Privacy and Confidentiality Policy

This Privacy and Confidentiality Policy (“Policy”) describes how Koh Vass & Co collects, stores and uses Personal Information and/or other confidential information (collectively, “Personal and Confidential Information”) including information about clients, contacts, suppliers and job applicants, as well in the context of visitors to the Koh Vass & Co website at www.kohvassandco.com.

Koh Vass & Co operates in Association with Osborne Clarke.  This Association enables Koh Vass & Co to offer clients a seamless international legal offering, in order to be able to provide such an offering it may be necessary to share personal data with Osborne Clarke.  This Policy describes how personal data may also be shared with Osborne Clarke.

When we refer to “Osborne Clarke” we are referring to one or more of the member entities of Osborne Clarke Verein, a Swiss verein.  Osborne Clarke Verein does not itself provide legal or any other services to clients.

Each Osborne Clarke Verein Member is a separate regulated legal entity providing legal and other client services in accordance with the laws of the jurisdictions in which it operates

Definitions

In this Policy, we use the terms “we”, “us”, and “our” (and other similar terms) to refer to Koh Vass & Co, the “Data Controller”.

“OC Member Firm” to refer to any entity, including Osborne Clarke Verein, which is a member of international Osborne Clarke network (“Network Firm”) or which is a member firm of Osborne Clarke Verein, a Swiss Verein (“Osborne Clarke Verein Member Firm”).

“Network Firm” includes Osborne Clarke Services (company number: 3049484), Osborne Clarke Trustees Limited (SRA reference: 199769), Open Trustees Limited (SRA reference: 80586), Oval Nominees Limited (company number: 1865795), Ovalsec Limited (company number: 1379423) and Osborne Clarke International Services Ltd (company number: 8096377) – the registered office of each of the above companies is 2 Temple Back East, Temple Quay, Bristol, BS1 6EG,

“Osborne Clarke Verein Member Firm” includes (but is not limited to) those listed in the website’s Terms and Conditions (http://www.osborneclarke.com/websiteterms-and-conditions). Each of the Osborne Clarke Verein Member Firm is a separately constituted and regulated legal entity or partnership which provides legal and other client services in accordance with the laws of the jurisdictions in which it operates. For the avoidance of doubt Osborne Clarke Verein is a Swiss verein which does not itself provide legal or other client services

“Engagement Letter” refers to a written document which sets out the terms and conditions of the engagement which describes the services to be provided to you by us.

“Personal Information” shall mean any information relating to an identified or identifiable natural person.

“identifiable natural person” is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors.

“you” and “your” (and other similar terms) to refer to our clients, contacts, suppliers, job applicants and website visitors.

This Policy is an important document. We recommend that you read it carefully and print and keep a copy for your future reference. When you instruct us, interact with us, or otherwise contact us, we will assume you agree to the uses of your Personal and Confidential Information described in this Policy according to the terms and conditions described herein.

  1. Your rights in relation to the data and how to exercise them

You are entitled at any time to obtain confirmation of the existence of your Personal and Confidential Information and to be informed of the contents and origin, verify its accuracy, or else request that such data be supplemented, updated or rectified according to the provisions of local law.

You also have the right to request erasure, anonymisation or blocking of any data that is processed in breach of the law as well as to object in all cases, on legitimate grounds, to processing of the data.

You also have a right free of charge to object on legitimate ground to the processing of your Personal and Confidential Information and to object to the processing of your Personal and Confidential Information for marketing purpose.

To exercise such rights and if you have any questions about how we collect, store and use Personal and Confidential Information, then please contact us using the details provided below:

  • Write to us:
    • in relation to the website to: Data Protection Officer, Suite 3002, 30/F, Prosperity Tower, 39 Queen’s Road Central, Hong Kong
    • in relation to our strategic alliance firm, Osborne Clarke, the Privacy Officer at the relevant OC Member Firm at their registered office as set out above.
  • E-mail us at: john.koh@kohvassandco.com.

We committed to protecting the privacy, confidentiality and security of the Personal Information we hold by complying with the Personal Data (Privacy) Ordinance of Hong Kong with respect to the management of Personal Information.

