The floor under every conversation, before any NDA is signed. A description of how information is held inside the firm and what survives the engagement.
Confidentiality is the operating premise of the firm. This file describes how we hold information that has not yet been disclosed, before any non-disclosure agreement is signed and irrespective of whether one is.
A bilateral NDA is offered at the first substantive conversation. The terms below are the floor; the NDA on the file may raise them. They are never lowered.
We treat as confidential any information that, in the circumstances of its disclosure, a reasonable practitioner would treat as confidential. The marker on the document is helpful but not required.
Information is shared on a need-to-know basis with the constituency members assigned to the file. The four-constituency model does not loosen confidentiality; it places more people under the same obligation.
Every person with access is bound by a written confidentiality undertaking that survives the end of their relationship with the firm. Devices are managed. Documents are encrypted in transit and at rest. Access to the engagement record is audited.
We engage a short list of operational sub-processors (hosting, mail, calendaring, secure document exchange). Each is bound by a written agreement equivalent to this policy. The current list is available on request.
We do not disclose to third parties outside that list without your prior written consent, save where disclosure is required by law and we are not lawfully restrained from notifying you.
The firm and its personnel do not trade in the securities or instruments of an entity whose confidential information we hold, and we do not allow such trading by anyone advising on the engagement. This applies for the duration of the engagement and until the information has been public for thirty trading days.
The duty to hold information confidential survives the end of the engagement. It is not time-bound. We retain only what we are required to retain for our professional records, and we hold it under the same posture.
On written request, and subject to our regulatory record-keeping obligations, we will return or destroy the materials we hold and confirm in writing that we have done so.
A suspected breach is reported to the file principal without delay. Where personal data is implicated, the GDPR procedure applies. Where the breach affects an active engagement, we notify you within 24 hours of detection, irrespective of legal thresholds.
Treat your interactions with us as confidential. Do not forward our correspondence outside the file without written agreement. Mark sensitive material and send it through the channels we provide rather than through the open networks of your inbox.
To report a suspected breach or to negotiate the NDA before a first conversation, write to the address below. Suspected breaches are escalated within four working hours.