Clio Privacy Notice

1. Our approach to privacy

1.1 Themis Solutions Inc. is a Canadian legal entity with corporation number 16240976 and headquarters at 4611 Canada Way, Suite 300, Burnaby, British Columbia, V5G 4X3, Canada.

1.2 Themis Solutions Inc. and its group companies, which include entities branded as “vLex part of Clio” following the acquisition of vLex, are together referred to in this Notice as “Clio”, “we”, “our”, or “us”.

1.3 We are a global company providing products and services worldwide. You can find more information about our group companies operating in different markets in Annex 2 (Group Companies) below.

1.4 We are responsible for complying with applicable data protection law. In this context this Privacy Notice has been drafted to comply with data protection legislation as it applies in:

(a) Europe, including the General Data Protection Regulation in the European Union (“EU GDPR”),

(b) the United Kingdom, including the General Data Protection Regulation as it applies in the United Kingdom (“UK GDPR”),

(c) Canada, including the Personal Information Protection and Electronic Documents Act (“PIPEDA”), and

(d) any other jurisdiction for which country-specific provisions have been adopted, as set out in Annex 5 (Country-specific provisions).

1.5 This Privacy Notice sets out how we collect, store, process, transfer, share and use data that identifies or is associated with you (“personal information”) and information regarding our use of cookies and similar technologies, as described in Annex 4 (Cookies and Similar Technologies) and in the applicable legal notices published on the websites in each jurisdiction.

1.6 Clio operates and provides cloud-based legal practice management solutions which require an account and login to access. These solutions are referred to in this Privacy Notice as the “Clio Services” and include, for example, app.clio.com, justis.vlex.com, Operate and other customer-facing platforms that you subscribe to or purchase. Clio also operates a number of publicly accessible marketing websites in the jurisdictions covered by Annex 5 (Country-specific provisions), which do not require an account to view and/or access. References to “Websites” in this Privacy Notice include both our marketing websites and the portal through which you may access the Clio Services.

1.7 This Privacy Notice applies to personal information that Clio processes when you interact with our Websites or when we provide the Clio Services (in relation to the processing at (a)-(k) only). For the purposes of data protection law in Europe and the United Kingdom, this Privacy Notice applies when we are acting as a controller of your personal information.

1.8 The circumstances in which we process your personal information in our capacity as a controller are limited to the following:

(a) Where you interact with our Websites and emails, including data collected using cookies (as described in Annex 4 (Cookies and Similar Technologies));

(b) For marketing our products and services, where we send direct marketing communications to you;

(c) Where you sign up for a trial account or request a demo from our websites;

(d) Where you interact with our branded social media pages;

(e) To provide the Clio Services and manage our relationship with you as the customer;

(f) To ensure the safety, security, and legal compliance of our products and services;

(g) To improve our products and services;

(h) Where you register for, attend or take part in our events, webinars, programs, surveys, or trainings;

(i) Where you request or download Clio content and documents;

(j) Where you join and participate on our Law Community, or other publicly accessible blogs; and

(k) Where we are required to confirm your identity to complete a sensitive request, as a customer or data subject.

1.9 This Privacy Notice also applies to individuals who apply for roles with Clio or otherwise engage with us in a recruitment context. Information about how we process personal data relating to recruitment and employment is set out separately in Annex 3 (Recruitment Privacy Information).

1.10 This Privacy Notice does not apply where Clio acts as a “data processor” on behalf of customers of the Clio Services, where personal information is collected and processed as part of a customer’s business operations with their respective clients and partners. This includes information processed as part of client portals provided by Clio in respect of the Clio Services, such as “Clio for Clients” and “Clio for Co-Counsel”. In those cases, the relevant customer’s own privacy notice or policy will apply.

1.11 Before accessing or using the Clio Services, please ensure that you have read and understood our collection, storage, use and disclosure of your personal information as described in this Privacy Notice. Where required by applicable law, we will obtain your consent for the collection, use, or other processing of personal information, and where consent is not required, we will process personal information in accordance with other lawful bases permitted under applicable data protection laws.

