Privacy Policy

PRIVACY POLICY

Berry Appleman & Leiden LLP is a limited liability partnership organized under the laws of the State of California and has offices in Atlanta, GA; Los Angeles, CA; Austin, TX; Boston, MA; Richardson, TX; Houston, TX; Tysons, VA; San Francisco, CA; Santa Clara, CA; New York, NY, Chicago, IL; Denver, CO; and Washington D.C. (together referred to as “BAL” or “we”, “our”, or “us”).

This privacy policy describes how we may collect, use, share and otherwise process your personal information, as an employee of one of our corporate clients or other individual to whom we offer our services – immigration and related products and services – via our Cobalt® website, mobile applications (e.g., BAL Cobalt mobile app), communications channels (e.g., portals or platforms available online) or other online and offline means (e.g., via fax, physical mail, or courier). BAL collects personal information through various means, including questionnaires, www.bal.com and its secured access sites, including, but not limited to cobalt.bal.com (collectively referred to as “sites”). This privacy policy applies to personal information collected by BAL including, but not limited to all sites that post a link to this privacy policy. In the context of this privacy policy BAL acts as a data controller or co-controller with third parties.

Changes to this privacy policy

We may change this privacy policy from time to time as our business changes or legal requirements change. If we make material changes to this privacy policy, we will post a notice on our sites before the changes go into effect, and where appropriate, send a direct communication to you about the change.

Summary of Key Points

What information we collect

Account information for Cobalt online tool

If you contact us, register with our Cobalt online tool or receive services from us, we collect information about you. In order to use such online tool, you may give us information, or your employer or immigration sponsor may send it to us. This may include your name, email address, phone numbers, employer and employment details, education history, and physical addresses. In the event that you are an existing client, we may collect a combination of such information as needed. Depending on the destination country, we may also require passport and visa number and details, government identifiers, gender, date of birth, nationality, ethnicity, race, former addresses, marital history, criminal background, disability, financial details, other information relating to health, religion, spouse or partner and parental details. If we provide services for your family or companions, we may collect similar information about them.

Categories of personal information collected in the prior twelve months

We may collect the following categories of information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household:

• Identifiers, such as: a real name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
• Records, such as the following types of information: bank account number, credit card number, debit card number, signature, physical characteristics or description, telephone number, state identification number, insurance policy number, and any other financial information.
• Internet or other electronic network activity information, such as, browsing history, search history, and information regarding a consumer’s interaction with an internet website, application, or advertisement.
• Employment information, such as professional or employment-related information.
• Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

Categories of sources

We may collect all categories of personal information listed above from the following categories of sources:

Source one: we collect personal information directly from you and/or your household that you provide us. Personal information is required to use certain features available on our sites, for example, to create a Cobalt online account, contact us via email, phone, or our “contact us” form (where we may retain your message content and our response), submit job application materials, receive or request data from us (e.g., via whitepapers, catalogs, and newsletters).

Source two: we collect personal information automatically when you access our sites. For example, we may collect information such as the websites you visit before or after you visit our sites, pages you click on our sites, IP address, search requests, browser type, operating system, data and time you visit our sites, the amount of time spend on our sites, and the device you use to access our sites.

• Account activity: we may collect data about how you use (i) your Cobalt online account; (ii) our sites when you are logged into your account. We may combine data automatically collected from you with other personal information about you.
• Cookies and other tracking technologies: we may use cookies for additional information. Please see the BAL Cookie Policy.

Source three: we collect personal information we get from third parties and public sources. If BAL is handling your visa or immigration matter, we may obtain personal information about you from your employer, our client, various governments (foreign and domestic) and from public sources. Such public sources may include, but are not limited to, social media sites such as LinkedIn, Facebook, Instagram, Google Scholar and other internet searches. The personal information we may collect and process will depend on the specific nature of an engagement and the services we are providing, such as:

• Name
• Addresses, telephone numbers, email addresses, and other contact details
• Age/Date of birth
• Nationality
• Country of residence
• Gender
• Familial/relationship situation
• Information relating to education and qualifications
• Information relating to employment
• Ethnicity
• Other information connected to health
• Criminal records or similar details

Purpose for collecting personal information

We may use all categories of personal information listed above for the following business purposes:

• As stated or agreed to at the point of collection. We may use personal information for the purposes stated or agreed to (or as is obvious) at the point of collection. For example, we use personal information to respond to your questions, comments, or complaints. We may also use personal information as requested or consented by you.
• Administration. We use personal information for administrative purposes, such as managing your accounts, facilitating transactions, to inform our business strategies, to understand our sites’ demographics and user preferences, for evaluating applications, and managing profiles.
• Website management. We use personal information for management of our sites, such as troubleshooting problems, improving the content and functionality of our sites, statistical and other analyses of our sites, and to customize our sites to you and our users.