  1. What Personal and Confidential Information do we collect?

From initial contact through to providing you with our services or working together in other ways, we may collect various Personal and Confidential Information about you. We may collect, store and use the following Personal and Confidential Information:

  • If you are a client (or prospective client) of Koh Vass & Co: We may collect, store and use your personal and/or professional contact details for the purpose of contacting and corresponding with you, as well as contact details for any organisation that you represent. We may also hold confidential details about any matter on which you choose to instruct us, as well as your bank account and/or other payment details for the purpose of paying our fees or remitting any payments to or from our client account. In addition, we may also hold the information described in the “If you are a contact of Koh Vass & Co” bullet below. As is explained at section 4 of this policy (Who Else May Have Access to Your Personal and Confidential Information), we also share client information with OC Member Firms.
  • If you are a supplier (or prospective supplier) to Koh Vass & Co: We may collect, store and use your personal and/or professional contact details for the purpose of contacting and corresponding with you, as well as contact details for any organisation that you represent. We may also hold confidential details about any services that you may supply to us, as well as your bank account and/or other payment details for the purpose of paying your fees. In addition, we may also hold the information described in the “If you are a contact of Koh Vass & Co” bullet below.
  • If you are a contact of Koh Vass & Co : We may collect, store and use your contact details, copies of any e-mail, postal or other correspondence between you and us, and recordings of any voicemails that you choose to leave. We and OC Member Firms may also hold details of any contact preferences that you specify, such as requests to subscribe to legal updates that we may circulate from time to time, to receive news about any events we are organising or participating in, or to receive information about us and the services we provide.
  • If you are a job applicant: We may collect, store and use your contact details, copies of your job application, curriculum vitae and covering letter, as well as any references provided or obtained, for the purposes of processing your application and for general recruitment and selection purposes.
  • If you are a website visitor: We may collect, store and use certain, limited information relating to your use of our website, if you have accepted the relevant cookies, for the purposes of better understanding the types of visitors who browse our website and improving our website offering. Other than information you choose to submit voluntarily to receive communications from us (as described in the “If you are a contact of Koh Vass & Co” bullet above), the information we collect about website visitors does not enable any visitor to be individually identified, is processed only in anonymised, aggregated form, and will only be used for website analytics purposes as described in the section entitled “Website cookies” below.

We collect your Personal and Confidential Information through various means, including via our website (including our on-line job application facility), through e-mail correspondence, through direct contact (for example at marketing events and law fairs). As a client of Koh Vass & Co, we may collect your Personal and Confidential Information through material you may provide to us to enable us to carry out our service for you. As a supplier of Koh Vass & Co, we may collect your Personal and Confidential Information through materials you may provide to us in relation to the services you provide to us.

The provision of your Personal and Confidential Information to us is optional – save for the case in which the law requires that this is provided (e.g. to enable us to comply with anti-money laundering regulation) in which case the provision of such data is mandatory and failure to provide the same may result in our inability to provide you with the services requested and subject you to administrative fines.

  1. How will we use your Personal and Confidential Information?

The ways in which we may use your Personal and Confidential Information necessarily depends on the relationship you have with us. For example, if you are a client, then we will use your Personal and Confidential Information to provide you with our services.

We use the Personal and Confidential Information that we collect for the following purposes:

  • For contact and communication purposes: We may use your contact information and preferences to send you legal updates that we may circulate from time to time, news about any events we are organising or participating in, and/or other information about us and the services that we or an OC Member Firm provides. If required by local law, we will obtain your consent before contacting you for direct marketing purposes.  We will only contact you in accordance with the contact preferences that you have specified (or otherwise in accordance with our local information collection notices). You can specify your contact preferences by advising us of your contact preferences using the contact details provided above.
  • To provide our services to our clients: We may also use Personal and Confidential Information to provide our services to our clients. Please note that we will use and disclose their Personal and Confidential Information in such manner as we believe is reasonably necessary to provide our services to them (including as described in this Policy and our Engagement Letter).
  • To receive services from our suppliers: We will use our suppliers Personal and Confidential Information to receive their services from them. Please note that we will use and disclose their Personal and Confidential Information in such manner as we believe is reasonably necessary to receive and to review the provision of those services from them.
  • To collect our fees or costs in connection with other legal enforcement: We will use your Personal and Confidential Information to agree payment arrangements with you, and to collect our fees and costs owing to us in connection with legal enforcement.
  • To make payments to our suppliers: We will use our suppliers Personal and Confidential Information to agree payment arrangements with our suppliers, and to make payments to them.
  • For recruitment and selection purposes: If you apply for a position with John Koh &* Co, we will use your Personal and Confidential Information to process your job application and for general recruitment and selection purposes. If you are successfully recruited, the Personal and Confidential Information you provide will be stored on your personnel file.
  • For website analytics purposes: If you have accepted the relevant cookies, we may collect, store and use certain, limited information relating to your use of the John Koh  & Co website for the purposes of better understanding the types of visitors who browse our website and improving our website offering. Other than information you choose to submit voluntarily to receive communications from Koh Vass & Co (as described in the “If you are a contact of Koh Vass & Co” bullet in the section entitled “What Personal and Confidential Information do we collect?” above), the information we collect about website visitors does not enable any visitor to be individually identified, is processed only in anonymised, aggregated form, and will only be used for website analytics purposes as described in the section entitled “Website cookies” below.
  • For compliance with anti-money laundering regulation: If you instruct us to act as your solicitors, we may use your Personal and Confidential Information (e.g. evidence of your identity) in order to fulfil our obligations to check the identity of our clients in compliance with anti-money laundering law and regulations and will share this information with any relevant OC Member Firm(s) required to support that instruction.

The processing operations connected with your Personal and Confidential Information are only handled by authorised subjects or by persons appointed on each case for the maintenance of the website.

  1. Who else may have access to your Personal and Confidential Information?

On occasion, we may need to share your Personal and Confidential Information with third parties. Where you supply us with Personal and Confidential Information as a client, we will assume, unless you instruct us otherwise in writing, that we can disclose your Personal and Confidential Information in such manner as we believe is reasonably necessary to provide our services (including as described in this Policy and our terms of engagement), or as is required under applicable law. This might be because, for example, we need to instruct overseas counsel on your behalf, to liaise with other professional service providers in relation to matters that we are handling, or because we need to liaise with the opposing party on a matter you have instructed us on.

We may pass your Personal and Confidential Information to third parties such as:

  • Credit-checking agencies: If you are a client, we may need to pass on your Personal and Confidential Information (e.g. information about your identity) to a third party credit-checking agency for credit control reasons.
  • Events: We may need to pass on your Personal and Confidential Information (e.g. name, company, occupation) to a third party in connection with management of an event, in which case the details will only be used by the third party for that specific purpose.

Business partners, service providers and other affiliated third parties: To enable us to provide our services to you, we may need to share your Personal and Confidential Information with OC Member Firms, our business partners (including other professional advisers such as accountants or auditors), external service providers and/or overseas counsel.  Our arrangements with external service providers currently cover the provision of support services including IT, AML/CDD checks, events management, document production, business and legal research, secretarial services, facilities management and debt collection and tracing.

  • OC Member firms: Subject to compliance with local law, we also share your Personal and Confidential Information with OC Member Firms:
    • To provide services to you and also:
    • So that they may contact you (including by email), if you have expressly agreed to receive marketing communications about legal developments, services or events which may be of interest to you;
    • Through the joint use of centralised IT tools;
    • To manage our international client relationships;
    • To respond to your requests concerning access, rectification, objection and cancellation as regards the processing of your personal data.
  • Disclosures required by law or regulation: In certain circumstances, please note that we may be required to disclose Personal and Confidential Information under applicable law or regulation, including to law enforcement agencies or in connection with proposed or actual legal proceedings.
  • Publicity: In accordance with professional ethical conduct rules, and subject to compliance with local law and market practice, unless you advise us in writing to the contrary, you consent to the disclosure of our involvement as your legal advisors for the purposes of publicising our practice. We may also provide a general description of the work we’ve done for you, or a more detailed description if this information is already in the public domain or you expressly consent to this.
  1. Monitoring for quality assurance and training

We strive to ensure that the legal services we deliver to our clients are of the highest possible standard. With this aim in mind, it may sometimes be necessary for us to monitor telephone and e-mail communications between our employees and third parties for the purpose of quality assurance and training or as otherwise permitted by law.

