LAW FIRM GALUBICKAS
PRIVACY POLICY
15 October 2018, Vilnius
Implementing Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the Regulation) and the Law of the Republic of Lithuania on the Legal Protection of Personal Data, law firm Galubickas (the Law Firm), adheres to this privacy policy on personal data protection at the Law Firm (the Privacy Policy). The Privacy Policy contains information on personal data processing. The Law Firm performs its obligation to be a transparent organisation, and provides clear information in this Privacy Policy about what personal data is processed, the purposes of processing, personal data retention periods as well as the legal basis of data processing and other information which should be provided in accordance with the effective legal acts.
1. What personal data is processed? For what purpose and on what basis such data is processed?
1.1. For the purpose of carrying out the functions defined in the Law on the Bar of the Republic of Lithuania and other legal acts, the Law Firm may process the following personal data of clients of the Law Firm and of other persons related to the client’s matters:
1.1.1. the name/s, surname/s; personal ID number; nationality, data of the passport and/or identity card; the agreements for legal services and representation made between the attorney-at-law and the client; contracts made between the client and third parties; decisions of courts and other state institutions, court rulings and other documents concerning the client; data on convictions; e-mail address, electronic correspondence, phone number, residential address and other contact data; a photo; attorney-client privilege; other data and information provided by the client of the Law Firm or third parties.
1.2. The legal basis for processing of the data indicated in paragraph 1.1.1 is the Law on the Bar of the Republic of Lithuania and other legal acts governing activities of the Lithuanian Bar Association, attorneys-at-law, assistant attorneys-at-law, and the lawyers of EU member states wishing to engage in legal practice in the Republic of Lithuania as well as performance of the agreements for legal services and representation made between attorneys-at-law of the Law Firm and the client.
1.3. For the purpose of entering into and performance of independent contractor agreements or employment contracts, maintaining bookkeeping, and proper performance obligations of the Law Firm as the employer set forth in the legal acts, the following personal data may be processed:
1.3.1. the name/s, surname/s; personal ID number; residential address; e-mail address and phone number; settlement account; information on the family status (the marriage / divorce certificate, information about children under 14 years of age; all the other information which may affect the employee’s rights and obligations and taxation); information on health condition (a copy of disability certificate, a medical certificate concerning ability to do a certain job); payroll information; information of annual leave, other leaves and business trips / secondments; state social insurance number; CV; information on additional leave entitlements; other information necessary to perform obligations and exercise rights of the Law Firm as the employer under effective legal acts.
1.4. The legal basis for processing of the data indicated in paragraph 1.3.1 is the Law on the Bar of the Republic of Lithuania, the Labour Code of the Republic of Lithuania and other legal acts governing employment relations.
1.5. For the purpose of entering into and performance of service agreements, the following personal data of the service provider’s representative who signed the agreement may be processed:
1.5.1 the name, surname of the counterparty or its representative; the position of the counterparty’s representative; the e-mail address and phone number of the counterparty’s representative; other information necessary to perform obligations and exercise rights of the Law Firm as the counterparty under effective legal acts.
1.6. The legal basis for processing of the data indicated in paragraph 1. 5.1 is the Civil Code of the Republic of Lithuania and performance of the concluded agreement.
1.7. For the purpose of providing information to the interested parties based on their enquiries, the data provided by the interested parties is processed. The personal data indicated in this paragraph is processed on the basis of consent of the interested party as the latter – when requesting information or expressing interest in obtaining legal services of the Law Firm – willingly provides his/her personal data necessary for the preliminary assessment by the Law Firm as to its abilities to provide legal services.
2. Ways of obtaining personal data
2.1. Personal data are obtained from data subjects where provision of such data is required under legal acts, or where data subjects submit such data willingly as they are necessary for rendering of legal services. In addition, personal data are obtained from third parties on their initiative or based on the enquiry of the Law Firm requesting data necessary for carrying out the functions of an attorney-at-law of the Law Firm prescribed by the legal acts.
3. Personal data retention periods
3.1. The retention period for the documents and other information on personal data processed at the Law Firm is defined by the legal acts of the Republic of Lithuania.
3.2. Unless the legal acts of the Republic of Lithuania do not provide for a retention period of any documents or other information processed at the Law Firm, such retention period is established based on the internal regulations of the Law Firm taking into consideration the lawful purpose, legal basis of retaining the data and the principles of lawful processing of personal data. The retention period is usually 10 years after termination of the legal services agreement.