1.12 Country-specific provisions. Where you contract Clio products or services in a jurisdiction for which country-specific provisions have been adopted, those provisions supplement — and, to the extent expressly stated, prevail over — the provisions of this Privacy Notice with respect to processing carried out in that jurisdiction. Country-specific provisions are set out in Annex 5 (Country-specific provisions). In each case, the controller of your personal data is the entity identified as the seller in the applicable order form or, where no order form has been issued, the Clio group company with which you have the closest connection under the applicable service.

2. Personal information we collect about you and how we use it

2.1 Information you give to us. We collect personal information about you when you voluntarily submit information directly to us by filling in forms on our Websites or by corresponding with us by phone, email or other means. This includes:

(a) information you provide when you register to use our Websites;

(b) subscribe to the Clio Services, participate in any discussion boards, forums or other social media functions on our Websites;

(c) enter a competition, promotion or survey;

(d) information you provide when you report a problem with our Websites; or

(e) use some other feature of the Clio Services as available from time to time.

(f) We may also receive personal information about you that we have collected directly from you if you use any of the other Websites we operate or the other services we provide from time to time.

(g) If you choose not to provide personal information, we may not be able to provide the Clio Services to you or respond to your other requests.

2.2 Information we receive from other sources. We may receive personal information about you from the following sources:

(a) individuals or corporate entities which are subscribers to the Clio Services (“Subscribers”) where you are designated as a user of the Clio Services;

(b) third parties we work closely with (including, for example, subcontractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers, credit reference agencies), subject to your agreements with them;

(c) third party organisations that Clio has acquired following any corporate acquisition by Clio of third party companies. For more information about our use of this type of information, please refer to paragraph 3.9 below.

2.3 How we use your personal data:

(a) The table at Annex 1 (Purposes for the Personal Information we collect) sets out the purposes and circumstances for processing personal information, the categories of personal information you provide to us and that we receive from other sources and how we use that information. The table also lists the legal basis which we rely upon to process the personal information.

(b) We also automatically collect personal information about you indirectly about how you access and use the Clio Services and information about the device you use to access the Clio Services.

(c) We may link or combine the personal information we collect and/or receive about you and the information we collect automatically. This allows us to provide you with a personalized experience regardless of how you interact with us.

(d) We may anonymize and aggregate any of the personal information we collect (so that it does not identify you). We may use anonymized information for purposes that include testing our IT systems, research, data analysis, improving the Clio Services and developing new products and features.

3. Disclosure and sharing of your personal information

3.1 We will not share your personal information with any third parties except as described in this Privacy Notice or in connection with the Clio Services.

3.2 Where Clio acts as a controller, we may share your personal information with selected external third parties, including:

(a) business partners, vendors, suppliers, and subcontractors who perform services as processors on our behalf (these companies are authorized to use your personal information only as necessary to provide these services to us);

(b) analytics and search engine providers that assist us in the improvement and optimization of our Websites;

(c) credit reference agencies for the purpose of assessing your credit score where this is a condition of us entering into a contract with you; and

(d) payment processors for the purpose of fulfilling relevant payment transactions.

3.3 Clio may also share your personal information to any member company of our group, which includes our subsidiaries and entities branded as “vLex part of Clio” for the purposes of providing the Clio Services and sending you marketing, as listed in Annex 2 (Group Companies) below.

3.4 We may also share anonymized and aggregated information with others. Further information about our anonymisation and aggregation practices is set out in paragraph 2.3(d) above. Where we share your personal information with third party processors, we will enter into appropriate data processing agreements to ensure that such processors provide adequate security and data protection measures in place in compliance with applicable data protection law. For a list of sub-processors, please see Themis Authorized Subprocessors. Country-specific sub-processor references, where applicable, are set out in Annex 5 (Country-specific provisions).

3.5 In certain situations, we may be required to disclose personal information in response to lawful requests by public authorities, including to meet law enforcement requirements.

3.6 We may disclose personal information where we believe this is necessary in order to comply with any legal obligation, or in order to enforce or apply our applicable terms and conditions of service (as published on the relevant Clio website for each jurisdiction) and other agreements; or to protect the rights, property, or safety of Clio, our customers, or others. This includes exchanging information with other companies and organizations as set out in Annex 1 (Purposes for the Personal information we collect) for the purposes of fraud protection and credit risk reduction.

