Recruitment Privacy Policy

Applying for a job means handing a stranger a detailed account of your life to date. This policy states what The First Counsel does with that account. It expands section 14 of the firm's website Privacy Policy; where the two differ on a point concerning recruitment data, this document governs. It takes effect on [EFFECTIVE DATE — ON PUBLICATION] and speaks as at that date. As at that date, Pakistan has no comprehensive personal-data-protection statute in force; the firm applies the standards below as a matter of professional practice, and will conform this policy to comprehensive legislation when it is enacted.

1. Scope

1.1 This policy applies to every application to work at The First Counsel (the "firm", "we", "us"), whatever the role and however the application arrives. It covers applications for positions as associates, interns, lateral hires at any level of seniority — including counsel and partner candidates — and business-services staff, such as finance, administration, information-technology, and library personnel.

1.2 It applies equally to applications made in response to an advertised opening and to speculative applications sent when no opening has been advertised. A speculative CV emailed to [email protected] is recruitment data under this policy from the moment of receipt.

1.3 It applies to candidates introduced by a third party — a referrer, a law-school placement office, or a recruitment agent — from the moment the firm receives their information. Where an agent sends the firm a candidate's details, the firm assumes the agent had the candidate's authority to do so; a candidate who did not give that authority should tell the firm, and the firm will delete the material.

1.4 It does not apply to internal mobility. A person already employed or retained by the firm who seeks a different role within it is dealt with under the firm's employment terms and personnel practices, not under this policy.

1.5 It does not apply to the personnel records of people the firm has hired. Section 7.4 explains where an application goes when it succeeds.

1.6 As at the effective date, the firm receives applications by email only. It operates no application portal and uses no recruitment platform. If the firm adopts one, this policy will be amended before the platform is used, and the provider will be named in it.

2. What we collect

2.1 What you submit. The firm collects what you choose to send: your CV, your covering email or letter, academic transcripts and certificates, a writing sample where the role calls for one, and the correspondence you exchange with the firm during the process. For lawyer roles the firm may ask for evidence of enrolment as an advocate; section 3 explains what it does not want with that evidence.

2.2 What the process generates. The firm creates records as the process runs: notes of interviews, written assessments of writing samples and of performance in any exercise, internal correspondence about scheduling, and the record of the decision and its reasons. Section 6 deals with these records in detail.

2.3 References — taken with consent only. The firm approaches referees only after telling you it intends to, and only the referees you have named or otherwise agreed to. What a referee says in response is collected and held as part of your application. The firm does not contact your current employer without your prior, express agreement.

2.4 Publicly available professional information. For lateral candidates, and to a lesser extent for other lawyer roles, the firm may consult public professional sources: the rolls of the Provincial Bar Councils and the Pakistan Bar Council, reported judgments in which the candidate appeared, published articles, and recorded appearances before courts and tribunals. These are public records of a public profession. Where such material influences an assessment, the assessment record will say so. The firm does not trawl personal social-media accounts, and material about your private life found online forms no part of any assessment.

2.5 The firm collects nothing about an applicant covertly, buys no information about applicants from data brokers, and uses no automated screening or ranking tools. Every application sent to the firm is read by a person.

3. What we do not want

3.1 Some information is routinely over-supplied by applicants, and the firm asks you plainly not to send it. At the application stage, do not send:

(a) a copy of your CNIC, passport, or other identity document. Your name and contact details are enough to be considered. Identity documents become relevant only if the firm makes you an offer, and it will ask for them then, for onboarding and verification;

(b) financial information — bank account details, salary slips, tax records, or statements of your current remuneration. If remuneration needs discussing, it will be discussed at the appropriate stage, in conversation;

(c) health information — medical records, disability details, or fitness certificates. The exception is stated in clause 3.3;

(d) other sensitive personal details that have no bearing on merit — information about your religion, sect, marital status, or family — unless a law in force requires the firm to collect it, in which case the firm will say so and cite the requirement.

3.2 If you send it anyway. Unsolicited material of the kinds listed in clause 3.1 will be disregarded in the assessment of your application. Where practicable, the firm will delete the document or redact the detail on receipt and will tell you it has done so; where the material is embedded in something the firm must keep — a sentence in a covering email, for instance — it will remain unused and will be deleted with the application on the schedule in section 7.