4. To whom / what can the Law Firm disclose personal data?
The Law Firm may disclose personal data of the data subjects to:
4.1 data processors rendering the Law Firm ancillary services (IT, bookkeeping, translation) during which a limited processing of personal data of the data subjects may occur. All the data processors of the Law Firm are bound by confidentiality undertakings and must ensure the same level of personal data protection of data subjects, refrain from using the data for unauthorised purposes, and ensure that their associates act in the same manner.
4.2. Other cases of personal data transfers: the Law Firm may transfer personal data protection of the data subject to state and municipal institutions, courts, judicial officers (bailiffs), notaries and other persons carrying out functions assigned to them by the law at their request or for the purpose of the legitimate interest of the Law Firm of the client, i.e. for the establishment, exercise or defence of legal claims; personal data may also be transferred or disclosed in other cases only on the grounds and in the manner specified by the legal acts.
5. Protection of personal data at the Law Firm
At the Law Firm, we treat personal data responsibly:
5.1. Personal data security. The Law Firm applies technical and organisation measures for protection of personal data. Data is kept securely, and only a limited number of persons have access to it.
5.2. International transfers of personal data. Personal data is processed within the European Union / European Economic Area. In some case it might be necessary to forward personal data to the recipients outside the European Union / European Economic Area. The Law Firm takes steps to safeguard personal data in such cases and may rely on an adequacy decision of the European Commission, which means that, in the opinion of the European Union, the laws and agreements of the country ensure an adequate level of personal data protection. In the absence of an adequacy decision of the European Commission, the data controller or data processor may transfer personal data to a third country or an international organisation outside the European Union / European Economic Area only if the data controller or data processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.
6. Rights of the data subject
A data subject has the following rights:
- the right to obtain information whether we process personal data concerning the data subject, and if so, the data subject has the right to access his/her personal data. That is why we inform them about it in advance in this Privacy Policy;
- the right to contact us and request rectification of incorrect personal data;
- the right to request erasing his/her personal data where, in the data subject’s opinion, the Law Firm no longer needs such data, or where the data subject has given consent and later decided to withdraw it. The request may be granted only if it is well-grounded. This right does not apply if data processing is related to the freedom of expression and information, legal obligations or the establishment, exercise or defence of legal claims;
- the right to obtain his/her personal data and transfer such data to another entity (the so-called right to data portability). This right applies where the personal processing is carried out by automated means, and the data subject’s request is received;
- the right to have the personal data processing restricted under certain circumstances. It means that we will continue storing the personal data of the data subject but we will not be able to process the data for the time being. For instance, that may be necessary if inaccurate data is detected. It is likely that the data subject would not want that such data is processed until it is rectified;
- the right to object to personal data processing where it is based on the legitimate interests of the Law Firm or third parties. The data subject may exercise this right if believes that his/her personal interests override the legitimate interests of the Law Firm in processing of the data subject’s personal data;
- the right to withdraw the consent to processing of personal data concerning him/her if the personal data processing is based on the previously given consent.
In order to exercise these rights, the data subject may contact the Law Firm in writing, including electronically.
If the data subject believes that processing of personal data at the Law Firm is inconsistent with the effective legal acts, the data subject has the right to contact the State Data Protection Inspectorate (its website is vdai.lrv.lt).
7. Use of cookies on the website www.galubickas.lt
To improve your experience when visiting the website of the Law Firm, the Law Firm may use cookies on it. Cookies are small pieces of textual information that are automatically generated when browsing the webpage and are stored on the webpage visitor’s computer or another endpoint device. The information collected by means of cookies allows us ensuring more convenient browsing on the website of the Law Firm and learning more of its visitors’ behaviour, analysing trends and improving the website both in terms of the services of the Law Firm and the information provided on the website. The Law Firm uses cookies to process only anonymised personal data. If the webpage visitor does not consent to saving of Google cookies on his/her computer or another endpoint device, the visitor may change settings of his/her web browser and disable, delete all the cookies, or activate / disable them one by one. You can find more information about the cookies used by Google on AllAboutCookies.org or www.google.com/privacy_ads.html.
8. Changes to the Privacy Policy
The Law Firm regularly reviews its Privacy Policy, and its amendments will be published on www.galubickas.lt/en
9. Contacts
If you have any questions concerning personal data processing, you may contact Law firm Galubickas by phone +370 616 13406, mail Advokato Galubicko the Law Firm, Šv. Dvasios g. 6-13, LT- 02101 Vilnius, or e-mail paulius@galubickas.lt