Privacy Policy

What does this Privacy Policy mean?

In this Privacy Policy (‘Privacy Policy’) we explain how the law firm Glimstedt Bernotas ir partneriai and the specific Glimstedt lawyer or legal professional handling your matter (together, ‘Glimstedt’) process your personal data when you visit Glimstedt’s website at https://www.glimstedt.lt (the ‘Website’), visit our office, interact with Glimstedt social media accounts, or contact us by email or phone. This Privacy Policy also covers personal data that Glimstedt receives when performing contracts with partners or corporate clients where you are their employee or representative.

About Glimstedt

Glimstedt is established at Jogailos g. 4, LT-01116 Vilnius, Republic of Lithuania. Email: [email protected].

What is personal data?

Personal data is any information that Glimstedt collects about a natural person which can be used to identify that person. Personal data includes any information such as name, surname, address and IP address.

What personal data do we collect?

Glimstedt processes your personal data for the purposes listed below.

Provision and administration of legal services

For the provision and administration of legal services, Glimstedt processes the personal data of the person who has concluded a legal services agreement with Glimstedt (the ‘Client’, where the Client is a natural person) and the personal data of the Client’s representatives, employees and other persons involved in the Client’s instructions. This includes: personal data contained in the legal services agreement; personal data provided by the Client (for example, information about contracts concluded by the Client, relationships with other persons, and correspondence with the Client); and data that Glimstedt collects from other sources while providing legal services (for example, from publicly available sources, registers, etc.). These data are processed on the basis of the contract and/or to take steps at your request prior to entering into a contract, and/or for compliance with legal obligations, and/or on the basis of legitimate interests.

For the provision and administration of legal services, Glimstedt will process your special categories of personal data only with your explicit consent and/or in order to establish, exercise or defend your legal claims and/or where you have manifestly made such data public.

Personal data processed for the provision and administration of legal services are retained for 10 years after the Client’s last instruction to Glimstedt has ended and until 15 January of the following year, unless a longer retention period is set by laws or other legal acts.

Prevention of money laundering and terrorist financing

For the purposes of preventing money laundering and terrorist financing, Glimstedt (depending on the case) collects the following personal data about Clients, their representatives, employees, ultimate beneficial owners and their family members: name, surname, email address, telephone number, personal identification number, nationality, residential address, identity document details (document name, number, expiry date, issuing country), information on whether the Client/the Client’s family members are politically exposed persons (PEPs), source of funds, and other data processed for compliance with legal obligations and/or on the basis of legitimate interests.

These personal data are retained for 8 years after the Client’s last instruction to Glimstedt has ended and until 15 January of the following year.

Sending offers to Clients

With your consent, Glimstedt may process personal data (name, surname, email address, telephone number) to send news and other information about Glimstedt’s services and offers, information about events, and similar communications.

If, when concluding a legal services agreement with Glimstedt, you did not explicitly give consent to receive direct marketing communications and did not object by ticking the ‘I do not agree’ box, Glimstedt may, on the basis of legitimate interests to communicate with Clients (Article 81(2) of the Law on Electronic Communications), process your personal data (name, surname, position, email address) as a Client or Client’s representative for direct marketing purposes by emailing you such communications about news and other information about Glimstedt’s services and offers, events, and similar updates. Each direct marketing message will give you the opportunity to opt out by emailing us at the address provided or by using other methods described in this Privacy Policy.

Where we process your personal data for direct marketing with your consent, we retain the data for 5 years from receipt of your consent and until 15 January of the following year. Where we process your personal data for direct marketing on the basis of legitimate interests, we retain the data for the duration of the legal services agreement.

Performance of contracts with partners and service providers

Glimstedt processes personal data of employees of its suppliers, service providers or partners (legal entities), and personal data of suppliers, service providers or partners who are natural persons, to perform contracts concluded between Glimstedt and those persons. In such cases, Glimstedt will process: name, surname, date of birth, telephone number, email address, correspondence content, date, and other data related to contract performance.

