Legal Notices: Privacy Policy

Last Updated: January 21, 2026

This Privacy Policy explains our approach to any personal information that we collect from you or which we have obtained about you from a third party and the purposes for which we process your personal information. It also sets out your rights in respect of our processing of your personal information.

This Privacy Policy will inform you of the nature of your personal information that is processed by us and how you can request that we delete, update, transfer and/or provide you with access to it.

This Privacy Policy is intended to assist you in making informed decisions when using the Site and our Services and/or to understand how your personal information may be processed by us as a result of providing the Services to third parties or when you apply to work at SUNWAY LAW. Please take a moment to read and understand it.

Please also note that this Privacy Policy only applies to the use of your personal information obtained by us.

1. Who Are We

Back to top

Shanghai Sunway Law Firm (SUNWAY LAW) is a law firm based in Shanghai, China. For more information about our firm, please visit our About Us page.

Shanghai Sunway Law Firm is the data controller responsible for your personal information processed via the Site and in connection with our Services.

2. Contact Us

Back to top

If you have any questions about this Privacy Policy or want to exercise your rights set out in this Privacy Policy, please contact us by:

  • Sending an email to: info@sunwaylaw.cn
  • Company: Shanghai Sunway Law Firm
  • Location: Shanghai, China

3. Information We Collect

Back to top

3.1 Website Visitors

  • Name and job title
  • Contact information (company, email address, social media accounts)
  • Demographic information (address, preferences, interests)
  • Other information relevant to providing our services

3.2 Clients and Prospective Clients

  • Name and job title
  • Contact information (company, email address)
  • Payment information
  • Information relevant to service provision
  • KYC and anti-money laundering information (including proof of source of funds)
  • Meeting and event information (including dietary requirements which may reveal health or religious beliefs)

3.3 Individuals Involved in Service Provision

  • For pension advice: beneficiary rights, service years, salary, contact details, date of birth, gender
  • For litigation advice: personal information of plaintiffs, defendants, witnesses, which may include sensitive categories of personal information

3.4 Marketing Purposes

  • Name and business information (job title, company)
  • Areas of interest or topics
  • Events attended
  • Dietary preferences (which may reveal health or religious beliefs)

3.5 Job Applicants

  • Name and job title
  • Contact information (email address)
  • Resume (age, gender, education, work experience)
  • Other recruitment-related information

4. How We Use Information

Back to top

4.1 Service Fulfillment

We collect and maintain personal information voluntarily submitted by users to fulfill our services, and personal information provided by clients or their legal advisors to perform our services.

Legal Basis: Performance of contract obligations; Legitimate interests

4.2 Legal Compliance and Rights Protection

  • Comply with legal obligations (including KYC, anti-money laundering, anti-bribery, conflict checks, etc.)
  • Enforce legal rights
  • Protect third party rights
  • Business transactions (such as mergers, reorganizations, sales)

Legal Basis: Legal obligations; Legitimate interests

4.3 Recruitment

Evaluate applicant suitability for positions (partners, lawyers, training contracts, summer internships, business support roles) and review equal opportunity situations to ensure non-discrimination.

Legal Basis: Steps prior to entering into a contract; Legitimate interests; Explicit consent (for sensitive data)

4.4 Marketing

  • Postal marketing
  • Email marketing

Legal Basis: Legitimate interests; User consent

4.5 Website Analytics and Improvement

  • Monitor website traffic using IP addresses
  • Track usage statistics with session IDs
  • Analyze personal or professional interests, demographics, product experience, and contact preferences

Legal Basis: Legitimate interests (in non-anonymized form)

5. Legal Basis

Back to top

Our legal basis for collecting and using your personal information depends on the specific context in which we collect it. We will normally collect personal information from you where:

  • Performance of Contract: We need the personal information to perform a contract with you
  • Legitimate Interests: The processing is in our legitimate interests or the legitimate interests of a third party, and it is not overridden by your data protection interests or fundamental rights and freedoms
  • Legal Obligation: We need to comply with a legal obligation

6. Information Sharing

Back to top

We may share your personal information with the following categories of third parties:

  • Professional advisors (lawyers, accountants)
  • Government or regulatory authorities
  • Professional indemnity or other relevant insurance companies
  • Regulatory authorities/tax authorities/company registries
  • Outsourced service providers:
    • Document processing and translation services
    • Confidential waste disposal
    • IT systems or software providers
    • IT support service providers
    • Document and information storage providers
  • Third parties involved in service provision:
    • Lawyers, arbitrators, mediators, clerks, witnesses
    • Cost draftsmen, courts, opposing parties and their lawyers
    • Document review platforms
    • Experts (tax advisors, appraisers)
  • Client insight analytics service providers (such as Google Analytics)
  • Postal or courier providers

This list is not exhaustive and there may be other sharing situations to effectively provide services.