3.3 Adjustments. If you need an adjustment to the process — an accessible interview venue, additional time in a written exercise, scheduling around a medical treatment — you are welcome to tell the firm, and that limited disclosure is invited, not unsolicited. It will be used only to make the adjustment, shared only with those arranging it, and kept out of the assessment of merit.

4. How we use it

4.1 The firm uses recruitment data for four purposes, and no others:

(a) assessment — reading, testing, and comparing applications to reach a hiring decision on merit;

(b) logistics — arranging interviews, exercises, and correspondence with you about the process;

(c) references and verification — taking the references you have consented to, and verifying academic credentials and bar enrolment where the role requires it;

(d) compliance and record — meeting any legal obligation that attaches to hiring, and keeping a record sufficient to explain the decision if it is questioned, whether by you or before a court or authority.

4.2 The grounds on which the firm relies, expressed in the terms used in the website Privacy Policy: the taking of steps at your request with a view to a contract of employment or engagement; the firm's legitimate interest in recruiting on merit and in being able to account for its decisions; your consent, where a use rests on it (references, and the talent pool in section 8); and compliance with legal obligations, where they apply.

4.3 Recruitment data is not used for marketing, is not added to any mailing list, and is not used to build profiles for any purpose beyond the application it belongs to.

5. Who sees it

5.1 Inside the firm, your application is seen only by the people involved in the hiring decision: the partners responsible for recruitment for the relevant role, the lawyers or managers who interview or assess you, and the staff who administer the process. Applications are not circulated for general interest.

5.2 Outside the firm, your application is disclosed to no one, with three exceptions:

(a) referees — the firm discloses to a referee only what the referee needs to give a meaningful reference: your name, the role applied for, and the aspects on which comment is sought;

(b) verification and background checks — [BACKGROUND-CHECK OR VERIFICATION PROVIDER, IF ANY — TO BE CONFIRMED BY THE FIRM]. As at the effective date, verification the firm performs itself — of bar enrolment against public rolls, or of degrees with the issuing institution — is done with your knowledge. If the firm engages an external provider for this, this policy will be amended to name it before it is used;

(c) legal compulsion — disclosure required by a law in force in Pakistan or by a lawful order, on the terms in section 7.2 of the website Privacy Policy, which apply here.

5.3 Recruitment data also resides, incidentally, on the systems of the firm's email provider, because applications arrive and are handled by email. That is a hosting fact, not a disclosure decision; the provider is not authorised to use the data for its own purposes.

5.4 The firm does not tell anyone outside the firm that you have applied — including your current employer, chambers, or colleagues — except as clause 5.2 allows. Discretion is understood to be part of what an applicant asks for.

6. Interview notes and assessment records

6.1 Interviewers and assessors make notes. The firm instructs those who make them to record observations relevant to the role — reasoning, drafting, knowledge, conduct in the interview — and nothing else. Notes are working records of professional judgment, not transcripts.

6.2 Assessment records are held with the application, seen by the people in clause 5.1 only, and retained and destroyed on the same schedule as the application itself (section 7).

6.3 If you exercise the right of access in section 9, the firm will give you the substance of the assessments made of you. Where a note records one person's candid evaluation in terms that also disclose information about someone else — another candidate, or the assessor — the firm may provide a faithful summary rather than the verbatim note. What it will not do is withhold the gist of why a decision went the way it did.

7. Retention

7.1 Unsuccessful applications. If your application does not result in an offer, or results in an offer you decline, the firm retains the application and its assessment records for [12] months from the date the decision is communicated. The bracketed period is the firm's standard and is subject to confirmation; it will not be lengthened without amending this policy.

7.2 The purposes of that retention are two: audit — answering your questions about the decision, and explaining or defending it if it is challenged — and future openings — if a role arises during the period for which you appear suited, the firm may contact you and ask whether you wish to be considered. Retention beyond the period for future roles happens only on the consent basis in section 8.

7.3 Earlier deletion on request. You may ask the firm to delete your application at any time, and it will do so, keeping only a minimal record — your name, the role, the dates, and the fact of your deletion request — sufficient to show the application existed and was disposed of properly.

7.4 Successful applications. If you join the firm, your application, assessments, and references become the opening entries of your personnel file. From that point they are governed by the firm's employment terms and personnel-records practices, not by this policy, and they are retained on the schedules that employment and statutory obligations require.