Where personal data of a service provider’s or supplier’s employees are processed, the legal basis is Glimstedt’s legitimate interests in performing the contract. If you conclude a contract with Glimstedt as a natural person, Glimstedt will process your data on the basis of contract performance.

The personal data specified in this section are processed for the duration of the contract. If personal data are included in the contracts, such data are retained for 10 years from the end date of the contract.

Event organisation

For the purpose of organising events or online seminars, Glimstedt processes the following data: name, surname, telephone number, employer, position, email address. These data are processed on the basis of contract or legitimate interests to perform a contract. During events we may also take photographs or film and process your image on the basis of consent. Such data are retained for 5 years after the event.

External communications

For the purpose of presenting Glimstedt’s activities in announcements, including brochures, visual presentations and on social media, we process the following data: your photograph, name, surname, employer, position. These data are processed on the basis of your consent and retained for 5 years from receipt of your consent and until 15 January of the following year.

Social media

Information you provide via social media when visiting our accounts (including posts, use of ‘Like’ and other interactions) is jointly controlled by us and the social network operators as joint controllers.

We currently maintain the following social media accounts:

We recommend reading these third-party privacy notices and contacting the service providers directly if you have any questions about how they use your personal data.

Careers

For the purpose of administering our candidate database, Glimstedt processes: name, surname, date of birth, telephone number, employer, email address, place of residence (address), education, foreign language skills, desired role, desired salary, personal qualities, work experience (most recent employer, length of service with the employer, positions held), other work experience, and other information provided in your CV, references and/or covering letter.

These data are processed on the basis of legitimate interests in selecting a suitable candidate.

Unless you give separate consent for us to retain your personal data after the recruitment process ends, we will delete and/or destroy your personal data within 5 working days after a contract is concluded with the selected candidate.

Enquiries

Any other personal data that you may provide to us at any time when communicating with us — by email, via the enquiry form on the Website, by telephone or in person at the Glimstedt office — are processed on the basis of legitimate interests in providing services and retained for 2 years from receipt of your enquiry and until 15 January of the following year. If you sign a contract with Glimstedt, such data are then retained as described under Provision and administration of legal services above.

How are your personal data processed?

Your personal data are processed in accordance with the General Data Protection Regulation (GDPR), the Law on Legal Protection of Personal Data of the Republic of Lithuania, the Law on the Bar of the Republic of Lithuania and other applicable legal requirements. Your personal data are processed responsibly and securely. When determining the means of processing and during processing itself, Glimstedt implements appropriate technical and organisational measures required by law to protect personal data against accidental or unlawful destruction, damage, alteration, loss, disclosure and any other unlawful processing. Appropriate measures are selected having regard to the risks arising from personal data processing.

To whom may we disclose your personal data?

Personal data obtained in the course of providing legal services may be disclosed for the purpose of providing those services to: (i) courts, bailiffs, state or municipal authorities, institutions and/or organisations; or (ii) foreign (overseas) legal partners or specialists in specific fields (for example, auditors, engineers, valuers, bankers, brokers, translators), as provided in the legal services agreement with the Client; or (iii) third parties against whom the Client is represented; or (iv) other Glimstedt lawyers and/or staff or Glimstedt’s service companies or personnel; or (v) third parties, including certain service providers such as IT providers, translators, couriers and others where reasonably necessary for the purposes set out in this Privacy Policy.

We may disclose your personal data to processors who provide services to us (perform work) — e.g., IT service providers, auditors, consultants — and who process your data on behalf of Glimstedt as controller.

Processors may process personal data only in accordance with our instructions and only to the extent necessary. When engaging processors, we take all necessary steps to ensure that they implement appropriate organisational and technical measures to ensure the security of personal data and maintain confidentiality.

Your data may be transferred to state bodies and institutions and to other persons performing functions assigned to them by law.

In addition, we may disclose information about you:

  • where we are required to do so by law;

  • to protect our rights or interests (including disclosing your personal data to third parties for the purpose of recovering amounts you owe us).

