means other than through this form or mail address.

Our Practices Concerning Sensitive Data

We will not process your Sensitive Data or Sensitive Personal Information (as those terms are defined under applicable U.S. consumer privacy laws) without your prior consent.

14. Your EEA/UK Privacy Rights

If you are located in the European Economic Area or the United Kingdom, you may have certain rights and protections under applicable laws regarding the processing of your Personal Data (including under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) or the UK version of the GDPR (“UK GDPR”) (together “European Privacy Laws”)). European Privacy Laws generally afford applicable data subjects the right to:

• Know whether we’re processing your Personal Data.
• Request a copy of the Personal Data we hold about you, subject to exceptions under applicable law.
• Request that we correct inaccurate or incomplete Personal Data we hold about you.
• Request that we erase your Personal Data, subject to exceptions under applicable law.
• Request, in certain circumstances, that we transfer any Personal Data we hold about you to another company.
• Under certain circumstances, restrict certain types of processing.
• Object to having certain decisions made about you by automated processes or profiling.
• Withdraw your consent where we have processed your Personal Data based on your consent.
• Lodge a complaint with the relevant supervisory authority.

We do not make decisions about you based solely on automated processing, including profiling, which produces legal effects concerning you or significantly affects you in a similar way.

In addition to the security measures mentioned above, we will ensure that your Personal Data is adequately protected, for example, by entering into contracts which contain appropriate data protection provisions.

Our other obligations to you as our client, if applicable, are not addressed by this Privacy Policy. Those obligations are described in our terms of engagement or otherwise arise as a result of applicable law.

How to Submit a Request

If you are located in the EEA or the UK, to the extent we are subject to European Privacy Laws and you wish to exercise any of your rights under such European Privacy Laws where applicable, please submit your request by emailing us at privacy@vorys.com.  You may also contact our Data Protection Officer at de_dpo_vorys@pwc.com.

Please note that the above rights are not absolute and we may be entitled to refuse or limit requests, wholly or partly, where exceptions under the applicable law apply.

If you would like to make a complaint about how we handle your Personal Data, or make a complaint about a breach of data protection laws, please contact us using the contact information described above. Complaints will be investigated and the outcome of the investigation will be communicated to you after the complaint is made in accordance with applicable law.  If European Privacy Laws apply, you also have the right to make a complaint with your local data protection authority.

Legal Basis for Processing

We will process your Personal Data only where we have a lawful basis for doing so. These “lawful bases” for processing are set forth in applicable data protection law and, where European Privacy Laws apply, our processing will be on the basis of one or more of the following (where applicable): (a) the performance of a contract to which you are a party or in order to take steps at your request prior to entering a contract; (b) compliance with our legal obligations; (c) for our legitimate interests (for example, carrying out the business of providing legal services and pursuing our general business interests); (d) the establishment, exercise or defense of legal claims; (e) to carry out tasks in the public interest/reasons of substantial public interest; or (f) to comply with laws relating to anti-money laundering or counter-terrorist financing obligations or the prevention, detection, or prosecution of any crime.

In addition, in some circumstances we may process your information if you have provided your consent for us to do so.  Please note that you have the right to withdraw any such consent by contacting us using the contact details below.

For the purposes of European Privacy Laws, and adopting the definitions used further above in this Privacy Policy, namely What information does Vorys collect about you? and How do we use the information we collect about you?, we rely on the following lawful bases in respect of your information:

• We use Contact Information, Call and Email Records, Submitted Content and Demographic Information for our and your legitimate (or overriding) interests to provide our services to customers, manage our customer relationship, resolve issues, develop our products/services, grow our business and update you regarding any changes to our terms, policies and any other technical updates.
• We use Contact Information and Call and Email Records for our and your legitimate (or overriding) interests to respond to your queries and provide any information and materials requested in order to generate and develop business.
• We use Contact Information for Marketing Communications which, unless we are relying on your consent, is for our legitimate (or overriding) interests to market our products/services, grow our business and to inform our marketing strategy.
• We use Device Information, Location Information, Website Interactions, Usage Data, Submitted Content and Social Media Usage for Online Advertising, Understanding Our Website Users, and Website Experience. This is in our legitimate (or overriding) interests to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy.
• We use Device Information, Location Information, and Website Interactions for our legitimate (or overriding) interests in running our business, providing administration and IT services, network security, fraud prevention and in the context of a business reorganization or group restructuring exercise.
• We use Job Applications for our legitimate (or overriding) business interests in selecting appropriate candidates, to fulfil our contract with you, and/or to retain data for future opportunities.