3.7 Publicly accessible blogs. Our Website includes publicly accessible blogs or community forums. Any information you provide in these areas may be read, collected and used by others who access them. This includes information posted on our public social media accounts. To request removal of your personal information from our blog or community forum, contact us at privacy@clio.com. In some cases, we may not be able to remove your personal information, in which case we will let you know if we are unable to do so and why.

3.8 Testimonials. With consent, we may display personal testimonials of satisfied customers on our Websites, along with other endorsements. If you wish to update or delete your testimonial, you can contact us at privacy@clio.com.

3.9 We may disclose personal information to third parties in connection with a business transaction. Personal information may be disclosed to third parties in connection with a transaction, such as a merger, sale of assets or shares, reorganization, financing, change of control or acquisition of all or a portion of our business. If we are involved in a merger, acquisition, or sale of all or a portion of its assets, you will be notified via email and/or a prominent notice on our Website of any change in ownership that impacts the use of your personal information, as well as any choices you may have regarding your personal information.

4. Marketing and advertising

4.1 From time to time we may contact you with relevant information about the Clio Services and our other products and services. Most marketing communications will be sent to you electronically via email or SMS (text messages), and in some cases by telephone call. For some communications, we may use personal information we collect about you to help us determine the most relevant information to share with you. Marketing communications may come from Clio, including any of our group companies operating as “vLex part of Clio”. These communications will identify the sender and provide clear options to manage your preferences or unsubscribe. For more information on the Clio group companies, please consult Annex 2 (Group Companies) below.

4.2 Managing your marketing preferences.

(a) You can control whether you receive marketing communications from us at any time.

(b) Where we rely on your consent, you will be asked to indicate your preferences when we first collect your contact details, and you may withdraw your consent at any time. Where we send marketing communications on the basis of our legitimate interests (for example, in a business-to-business context where permitted by law) as more fully described in Annex 1 (Purposes for the Personal information we collect), you have the right to object at any time.

(c) Email marketing. You can manage your preferences or opt out of receiving marketing emails by using the unsubscribe link included in our emails, by accessing the Clio subscription centre, or by contacting us at privacy@clio.com. We will respect your preferences and objections in accordance with applicable data protection and e-marketing laws.

(d) SMS marketing. Where we send marketing by SMS, you can opt out at any time by following the instructions included in the message (for example, replying “STOP”) or by contacting us at privacy@clio.com.

(e) Telephone marketing. Where we conduct marketing by telephone call, you may object at any time during the call or by contacting us at privacy@clio.com. We will maintain and apply suppression lists to ensure that individuals who object are not contacted again by telephone.

5. Storing and transferring your personal information

5.1 Security.

(a) Clio has implemented administrative, technical, and physical safeguards to protect its and its customers’ information. For further information on Clio’s security controls and practices, please refer to our Security & Reliability page. Where we have given you (or where you have chosen) a password which enables you to access certain parts of the Clio Services, you are responsible for keeping this password confidential. Subscribers should not share their password with anyone.

(b) While no transmission of information via the internet is completely secure, we take reasonable measures to protect your personal information. We cannot guarantee the security of your personal information transmitted to our Website; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorized access.

5.2 International transfers of your personal information.

(a) The personal information we collect may be transferred to and stored in countries outside of the jurisdiction you are in where we and our third-party service providers have operations. If you are located in the European Union (“EU”) or the United Kingdom (“UK”), your personal information may be processed outside of the EU and/or the UK including in the United States.

(b) Where such international transfers occur, we will take suitable steps, including by putting in place appropriate safeguards, to ensure that your personal information is protected to the same standard as under the EU GDPR and UK GDPR.

(c) Such safeguards shall include, but are not limited to, putting in place an appropriate data transfer mechanism (such as, for example, EU Standard Contractual Clauses, EU-US Data Privacy Framework) to protect your data or relying on findings of adequacy.

(d) If you wish to inquire further about these safeguards used, please contact us using the details set out at the end of this policy.

6. Retaining your information

6.1 Your personal information will be generally retained as long as necessary to fulfil the purposes for which we collected the personal information. Once you and/or your company have terminated the contractual relationship with us or otherwise ended your relationship with us, we may continue to retain your personal information in our systems and records where needed to fulfil surviving obligations or for other legitimate business purposes — such as to evidence our business practices and contractual obligations, to provide you with information about our products and services, to ensure the integrity and security of our platform, or to comply with applicable legal, tax, or accounting requirements (for example, we typically retain financial records for up to seven years).

