Data controllers

1.Definitions

1.1.Personal Data – any information relating to a natural person (data subject) whose identity is known or can be established, directly or indirectly, by reference to an identifier such as an identification number or to one or more factors specific to that person’s physical, physiological, mental, economic, cultural or social identity, location data or an online identifier.

1.2.Data Controllers (the Companies) – UAB “Sostinės teisė”, company code 303174678, address Laisvės pr. 78B-244, Vilnius, and UAB “Realm Juridical”, company code 302046565, address Laisvės pr. 78B-244, Vilnius.

1.3.Data Subject – a natural person or a representative of a legal entity who uses the Companies’ services, or a person who browses the Website.

1.4.IP address – a unique number identifying a computer, phone, tablet or other device connecting to the internet. An IP address may be used to identify the country in which the computer is connected to the internet.

1.5.Client – a natural or legal person who applies for, or uses, the legal services provided by the Companies.

1.6.Privacy Policy – this document, which sets out the main rules for the collection, accumulation, processing and storage of Personal Data applicable when visiting the Website, as well as the rights of Data Subjects and the procedure for exercising them at the Companies.

1.7.Cookies – small files placed on a computer, phone, tablet or other device used by any person visiting the www.sostinesteise.lt platform, by means of which the Website recognises the device. This term covers not only cookies but also the use of similar tools.

1.8.Website – the website www.sostinesteise.lt operated by the Companies.

1.9.Direct marketing – activity aimed at offering goods or services to persons by post, telephone or other direct means and/or at asking for their opinion on the goods or services offered.

1.10.Regulation – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

2.General provisions

2.1.In this Privacy Policy we provide you with information on how the Companies process Data Subjects’ Personal Data. Additional information may be provided in purchase and sale agreements, assignment of claim agreements, service agreements and other contracts that you conclude with the Companies.

2.2.We recommend that you read this Privacy Policy carefully before submitting an enquiry on the Website or contacting us about services. You can review the Privacy Policy again at any time on the Website.

2.3.This Privacy Policy does not cover how the Companies process Personal Data when you visit other websites of the Companies or use services promoted on, or provided through, other websites. If you visit other websites of the Companies or use services promoted on, or provided through, such websites, your Personal Data will be processed in accordance with the information given on those websites. In that case, please read the privacy policy published on the other Company website.

2.4.The processing of personal data at the Companies is governed by the Regulation, the Law on the Legal Protection of Personal Data of the Republic of Lithuania, other legal acts and the Companies’ internal rules.

3.Principles of personal data processing

3.1.The scope of the Personal Data processed depends on the services ordered or used by the Data Subject and on the information the Data Subject provides when enquiring about, ordering or using services or visiting the Website.

3.2.Data are processed only where there is a lawful basis for processing: to provide the services promoted on the Companies’ websites; with the person’s consent; where the Companies are obliged to process personal data by law; or where personal data must be processed for the legitimate interests of the Company or a third party (including creditors).

3.3.We seek to ensure that Personal Data are processed accurately, fairly and lawfully, only for the purposes for which they are collected, in compliance with the clear and transparent principles and requirements for personal data processing laid down in legal acts.

3.4.You are not required to provide any Personal Data, but certain services may not be provided if Personal Data are not provided.

3.5.The Website is not intended for persons under 16 years of age and we do not knowingly collect their personal data. If you believe that a child’s data has been submitted by mistake, contact us and we will delete it.

3.6.We do not take decisions based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you.

4.Scope, purposes and legal bases of personal data processing

4.1.The Companies process Personal Data collected when Clients visit the Companies’ Website, in connection with the services offered on the Website, for the following purposes, on the following bases and to the following extent:

4.1.1.Personal Data provided by the Client, processed on the basis of entering into a contract with the Client, for the purpose of verifying the Client’s identity before the contract is concluded and of concluding the contract

4.1.1.1.Client who is a natural person: first name, surname, personal identification number, date of birth, telephone number, e-mail address, residential address, IP address, a copy of the identity card or passport and the personal data contained in them;

4.1.1.2.Representative of a Client that is a legal entity: position, first name, surname, personal identification number, date of birth, e-mail address, residential address, basis of representation, registration certificate, extract from the state register on the legal entity, a copy of the power of attorney of the representative and the data contained in them;

4.1.2.Personal Data about third parties (customers, debtors, partners, their representatives, employees) provided by the Client, collected for the purpose of performing the contract concluded with the Client and processed on the basis of legitimate interests (Article 6(1)(f) of the Regulation): the interest of the Client and the Companies in performing the contract with the Client and defending the Client’s rights (for example, recovering a debt):

4.1.2.1.The third party’s first name, surname, personal identification number, date of birth, telephone number, e-mail address, residential address, current bank account number and other Personal Data necessary for the provision of the services.