7.5 Overriding grounds. A period in this section yields where a law in force requires longer retention, or where litigation or a regulatory process involving the application is pending or reasonably anticipated, in which case the material is held until the matter concludes.

8. Talent pool consent

8.1 The firm keeps a CV on file beyond the period in clause 7.1, for consideration against future roles, only where you have expressly asked it to or expressly agreed. Silence is not agreement; a sentence in the firm's rejection letter offering the option, unanswered, keeps nothing on file.

8.2 Talent-pool retention runs for up to [24] months from your consent, after which the firm deletes the material unless you renew the consent. You may withdraw at any time by writing to [email protected], and withdrawal takes effect on receipt.

8.3 Material held in the talent pool is used only to identify roles that may suit you and to contact you about them. It is not re-assessed, ranked, or shared in the meantime.

9. Applicant rights

9.1 You may ask the firm, in respect of your recruitment data:

(a) access — whether the firm holds recruitment data about you, and for a copy of it, subject to clause 6.3;

(b) correction — to correct data that is inaccurate or incomplete;

(c) deletion — to delete your application, on the terms in clause 7.3;

(d) withdrawal — to withdraw your application, or a consent you have given (to a referee approach, or to talent-pool retention), with effect for the future.

9.2 The procedure is that in section 11 of the website Privacy Policy: write to [email protected] with the subject line "Privacy request — recruitment". The firm will acknowledge within 7 days and respond substantively within 30 days of verifying your identity.

9.3 The limits are those in the website Privacy Policy, and one more specific to this context: withdrawing an application ends the process, but it does not oblige the firm to erase the record that a process took place, where clause 7.3's minimal record or clause 7.5's overriding grounds apply.

10. References given by the firm

10.1 This policy also covers the mirror-image case: a request to the firm for a reference about someone who used to work here. The firm gives references about former partners, lawyers, interns, and staff only with the written consent of the person concerned, or at that person's request.

10.2 An unsolicited request from a prospective employer, unaccompanied by evidence of the person's consent, receives a standard reply: the firm neither confirms nor denies the person's association with it, and invites the requester to have the person contact the firm directly.

10.3 What a reference contains is agreed with the person concerned before it is sent — at minimum, confirmation of dates of service and roles held; beyond that, only what a partner is prepared to say and the person is content to have said. The firm keeps a record of each reference given and the consent on which it rested. The firm's Alumni Privacy Policy deals with former personnel more fully.

11. Security

11.1 Recruitment data lives principally in the firm's email system and, once a process begins, in the firm's internal records. The security measures described in section 10 of the website Privacy Policy apply to it: access limited to the personnel in clause 5.1, authentication controls on the email system including multi-factor authentication [CONFIGURATION — TO BE CONFIRMED BY THE FIRM], and encrypted transport.

11.2 The honest caveat given elsewhere applies here too: ordinary email is not end-to-end encrypted. That is one more reason not to send the material listed in section 3. A CV and a transcript are records of a professional life; the firm protects them accordingly, and asks you not to raise the stakes by attaching your identity documents to them.

11.3 If an incident affecting recruitment data creates a real risk of harm to identifiable applicants, the firm will inform them without undue delay, on the terms in section 10.4 of the website Privacy Policy.

12. Changes

12.1 The firm will amend this policy when its recruitment practices change — above all, if it adopts a recruitment platform (clause 1.6) or an external verification provider (clause 5.2(b)) — and when Pakistani law changes, including on the enactment of comprehensive data-protection legislation.

12.2 Amendments take effect on publication on the firm's website with a new effective date. A material change — a new category of collection, a new disclosure, a longer retention period — will be flagged prominently and will not be applied retroactively to applications received under an earlier version without a lawful basis.

13. Contact

13.1 Questions, requests, and complaints about this policy should be addressed to:

The First Counsel Attention: [PARTNER RESPONSIBLE FOR DATA PROTECTION — TO BE CONFIRMED BY THE FIRM] 8th Floor, Askari Corporate Towers, Lahore, Punjab, Pakistan Email: [email protected] (subject line "Privacy — recruitment") Telephone: [TELEPHONE — TO BE CONFIRMED BY THE FIRM]

13.2 The firm will acknowledge a complaint within 7 days and respond substantively within 30 days. A complainant dissatisfied with the response may ask for review by a partner not involved in the recruitment process concerned. As at the effective date Pakistan has no data-protection authority; if one is constituted, this clause will be updated with its details.