Search
Contact
Login
Berry Appleman & Leiden LLP is a limited liability partnership organized under the laws of the State of California and has offices in Atlanta, GA; Los Angeles, CA; Austin, TX; Boston, MA; Richardson, TX; Houston, TX; Tysons, VA; San Francisco, CA; Santa Clara, CA; New York, NY, Chicago, IL; Denver, CO; and Washington D.C. (together referred to as “BAL” or “we”, “our”, or “us”).
This privacy policy describes how we may collect, use, share and otherwise process your personal information, as an employee of one of our corporate clients or other individual to whom we offer our services – immigration and related products and services – via our Cobalt® website, mobile applications (e.g., BAL Cobalt mobile app), communications channels (e.g., portals or platforms available online) or other online and offline means (e.g., via fax, physical mail, or courier). BAL collects personal information through various means, including questionnaires, www.bal.com and its secured access sites, including, but not limited to cobalt.bal.com (collectively referred to as “sites”). This privacy policy applies to personal information collected by BAL including, but not limited to all sites that post a link to this privacy policy. In the context of this privacy policy BAL acts as a data controller or co-controller with third parties.
We may change this privacy policy from time to time as our business changes or legal requirements change. If we make material changes to this privacy policy, we will post a notice on our sites before the changes go into effect, and where appropriate, send a direct communication to you about the change.
If you contact us, register with our Cobalt online tool or receive services from us, we collect information about you. In order to use such online tool, you may give us information, or your employer or immigration sponsor may send it to us. This may include your name, email address, phone numbers, employer and employment details, education history, and physical addresses. In the event that you are an existing client, we may collect a combination of such information as needed. Depending on the destination country, we may also require passport and visa number and details, government identifiers, gender, date of birth, nationality, ethnicity, race, former addresses, marital history, criminal background, disability, financial details, other information relating to health, religion, spouse or partner and parental details. If we provide services for your family or companions, we may collect similar information about them.
We may collect the following categories of information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household:
We may collect all categories of personal information listed above from the following categories of sources:
Source one: we collect personal information directly from you and/or your household that you provide us. Personal information is required to use certain features available on our sites, for example, to create a Cobalt online account, contact us via email, phone, or our “contact us” form (where we may retain your message content and our response), submit job application materials, receive or request data from us (e.g., via whitepapers, catalogs, and newsletters).
Source two: we collect personal information automatically when you access our sites. For example, we may collect information such as the websites you visit before or after you visit our sites, pages you click on our sites, IP address, search requests, browser type, operating system, data and time you visit our sites, the amount of time spend on our sites, and the device you use to access our sites.
Source three: we collect personal information we get from third parties and public sources.If BAL is handling your visa or immigration matter, we may obtain personal information about you from your employer, our client, various governments (foreign and domestic) and from public sources. Such public sources may include, but are not limited to, social media sites such as LinkedIn, Facebook, Instagram, Google Scholar and other internet searches. The personal information we may collect and process will depend on the specific nature of an engagement and the services we are providing, such as:
We may use all categories of personal information listed above for the following business purposes:
WE DO NOT ALTER OUR DATA COLLECTION AND USE PRACTICES IN RESPONSE TO DO NOT TRACK SIGNALS. WE CURRENTLY DO NOT HONOR “DO NOT TRACK” REQUESTS.
When we process personal information about you, we do so as necessary to provide the products and services you and your employer or immigration sponsor use, to operate our business, to meet our contractual and legal obligations, to protect the security of our services, systems and customers, or to fulfill other legitimate interests to provide the Cobalt site and the services that we have been engaged to provide described in this policy.
Our services to you are typically provided under the terms of our service agreements with your employer or immigration sponsor. We share your information with them to allow them to manage their immigration needs and assure compliance with their policies. At the request of your employer or immigration sponsor, we may also share information with their vendors. In the event that our client wishes to engage alternative legal advisers, we may transfer your personal information to those advisors to ensure continuity of business.
If your immigration request takes you to countries serviced by one of our local network partners, they may have access to your account information, immigration plans and other information necessary to provide you with the services you or your employer or immigration sponsor may request.Sharing with these local partners is in accordance with our Data Protection Principles which mandate privacy and security measures for the transfer of information wherever they may be located.
We share information with immigration authorities (for example consulates and other government or law enforcement agencies), and their vendors as necessary to provide immigration and related services to you and your employer.
We share information with vendors that perform functions on our behalf, such as vendors offering notarization, translation, authentication, and legalization services, visa and passport providers, third party providers and services partners to facilitate the provision of services with respect to foreign governments, mobile application and software developers, and vendors who provide IT support, data hosting and marketing and communication services. These vendors process your information only as necessary to perform their functions as instructed in our contracts with them. We may share information with Deloitte LLP as part of our service partner relationship with Deloitte LLP, used to facilitate the provision of BAL services with respect to foreign governments. Information regarding the ways in which Deloitte LLP collects, uses and shares personal information when providing immigration services to you outside of the United States can be found on Deloitte’s Global Advantage Privacy Statement. Please note that we cannot and do not control Deloitte LLP’s privacy practices.
We combine data from many people to create aggregated statistics that do not identify you personally. We use this data to understand business trends and insights, and we may share them with third parties.
We share personal information when we think it’s reasonably necessary to protect ourselves and the people who use our services, enforce agreements, respond to emergencies and comply with law.
In exceptional circumstances, we may share personal information with government agencies other than immigration authorities and other third parties if we believe it is reasonable and necessary to comply with law, regulation, legal process or governmental request; to enforce our agreements, policies and terms; to protect the security of our services; to protect BAL or the public from harm or illegal activities; or to respond to an emergency.
We may also share personal information with other parties as directed by you or subject to your consent.
