PRIVACY POLICY

This privacy policy (“Privacy Policy”) is designed to assist you, our website http://www.glimstedt.lt (“Website“) visitor, in understanding how the Law Firm GLIMSTEDT Bernotas&Partners (“GLIMSTEDT”) with its office at Jogailos g. 4, Vilnius, LT-01116 Lithuania and a given lawyer (jointly, “DataController”) processes your personal data submitted to us either visiting our office or Website or social media accounts, or by e-mail or phone, or obtained by us in connection with the performance of contracts with our partners or clients (legal persons) an employee or a representative of whom you are.

What kind of personal data do we collect?

We may collect the following information:

• For the purpose of providing and administering legal services – personal data of a data subject (“Client”) who enters into a contract for legal services with GLIMSTEDT, i.e. data contained in such contract; personal data disclosed by the Client (for example, information about the agreements made by the Client, his/her/its relations with other persons, his/her/its correspondence); data that will be collected by GLIMSTEDT from other sources, such as publicly available sources, registers, etc., during the provision of services. The legal basis for processing of these data is processing necessary for the compliance with obligations laid down by a contract and/or law, and/or for the purposes of legitimate interest or for the performance of a contract and/or in order to take steps at the Client’s request prior to entering into a contract for legal services.

When providing and administering legal services, special categories of your personal data will be processed only if your express consent has been given and/or if it is necessary for the establishment, exercise or defence of legal claims and/or if such data have been manifestly made public by you.

The personal data processed for the purpose of providing and administering legal services will be stored for 10 (ten) years as of the fulfilment by us of your last assignment plus the period until 15 January of the succeeding year, except where a longer period is established by laws and/or other regulations.

• For the purpose of direct marketing – your personal data to be processed on the basis of our legitimate interest and/or your consent.

Where at the time of entering into a contract for legal services you do not give your explicit consent to sending direct marketing communications and do not tick the “I Do Not Consent” box, your, as our Client, personal data (first name, last name, position, email address) will be processed on the basis of our legitimate interest and direct marketing communications reporting on any developments or other information about our services or proposals or any events, etc. will be sent to your email for direct marketing purposes. Each time upon receipt of a direct marketing communication, you may refuse it by giving notice to the email address specified in the direct marketing communication or in any other way indicated in this Privacy Policy.

In the event that you give your consent, your personal data will be stored for 5 (five) years from the date of your consent plus the period until 15 January of the succeeding year. Where your personal data are processed for the purpose of direct marketing on the basis of our legitimate interest, your personal data will be stored for a period of validity of a contract for legal services.

• For the purpose of administering the database related to recruitment – your first name, last name, date of birth, phone number, workplace, e-mail address, residence address, educational background, foreign language skills, desirable position, desirable salary, personal qualities, professional experience: former workplace, length of service in that workplace, position, other professional experience; any other information contained in your letter of reference and/or motivation letter.

These data will be processed on the basis of your consent. If you do not submit your CV and/or motivational letter, we will not be able to assess your eligibility for the position.

In the event that you do not consent to your personal data processing upon completion of the recruitment process, we undertake to delete and/or destroy your personal data within 5 (five) business days after signing an employment contract with the selected candidate.

• For the purpose of organising events – your first name, last name, phone number, workplace, position, e-mail address, and your photo. These data will be processed on the basis of your consent and will be stored for 5 (five) years from the date of your consent plus the period until 15 January of the succeeding year.
• For the purpose of presenting GLIMSTEDT in communications, including, but not limited to, leaflets, visual presentations, social media networks – your photo, first name, last name, workplace, position. These data will be processed on the basis of your consent and will be stored for 5 (five) years from the date of your consent plus the period until 15 January of the succeeding year.
• For the purpose of ensuring the safety of property and people, video surveillance on the floors leading to the GLIMSTEDT office will be conducted outside GLIMSTEDT working hours, and video surveillance data, your image in particular, will be collected. These data will be processed on the basis of our legitimate interest and will be stored for 14 (fourteen) calendar days.
• For the purpose of improving the Website, implementing marketing campaigns (through the use of cookies) – the Website visitors IP addresses and Website usage data. These data will be processed on the basis of your consent. For more details, see “Which cookies are used on this Website?”
• Any other personal data you may provide to us at any time by contacting us by e-mail or phone or by visiting our office. These data will be processed on the basis of your consent and will be stored for 2 (two) years from the date of your consent plus the period until 15 January of the succeeding year.
• For the purpose of making and executing contracts with GLIMSTEDT clients or partners (legal persons) – first names, last names, positions, contact details of the employees or representatives of such clients or partners, data contained in relevant correspondence, any other information obtained in connection with the contractual performance.

Please note that failing to submit certain personal data will deprive us from rendering legal services in full in accordance with the procedure established by laws.

How is your personal data processed?

Your personal data will be processed in accordance with the Law of the Republic of Lithuania on Legal Protection of Personal Data and other regulations. When identifying the means of personal data processing and in the course of such processing, we undertake to implement appropriate technical and organizational measures for protecting your personal data from accidental or unlawful destruction, damage, modification, loss, disclosure or any other kind of illegal processing and to adopt proper measures taking into account the risks around your personal data processing.

In cases where during the performance of a contract for legal services the data are not obtained directly from the Client, the notification obligation will not apply because of the lawyer’s (i) statutory duty of confidentiality, and (ii) the right to receive and collect information (special categories of personal data including) and to perform processing operations on such information.

Which cookies are used on this Website?

A cookie is information sent by the web server to the web browser and stored in the browser. This information is sent to the web server each time the browser requests to open the page from the server. This allows the web server to set up and monitor the web browser.