California’s Do Not Track Signals Requirement

WE DO NOT ALTER OUR DATA COLLECTION AND USE PRACTICES IN RESPONSE TO DO NOT TRACK SIGNALS. WE CURRENTLY DO NOT HONOR “DO NOT TRACK” REQUESTS.

How we use your information

When we process personal information about you, we do so as necessary to provide the products and services you and your employer or immigration sponsor use, to operate our business, to meet our contractual and legal obligations, to protect the security of our services, systems and customers, or to fulfill other legitimate interests to provide the Cobalt site and the services that we have been engaged to provide described in this policy.

• Provide our products and services to you or to our corporate clients
  We use your information to provide our immigration, consulting, business insights, and other related services to you or at the direction of your employer or immigration sponsor, to comply with our agreements with them, to communicate about our products and services, and to help them ensure compliance with their policies.
• Operate websites and mobile applications
  We use device data to monitor and improve the performance and content of our services, provide updates, analyze trends and usage in connection with our services, and measure whether our site content is effective.
• Operate and improve our business
  We use your information for compliance with our company policies and procedures, for accounting and financial purposes, to detect or prevent fraud or criminal activity, and to perform, analyze and improve our business and services.
• Complying with law
  Some of the activities we undertake are necessary to comply with our legal or other obligations as a business service provider of legal advice. Under certain circumstances, we may be required by law to provide personal data to law enforcement agencies, courts or others in connection with claims and other litigation; to comply with state public records law, or an anti-terrorism request.

How and with whom we share your personal information

Your employer or immigration sponsor

Our services to you are typically provided under the terms of our service agreements with your employer or immigration sponsor. We share your information with them to allow them to manage their immigration needs and assure compliance with their policies. At the request of your employer or immigration sponsor, we may also share information with their vendors. In the event that our client wishes to engage alternative legal advisers, we may transfer your personal information to those advisors to ensure continuity of business.

With our business partners and partner network

If your immigration request takes you to countries serviced by one of our local network partners, they may have access to your account information, immigration plans and other information necessary to provide you with the services you or your employer or immigration sponsor may request. Sharing with these local partners is in accordance with our Data Protection Principles which mandate privacy and security measures for the transfer of information wherever they may be located.

Immigration authorities in destination countries

We share information with immigration authorities (for example consulates and other government or law enforcement agencies), and their vendors as necessary to provide immigration and related services to you and your employer.

Vendors and third party providers

We share information with vendors that perform functions on our behalf, such as vendors offering notarization, translation, authentication, and legalization services, visa and passport providers, third party providers and services partners to facilitate the provision of services with respect to foreign governments, mobile application and software developers, and vendors who provide IT support, data hosting and marketing and communication services. These vendors process your information only as necessary to perform their functions as instructed in our contracts with them.

We may share information with Deloitte LLP as part of our service partner relationship with Deloitte LLP, used to facilitate the provision of BAL services with respect to foreign governments. Information regarding the ways in which Deloitte LLP collects, uses and shares personal information when providing immigration services to you outside of the United States can be found on Deloitte’s Global Advantage Privacy Statement. Please note that we cannot and do not control Deloitte LLP’s privacy practices.

Business insights

We combine data from many people to create aggregated statistics that do not identify you personally. We use this data to understand business trends and insights, and we may share them with third parties.

Business transfers for change in ownership

In the event that we sell or buy any business or assets, we may transfer your personal information to the seller or buyer of such business or assets.
If BAL assets are acquired by a third-party personal information may be one of the transferred assets.

As permitted or required by law

We share personal information when we think it’s reasonably necessary to protect ourselves and the people who use our services, enforce agreements, respond to emergencies and comply with law.

In exceptional circumstances, we may share personal information with government agencies other than immigration authorities and other third parties if we believe it is reasonable and necessary to comply with law, regulation, legal process or governmental request; to enforce our agreements, policies and terms; to protect the security of our services; to protect BAL or the public from harm or illegal activities; or to respond to an emergency.

We may also share personal information with other parties as directed by you or subject to your consent.

We do not sell personal information

We do not sell information to third parties so that they can independently market their own products or services directly to you.

