Advokatų profesinė bendrija „G&G ADVOKATAI Gidra Gubavičius ir partneriai“, legal entity code 306026688, registered office at Laisvės al. 76-14, LT-44249 Kaunas, and the attorneys and assistant attorneys working within it and providing legal services (hereinafter the Firm), process personal data (that is, data from which an individual can be identified) in accordance with the General Data Protection Regulation (hereinafter the GDPR), the Law of the Republic of Lithuania on Legal Protection of Personal Data, the Law of the Republic of Lithuania on the Bar, other legislation and this privacy policy, published in the “Privacy policy” section of the Firm’s website (https://ggadvokatai.lt/en/privatumo-politika/).
I. PERSONS WHOSE DATA ARE PROCESSED, PURPOSES AND LEGAL BASES OF PROCESSING
1. Technical data, such as a visitor’s IP address, are processed to ensure the operation and security of the website. These data may be recorded in server logs. Processing is based on the Firm’s legitimate interest in ensuring the availability of the website and protecting it against unlawful activity (Article 6(1)(f) of the GDPR). The website does not use cookies. No tools for analysing or tracking visitor behaviour are installed.
2. The Firm processes personal data relating to its clients, partners, suppliers and their representatives (such as employees) who have maintained or maintain relations with the Firm on behalf of clients, partners or suppliers, as well as persons with whom the Firm’s clients have indicated that they have had or have legal relationships. Depending on the particular service and what is necessary to provide it, identity, contact, representation, contractual, payment, property-related and other legal relationship and case data may be processed. Data are obtained from the individual concerned, the Firm’s clients or their representatives, other parties to proceedings, courts, institutions, registers and other lawfully used sources. Where data are not obtained from the individual concerned, information is provided in accordance with Article 14 of the GDPR, subject to lawfully applicable exceptions, including protection of professional secrecy under Article 14(5)(d).
3. The personal data of the Firm’s clients are processed for the purposes of providing legal services to them and administering the Firm (compliance with accounting, document retention and other statutory requirements). Where the client is an individual, data necessary to take steps at the client’s request before entering into a legal services agreement and to perform that agreement are processed under Article 6(1)(b) of the GDPR. Data necessary to comply with statutory accounting, document retention and other obligations are processed under Article 6(1)(c) of the GDPR. Data necessary for the establishment, exercise or defence of legal claims of the Firm or its clients are processed on the basis of the relevant legitimate interest under Article 6(1)(f) of the GDPR.
4. Personal data of the Firm’s partners, suppliers and their employees who have maintained or maintain relations with the Firm on behalf of clients, partners or suppliers are processed to perform contracts concluded with them (Article 6(1)(b) of the GDPR, where the data subject is a party to the contract). Data of representatives and employees of legal entities are processed on the basis of the Firm’s legitimate interest in maintaining and performing contractual relationships (Article 6(1)(f) of the GDPR). Data are also processed for the administration of the Firm (compliance with accounting, document retention and other statutory requirements), in fulfilment of statutory obligations concerning the proper administration of the Firm (Article 6(1)(c) of the GDPR).
5. Personal data of persons with whom the Firm’s clients have indicated that they have had or have legal relationships are processed without their consent for the purpose of providing legal services to the Firm’s clients, on the basis of the legitimate interest of the Firm or its clients in establishing, exercising or defending legal claims and otherwise lawfully protecting clients’ rights and interests (Article 6(1)(f) of the GDPR), taking into account the necessity of the processing and the rights and interests of the data subjects. Such data are also processed for the administration of the Firm where necessary to fulfil statutory obligations concerning its proper administration (Article 6(1)(c) of the GDPR). Special categories of personal data are processed where necessary for the establishment, exercise or defence of legal claims (Article 9(2)(f) of the GDPR). Personal data relating to criminal convictions and offences are processed to the extent necessary to provide legal services and permitted by law (Article 10 of the GDPR).
6. The Firm uses technical and organisational measures to protect the personal data it processes against accidental or unlawful destruction, damage, alteration, loss, disclosure or other unlawful processing.
II. RECIPIENTS OF DATA
7. To the extent necessary in each particular case for the purposes of processing, personal data processed by the Firm may be disclosed to law enforcement and judicial authorities (for example, courts when providing legal services to the Firm’s clients), the Firm’s partners (for example, specialists whose advisory opinions are required to provide legal services to the Firm’s clients) and other persons to whom disclosure is necessary to provide legal services to the Firm’s clients, as well as tax authorities, persons recording and processing the Firm’s accounting data and other persons assisting in the fulfilment of statutory obligations concerning the proper administration of the Firm. Personal data processed by the Firm may also be disclosed to other persons where disclosure to them is required by law, in compliance with the requirements protecting attorneys’ professional secrecy and the confidentiality of the Firm’s clients. Service providers processing data on the Firm’s behalf are engaged in accordance with Article 28 of the GDPR and are granted access to data only to the extent necessary to perform their functions.
