HubLegal Law Firm's Privacy Policy

1 July 2023, Vilnius

HubLegal Law Firm (the ‘Law Firm’) has adopted this privacy policy on personal data protection (the ‘Privacy Policy’) to implement Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the ‘Regulation’) and the Republic of Lithuania Law on the Legal Protection of Personal Data. The Privacy Policy contains information on personal data processing. Performing its obligation to be a transparent organisation, in this Privacy Policy the Law Firm provides clear information about what personal data are processed, purposes of processing, personal data retention periods, legal basis for data processing and other information that has to be provided according to the law.

1. What personal data are processed, for what purpose and on what grounds?

1.1. For the purpose of carrying out the functions defined in the Republic of Lithuania Law on the Bar and other legal acts, the Law Firm may process the following personal data on its clients and on other persons related to the matters of the client:

1.1.1. the name/s, surname/s; personal ID number; nationality, passport and/or identity card details; agreements on legal services and representation concluded by and between the attorney-at-law and the client; agreements between the client and third parties; decisions of courts and other state institutions, court rulings and other documents concerning the client; criminal record data; e-mail address, electronic correspondence, telephone number, residential address and other contact details; a photograph; attorney-at-law - client privilege; other data and information provided by the client of the Law Firm or third parties.

1.2. The legal ground for processing of the data indicated in paragraph 1.1.1 is the Republic of Lithuania Law on the Bar and other legal acts governing activities of the Lithuanian Bar Association, attorneys-at-law, assistant attorneys-at-law, and lawyers of the EU Member States intending to engage in a legal practice in the Republic of Lithuania as well as performance of agreements on legal services and representation concluded by and between attorneys-at-law of the Law Firm and the clients.

1.3. For the purpose of concluding and performance of service agreements with persons holding an individual business licence or employment contracts, for bookkeeping purposes, and for performing statutory obligations of the Law Firm as the employer, the following personal data may be processed:

1.3.1. the name/s, surname/s; personal ID number; residential address; e-mail address and telephone number; current account number; information on family status (marriage / divorce certificate, information about children under 14 years of age; all other information that may affect the employee’s rights and obligations as well as taxation); information on health condition (a copy of a disability certificate, a medical certificate of ability to do a certain job); payroll information; information of annual leave, other leaves and business trips/secondments; state social insurance number; Curriculum Vitae; information on additional leave entitlements; other information necessary for the performance of the obligations and exercise of the rights of the Law Firm as the employer under the law.

1.4. The legal ground for processing of the data indicated in paragraph 1.3.1 is the Republic of Lithuania Law on the Bar, the Labour Code of the Republic of Lithuania and other legal acts governing employment relations.

1.5. For the purpose of concluding and performance of service agreements, the following personal data of the service provider’s representative who signed the agreement may be processed:

1.5.1 the name, surname of the counterparty or its representative; job title of the counterparty’s representative; e-mail address and telephone number of the counterparty’s representative; other information other information necessary for the performance of the obligations and exercise of the rights of the Law Firm as a counterparty under the law.

1.6. The Civil Code of the Republic of Lithuania and performance of the relevant agreement is the legal ground for processing of the data indicated in paragraph 1. 5.1.

1.7. For the purpose of providing information to interested parties based on their enquiries, the data provided by the interested parties are processed. The personal data referred to above are processed on the ground of consent of the interested party as the latter – when requesting information or expressing interest in obtaining legal services of the Law Firm – voluntarily provides his/her personal data necessary for the preliminary assessment by the Law Firm as to the possibility of providing such legal services.

2. Ways of obtaining personal data

2.1. Personal data are obtained from data subjects where provision of such data is required under legal acts, or where data subjects submit such data voluntarily as they are necessary for the rendering of legal services. In addition, personal data are obtained from third parties on their initiative or based on an enquiry of the Law Firm requesting data necessary for the carrying out of the statutory functions of an attorney-at-law of the Law Firm

3. Personal data retention period

3.1. The retention period for the documents and other information on personal data processed at the Law Firm is prescribed by the Lithuanian law

3.2. If no retention period of any documents or other information processed at the Law Firm is specified in legal acts of the Republic of Lithuania, such retention period is established based on internal regulations of the Law Firm taking into consideration the legitimate purpose of, the legal ground for retaining the data and the principles of lawful processing of the personal data. The retention period is usually 10 years after termination of the legal services agreement

4. To whom can the Law Firm disclose personal data

The Law Firm may disclose personal data of the data subjects to

4.1 data processors providing ancillary services to the Law Firm (IT, bookkeeping, translation) during which a very limited processing of personal data of the data subjects may take place. All the data processors of the Law Firm are bound by confidentiality undertakings and must ensure the same level of personal data protection of data subjects, refrain from using the data for unauthorised purposes, and ensure that their partners act in the same manner.