Before transferring your personal information to third parties, we will require the third party to maintain at least the same level of privacy and security for your personal information that we do. We remain liable for the protection of your personal information within the scope of our Data Protection Principles except to the extent that we are not responsible for the event that leads to any unauthorized or improper processing.

Marketing and your choices

• BAL may use your personal Information to communicate with you via email or direct mail to inform you about newsworthy topics and upcoming events that may be of interest to you. For example, BAL would like to use your email address to send you the firm’s Legal Update newsletter or to send you an announcement concerning an upcoming seminar. When collecting your personal information for this use BAL will seek your consent to being contacted in this way. If you would like us to stop sending you these marketing messages, you may update your email preferences by using the “Unsubscribe” link found in emails we send to you or by contacting us.
• We also send you messages that are essential for our services; for example, we may communicate with you about questions we have in drafts relating to your immigration case, to service your account, to fulfill your requests or otherwise as required by law. Some of these services contain information presented to you as part of our service relationship with your employer or immigration sponsor (for example, messages that help you comply with their business policies). If you opt out of marketing messages, you will continue to receive these service messages.

How we protect and store your information

We maintain reasonable administrative, technical, and physical security measures to protect your information from unauthorized access and use. We retain your information only as long as needed to provide our services and for legitimate business purposes, unless we are required by law or regulation or for litigation and regulatory investigations to keep it for longer periods of time.

Use and disclosure of de-identified or aggregated information

We may collect, use, share, transfer and otherwise process de-identified and aggregated information that we receive or create for any purposes in our sole discretion, in compliance with applicable laws. We are the sole and exclusive owner of such de-identified and aggregated information, including if we de-identified personal information so that it no longer is capable of identifying an individual.

International transfers

For the purposes described here, it may be necessary to transfer your information to jurisdictions outside of your home country including to countries that may not provide the same level of data protection as your home country. As immigration services are inherently global, we may transfer data to any jurisdiction in the world where you may be traveling to. To protect your information, transfers will be made as permitted by applicable law, including, where necessary, being subject to appropriate contractual clauses. Regardless of where we process your information, we protect it in the manner described in this privacy statement and in accordance with applicable law.

Other details

Data retention

BAL keeps personal information for as long as necessary to provide our products and services, fulfill requested transactions, or for other essential purposes such as complying with our legal obligations, preventing fraud, resolving disputes and enforcing our agreements. Because these needs can vary for different data types in the context of different services, actual retention periods may vary. Here are some of the factors we have considered to set retention times:

1. How long do we need the personal information to develop, maintain and improve our services, keep our systems secure, prevent fraud, and store appropriate business and financial records.
2. Have you asked us to stop using your data? Where we can delete the data, we will process it for only a short period after this to meet your request.
3. Are we subject to a legal, regulatory or contractual obligation to keep the data? For example, we’re required to keep transaction data and other information that helps us carry out law firm record requirements. We may also need to comply with government orders to preserve data relevant to an investigation or retain data for the purposes of litigation.

Social media links

Our sites include Social Media Features, such as the Facebook Like button and Widgets, such as the “Share this” button or interactive mini-programs that run on our sites. These features may collect your IP address, which page you are visiting on the site, and may set a cookie to enable the feature to function properly. Social Media Features and Widgets are either hosted by a third party or hosted directly on our sites. Your interactions with these features are governed by the privacy policy of the company providing it.

Children’s privacy

Our sites are general audience sites not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we obtain actual knowledge that any personal information we collect has been provided by a child under the age of 13, we will promptly delete that information. If a parent or legal guardian learns that their child provided us with personal information without his or her consent, please contact us and we will make commercially reasonable attempts to delete such personal information.

Your rights

If you have created an online account with us and would like to update the information you have provided to us, you can access your account to view and make changes or corrections to your information. You may also have the right to be informed of whether we are processing your personal information and to access, transfer, correct, delete or object, upon request and free of charge, to our use of your information. Please note that we may need to retain certain information for record-keeping, to complete any transactions you began before your request, or for other purposes permitted by law.

Subject to certain limitations such as (a) exceptions permitted by applicable law and (b) verification of your identity, you may exercise the following rights with regard to your personal information:

• Right to access: You have a right to access any of the following which occurred in the prior 12-month period: (a) the categories of personal information we collected from you, (b) the categories of sources from which the personal information was collected, (c) the business or commercial purpose for collecting or selling your personal information, (d) the categories of third parties with whom we shared your personal information, and (e) the specific pieces of personal information we collected from you (i.e. “data portability”). You also have a right to access a list of categories of personal information we sold or disclosed for a business purpose in the last 12 months.
• Right to deletion: You have a right to request that we delete personal information we collected from you. We will comply with such request, and direct our service providers to do the same, subject to certain exceptions permitted by applicable law.

