Privacy Policy

Last Revised: August 12, 2026

This Privacy Notice informs you of important information about how Gesmer Updegrove LLP (“Gesmer,” “we,” or “our“) processes the personal data that we collect in online and offline formats through the Services.

“Personal data” means data that reasonably can be used to identify a living person, or that reasonably relates to a living person.

When we use the term “Services” we mean to refer collectively to:

  • The provision of legal and related services to our clients and prospective clients (“Client Services“);
  • The websites and mobile applications owned and controlled by us that link to this Privacy Notice (“Sites“); and
  • Our marketing and business development activities, including social media properties we create and emails that we send (“Marketing Activities“).

This Privacy Notice covers the personal data that we collect through the provision of our Services.

1. How we collect and use personal data

We collect and process personal data about a number of different individuals through the provision of the Services. These individuals include our individual clients and prospective clients, their representatives, visitors to our Sites, vendors, and other individuals.

2. Clients and prospective clients

In certain instances, we are required to obtain certain information before we can accept someone as a client. For individual clients, this includes:

  • Name
  • Contact details
  • Information to verify identity or rights to act on behalf of a client or prospective client

The majority of our clients are corporate entities, and data about entities is not personal data. But we do process personal data of company employees, representatives, and other personal data clients provide to us, or allow us to collect on their behalf, while providing the Client Services. This includes contact information and any other personal data that is relevant to or necessary for us to deliver the Client Services.

We also process personal data to assist in building relationships. This includes name, contact information, and job title, and may also include job duties and gender.

We collect and use this information to provide the Client Services and for other legitimate business interests. For example, we use contact details to send communications and legal updates. You can update your communication preferences by clicking on the link at the bottom of one of our marketing emails or contacting info@gesmer.com.

We also obtain personal data from third-party sources in connection with Client Services, such as commercial databases, legal research services, and general internet searches. Such third-party information sometimes contains personal data about family, health, or immigration status. We use this information to perform relevant diligence, conduct investigations, and perform conflict checks.

Our legal basis for processing personal data in connection with Client Services is:

  • To comply with legal obligations and professional responsibilities;
  • To perform contracts;
  • To pursue our legitimate interests of:
    • ensuring that we deliver the best possible service to our clients,
    • keeping individuals informed of developments in the law,
    • business development and general marketing,
    • providing you with information on our services, and
    • ensuring we build and maintain a good working relationship with you;
  • Your consent, where we make it clear to you in advance that we are relying on your consent (for example, when you sign up to our mailing list).

For prospective clients, or an employee or representative of a prospective client, we will process personal data including your name and contact details as well as details of any interactions you may have with us or our attorneys (for example, meetings you have had, networking events, or pitches you have invited us to).

We may obtain this information directly from you, from your employer, or from publicly available sources like your employer’s website.

The legal bases we rely on to process your personal data are:

  • To take steps requested by you prior to entering into a contract with you;
  • To pursue our legitimate interests in building our business and developing a relationship with potential new clients.

3. Visitors to our Sites

Certain visitors interact with the Sites in ways that lead us to gather personal data. The amount and type of data that we gather depends on the nature of the interaction. For example, if you sign up to our mailing list we collect your name, contact details, job title, and company name. This is more information than we require to add you to our emailing list, but we collect other information about you to ensure that we do not create a duplicate record for you in our database. Visitors can always refuse to supply personal data, with the caveat that it may prevent them from engaging in certain Site-related activities.

In addition, we collect information automatically as disclosed in our Cookie Notice, below.

The legal bases we rely on to process this information are:

  • To pursue our legitimate interests in developing and growing our business, operating and improving the Sites, and conducting Marketing Activities; and
  • Your consent, where we make it clear to you in advance that we are relying on your consent (for example, when you sign up to our mailing list).

4. Vendors and business partners

We process personal data of vendors and business partners, including name and contact details. For vendors, we do this so that we can liaise about the services the vendors are providing to us now and in the future. For business partners, we do this to support, grow, and maintain the relationship. For individual vendors and business partners, we also may hold financial information in order to pay invoices. Sometimes we receive this information from a third party who is recommending the service to us.

The legal basis we rely on to process this personal data is:

  • To pursue our legitimate interests of managing and operating our business, including through use of vendors.

5. Other individuals

When we provide certain types of Client Services we may be provided with personal data from third parties about a number of individuals other than those described explicitly in this Privacy Notice. The personal data we process will depend on the type of matter for which our client has retained us. For example:

  • If we are engaged by our client to advise them on selling its business, our client may send us information about its customers and employees as part of the due diligence process with the buyer;
  • If we are engaged by our client to advise them on buying a business, we may receive personal data about the target company’s customers and employees in order to conduct a due diligence exercise and determine the risks that exist at the target business;
  • If we are engaged by our client to advise them on a dispute, we will have personal data about the opposing parties, their attorneys, witnesses, and any personal data contained in witness statements or evidence.