4.2.The Personal Data specified above are processed while the services are provided; afterwards the data are kept for 10 (ten) years in order to establish, exercise or defend the Companies’ legal claims and so that the Companies can comply with the legal obligation to archive documents.

4.3.Telephone calls. The Companies do not record telephone calls. When you call, we may write down your name, telephone number and the gist of the call so that we can respond to your enquiry; these data are processed as set out in clause 4.7.

4.4.Other purposes. The Companies may process your personal data for other purposes in compliance with the requirements and procedures of the Regulation and the Law on the Legal Protection of Personal Data of the Republic of Lithuania.

4.5.Retention periods. We process personal data for no longer than the purposes of processing, the data subjects and/or legal acts require. As a rule (unless stated otherwise), personal data are processed at the Companies for 10 (ten) years from receipt of the personal data, while data of enquiries that did not lead to a contract, and in other cases specified in this Privacy Policy, are processed for the periods specified in this Privacy Policy. If a data subject requests restriction of the processing of their data and the Companies grant the request, the collected personal data are no longer processed at the Companies, except that they are kept for the periods set out in this Privacy Policy. This Privacy Policy may specify particular periods for processing, including storing, Personal Data.

4.6.Sources of data. The Companies obtain Personal Data not only directly from the data subject. When providing legal services (for example, in debt recovery, bankruptcy, employment dispute and other cases), the Companies may receive data about third parties (for example, debtors, creditors, employees or employers) from the Client, from public registers and information systems (for example, the Register of Legal Entities, the Real Property Register, the Lithuanian courts information system LITEKO), and from courts, bailiffs and other state authorities. These data are processed only to the extent necessary to defend the Client’s rights and legitimate interests and to perform the contract.

4.7.Enquiries through Website forms and by telephone. When you fill in an enquiry or consultation form on the Website or call the Companies, we process the data you provide: name or company name, telephone number, e-mail address and a short description of the situation. These data are processed so that we can contact you, assess your enquiry and make an offer (Article 6(1)(b) of the Regulation: steps taken at your request prior to entering into a contract). If no contract is concluded, we keep the enquiry data no longer than necessary to deal with the enquiry, and in any case for no more than 5 (five) years from the submission of the enquiry. Please do not include excessive data in the form (for example, about health or criminal convictions) unless it is necessary for us to understand your enquiry.

4.8.Summary of purposes, legal bases and retention periods (under the Regulation):

5.Disclosure of processed data to other parties; data controllers and processors

5.1.The Companies do not disclose the Personal Data they process to third parties without the prior consent of the person (data subject), except as provided by law.

5.2.Recipients and categories of recipients: state bodies and institutions, law enforcement authorities, courts and bailiffs; auditors, legal and financial advisers; third parties maintaining registers; service providers that process data on behalf of the Companies under contracts (for example, providers of website hosting, management system, e-mail and information technology services).

5.3.Data processors may process Personal Data only on the Company’s instructions and only to the extent necessary to properly perform their contractual obligations. By engaging data processors, we seek to ensure that they, too, have implemented appropriate organisational and technical security measures and keep personal data confidential.

5.4.Your personal data may be disclosed to third parties: in writing, by electronic means of communication, by connecting to databases or information systems that hold the relevant data, or in another manner agreed between the personal data controllers.

5.5.The Companies process Personal Data as joint controllers. The Companies have agreed between themselves that responsibility for exercising your rights and providing information is allocated as set out in this Privacy Policy; you may contact either Company, and it will reply on behalf of all the controllers (Article 26 of the Regulation).

6.Security of personal data

6.1.Through their internal organisational and technical measures, the Companies make every reasonable effort to protect Personal Data against any unlawful acts. All Personal Data and other information provided by the Data Subject are treated as confidential. Access to Personal Data is granted only to those employees and data processors of the Companies who need it to perform their duties or to provide services.

6.2.We will notify the State Data Protection Inspectorate of a personal data breach that may pose a risk to your rights and freedoms within 72 hours of becoming aware of it, and where the breach may pose a high risk, we will also inform you in accordance with the Regulation.

6.3.Documents and electronic correspondence are kept in the Companies’ e-mail accounts and internal database. The internal database can be accessed only with individual login credentials and only from the Companies’ office network; the e-mail accounts can be accessed only with individual login credentials. Access is limited to those lawyers and employees who need it for their work.