Lawfulness of processing

In many of the countries where we operate, data protection law requires us to process personal data only where we have an approved basis under the law. You have the right to understand what our legal bases are, so we explain them here. We use the following bases, depending on the activity we undertake:

– Performing a contract

In most cases, the data we collect and the things we use it for are necessary for us to provide immigration services as requested by you or your employer or immigration sponsor.

• Provide you with our products and services
  To provide immigration services to you and your family, to communicate with you about our products and services, provide customer services and manage your account. We may also use your personal information to complete background checks and confirm references as needed for immigration requirements.
• Provide our products and services to corporate clients
  To provide our immigration, consulting, business insights, and other related services to your employer or immigration sponsor, to comply with our agreements with them, to communicate about our products and services, and to help them ensure compliance with their policies.

When we receive and process a request for our services, we are complying with GDPR Article 6(1)(b).

– Meeting our legitimate interests

We use personal data as necessary to meet our legitimate business interests. When we do, we make sure we understand and work to minimize its privacy impact. For example, we limit the data to what is necessary, control access to the data, and where we can, aggregate or de-identify the data.

Some examples of the data processing activities we undertake in our legitimate interests are:

• Preventing fraud and unauthorized use
• Communicating news and industry events to our current and prospective clients
• Developing and improving our products and services
• Accounting and financial purposes
• To perform, analyze and improve our business and services
• Operate websites and mobile applications
• Monitor and improve performance and content
• Compliance with our company policies and procedures
  What is legitimate interest? Under GDPR Article 6(1)(f), companies have the ability to engage in activities without consent under a balancing test. Do we have legitimate interest in engaging gin the activity that is not outweighed by the interest or fundamental rights and freedoms of the data subject?

– With your consent

In some cases, we process personal data with your specific and informed consent. We tell you in the service where you can make a choice or grant consent. If you have granted consent, you may withdraw it at any time to stop any further processing. In order to request this, please send an email.

How to exercise your rights

To exercise your rights described in this policy, please fill in a Privacy Request Form, call us toll free at +1-877-757-7108, send us an email or write to us at:

Global Privacy team
BAL
2400 N. Glenville Dr.
Richardson, TX 75082

More on submitting a request to delete or access your information. Subject to our verification of your identity as described below, you may submit your request to delete or access your information here: Privacy Request Form.

Who may exercise their rights.You may only make a request to exercise your rights on behalf of yourself. A parent or legal guardian may make a request on behalf of their child. If you are a California resident, only you or a person registered with the California Secretary of State that you authorize to act on your behalf may make a request related to your personal information. See the section titled “Authorized Agents” below for more information.

Verifiable consumer request.In order to verify your request, you must provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information and you must describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

When we will respond. We will try to respond to your request within 30 days. If we require additional time, we will inform you of the reason and extension period. Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. For data portability requests, we will select a format to provide your personal information to you. We may charge a fee to process or respond to your request if it is excessive, repetitive, or manifestly unfounded.

Non-discrimination

You have a right to not receive discriminatory treatment for exercising any of your rights as mentioned in this section.

Authorized agents

You may designate an authorized agent to make a request on your behalf to exercise your rights by doing the following: (1) provide the authorized agent written permission to do so; and (2) verify your own identity (per the process stated above), as well as the identity of the authorized agent directly.

If you are in the EU

You have a number of rights under European law consisting of the right to:

• Request access to or correction of your personal information
• Object to the processing of your personal information
• Where you have granted consent for us to process your personal information, you can withdraw that consent at any time for future processing
• Under certain circumstances, you may be able to transfer the personal information you submitted to us to another company
• You can lodge a complaint with a data protection authority
• Request a copy of relevant standard contractual clauses
• To learn more or exercise these rights, contact us.

Contact us

If you have any questions or complaints about BAL and privacy, or to exercise your rights, or to request
an additional review of a declined rights request within 30 days of our response, please contact the data protection office, or please fill in a Privacy Request Form, call us toll free at +1-877-757-7108, send us an email or write to us at:

Global Privacy team
BAL
2400 N. Glenville Dr.
Richardson, TX 75082

In most cases, we will ask that you put a complaint or request in writing. We will investigate your complaint or request and will generally respond to you in writing within 30 days of receipt. If any complaint or request remains unresolved or if you are otherwise dissatisfied with the response that you receive from us, you may have the right to lodge a complaint with your regulator or the U.S. Department of Commerce.