General Data Privacy Notice 1 PURPOSE OF THIS PRIVACY NOTICE 1.1 The London Court of International Arbitration (“LCIA”, “we”, “us”) performs dispute resolution services in relation to disputes or potential disputes, whether before or after their conclusion, including under the LCIA Arbitration Rules and the LCIA Mediation Rules (“LCIA Proceedings”). The LCIA’s privacy notice for LCIA Proceedings can be found here. 1.2 The LCIA also carries out other services and activities including, but not limited to, in respect of the membership of the LCIA Users’ Councils. The LCIA’s membership terms can be found here. 1.3 This Privacy Notice describes how we collect and process personal data in the context of those services and activities. 1.4 This Notice is in effect as of the date indicated at the end of this Notice. If we make changes to this Privacy Notice, we will change the date and update this Notice on our website. 1.5 If you have any questions about this Notice, how we treat your personal data or wish to exercise any of your data subject rights, please refer to the details found at the end of this Notice. 2 WHAT PERSONAL DATA DO WE COLLECT AND HOW DO WE COLLECT IT? 2.1 Depending on the circumstances, we may obtain the following personal data about you: 2.1.1 basic information, such as your name (including name prefix or title), the company you work for, your title or position, your gender, your date of birth and your relationship to a person; 2.1.2 contact information, such as your postal address(es), email address(es) and phone number(s); 2.1.3 financial information, such as payment-related information; 2.1.4 technical information, such as information from your visits to our website/online services or in relation to materials and communications we send to you electronically; 2.1.5 information you provide to us for the purposes of attending meetings and events, including passport and visa information, accessibility and dietary requirements; 2.1.6 identification and background information provided by you or collected as part of our business acceptance processes; 2.1.7 any personal information provided to us in the course of providing services in relation to an arbitration, whether by you, or by or on behalf of the parties; and 2.1.8 any personal information provided to us in the course of providing services in relation to membership and events; 2.1.9 CVs, cover letters and employment history; 2.1.10 profile pictures and photos taken at events (see Events Terms and Conditions); 2.1.11 a record of correspondence via email and social media. 2.2 The LCIA uses cookies, and similar technology, on our website. More information can be found in our Cookies Policy. 3 HOW DO WE USE YOUR PERSONAL INFORMATION 3.1 We will only use your personal data for the purposes for which we collect it, unless we reasonably consider that we need to use it for another reason, and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. 3.2 To find out more about the legal bases that we rely on to be able to use and process your personal data, please see below under "Legal bases for processing your personal data". 3.3 Please note that the below list of the way in which we use your personal data is not exhaustive. 3.4 We might use information held about you in the following ways: 3.4.1 when you join or apply to join as a member of the LCIA’s Users’ Council or YIAG; 3.4.2 in the provision of our services to you or to others; 3.4.3 to notify you about changes to our services; 3.4.4 to promote our services, including sending legal updates, publications and details of events; 3.4.5 to provide and improve our website/online services, including auditing and monitoring its use; 3.4.6 to fulfil our legal, regulatory and risk management obligations, including establishing, exercising or defending legal claims; or 3.4.7 for the purposes of recruitment. 4 LEGAL BASES FOR PROCESSING YOUR PERSONAL DATA 4.1 There are a number of different ways that we are lawfully able to process your personal data. We have set these out below. 4.1.1 Where processing your personal data is necessary for us to carry out our obligations under our contract with you, to ensure that you are properly fulfilling your obligations to us, and to ensure that we are fulfilling our obligations to others We are able to lawfully process your data under Article 6(1)(b) of the UK GDPR, which states that we can process your data where this processing "is necessary for the performance of a contract to which [you] are a party". We therefore rely on this legal basis to collect and otherwise use your personal data to enable us to perform our part of our contract with you and our obligations to third parties, and to ensure that you are properly fulfilling your obligations to us. 4.1.2 Where processing your personal data is necessary for us to carry out our legal obligations As well as our obligations to you under our contract, we also have other legal obligations that we need to comply with. Article (6)(1)(c) of the UK GDPR states that we can process your personal data where this processing "is necessary for compliance with a legal obligation to which [we] are subject". 4.1.3 Where processing your data is within our legitimate interests Article 6(1)(f) of the UK GDPR explains that we can process your data where it "is necessary for the purposes of the legitimate interests pursued by [us] or by a third party, except where such interests are overridden by the interests or fundamental rights or freedoms of [you] which require protection of personal data." We consider the following to be non-exhaustive examples of processing activities that are in our legitimate interests: to help us understand our users better and provide better, more relevant information and services to them; to ensure our website runs smoothly; to help us keep our systems secure and prevent unauthorised access or cyber-attacks. 