Where Glimstedt needs to transfer your personal data to a third country or an international organisation, one of the following conditions will be met: (i) the data are transferred to a country in respect of which an adequacy decision has been adopted; (ii) the transfer is carried out subject to appropriate safeguards provided by law; or (iii) a derogation provided by law applies where transfer under (i) or (ii) is not possible.

Cookies

A cookie is information that an internet server sends to a web browser and which is stored in the browser.

Cookie settings

[Your cookie settings controls appear here.]

What are your rights?

Below we set out information about your rights in relation to Glimstedt’s processing of your personal data and when you can exercise them. If you would like more information about your rights or wish to exercise them, please contact us at the email address given in this Privacy Policy.

Right of access

We want you to fully understand how we use your personal data and to experience no inconvenience as a result. You may contact us at any time to ask whether we process any of your personal data. If we store or otherwise use your personal data, you have the right to access them. To do so, please send us a written request at the email address indicated in this Privacy Policy. For the purpose of fulfilling your request, we may ask you to verify your identity. Please act in good faith and reasonableness when making such requests.

Right to withdraw consent

If you have given us explicit consent to process your data, you may withdraw it at any time by emailing us at the address indicated in this Privacy Policy.

Right to request further information

We recognise it is difficult to cover every possible way in which personal data may be collected and used. We strive to provide clear and comprehensive information and undertake to update this Privacy Policy when our processing changes. If you have any questions about how your personal data are used, we will be pleased to answer them or provide any additional information we can disclose. If you have specific questions or do not understand something, please contact us.

Additional rights

You also have the following rights, which you may exercise in accordance with the procedures described below:

  • The right to rectification — you may ask us to correct any inaccuracies in the data we hold. We may ask you to confirm the corrected information.

  • The right to erasure — you may ask us to delete your personal data in the cases provided for in Article 17 of the GDPR.

  • The right to restriction — you may ask us to restrict the processing of your personal data or not to process them.

  • The right to data portability — for data processed by automated means and obtained from you with your consent or for the purposes of concluding a contract, you may request a copy of your data to be transferred to you or to another controller.

  • The right to object — in the cases and under the procedures set out in Article 21 of the GDPR, you may object to our use of your personal data.

How can you exercise your rights?

To exercise your rights, please submit requests, complaints or demands to us in writing:

  • by email: [email protected];

  • by post: Jogailos g. 4, LT-01116 Vilnius, Republic of Lithuania;

  • in person at Glimstedt, Jogailos g. 4, LT-01116 Vilnius, Republic of Lithuania.

We will respond to your requests, complaints or demands in writing in accordance with the procedures and time limits set by law. We aim to provide information as soon as possible and no later than 30 days from receipt of your request.

If you contact us, we may process the data you provide — name, surname, email address, telephone number, date and the content of correspondence — as described in this Privacy Policy. Please note that we may need to contact you by post, email or telephone. Please inform us of any changes to your personal data.

If, upon receiving a request, complaint or demand, we have doubts about the identity of the person contacting us, we have the right to request proof of identity.

If we are unable to provide you with the information you need and/or you have complaints about how your personal data are processed, you have the right to lodge a complaint with the State Data Protection Inspectorate (www.vdai.lrv.lt).

Liability

You are responsible for ensuring that the data you provide to us are accurate, correct and complete. If your data change, you must inform us immediately by email. We will not be liable for any damage you suffer as a result of providing incorrect or incomplete personal data or failing to inform us of changes to them.

Changes to this Privacy Policy

Glimstedt may update or amend this Privacy Policy at any time. The updated or amended Privacy Policy will take effect from the date it is published on the Website. Please check it from time to time to ensure you are satisfied with the current version.

When we update the Privacy Policy, we will inform you of changes we consider material by publishing them on the Website. The ‘Last updated’ date below indicates when this Privacy Policy was last revised.

Last updated: 1 December 2023