Data Protection Principles

When processing your Personal Data, Vorys adheres to the following principles:

• Lawfulness, fairness and transparency: Personal Data must be processed lawfully, fairly, and in a transparent manner.
• Purpose limitation: Personal Data must be collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
• Data minimization: Personal Data must be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.
• Accuracy: Personal Data must be accurate and kept up to date.
• Storage limitation: Personal Data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the Personal Data is processed.
• Integrity and confidentiality: Personal Data must be processed in a manner that ensures appropriate security of the data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage by using appropriate technical and organizational measures.

Marketing Notice

We may process your Personal Data for marketing purposes, for example, to let you know about news or an event which we think you may be interested in.

If you are a data subject in the UK or the EEA, for email marketing to an individual (that is, a non-corporate email address), we need your consent to send you unsolicited email marketing. Where you provide consent, you can withdraw your consent at any time, but without affecting the lawfulness of processing based on consent before its withdrawal.

Your Personal Data may also be collected in our relationship management system when you register online to receive information, or when we otherwise receive your contact details.

You can opt out of direct marketing at any time by contacting us at info@vorys.com. You can also unsubscribe or opt-out from receiving further marketing communications by following the instructions at the bottom of each communication.

Data Protection Authority

If you have a concern about our processing of Personal Data that we are not able to resolve, you have the right to lodge a complaint with the applicable data protection regulator. Contact details for the relevant data protection regulator can be found using the links below:

Where the GDPR applies: https://edpb.europa.eu/about-edpb/board/members_en

Where the UK GDPR applies: https://ico.org.uk/global/contact-us/

15. Your Canadian Privacy Rights

If you are located in Canada, you may have certain rights and protections under applicable laws regarding the processing of your Personal Information, including under the Personal Information Protection and Electronic Documents Act (“PIPEDA”). For purposes of this Section 15, “Personal Information” has the meaning given under PIPEDA.

In compliance with PIPEDA, we provide Canadian residents the right to request information about:

• The Personal Information we hold about you;
• The categories of Personal Information concerned;
• The purposes of the processing;
• Details to whom your Personal Information has been/will be disclosed;
• How long we retain your Personal Information;
• If we did not collect the Personal Information directly from you, information about the source; and
• How to lodge a complaint with the correct supervisory authority.

You may also request that we delete your Personal Information in accordance with applicable laws.

There may be circumstances where we are unable to provide access to your Personal Information. We may deny access for legally permissible reasons, such as situations where the information contains references to other users and is not reasonably severable, or where it cannot be disclosed for legal, security, or commercial proprietary reasons. We will advise you of any reason for denying an access request.

Please read this Policy carefully. To review or update your Personal Information in our possession, withdraw consent for the collection, use, and/or disclosure of your Personal Information, or if you do not understand or agree with our practices as described in this Policy, please contact us at info@vorys.com. Additional contact information is set out in the How may I contact Vorys? Section below.

Please note that when requesting access to Personal Information, we may request confirmation of your identity and other details to protect you and to help us to respond to your request. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect.

16. How may I contact Vorys?

If you have any questions, comments, or concerns about this Privacy Policy, please contact us by emailing info@vorys.com. When writing us, please make sure to include your name and mailing address or telephone number so that we can contact you.

You may also contact:

Andrew Laux
52 E. Gay Street
Columbus, Ohio 43215
614.464.5449
adlaux@vorys.com  

If you are located in the EEA or UK and have a question regarding this Privacy Policy, you may also contact our Data Protection Officer at de_dpo_vorys@pwc.com.

Effective Date (last updated on): September 30, 2024