We will only ever conduct communications monitoring in compliance with applicable law, and will at all times continue to protect the confidentiality of your communications in accordance with this Policy.

  1. International transfers of Personal and Confidential Information (including to outsourced service providers)

As described above, from time to time, we may need to transfer your Personal and Confidential Information to OC Member Firms, whose offices are located outside Hong Kong, including in the USA, in order to provide you with the services required.

Please note that the legal regimes of some countries outside of Hong Kong do not always offer the same standard of data protection as Hong Kong, although we will ensure that your Personal and Confidential Information is only ever treated in accordance with this Policy and, if you are a client, our Engagement Letter.

We have entered into standard European Commission approved form model data protection clauses with OC Member Firms. If you would like to discuss any aspect of our arrangements with external service providers please contact the person responsible for your work.

If you or others on your behalf give us any Personal and Confidential Information about another person, you take full responsibility for complying with any relevant data protection laws which apply to the provision of that information to us, and our use of it as explained in this Policy.

  1. How we look after your Personal and Confidential Information

Personal and Confidential Information may be processed by either automated or manual methods.

We have in place appropriate technical and organisational security measures to protect your Personal and Confidential Information against unauthorised or unlawful use, and against accidental loss, damage or destruction.

We put in place strict confidentiality agreements (including data protection obligations) with our third party service providers.

  1. Website cookies

The Koh Vass & Co website is built in WordPress and subsequently uses the standard WordPress Cookies.

The website uses KISSmetrics (https://www.kissmetrics.com/) for website analytics purposes – meaning that we use them to see how many visitors come to our website, the pages that generate interest and the links that visitors most often click on (amongst other things). KISSmetrics uses cookies – small text files that are placed on your computer that store certain limited information about you.

In addition, WordPress uses functional cookies which are needed to make the site run correctly. All functional cookies can be deleted at any time.

For more information about cookies, we recommend that you visit www.allaboutcookies.org

If you wish to switch off the use of any cookies, you can change your browser settings to reject cookies. As the means by which you can do this varies from browser to browser, please visit your web browser’s “Help” menu for further details. Please note that, should you choose to refuse cookies, this might impair some of the functionality of the Koh Vass & Co website.

The cookies that we use on the site are:

Analytics cookies

“km_lv”, “kvcd”, “km_ai”, “km_ni”, “km_uq” are all KISSmetrics cookies – These cookies are used to collect information about how visitors use the site. The information is collected anonymously, and used to report on the number of visitors to the site, where they have come from, and the pages they have visited. You can find out more info on them there: https://www.kissmetrics.com/how-it-works

Functional Cookies

wordpress_test_cookie – This cookies is used on sites built with WordPress. It tests whether or not the browser has cookies enabled.

wordpress_logged_in – This cookie is used to determine whether a user is logged in or not. If the cookie is set, then WordPress won’t need to ask you for your login credentials again until the cookie expires.

wordpress_eli – If you’re logged in to WordPress when you visit the website, this cookie will enable you to get all of the WordPress cookies.

wpc_wpc – This cookie contains an access token for WordPress

  1. Updates to this Policy

This Policy was last updated in August 2015. Please note that for legal, business or operational reasons we may from time to time update this Policy. We will highlight any material changes that we make to this Policy on the Koh Vass & Co website.

  1. Links to other websites

The Koh Vass & Co website may link to other, unaffiliated third party websites. Please note that Koh Vass & Co is not, and cannot, control or be responsible for the content or privacy and confidentiality practices of any third party websites. You must always carefully review the privacy and confidentiality policy of any third party website that you may visit in order to understand how the operators of that website may collect, store and use your personal and confidential information.

  1. How long do we retain your Personal and Confidential Information?

We will retain your Personal and Confidential Information only for so long as is necessary for fulfilling the purposes for which they were collected.

Team