We use the following cookies on our Website:

(a) Session cookies. These cookies are used to improve the Website usability and to collect general (anonymous) information about the Website use;

(b) Analytical cookies (tracking cookies from “Google Analytics”). These cookies allow the Data Controller to recognise and to count the number of visitors to the Website and to track how visitors move around the Website. This helps the Data Controller to improve the functioning of the Website, for example, to make sure that the Website visitors easily find what they are looking for. Data collected through the use of these cookies are processed on the basis of your consent;

(c) Functional cookies. These cookies are used to recognise you when you are returning to the Website. This enables the Data Controller to provide the content customised according to your needs on social networks and to remember the information relevant to you. Data collected through the use of these cookies are processed on the basis of your consent.

For more information about the cookies used on the Website click here.

How is your personal data you make available to us via social media networks used?

We currently have accounts on the following social networking sites:

• An account on Facebook – @LawFirmGLIMSTEDT. You can find its Privacy Policy at https://www.facebook.com/privacy/explanation;
• An account on LinkedIn – GLIMSTEDT Lithuania. You can find its Privacy Policy at https://www.linkedin.com/legal/privacy-policy.

We would recommend that you should read the privacy statements of the other parties with whom you interact if you have any questions regarding their use of your personal data.

Whom may we disclose your personal data to?

Personal data made available to us in connection with our provision of legal services may be disclosed to the following persons for the purpose of providing such services (i) to courts, bailiffs, national or local authorities, agencies and/or organisations, or (ii) to our lawyer partners in other countries or to certain professionals (e.g. auditors, engineers, assessors, bankers, stockbrokers, translators, etc.) as stipulated in the Legal Services Contract signed with the Client, or (iii) to opposing parties before which we represent the Client, or (iv) to any other lawyer and/or staff of the Data Controller or to any other company or individual providing services to the Data Controller, or (v) to any other parties, including providers of certain services, such as IT, translation, courier and similar services.

Whenever the Data Controller transfers your personal data to a third country, such transfer will only be made subject to one of the followings conditions: (i) the transfer is made to the country in respect of which an adequacy decision has been taken, (ii) the transfer is made subject to appropriate safeguards designated by law, (iii) the transfer is made by applying derogations for specific situations determined by law where it cannot be made pursuant to items (i) and (ii) above.

What are your rights?

You have the following rights:

• To ask us in writing to let you know whether or not data concerning you are being processed. In case of data processing, you are entitled to access your personal data and to receive the following information: (i) the purposes of personal data processing; (ii) the relevant categories of personal data; (iii) the data recipients or the categories of such data recipients to whom your personal data have been/will be disclosed; (iv) where possible, the length of time your personal data will be stored or, if that is not possible, the criteria for determining such time;
• To request us to correct any inaccuracies or incompleteness of your personal data;
• To request us to delete your personal data. Nevertheless, this right is not absolute and is capable of being justified by the occurrence of at least any of the following: (i) your personal data are no longer needed to achieve the purposes for which they have been collected or otherwise processed; (ii) you decide to withdraw consent to process your personal data when your personal data processing is solely based on such consent and there are no other reasons for your personal data to be processed; (iii) you withhold your consent to process your personal data in the cases envisaged by law and there are no overriding legitimate reasons for your personal data to be processed; (iv) your personal data are processed illegally; or (v) your personal data must be deleted when we are under an obligation to delete such data;
• To request us to restrict your personal data processing in any of the following cases: (i) you dispute the accuracy of your personal data for the period during which such accuracy of your personal data may be verified by us; (ii) your personal data processing is illegal and you do not agree to have your personal data deleted requesting that the use of such data be restricted instead; (iii) we no longer need your personal data for processing purposes but such data are needed for imposing, enforcing or safeguarding legal requirements. Having restricted your personal data processing, we will be allowed to process such data (except for their storage) with your consent or for the purposes of imposing, enforcing or safeguarding legal requirements and/or protecting your rights or the rights of others, or for the reasons of public interest;
• To withdraw consent to process your personal data when your personal data processing is  solely based on your consent;
• To ask us to forward your personal data processed by us to another data controller provided such forwarding is technically possible;
• To file a complaint with us or with the National Data Protection Authority if you believe that your rights as a data subject are and/or may be violated.

How can you exercise your rights?

In order to exercise your rights, you may submit a written request, complaint or claim to us in any of the following ways:

• By sending an e-mail to vilnius@glimstedt.lt; or
• By sending a letter to Jogailos g. 4, Vilnius, LT-01116 Lithuania; or
• By visiting GLIMSTEDT office at Jogailos g. 4, Vilnius, LT-01116 Lithuania.

We will respond to your request, complaint or claim in writing, acting in accordance with the applicable laws and will do our best to provide you with information within the shortest time possible, but in no event later than within 30 (thirty) days after receiving your request, complaint or claim. In exceptional cases, the said 30-day period may be extended by another 30 (thirty) days by giving notice to you.

If having received your request, complaint or claim we have doubts as to your identity, we will have the right to ask for your identity document.

If we fail to provide you with the necessary information and/or you have complaints about how your personal data are processed, you may approach the National Data Protection Authority by filing a complaint.

How will we notify you of any changes in our Privacy Policy?

We may update or modify this Privacy Policy from time to time. Such updated or modified Privacy Policy will take effect immediately after being published on our Website.

Having updated our Privacy Policy, we will notify you of any changes we deem important by posting them on the Website. You may look at the “Update Date” listed at the bottom to find out when the Privacy Policy was last updated.

Last updated on 7 January 2019