We do not sell information to third parties so that they can independently market their own products or services directly to you.
Before transferring your personal information to third parties, we will require the third party to maintain at least the same level of privacy and security for your personal information that we do. We remain liable for the protection of your personal information within the scope of our Data Protection Principles except to the extent that we are not responsible for the event that leads to any unauthorized or improper processing.
We maintain reasonable administrative, technical, and physical security measures to protect your information from unauthorized access and use. We retain your information only as long as needed to provide our services and for legitimate business purposes, unless we are required by law or regulation or for litigation and regulatory investigations to keep it for longer periods of time.
We may collect, use, share, transfer and otherwise process de-identified and aggregated information that we receive or create for any purposes in our sole discretion, in compliance with applicable laws. We are the sole and exclusive owner of such de-identified and aggregated information, including if we de-identified personal information so that it no longer is capable of identifying an individual.
For the purposes described here, it may be necessary to transfer your information to jurisdictions outside of your home country including to countries that may not provide the same level of data protection as your home country. As immigration services are inherently global, we may transfer data to any jurisdiction in the world where you may be traveling to. To protect your information, transfers will be made as permitted by applicable law, including, where necessary, being subject to appropriate contractual clauses. Regardless of where we process your information, we protect it in the manner described in this privacy statement and in accordance with applicable law.
BAL keeps personal information for as long as necessary to provide our products and services, fulfill requested transactions, or for other essential purposes such as complying with our legal obligations, preventing fraud, resolving disputes and enforcing our agreements. Because these needs can vary for different data types in the context of different services, actual retention periods may vary. Here are some of the factors we have considered to set retention times:
Our sites include Social Media Features, such as the Facebook Like button and Widgets, such as the “Share this” button or interactive mini-programs that run on our sites. These features may collect your IP address, which page you are visiting on the site, and may set a cookie to enable the feature to function properly. Social Media Features and Widgets are either hosted by a third party or hosted directly on our sites. Your interactions with these features are governed by the privacy policy of the company providing it.
Our sites are general audience sites not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we obtain actual knowledge that any personal information we collect has been provided by a child under the age of 13, we will promptly delete that information. If a parent or legal guardian learns that their child provided us with personal information without his or her consent, please contact us and we will make commercially reasonable attempts to delete such personal information.
If you have created an online account with us and would like to update the information you have provided to us, you can access your account to view and make changes or corrections to your information. You may also have the right to be informed of whether we are processing your personal information and to access, transfer, correct, delete or object, upon request and free of charge, to our use of your information. Please note that we may need to retain certain information for record-keeping, to complete any transactions you began before your request, or for other purposes permitted by law.
Subject to certain limitations such as (a) exceptions permitted by applicable law and (b) verification of your identity, you may exercise the following rights with regard to your personal information:
In many of the countries where we operate, data protection law requires us to process personal data only where we have an approved basis under the law. You have the right to understand what our legal bases are, so we explain them here. We use the following bases, depending on the activity we undertake:
In most cases, the data we collect and the things we use it for are necessary for us to provide immigration services as requested by you or your employer or immigration sponsor.
When we receive and process a request for our services, we are complying with GDPR Article 6(1)(b).
We use personal data as necessary to meet our legitimate business interests. When we do, we make sure we understand and work to minimize its privacy impact. For example, we limit the data to what is necessary, control access to the data, and where we can, aggregate or de-identify the data.
Some examples of the data processing activities we undertake in our legitimate interests are:
What is legitimate interest? Under GDPR Article 6(1)(f), companies have the ability to engage in activities without consent under a balancing test. Do we have legitimate interest in engaging gin the activity that is not outweighed by the interest or fundamental rights and freedoms of the data subject?
In some cases, we process personal data with your specific and informed consent. We tell you in the service where you can make a choice or grant consent. If you have granted consent, you may withdraw it at any time to stop any further processing. In order to request this, please send an email.
To exercise your rights described in this policy, please fill in a Privacy Request Form, call us toll free at +1-877-757-7108, send us an email or write to us at:
More on submitting a request to delete or access your information. Subject to our verification of your identity as described below, you may submit your request to delete or access your information here: Privacy Request Form.
Who may exercise their rights.You may only make a request to exercise your rights on behalf of yourself. A parent or legal guardian may make a request on behalf of their child. If you are a California resident, only you or a person registered with the California Secretary of State that you authorize to act on your behalf may make a request related to your personal information. See the section titled “Authorized Agents” below for more information.
Verifiable consumer request.In order to verify your request, you must provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information and you must describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
When we will respond. We will try to respond to your request within 30 days. If we require additional time, we will inform you of the reason and extension period. Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. For data portability requests, we will select a format to provide your personal information to you. We may charge a fee to process or respond to your request if it is excessive, repetitive, or manifestly unfounded.
You have a right to not receive discriminatory treatment for exercising any of your rights as mentioned in this section.
You may designate an authorized agent to make a request on your behalf to exercise your rights by doing the following: (1) provide the authorized agent written permission to do so; and (2) verify your own identity (per the process stated above), as well as the identity of the authorized agent directly.
You have a number of rights under European law consisting of the right to:
To learn more or exercise these rights, contact us.
If you have any questions or complaints about BAL and privacy, or to exercise your rights, or to request an additional review of a declined rights request within 30 days of our response, please contact the data protection office, or please fill in a Privacy Request Form, call us toll free at +1-877-757-7108, send us an email or write to us at:
In most cases, we will ask that you put a complaint or request in writing. We will investigate your complaint or request and will generally respond to you in writing within 30 days of receipt. If any complaint or request remains unresolved or if you are otherwise dissatisfied with the response that you receive from us, you may have the right to lodge a complaint with your regulator or the U.S. Department of Commerce.