7. Cookies

Back to top

Our Site uses certain tags, log files and other technologies of which you should be aware. Please see our Cookie Policy to find out more about the cookies we use and how to manage and delete cookies.

8. Third Party Contractors

Back to top

8.1 Data Processing Subcontractors

We may appoint subcontractor data processors to provide services, including: document processing and translation, confidential waste disposal, IT systems/software providers, IT support, and document and information storage.

We conduct appropriate due diligence and enter into contractual documents to ensure personal information is processed in accordance with legal and regulatory obligations.

8.2 External Data Controllers

We may appoint external data controllers to provide services, including: accountants, barristers, and other third-party experts.

We comply with legal and regulatory obligations, including taking appropriate safeguards.

Legal Basis: Performance of contract obligations; Legitimate interests

9. Data Transfer

Back to top

To provide our services, we may need to transfer your personal information outside the jurisdiction where the information was provided.

9.1 Cross-Border Data Transfer

If necessary, we will transfer personal information to countries outside of China, including transfers to our service providers.

9.2 Data Protection Measures

  • We have implemented appropriate data protection agreements with service providers
  • Based on standard contractual clauses approved by relevant authorities
  • Includes other relevant/applicable legal requirements
  • Ensures compliance with legal and regulatory obligations
  • Ensures personal information is adequately protected

10. Data Retention

Back to top

10.1 Website Visitors

We retain personal information for at least 3 years from the date of last interaction, in compliance with applicable data protection laws. Depending on regulatory obligations or professional indemnity obligations, we may retain information for longer periods.

10.2 Client Service Provision

We retain personal information for at least 6 years from the date of last interaction with the client, in compliance with applicable data protection laws. Depending on regulatory obligations or professional indemnity obligations, we may retain information for longer periods. After this period, we may destroy documents without further notice or liability.

10.3 Short-Term Information

Personal information that is only useful in the short term (such as for specific marketing campaigns) may be deleted sooner.

11. Security

Back to top

We are committed to protecting the security of your personal information. We implement appropriate information security policies, rules and technical measures to prevent unauthorized access, improper use or disclosure, unauthorized modification, illegal destruction or accidental loss.

All partners, employees, consultants, staff and data processors who have the right to access and process your personal information must respect the confidentiality of your personal information.

12. Your Rights

Back to top

12.1 Right to Access

You can request confirmation of whether we are processing your personal information and obtain a copy of your personal information (along with certain other details). Additional copies may require payment of a reasonable fee.

12.2 Right to Rectification

If the personal information we hold is inaccurate or incomplete, you have the right to request correction. If we have shared the information with others, we will notify them of the correction where possible. You can request to be informed of the recipients so you can contact them directly.

12.3 Right to Erasure

In certain circumstances, you can request deletion or removal of your personal information, for example, if the information is no longer needed or you withdraw consent (if applicable). If we have shared the information with others, we will notify them of the deletion where possible. You can request to be informed of the recipients so you can contact them directly.

12.4 Right to Restriction of Processing

In certain circumstances, you can request to "block" or suppress the processing of your personal information, for example, if you dispute the accuracy of the personal information or object to the processing. If we have shared the information with others, we will notify them of the restriction where possible. You can request to be informed of the recipients so you can contact them directly.

12.5 Right to Data Portability

In certain circumstances, you have the right to obtain the personal information you provided (in a structured, commonly used and machine-readable format). You can reuse it elsewhere or request that we transfer it to a third party of your choice.

12.6 Right to Object

You can request that we stop processing your personal information. We will stop processing unless we can demonstrate compelling legal grounds, in the following cases:

  • We rely on our own or others' legitimate interests to process your personal information
  • We process your personal information for direct marketing purposes

Important Note: Certain rights may be limited if we have overriding interests or legal obligations to continue processing data. Data may be exempt from disclosure due to legal professional privilege or professional confidentiality obligations.

13. Third Party Sites

Back to top

The Site contains links to other sites whose information practices may be different than ours. Visitors should consult the other sites' privacy notices as SUNWAY LAW has no control over information that is submitted to, or collected by, these third parties.

14. Policy Changes

Back to top

We may make changes to this Privacy Policy from time to time. To ensure that you are always aware of how we use your personal information, we will update this Privacy Policy from time to time to reflect any changes to our use of your personal information. We may also make changes as required to comply with changes in applicable law or regulatory requirements.

Where it is practicable, we will notify you by email of any significant changes. However, we encourage you to review this Privacy Policy periodically to be informed of how we use your personal information.