Privacy notice

Who we are

Halden Rook LLP, 7 Wrenfield Place, London WC1R 4MV, is the controller of personal information processed in connection with our work in the United Kingdom and elsewhere outside North America. Halden Rook Inc., 11 Ostrander Place, Fourth Floor, New York, NY 10013, is the controller for our work in North America. Our data protection lead is our chief operating officer, Helen Barraclough, who can be reached at privacy@haldenrook.com.

Clients and their staff

We hold the names, roles and contact details of the people we work with at our clients, the content of our correspondence and the documents we prepare together. We use them to provide our services, to keep a record of our advice and to meet our legal, regulatory and insurance obligations. Our lawful bases are the performance of our contract with the client and our legitimate interests in running our business.

Client documents are held in our client extranet. Each user has a named account, and access is reviewed every quarter.

Journalists, commentators and others whose published work we follow

If you are a journalist, editor, analyst, academic, campaigner or commentator who writes or speaks publicly about our clients or their sectors, we may hold information about you drawn from published and publicly available sources: your name, your role and the organisations you write for, your published work, your public social media posts, and notes of our contacts with you.

We use this information to advise our clients on how they may be reported, who is likely to report on them and what questions they may be asked, to prepare our clients for interviews and briefings, and to keep a record of our contacts with the media. Our lawful basis is our legitimate interests, and our clients’, in understanding and responding to public discussion of their affairs. We have assessed those interests against yours and concluded that they do not override your rights, because the information we use is information you have chosen to publish, in your professional or public capacity.

We do not obtain private information about you, we do not use pretexts, and we do not monitor private accounts or private communications. Profiles are reviewed every six months and deleted when the matter they support closes, unless we are required to keep them for longer to defend legal claims. You may ask us whether we hold information about you, and you may object to our use of it, by writing to the address below.

People who contact us and job applicants

If you write to us, telephone us or call our 24-hour line, we keep your details and a note of the contact for as long as we need to respond and for six years afterwards. If you apply for a job, we use your application to consider you for the role and keep it for twelve months after the role is filled, unless you ask us to delete it sooner.

This website

This website sets no cookies and loads nothing from any other site. Our hosting provider keeps standard server logs, including IP addresses, for up to thirty days for security purposes. See our cookies page for details of the browser storage used by the client extranet.

Who we share information with

We share personal information with our clients, where that is the purpose of our work; with our professional advisers and insurers; with suppliers who provide services to us, including hosting, email, payroll and document storage, under contracts that require them to protect it; and with regulators, courts and law enforcement where the law requires. Our client extranet is hosted on our own servers at a data centre in New Jersey, in the United States.

We transfer personal information between the United Kingdom and the United States in the course of our work. Where we do, we rely on the safeguards the law provides for such transfers.

Your rights

Under data protection law, including the UK GDPR and, where it applies, the laws of the states in which we work, you may have the right to ask for a copy of the personal information we hold about you, to ask us to correct or delete it, to object to or restrict our use of it, and to ask us to transfer it. Some rights are limited where information is held for the purposes of journalism, legal advice or legal proceedings.

To exercise any of these rights, write to privacy@haldenrook.com or to the Data Protection Lead at our London address. We will reply within one month. If you are not satisfied with our reply, you may complain to your local data protection authority.