8. Technical personal data of visitors to the Firm’s website may be processed by website hosting and technical maintenance service providers to the extent necessary to provide those services.
III. SCOPE OF PROCESSING AND RETENTION PERIOD
9. The Firm processes personal data only to the extent required for the purposes of processing. Any excessive personal data received that are not needed for those purposes are deleted immediately upon receipt. Data whose further processing is no longer necessary and for which no other lawful basis for retention remains are deleted. The retention period is determined by the purpose of processing, applicable mandatory document retention periods, the duration of contractual relationships and the relevant case, applicable time limits for bringing claims, and the need to establish, exercise or defend legal claims. Where a dispute, investigation or other proceeding is ongoing, data required for it may be retained until its conclusion and for any further period during which retention is lawful and necessary. These provisions apply in the following cases, among others:
9.1. The Firm processes the personal data of its clients and their representatives who maintained relations with the Firm on clients’ behalf, and only data necessary to provide legal services to clients and administer the Firm, for as long as it is necessary to provide legal services and fulfil statutory obligations concerning the proper administration of the Firm. After legal services have been provided, only data that must be retained to comply with applicable legal obligations or to establish, exercise or defend legal claims of the Firm or its clients continue to be retained; once those grounds cease to apply, the data are deleted;
9.2. The Firm processes the personal data of its partners, suppliers and their representatives who maintained relations with the Firm on partners’ or suppliers’ behalf, and only data necessary to perform contracts concluded with them and administer the Firm, for as long as those contracts are being performed and it is necessary to fulfil statutory obligations concerning the proper administration of the Firm. After the contracts have been performed, only data that must be retained to comply with applicable legal obligations or to establish, exercise or defend legal claims continue to be retained; once those grounds cease to apply, the data are deleted;
9.3. Personal data of persons with whom the Firm’s clients have indicated that they have had or have legal relationships, and only data necessary to provide legal services to the Firm’s clients and administer the Firm, are processed for as long as it is necessary to provide legal services and fulfil statutory obligations concerning the proper administration of the Firm. After legal services have ended, only data that must be retained to comply with applicable legal obligations or to establish, exercise or defend legal claims of the Firm or its clients continue to be retained; once those grounds cease to apply, the data are deleted.
10. Technical data of website visitors are retained for no longer than necessary to ensure the operation and security of the website and to detect and investigate security incidents. Once the lawful basis for retention ceases to apply, the data are deleted.
IV. RIGHTS OF DATA SUBJECTS
11. A data subject whose personal data are processed by the Firm (a person whose data the Firm processes) has the right to access their data processed by the Firm, request rectification and, in the cases provided for by law, request erasure, restriction of processing and data portability.
12. Where personal data are processed on the basis of the consent of the data subject (for example, a client of the Firm), consent may be withdrawn at any time; withdrawal does not affect the lawfulness of processing carried out before withdrawal. Once consent has been withdrawn, processing on that basis ceases. The data are deleted unless there is another lawful basis for processing or an exception under Article 17(3) of the GDPR, including the need to comply with a legal obligation or to establish, exercise or defend legal claims.
13. Where personal data are processed on a basis other than consent, a request for erasure is assessed under the conditions and exceptions in Article 17 of the GDPR. Where processing is based on legitimate interests, the data subject has the right to object on grounds relating to their particular situation. In that case, the Firm ceases processing unless there are compelling legitimate grounds for processing which override the interests, rights and freedoms of the data subject, or the data are necessary for the establishment, exercise or defence of legal claims.
14. Data subjects whose personal data are processed by the Firm may exercise their rights by contacting the Firm in writing by email at info@ggadvokatai.lt or by post at Laisvės al. 76-14, LT-44249 Kaunas. The Firm provides information on action taken on a request without undue delay and no later than one month after receipt of the request. Where necessary due to the complexity of the request, this period may be extended by no more than two further months. The data subject is informed of the extension and the reasons for it within one month after receipt of the request. Where there are reasonable doubts about the identity of the person making the request, only additional information necessary to confirm their identity may be requested. A data subject who considers that their personal data are being processed in breach of the law has the right to lodge a complaint with Valstybinė duomenų apsaugos inspekcija (the Lithuanian State Data Protection Inspectorate), regardless of whether they have first contacted the Firm (email: ada@ada.lt, address: L. Sapiegos g. 17, LT-10312 Vilnius, website: https://vdai.lrv.lt).