4.1.4 Where you give us your consent to process your personal data In very limited circumstances, we are required to obtain your opt-in consent before we can undertake certain processing activities with your personal data. Article 4(11) of the UK GDPR states that opt-in consent is "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her." In plain language, this means that: you have to give us your consent freely, without us putting you under any type of pressure; you have to know what you are consenting to – so we'll make sure we give you enough information; you should only be asked to consent to one processing activity at a time – we therefore avoid "bundling" consents together so that you don't know exactly what you're agreeing to; and you need to take positive and affirmative action in giving us your consent – we're likely to provide a tick box for you to check so that this requirement is met in a clear and unambiguous fashion. You have the right to withdraw your consent to these activities. You can do so at any time. We do not think that any of the above activities prejudice you in any way. However, you do have the right to object to us processing your personal data in certain circumstances. 5 HOW DO WE SHARE YOUR PERSONAL INFORMATION? 5.1 Your information will not be disclosed to third parties outside of the LCIA, except to the following limited categories of recipients: 5.1.1 any current or future member of our group, which includes our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006, insofar as reasonably necessary for the purposes set out in this policy; 5.1.2 third party service providers who perform functions on our behalf (including external consultants, IT service providers and professional advisers such as lawyers, auditors and accountants); 5.1.3 third parties such as Oxford University Press for the online use, and sending copies, of Arbitration International; 5.1.4 third parties including financial institutions or law enforcement agencies, where necessary to comply with our legal obligations, our contract with you or where it is otherwise in our or a party’s legitimate interests to do so; 5.1.5 if we have to disclose or share your personal data if we believe that such action is necessary to protect and defend the rights, property or personal safety of the LCIA, its sites or its visitors; 5.1.6 third parties to whom the LCIA is providing services; and 5.1.7 third parties involved in hosting or organising events or seminars. 6 WHERE DO WE TRANSFER YOUR PERSONAL DATA TO? 6.1 The personal data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area (EEA). It may also be processed by staff operating outside the EEA, who work for us or for one of our suppliers, subsidiaries or any other entity in which the LCIA has an interest. These staff may be engaged in, among other things, the fulfilment of your request, the processing of your payment details and the provision of support services. By submitting your personal data, you expressly agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your personal data is treated securely and in accordance with this privacy policy. 6.2 Payments made in connection with our services and activities may be processed via a third party payment service provider. Please see the separate terms and conditions of that provider for further terms (including relating to your personal data provided to that provider) that may apply to you for use of that third party payment service. 6.3 Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site including via our online filing system; any transmission is at your own risk. Once we have received your personal data, we will use strict procedures and security features to try to prevent unauthorised access. 7 HOW LONG WE WE RETAIN YOUR PERSONAL INFORMATION FOR? 7.1 Your personal information will only be retained for as long as is reasonably necessary in the circumstances. Retention periods vary depending on the category of data, taking into account legal and regulatory requirements, limitation periods for taking legal action, good practice and the LCIA’s business purposes. 8 WHAT RIGHTS DO YOU HAVE OVER YOUR PERSONAL DATA? 8.1 Depending on the circumstances, you have a number of rights over the personal data that we process about you. These may include the right to: 8.1.1 request access to your personal data and obtain a copy of it from us; 8.1.2 correct your personal data that we hold where it is incomplete or inaccurate; 8.1.3 have your personal data erased where there is no good reason for us continuing to use or retain it, unless the processing is necessary to pursue a legal claim or defence; 8.1.4 request that your personal data is used only for restricted purposes, unless the processing is necessary to pursue a legal claim or defence; 8.1.5 object to your personal data being processed if the lawful basis for processing it is either our or a third party’s legitimate interest; and 8.1.6 require certain of your personal data to be transferred to you or a third party to the extent that the data was collected directly from you. 8.2 If the relevant legislation allows us to do so, we may refuse to provide access or may charge a fee for access, in which case we will provide reasons for our decision as required by law. 8.3 Information we hold about you should be up-to-date and accurate. Please advise us of any changes to your information using the contact details below. 8.4 You also have the right to lodge a complaint with a supervisory authority. Our supervisory authority is the Information Commissioner's Office in the UK. Contact details for the ICO are set out below: Phone: 0303 123 1113 Email: [email protected] Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF 8.5 The privacy regulators for other EU Member States are listed (along with contact details) on the following website: http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm If you wish to exercise any of these rights, or if you have any questions about this notice, how we treat your personal data, or wish to exercise any of your data subject rights, you can contact us: By email: [email protected] By post: Attn: HR Manager LCIA 1 Paternoster Lane London EC4M 7BQ United Kingdom Last updated: November 2021