6.2 To determine the appropriate retention period for personal information, we consider factors such as:

(a) the type, amount, nature, and sensitivity of the personal information;

(b) the potential risk of harm from unauthorized use or disclosure of your personal information;

(c) the purposes for which we process your personal information;

(d) the duration of your contract or account with us;

(e) the potential for disputes or legal claims;

(f) operational and security needs, including the maintenance of system back-ups and any other legitimate business purposes; and

(g) the applicable legal, regulatory, tax or accounting requirements.

6.3 When we have no ongoing legitimate business need nor lawful legal ground to process your personal information, we will, within a reasonable period after it is no longer needed, delete, anonymize, or aggregate your personal information or, if this is not technically feasible (for example, because your personal data has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

6.4 Clio maintains data retention policies setting out the retention periods applicable to each processing activity. If you wish to know the retention period applicable to your personal data, you may request this information by writing to privacy@clio.com.

7. Referral program

7.1 We operate a referral program for our Service; you may choose to provide us with names and email addresses of businesses and individuals who you feel would be interested in learning more about our products and services in exchange for rewards. We will store the contact details in order to track the success of our referral service. The referred individual may request that their business contact details be removed from our database and they may also contact us at any time at privacy@clio.com to make the request. The referral program is offered only in jurisdictions where it is legally permitted, and availability may vary depending on applicable laws.

7.2 We process referral contact information in accordance with applicable data protection and e-marketing laws. We do not rely on consent obtained indirectly through third parties as a lawful basis where such reliance is not permitted by law. Where permitted, we may send a limited referral communication on an appropriate lawful basis, such as legitimate interests in a business-to-business context. Where required by law, we will not send direct marketing communications unless and until we have obtained valid consent directly from the individual.

8. Your rights in respect of your personal information

8.1 In accordance with applicable privacy law, you have the following rights in respect of your personal information that we hold:

(a) Right of access and portability. The right to obtain access to your personal information along with certain information, and to receive that personal information in a commonly used format and to have it ported to another data controller.

(b) Right to rectification. The right to obtain rectification of your personal information without undue delay where that personal information is inaccurate or incomplete.

(c) Right to erasure. The right to obtain the erasure of your personal information without undue delay in certain circumstances, such as where the personal information is no longer necessary in relation to the purposes for which it was collected or processed.

(d) Right to restriction. The right to obtain the restriction of the processing undertaken by us on your personal information in certain circumstances, such as where the accuracy of the personal information is contested by you, or where you have objected to the sale of your personal information, for a period enabling us to verify the accuracy of that personal information.

(e) Right to object. The right to object, on grounds relating to your particular situation, to the processing of your personal information, and to object to the processing of your personal information for direct marketing purposes, to the extent it is related to such direct marketing.

(f) Right to non-discrimination. The right to non-discrimination for exercising your rights as outlined in this policy. This includes, but is not limited to, denying you goods or services, charging you different prices for similar services, or providing a different level or quality of service.

(g) Right not to be subject to automated decision-making. You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you, except where such automated processing is permitted under applicable law (including Article 22(2) EU GDPR or equivalent). Clio does not currently make decisions based solely on automated processing that produce legal or similarly significant effects on individuals. Where Clio uses profiling techniques (for example, to generate personalised content recommendations) this is limited to improving your access to relevant content and does not produce such effects. Should this change in the future, Clio will notify you and ensure your rights to obtain human intervention, to express your point of view, and to contest the decision are respected.

(h) Right to withdraw consent. Where we have relied on consent to legitimise certain processing activities such as, in certain circumstances, sending you direct marketing, you have a right to withdraw your consent at any time, by emailing us at privacy@clio.com. For Clio branded marketing, you can also change your marketing preferences at any time by accessing the subscription center.

8.2 Additional information relevant to job applicants, including how to exercise rights in a recruitment context, is set out in Annex 3 (Recruitment Privacy Information).

8.3 If you wish to exercise any of these rights, you may do so by emailing privacy@clio.com. Country-specific channels for exercising your rights, where applicable, are set out in Annex 5 (Country-specific provisions). Upon request, we will provide you with information about whether we hold any of your personal information. We may request that you verify your identity prior to transferring personal information. You may also access, correct or request deletion of your personal information by logging into your Clio Service account. We will respond to your request within 30 days.