7.Rights of data subjects

7.1.Every data subject has the following rights:

7.1.1.to access the Personal Data they have provided at any time by contacting the Companies;

7.1.2.to receive, on a written request, information on the sources from which and which of their Personal Data have been collected, for what purpose they are processed and to whom they are disclosed;

7.1.3.to demand, on a written or e-mail request, that incorrect, incomplete or inaccurate personal data be rectified and/or that the processing of such personal data be suspended.

7.1.4.to object to the processing of their Personal Data, except where the personal data are processed for a legitimate interest pursued by the data controller or by a third party to whom the personal data are disclosed, and the interests of the data subject do not override it;

7.1.5.to demand that the Personal Data provided be erased;

7.1.6.to demand that the processing of personal data be restricted;

7.1.7.to demand that personal data provided by the data subject themselves, where processed on the basis of consent or a contract and by automated means, be transmitted by the data controller to another data controller, where technically feasible (data portability);

7.1.8.the right to object to solely automated processing of data;

7.1.9.the right to object to the processing of personal data for direct marketing purposes;

7.1.10.the right to withdraw consent given for data processing;

7.1.11.the right to lodge a complaint about the processing of personal data with the State Data Protection Inspectorate (L. Sapiegos g. 17, LT-10312 Vilnius, tel. +370 5 271 2804, e-mail ada@ada.lt, vdai.lrv.lt).

7.2.A data subject may apply to exercise their rights orally or in writing, by submitting a request in person, by post or by electronic means. Where a request is submitted by post or electronic means, the Companies may ask for confirmation of identity only to the extent necessary to ensure that the request was made by the data subject themselves (for example, by replying to the request at the contact address given, asking for additional information or for a copy of an identity document with unnecessary data redacted). We do not require notarisation or a qualified electronic signature. If the data subject’s personal data, such as name or surname, have changed, copies of documents confirming this must be submitted together.

7.3.A request to exercise data subject rights must be legible and must state the data subject’s first name, surname, address and/or other contact details for communication or at which the reply on the exercise of the data subject’s rights should be received.

7.4.A data subject may exercise their rights personally or through a representative. In the request, the representative must state their first name, surname, address and/or other contact details at which they wish to receive the reply, as well as the first name and surname of the person represented and other data required to identify the data subject properly, and must provide a document confirming the representation or a copy of it. If there are doubts about the identity of the data subject, the Companies ask for additional information needed to verify it.

7.5.We will reply no later than within 30 calendar days of receiving the request. For a complex or numerous request, this period may be extended by a further 2 months, and we will inform you of this within the first month.

7.6.The Companies, acting as Data Controllers, have the right to refuse, with reasons, to exercise your rights on the grounds laid down in the Regulation.

7.7.Information on the processing of your data is provided, the lawfulness and fairness of processing is checked, processing is stopped and data are erased free of charge.

7.8.You can submit a request by e-mail to info@sostinesteise.lt and info@juridical.lt, or by visiting the office at Laisvės pr. 78B-244, Vilnius.

8.Cookies and third-party services

8.1.The Website currently uses only a technical session cookie (PHPSESSID), needed for the operation and security of the Website and forms. It is deleted when you close the browser and is not subject to the consent requirement.

8.2.We do not currently use analytics, marketing or social network tracking cookies on the Website. If we start using them, we will first ask for your consent and update this Privacy Policy.

8.3.The Website’s contact page embeds a Google Maps map. When it loads, Google may receive your IP address and browser data. In that case, data may be transferred to the USA to Google LLC, which participates in the EU–US Data Privacy Framework. More about this is in Google’s privacy policy. Website files (for example, scripts and fonts) may be delivered through servers of the website management system provider and content delivery networks.

8.4.When you visit the Website, the Website server automatically records your IP address, time of visit, page opened and browser data (server logs). These data are processed for the purposes of ensuring the operation and security of the Website and visit statistics (Article 6(1)(f) of the Regulation: legitimate interest) and are kept for no longer than necessary for those purposes. They are processed and stored by the Website hosting provider.

8.5.The Website contains links to other websites (for example, social networks). We are not responsible for their content or privacy practices, so we recommend that you read their privacy policies.

9.Final provisions

9.1.This Privacy Policy and its performance and interpretation are governed by the law of the Republic of Lithuania.

9.2.If any provision of this Privacy Policy becomes or is found to be invalid, the remaining provisions remain in force.

9.3.This Privacy Policy is effective from the date of its publication on the Website. This Privacy Policy is not considered an agreement between the Companies and you on the processing of Personal Data. By this Privacy Policy the Companies inform you of the principles of processing your personal data at the Companies. We may amend the Privacy Policy at any time. All amendments to the Privacy Policy are published on the Website. Amendments and/or additions to the Privacy Policy take effect from the moment they are published on the Website. We recommend that you review our Privacy Policy regularly.