The primary reason we process this personal data is to provide the Client Services, fulfill our professional duties, comply with law, and operate our business.

We can obtain this information from a number of different sources including our client, our client’s opponent or counterparty, the courts, tribunals, and law enforcement authorities.

The legal bases we rely on to process your personal data are:

  • To comply with our legal obligations and meet our professional responsibilities;
  • To pursue our legitimate interests of operating our business, providing Client Services, and conducting Marketing Activities.

6. Additional uses of personal data

In addition to the uses described above, we may use your personal data for the following purposes. Some of these uses may, under certain circumstances, be based on your consent, may be necessary to fulfill our contractual commitments to you, or are necessary to serve our legitimate interests in the following business operations:

  • Operating our business, administering the Services, and managing your accounts;
  • Contacting you to respond to your requests or inquiries;
  • Processing and completing your transactions including, as applicable, order confirmation and delivering products or services;
  • Providing you with newsletters, articles, alerts, announcements, and other information that we believe may be of interest to you;
  • Providing you with marketing information, and other information that is tailored to your interests;
  • Conducting research, surveys, and similar inquiries to help us understand trends and client needs;
  • Analyzing your interactions with us, and improving our products, services, programs, and other offerings;
  • Preventing, investigating, or providing notice of fraud, unlawful or criminal activity, or unauthorized access to or use of personal data, our website, or data systems, or to meet legal obligations; and
  • Enforcing our Terms of Use and other agreements.

7. How we share and disclose personal data

We share personal data with the following categories of recipients.

(a) Service Providers.

We may disclose your personal data to third-party service providers to provide us with services such as website hosting, professional services (including information technology services and related infrastructure), customer service, e-mail delivery, auditing, and other similar services.

(b) To Perform Client Services.

We will also disclose personal data to the following categories of third parties: (1) anyone involved in the matter we are working on, including lawyers, counterparties, experts, mediators, opponents, other attorneys, and witnesses; (2) law enforcement, tax, and regulatory agencies and bodies; (3) insurers; and (4) service providers such as IT and telephony services, document production, and postal and delivery services.

We may disclose personal data to third parties in order to perform services you request or functions you initiate, such as when you post information and materials on message boards and forums.

We do not sell any personal data and have not sold any personal data in the past.

(c) Corporate Transactions or Events.

We may disclose your information to a third party in connection with a corporate reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or capital, including in connection with any bankruptcy or similar proceedings.

(d) Other Legal Reasons.

In addition, we may use or disclose your personal data as we deem necessary or appropriate: (1) under applicable law, including laws outside your country of residence; (2) to respond to requests from public and government authorities, including public and government authorities outside your country of residence; (3) to comply with subpoenas and other legal processes; (4) to pursue available remedies or limit damages we may sustain; (5) to protect our operations; (6) to protect the rights, privacy, safety, or property of Gesmer, you, and others; and (7) to enforce our terms and conditions.

8. State Privacy Rights

A growing number of U.S. states have enacted comprehensive consumer privacy laws that grant residents certain rights relating to the collection, use, and sharing of their personal data, and that impose corresponding obligations on businesses meeting specified jurisdictional thresholds (typically tied to revenue, the volume of personal data processed, or the share of revenue derived from the sale of personal data). These laws include the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (collectively, the “CCPA”); the Virginia Consumer Data Protection Act; the Colorado Privacy Act; the Connecticut Data Privacy Act; the Utah Consumer Privacy Act; the Iowa Consumer Data Protection Act; the Indiana Consumer Data Protection Act; the Tennessee Information Protection Act; the Montana Consumer Data Privacy Act; the Oregon Consumer Privacy Act; the Texas Data Privacy and Security Act; the Florida Digital Bill of Rights; the Delaware Personal Data Privacy Act; the New Jersey Data Privacy Act; the New Hampshire Privacy Act; the Kentucky Consumer Data Protection Act; the Maryland Online Data Privacy Act; the Minnesota Consumer Data Privacy Act; the Rhode Island Data Transparency and Privacy Protection Act; and the Nebraska Data Privacy Act (collectively with the CCPA, the “State Privacy Laws”).

Gesmer does not currently meet the applicability thresholds of any of the State Privacy Laws and is therefore not subject to their requirements. Regardless, Gesmer does not sell your personal data and will not do so in the future without providing you with notice and an opportunity to opt out of such sale if required by law. Gesmer likewise does not share your personal data for purposes of cross-context behavioral advertising or targeted advertising as those terms are defined under the State Privacy Laws, and does not offer financial incentives in connection with the collection, use, or disclosure of your personal data. If Gesmer’s practices or scale of operations change such that one or more of the State Privacy Laws becomes applicable, Gesmer will update this policy and provide the disclosures and rights required by the applicable law(s).

As a courtesy, however, if you have submitted personal data to us through the Sites, you may email us at info@gesmer.com to request that we correct or delete that information, and we will use reasonable efforts to honor your request. We may need to verify your identity before acting on a request, and we may retain information where we are required or permitted to do so by law or our professional obligations.

Separate from the State Privacy Laws, California’s Shine the Light law (California Civil Code Section 1798.83) gives California residents the right to ask companies what personal data (as that term is defined in Section 1798.83) they share with third parties for those third parties’ direct marketing purposes. Gesmer does not disclose your personal data to third parties for the purpose of directly marketing their goods or services to you unless you request such disclosure. If you are a California resident with questions regarding this, please contact us in the manner set forth under the heading “HOW CAN YOU CONTACT US?” below.

9. Region-Specific Disclosures

Individuals in certain jurisdictions may have certain data subject rights. These rights vary, but they may include the right to: (i) request access to and rectification or erasure of their personal data; (ii) restrict or object to the processing of their personal data; and (iii) obtain a copy of their personal data in a portable format. Individuals may also have the right to lodge a complaint about the processing of personal data with a data protection authority.

If you make a request related to personal data about you, you may be required to supply a valid means of identification as a security precaution. We will process your request within the time provided by applicable law.

10. E-mail Marketing

We may periodically send you relevant alerts and newsletters by e-mail. To help improve our marketing activities, we often receive a confirmation when you open an e-mail or click on a link included in one of these emails, if your computer supports such capabilities. Instructions on how to unsubscribe from these alerts and newsletters are included in each e-mail.

11. Cookie Notice

(a) How we use Cookies

We use cookies and related technologies (“Cookies“) to provide Services, gather information when users navigate through the Sites to enhance and personalize the experience, to understand usage patterns, and to improve our Sites, products, and Services.

Cookies on our Sites are generally divided into the following categories:

  • Essential Cookies: Strictly necessary to provide you with services available through our Services and to use some of their features, such as access to secure areas. Because these cookies are strictly necessary, you cannot refuse them without affecting how our Services function.
  • Performance and Functionality Cookies: Used to enhance performance and functionality but non-essential. Without these cookies, certain functionality may become unavailable.
  • Analytics and Customization Cookies: Collect information used to help us understand how our Services are being used or how effective our marketing campaigns are, or to help us customize our Services for you.
  • Targeting Cookies: Record your visit to our Sites, the pages you have visited, and the links you have followed to recognize you as a previous visitor and to track your activity on the Sites and other websites you visit. These are persistent cookies. You can delete these cookies via your browser settings.

We also allow third parties to use Cookies on our Sites to collect information about your online activities over time and across different websites you visit, in order to provide advertising tailored to your interests and to analyze the effectiveness of such advertising.

(b) How to control Cookies

You can review your Internet browser settings, typically under the sections “Help” or “Internet Options,” to exercise your options for certain Cookies. If you disable or delete certain Cookies in your settings, you may not be able to use features of the Sites.

To learn more about the use of Cookies by Google for analytics and to exercise choice regarding those Cookies, please visit the Google Analytics Opt-out Browser Add-on.

We support the Self-Regulatory Principles for Online Behavioral Advertising of the Digital Advertising Alliance (“DAA“). To learn more about certain third-party Cookies used for interest-based advertising and to exercise certain choices, please visit the Digital Advertising Alliance, Network Advertising Initiative, or European Interactive Digital Advertising Alliance.

The opt-outs described above are device- and browser-specific and may not work on all devices. Opting out does not mean you will cease to see advertising; rather, the ads you see will just not be based on your interests.

To the extent that the cookies and web beacons we use to track your interaction with the Site, customize our Site for you, and to collect certain information and data related to your use of the Site, as set forth in this Privacy Policy above, are deemed to be “pen registers” under Section 638.51 of the California Invasion of Privacy Act, by agreeing to this Privacy Policy and using the Site, you provide us with consent to use such cookies and web beacons.

12. Links to Other Sites

Occasionally we provide links to other websites for your convenience and information. These sites operate independently from our Sites and are not under our control. These sites may have their own privacy notices or terms of use, which you should review if you visit any sites linked through our Sites. We are not responsible for the content or use of these unrelated sites.

13. Updates to this Privacy Notice

Although most changes are likely to be minor, Gesmer may change its Privacy Notice from time to time, at its sole discretion. Gesmer encourages visitors to check this page frequently for any changes.

14. How to contact us

If you have any queries, questions, or concerns about this Privacy Notice or our personal data handling practices, please contact us at info@gesmer.com, or by mail at:

Gesmer Updegrove LLP
40 Broad St., 3rd Floor
Boston, MA 02109