4.2. Other cases of personal data transfer: the Law Firm may transfer personal data on the data subject to state and municipal institutions, courts, bailiffs, notaries and other persons carrying out their statutory functions, either at their request or for the purpose of the legitimate interest of the Law Firm or the client, i. e. for the establishment, exercise or defence of legal claims; personal data may be transferred or disclosed in other cases only on the grounds and according to a procedure prescribed by legal acts.

5. Protection of personal data at the Law Firm

At the Law Firm, we treat personal data responsibly:

5.1. Personal data security. The Law Firm applies technical and organisational measures for the protection of personal data. Data are kept securely, and only a limited number of persons have access to them.

5.2. International transfers of personal data. Personal data are processed within the European Union / European Economic Area. In some cases it may be necessary to forward personal data to the recipients outside the European Union / European Economic Area. The Law Firm takes steps to safeguard personal data in such cases and may rely on an adequacy decision of the European Commission, which means that, in the opinion of the European Union, the laws and agreements of the country ensure an adequate level of personal data protection. In the absence of an adequacy decision of the European Commission, the data controller or data processor may transfer personal data to a third country or an international organisation outside the European Union / European Economic Area only if the data controller or data processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.

6. Rights of the data subject

A data subject has the following rights:

• the right to obtain information on whether we process personal data concerning the data subject, and if so, the data subject has the right to access his/her personal data. That is why we inform them in advance in this Privacy Policy;

• the right to contact us and request rectification of incorrect personal data;

• the right to request erasure of his/her personal data where, in the data subject’s opinion, the Law Firm no longer needs such data, or where the data subject gave their consent and has later decided to withdraw it. The request may be granted only if it is well-grounded. This right does not apply if data processing is related to the freedom of expression and information, legal obligations or the establishment, exercise or defence of legal claims;

• the right to obtain his/her personal data and transfer such data to another entity (the right to data portability). This right applies where the personal processing is carried out by automated means on the basis of the data subject’s consent;

• the right to have the personal data processing restricted in certain circumstances. It means that we will continue storing the data subject’s personal data but we will not be able to process them temporarily. For instance, this may be necessary if inaccurate data are found. It is likely that the data subject would not want that such data are processed until they are rectified;

• the right to object to the personal data processing where it is based on the legitimate interests of the Law Firm or third parties. The data subject may exercise this right if they believe that their personal interests override such legitimate interests of the Law Firm;

• the right to withdraw the consent to processing of the personal data if the personal data processing is based on the previously given consent.

In order to exercise these rights, the data subject may contact the Law Firm in writing including electronically.

If the data subject believes that processing of personal data at the Law Firm is contrary to the law, the data subject has the right to apply to the State Data Protection Inspectorate (https://vdai.lrv.lt/lt/).

7. Use of cookies on the website www.hublegal.lt

To improve your experience when visiting the website of the Law Firm, the Law Firm may use cookies on it. Cookies are small pieces of textual information that are automatically generated when browsing the webpage and are stored on the webpage visitor’s computer or another endpoint device. The information collected by means of cookies allows us to ensure more convenient browsing on the website of the Law Firm, learn more about its visitors’ behaviour, analyse trends and improve the website both in terms of the services of the Law Firm and the information provided on the website. The Law Firm uses cookies to process only anonymised personal data. If the webpage visitor does not consent to the saving of Google cookies on his/her computer or another endpoint device, the visitor may change settings of his/her web browser and disable or delete all the cookies, or activate / disable them one by one. You can find more information about the cookies used by Google on AllAboutCookies.org or www.google.com/privacy_ads.html.

8. Changes to the Privacy Policy

The Law Firm regularly reviews this Privacy Policy, and its amendments will be published on www.hublegal.lt.

9. Contact details

If you have any questions concerning personal data processing, you may contact HubLegal Law Firm by telephone +370 616 13406, write to the address HubLegal Law Firm, Šv. Dvasios g. 6-13, LT- 02101 Vilnius, or e-mail paulius.galubickas@hublegal.lt.