Privacy Policy and Cookies Notice.

Amendments and drafting notes are highlighted throughout. Yellow shading indicates amended or new text. Amber callout boxes contain drafting notes explaining changes.

• We collect personal data from customers, consultants, suppliers and website visitors.
• We use it to deliver services, manage our business and (where you have not objected) for marketing.
• We share it within the KorumLegal Group and with trusted service providers, never for their own use.
• We transfer data to the UK, Singapore, Hong Kong and the US under appropriate safeguards.
• We keep it only as long as necessary — generally for the duration of your relationship with us plus up to seven years.
• You have rights to access, correct, erase or restrict your data. Contact hq@korumlegal.com.

The KorumLegal Group of companies (KorumLegal Group) is committed to protecting and respecting your privacy. This policy explains what personal data we collect, how we use it and your rights in relation to it.

This policy applies to personal data collected via our website www.korumlegal.com (Site), as well as data processed in the course of operating our business and providing our services. It covers potential and existing customers, consultants, suppliers and others who engage with the KorumLegal Group.

The KorumLegal Group is made up of different legal entities, details of which can be found on our website. This privacy policy is issued on behalf of the KorumLegal Group. References to KorumLegal, we, us or our refer to the relevant KorumLegal Group entity that is the controller of your personal data. Korum Consulting Limited (Hong Kong) is the controller responsible for the Site.

Contact

For any questions about this policy, or to exercise your rights, please contact us at: hq@korumlegal.com.

Changes

We keep this policy under regular review. The current version is published on this page. It is important that the personal data we hold about you is accurate; please notify us of any changes.

Personal data means any information about an individual from which that person can be identified. Anonymous data falls outside this definition.

The table below provides an overview of our processing activities. More detail for each category follows.

Customers

Consultants

Suppliers and Industry / Partner Contacts

Website Users — Cookies and Similar Technologies

When you visit our Site, data is collected via cookies and similar technologies. These do not generally store personally identifiable information. Please see our separate Cookie Notice for full details.

Special Categories of Personal Data

We do not collect special categories of personal data (e.g. health, criminal record) unless: (a) we have your explicit written consent; (b) we are required to by law; or (c) it is necessary for background or criminal record checks as part of our engagement processes.

Automated Decision-Making

We do not currently make solely automated decisions that produce legal or similarly significant effects about you. If we introduce automated profiling or AI-assisted decision-making in future, we will update this policy and take such steps as are required by applicable law, including providing meaningful information about the logic involved and your right to request human review.

Our processing of personal data relies on one or more of the following legal bases:

We will only use personal data for the purpose for which it was collected, or a compatible purpose. Where we need to process it for an unrelated purpose, we will notify you and confirm the applicable legal basis.

We may share your personal data with the following categories of third party:

• Other KorumLegal Group entities, for operational, HR, finance, IT and sales and marketing purposes.
• Customers and consultants, for the performance of contracts and service quality purposes.
• IT service providers (acting as data processors), including providers of email and office tools, website hosting, CRM, accounting, billing and document management systems.
• Professional advisors, including lawyers, bankers, accountants and auditors.
• Regulators, law enforcement authorities and courts, as required.
• Third parties providing onboarding and engagement services, including reference and criminal record checking agencies.
• Analytics and search engine providers, to help us maintain and improve the Site.
• Prospective buyers or merger partners, in the event we sell or restructure all or part of our business, subject to equivalent data protection obligations.

We require all third parties to maintain the security of your personal data, to treat it in accordance with the law, and to process it only for the specified purposes set out in our agreements with them.

International Transfers

We operate globally and may transfer personal data to countries outside the country in which it was originally collected, including the United Kingdom, Singapore and Hong Kong. Some of our data processors use cloud-based infrastructure with data centres in the US and elsewhere.

Where we transfer data internationally, we do so in compliance with applicable data protection law, using one or more of the following safeguards:

• For transfers to the United States: reliance on the EU-US Data Privacy Framework (where the recipient is certified) or Standard Contractual Clauses (SCCs) approved by the European Commission (updated 2021 versions) and/or the UK International Data Transfer Agreement or Addendum, as applicable.
• Standard Contractual Clauses or other approved transfer mechanisms for transfers to other third countries.

We maintain appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, use, alteration or disclosure. Access to personal data is limited to those with a legitimate business need, and all such persons are subject to a duty of confidentiality.

Please note that the transmission of data via the internet is not entirely secure. Whilst we take all reasonable steps to protect personal data transmitted to our Site, we cannot guarantee its security in transit.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours where required by law, and will inform affected individuals without undue delay where required.

We retain personal data only for as long as is necessary for the purposes for which it was collected, including any applicable legal, regulatory, tax or accounting requirements. When determining the appropriate retention period, we consider the volume, nature and sensitivity of the data, the risk of harm from unauthorised use or disclosure, and the purposes for which we hold it.

As a general guide:

Subject to applicable law, you may have the right to:

To exercise any of these rights, please contact us at hq@korumlegal.com. We aim to respond within the timeframe required by applicable law (typically one calendar month). We will not charge a fee unless your request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline the request.

Please note that our Site may contain links to third-party websites, plug-ins and applications. We are not responsible for those third parties' privacy practices; please review their own policies.

If you have concerns about how we process your personal data, please contact us in the first instance at hq@korumlegal.com. You also have the right to lodge a complaint with a supervisory authority: