GDPR/UK GDPR

GDPR/UK GDPR Notice of Personal Data Processing Practices

Last Updated: September 30, 2025

In the course of representing clients and building and maintaining relationships in the European Economic Area and the United Kingdom, Arnall Golden Gregory LLP (“AGG”) processes personal data about our individual clients and, where our client is an entity rather than an individual, we process personal data about employees or other representatives of our client. Depending upon the nature of the representation we also may collect personal data about other individuals as necessary for the particular legal matter for which we have been engaged. We also process personal data about our professional contacts and business partners. This notice only applies to our processing of personal data in connection with AGG’s processing of personal data about individuals who are located in the European Economic Area and the United Kingdom.

Categories of Personal Data Processed

The categories of personal data AGG processes depend on the nature of our relationship and the nature of work we have been engaged to perform.

AGG collects name and contact information, such as address(es), telephone number(s), e-mail address(es), and fax number(s) about our clients, contacts, and business partners. We also process personal data in the course of our correspondence and interactions with individuals.

If AGG is representing, doing business with, or in contact with an organization, rather than an individual, we may collect information about employees and representatives of the client organization, such as business contact information, titles, and other information related to our relationship.

If you visit AGG’s website, www.agg.com, AGG will collect information that you choose to submit through that site, as well as information about your IP address, device information, and other information about your interactions with our website as described in our online privacy policy. AGG will also collect information you choose to submit through our social media pages or other online profiles.

Other categories of personal data that AGG may process may vary depending upon the nature of the work that we have been engaged to perform.

If we are engaged in an immigration matter, for example, AGG will process contact information about the individuals related to the applications for visas, work permits or other benefits for which we are providing representation. This may include information about the individual on whose behalf an application is being submitted, as well as members of that individual’s family and other persons as may be required in a particular case. AGG also will process other personal data that may be necessary for a particular form or application such as passport or other government identification number(s), work history, employment history, education history, travel history, visa history, criminal history, financial information, health information, biometric information, information about racial or ethnic origin, trade union membership, religion, political affiliations, or philosophical beliefs.
If we are engaged in adversarial matters, such as litigation or arbitration matters, for example, AGG may process contact information about the parties to the legal proceeding, as well as potential witnesses, experts, counsel, and others who may be involved in the proceeding. AGG also may process personal data related to the factual and legal issues involved in the representation. This may include health information or other special categories of personal data if relevant to the representation.
If we are engaged in a transactional matter, AGG may process personal data about officers, directors, employees, agents, or other representatives of the client or counterparties to the transaction related to various aspects of the transaction, such as tax considerations, employment benefits, and due diligence.
We also may process personal data that an individual chooses to provide to us or that is publicly available.

Personal data will be retained for the length of our representation or relationship and for a period thereafter until disposal is required pursuant to AGG’s data retention policies.

Personal Data Processing Purposes

Providing Legal Services. Depending upon the type of legal or other services that AGG is providing, it may be necessary to process personal data about individuals who are not our clients to address the legal issues for which we have been engaged. In the case of providing services to our clients, this typically is done on the basis of our client’s legitimate interest to process personal data for the establishment, exercise, or defense of legal claims. In the case of some of the services that we provide, such as immigration-related services, processing also may occur with the consent of the individual, including consent for the processing of special categories of data.
Administering the Relationship With our Clients and Prospective Clients. AGG processes personal data to administer our relationship with our clients and prospective clients and to provide legal or other services. This routinely includes contacting a client or prospective client to discuss matters for which we have been engaged or for which we may be engaged. This also includes due diligence, fraud prevention, processing payments, accounting, auditing, billing and collection, and support services. Depending upon the specific legal or other services we are engaged to provide, this processing is undertaken to carry out our contract with a client or in anticipation of entering into such a contract.
Administering the Relationship With our Professional Contacts and Business Partners. AGG processes personal data to maintain professional relationships and to establish, administer, and maintain relationships with our business partners. This includes communicating with our contacts and partners, administering our relationships, and, in the case of our business partners, administering our business relationships including due diligence, fraud prevention, processing payments, accounting, auditing, billing and collection, and support services. Depending on the circumstances, this processing is done on the basis of our legitimate interests or, in the case of contractual business partners, this processing is undertaken to carry out our contract or in anticipation of entering into such a contract. Processing of personal data about our professional contacts is done pursuant to our legitimate business interests.
Compliance With Legal and Ethical Obligations. We process personal data in order to comply with our legal, regulatory, and ethical obligations (such as conflicts checks). We also process personal data to establish, exercise, and defend our legal rights and any legal proceedings which may arise; and to prevent, detect, and respond to actual or potential fraud or other illegal activities.
Visits to our Website or Engagement With our Content. If an individual visits our website or engages with our content on another site (e.g., Spotify, JDSupra, etc.), we collect data about the visit or engagement as well as personal data that the individual chooses to provide pursuant to our legitimate business interest.

Newsletters, Client Alerts, and Similar Communications. AGG also may process personal data to send individuals information about new legal developments or firm activities in the form of newsletters, event invitations, alerts, or other similar communications. Depending upon the nature of the communication, these messages may be sent to you with your consent or pursuant to our legitimate interests. If you do not wish to receive such communications, you can opt-out of receiving future messages by email by opting out using the link in the message or by contacting unsubscribe@agg.com.

Categories of Recipients of Personal Data

Processors/Service Providers. Personal data will be shared with processors/service providers acting on our behalf. Depending on the nature of the representation or relationship, this could include entities such as data storage or data services providers, litigation support services, consultants or experts, outside legal counsel, other people in your organization, or other parties involved in hosting or organizing events or seminars.
Government Agencies. If we are providing representation on a matter that involves seeking a right or benefit from a government agency, such as a visa application or another immigration matter, we will disclose personal data to the government agency or agencies involved in the processing of the visa application or other immigration right or benefit being sought. We also may disclose personal information to government agencies when making regulatory filings involving or on behalf of firm clients, such as filing information regarding beneficial ownership required by the U.S. Corporate Transparency Act.
Disclosures to Parties Involved in a Matter or Activity. Depending upon the matter, it may be necessary to disclose personal data when a client is involved in a dispute, litigation, arbitration, or a government investigation. In cases where we are working with professional contacts or business partners on a common effort or event, we may disclose personal data to other parties involved in the activity.

Categories of Third-Party Sources of Personal Data

AGG collects personal data from third-party sources where appropriate in the course of our representation of our client(s). The sources of such information vary depending upon the matter. In an immigration matter, for example, we may collect information from the applicant’s current and former employer(s), family members or government sources as appropriate for the application or other matter being filed. In an adversarial matter, we may obtain information from parties to the matter or from third-party sources that we reasonably believe may have information relevant to our representation of our client(s). In cases where our client is an organization, rather than an individual, we also may obtain personal data from our client(s) about employees or other individuals where it may be relevant to our representation of our client(s).

Data Subject Rights

You have the right to request access to, and rectification or erasure of personal data about you, as well as the right to request restriction of processing or to object to the processing of personal data and the right of data portability to the extent required by law. Please note that the data subject rights applicable in an individual case will depend on the circumstances. For example, in the case of personal data provided to AGG by a client, the steps that AGG is able to take with respect to data subject rights may be limited by our legal and ethical obligations with respect to confidentiality, preservation of evidence, data retention, the attorney-client privilege and/or other legal privileges. In some cases, AGG may need to refer you to our client.

We may request that you provide proof of your identity for security reasons and in order to prevent the unauthorized disclosure or misuse of personal data. We may charge to fulfill requests for access to personal data where they are unreasonable, unfounded, excessive, or such charges are otherwise permitted by law.

If our processing of personal data, including but not limited to special categories of personal data, is based on your consent as the data subject, you have the right to withdraw your consent at any time. If you withdraw your consent, this will not affect the lawfulness of any processing that occurred on the basis of your consent before you withdrew consent.

Individuals also have the right to lodge a complaint with a supervisory authority if you have concerns about the manner in which your personal data is processed.

Refusal to Provide Information

Depending on the work AGG has been engaged to perform, the provision of personal data may be required by applicable law or judicial process. For example, in immigration matters, the government agency from which the immigration right or benefit is being sought requires certain information to be submitted as part of the application. If that information is not provided to AGG for inclusion with the application, AGG may not be able to submit the application or the government agency may reject the application and deny the benefit sought. Similarly, failure to provide information that is required by judicial process in an adversarial matter could adversely affect the client’s standing and chances for success if personal data (or other information) in such a case were improperly withheld, and, depending upon the circumstances, failure to provide such information could adversely affect the chances for success in the matter or result in other sanctions. If you have questions as to whether you are required to provide personal data in a particular case, please consult with the AGG attorney handling your matter.

Data Transfers to the United States and Other Countries

AGG is located in the United States. Personal data will be transferred to and processed in the United States. The U.S. is not the subject of a nationwide adequacy determination by the European Union or the United Kingdom. Information processed by AGG in the United States is subject to U.S. law, which may provide fewer protections than afforded by the GDPR, the UK GDPR, or other EU or UK law. Depending upon the nature of the processing undertaken by AGG, the processing will occur on the basis of contractual safeguards, where necessary for the performance of a contract between AGG and a data subject (or pre-measures taken at the data subject’s request), the express consent of the data subject, or other another lawful basis.

In addition to transfers to the United States, if AGG is engaged in a matter involving a third country, transfers of personal data may be necessary in such a case. For example, if AGG is retained to assist an individual seeking an immigration right or benefit, such as a work permit or visa application, from a government other than the government of the United States, it is necessary to transfer personal data to that third country in support of the application(s). That country may or may not have laws that are considered adequate by the European Union or United Kingdom and therefore may not provide the same level of protection for personal data.

Questions/Points of Contact

AGG has two offices, both in the United States:

Atlanta, Georgia: 171 17^th Street NW, Suite 2100, Atlanta, Georgia, 30363.
Washington, D.C.: 2100 Pennsylvania Ave NW, Suite 350-S, Washington, D.C., 20037.

Questions about this notice or AGG’s data protection practices should be directed to AGG’s Privacy Officer, who can be contacted by mail at the Washington, D.C. address above or by email to privacyofficer@agg.com.