8.4 Clio does not sell personal information shared by you. Clio has not sold personal information shared by you in the 12 months preceding the modification date for this policy. All use of personal information is done for the delivery, use, and improvement of the Service, as listed in section 2 of this Privacy Notice.

8.5 If you reside in the EU or UK, Clio is the controller of your personal information for purposes of EU GDPR or UK GDPR (as applicable). If you are not happy with the way that we have handled your personal information, you may lodge a complaint. In the EU, you also have the right to lodge a complaint to your local data protection authority. Information about how to contact your local data protection authority is available at https://www.edpb.europa.eu/about-edpb/our-members_en. UK residents may lodge a complaint first with us (see clause 14 of this Privacy Notice below). If you are not satisfied with our response, you can complain to the UK data protection authority at https://ico.org.uk/make-a-complaint/data-protection-complaints/. Country-specific supervisory authorities and complaint channels are set out in Annex 5 (Country-specific provisions).

8.6 Removal of personal data from legal content databases. As described in connection with personal data that may appear within Clio legal content databases (such as judicial decisions and official publications), if you consider that personal data relating to you has not been removed from such content where it should have been, or that a document cites your name or other personal data in a way that causes you harm, you may contact us to request its removal. We will assess your case with due diligence, taking into account applicable data protection legislation. Requests may be directed to contentremovals@clio.com.

9. Cookies and similar technologies

Information about our use of cookies and similar technologies, including the types of cookies we use and how you can manage your preferences, is set out in Annex 4 (Cookies and Similar Technologies).

10. Links to third party sites

10.1 The Clio Services may, from time to time, contain links to and from third party websites. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for their policies. Please check the individual policies before you submit any information to those websites.

10.2 Some of the pages on our Websites may utilize framing techniques to serve content to/from our partners while preserving the look and feel of our Website. Please be aware that you are providing your personal information to these third parties and not to Clio.

11. Our policy towards children

The Clio Services are not directed at persons under 16 and we do not intend to nor knowingly collect personal information from persons under 16 in our capacity as a controller, except in those jurisdictions where local law provides for a different minimum age, as set out in Annex 5 (Country-specific provisions). Where we act as a processor for our customers, those customers are responsible for compliance with applicable child data protection laws. If we become aware that personal information relating to a person below the applicable minimum age has been provided to us in circumstances where this is not permitted, we will take appropriate steps to address this, which may include restricting or deleting the data, and notifying the relevant customer where applicable. If you believe that a person under the applicable minimum age has provided us with personal information without appropriate consent, then please contact us using the details below so that we can take the appropriate steps.

12. Changes to this policy

We may update this Privacy Notice from time to time and so you should review this page periodically. When we change this Privacy Notice in a material way, we will update the “last modified” date at the top of this Privacy Notice. Changes to this Privacy Notice are effective when they are posted on this page.

13. Notice to you

If we need to provide you with information about something, whether for legal, marketing or other business related purposes, where we have appropriate legal basis, we will select what we believe is the best way to get in contact with you taking into account any preferences you have told us about. We will usually do this through email or by placing a notice on our Website. The fact that we may send notices to you will not stop you from being able to opt out of certain types of contact as described in this privacy policy.

14. Contacting us

14.1 If you are based in the EU, our EU representative pursuant to Article 27 EU GDPR is Themis Solutions (Ireland) Limited, a limited company registered in Ireland with company number 533767 and with its registered office at Arthur Cox Building, Earlsfort Terrace, Dublin 2. Country-specific contracting entities and controller allocations are set out in Annex 5 (Country-specific provisions).

14.2 Regardless of your location, any questions, comments, and requests regarding this Privacy Notice are welcome and should be addressed to our Data Protection Officer, Niamh Pollak, at privacy@clio.com. Country-specific Data Protection Officers and additional contact channels are set out in Annex 5 (Country-specific provisions). Communication can also be addressed to:Themis Solutions Inc. DBA Clio
300-4611 Canada Way
Burnaby, BC, Canada
V5G 4X3
1-888-858-2546

14.3 If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third-party dispute resolution provider (free of charge) at feedback-form.truste.com/watchdog/request.