1. Who processes your data
The controller of your personal data is Advokatų profesinė bendrija KIZNĖ LEGAL (a professional partnership of attorneys), company code 307144910, registered office at Jonavos g. 60C, LT-44192 Kaunas (“we”).
Please send questions about personal data and requests concerning your rights by email to [email protected] or call +370 605 38755.
We have not appointed a data protection officer, as we are not required to do so. We answer all data protection questions ourselves, using the contact details above.
This policy applies when you visit the websites kizne.legal and konsultacija.kizne.legal, book a consultation, write to us on our Instagram account @advokate.evelina, use our legal services, subscribe to our newsletter (including via Instagram) or apply for a job or internship. The website alimentai.kizne.legal has a separate privacy policy.
2. What data we process and why
We process data only for the purposes stated and only to the extent necessary. We specify the legal bases under Article 6(1) of the General Data Protection Regulation (GDPR).
| When | What data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| You book a consultation or write to us (konsultacija.kizne.legal, website form, email, phone, Instagram message) | First name, surname, email, phone, a brief description of the situation, the name of the other party to the dispute, the time selected | To register the consultation, check for conflicts of interest and respond to your enquiry | Steps prior to entering into a contract (Article 6(1)(b) GDPR); legal obligation to check for conflicts of interest (Article 6(1)(c) GDPR) | If we do not provide services – deleted; if we do – retained as client files |
| We provide legal services | Identity and contact details, case circumstances, documents, correspondence; where the case requires it, also special categories of data (e.g. health data, data concerning children) and data relating to criminal convictions | To provide legal services, represent you, and establish and defend legal claims | Performance of a contract (Article 6(1)(b) GDPR); legal obligation (Article 6(1)(c) GDPR); for special categories of data – Article 9(2)(f) and Article 10 GDPR | 10 years from the end of the provision of services |
| Anti-money laundering obligations apply | Copy of identity document, beneficial owner data, source of funds, politically exposed person status, sanctions screening results, transaction data | To identify the client | Legal obligation (Article 6(1)(c) GDPR) | 8 years from the end of the business relationship; correspondence – 5 years |
| You pay for services | Name or company name, company details, invoices, payment data | To issue invoices and record payments | Legal obligation (Article 6(1)(c) GDPR) | 10 years |
| You subscribe to the newsletter | Email, the memo you chose, your role (employer or employee), email opens and clicks | To send news and offers | Consent (Article 6(1)(a) GDPR) | Until you withdraw consent |
| You write a keyword in a message or comment on our Instagram account @advokate.evelina, or answer quiz questions | Instagram username and display name, profile picture, account ID, text of messages and comments, answers selected, tags | To reply automatically to keywords and quiz answers, send the material you requested (quiz, guide, subscription offer), continue the conversation and answer your follow-up questions, and avoid sending the same material twice | Legitimate interest (Article 6(1)(f) GDPR) | Message and automation data – no longer than 15 months from the last interaction; public comments remain under the post until you delete them or we delete the post |
| You send your email address in reply to an Instagram message to receive the newsletter | Email, Instagram username, email opens and clicks | To send news and offers | Consent (Article 6(1)(a) GDPR) | Until you withdraw consent |
| You apply for a job or internship | CV, cover letter, contact details, education, work experience, interview notes | To select employees and interns | Steps prior to entering into a contract (Article 6(1)(b) GDPR); for future recruitment – consent (Article 6(1)(a) GDPR) | During the selection process and for 6 months afterwards; if you consent to future recruitment – 1 year |
| You visit the website | IP address, device, browser, pages visited, cookie identifiers | Website operation and security, traffic analysis, advertising | Security – legitimate interest (Article 6(1)(f) GDPR); analytics and advertising – consent (Article 6(1)(a) GDPR) | In line with cookie lifetimes (see section 7) |
| A dispute or claim arises | Data relating to the dispute | To defend our rights | Legitimate interest (Article 6(1)(f) GDPR) | Until the dispute ends and the limitation period expires |
When the retention period ends, we delete or anonymise the data. It may remain in backups until the next backup cycle, but it is not used during that time.
3. Conflict-of-interest checks and professional secrecy
Before confirming a booking, we check that we do not represent the other party to the dispute. To do so, we use your name and the name of the other party and compare them against our client list. We confirm the booking and send payment instructions only if there is no conflict of interest.
If a conflict is identified, we do not provide the consultation and we do not disclose the data you provided to anyone, including our client.
Everything we learn in the course of providing legal services is protected as attorney professional secrecy. This protection also applies where the consultation does not take place or no contract is concluded.
4. Where we obtain data from
Most of the data is provided by you. When providing legal services, we also obtain data from other sources:
- from our clients – about other parties to the dispute, employees, witnesses and other participants in the case;
- from courts, labour disputes commissions, bailiffs and other institutions – procedural documents;
- from other parties to the dispute and their representatives;
- from public registers, e.g. the Register of Legal Entities.
If you are a representative of another party to the dispute, a witness or another participant in the case, we process your data only to the extent necessary for the establishment, exercise or defence of our client’s legal claims. We do not inform you separately of such processing, as this would breach attorney professional secrecy (Article 14(5)(d) GDPR).
5. Who we share data with
We share data only where this is necessary to provide our services, where the law requires it or where we use service providers.
Independent recipients (processing data for their own purposes): courts, labour disputes commissions, bailiffs, notaries, other institutions and parties to the dispute – where needed for your case; our accountant; the bank through which you pay; translators, experts and foreign lawyers, where we engage them for your case; our professional liability insurer, if a claim is made regarding our services; state authorities, where required by law.
Data processors (processing on our behalf and on our instructions):
| Provider | What they do | Where |
|---|---|---|
| Hetzner Online | Hosts the kizne.legal website, the client management system and the consultation booking system | Germany |
| Google Workspace | Email, documents, calendar | EU / US |
| Cloudflare | Website security and performance | EU / US |
| Mailgun | Sends website form and notification e-mails | EU |
| Omnisend | Newsletter sending, subscription forms, and subscription via Instagram messages and comments | EU / US |
| ManyChat | Automated replies to Instagram messages and comments | US |
| Google (Analytics, Ads) | Traffic analysis and advertising, only with your consent | EU / US |
| CookieYes | Cookie consent management and records | EU / US |
We conclude contracts with processors as required by Article 28 GDPR or rely on their standard data processing terms.
6. Transfers outside the European Economic Area
Some of our service providers (Google, Meta, Cloudflare, Omnisend, CookieYes, ManyChat) may also process data in the United States. We transfer data outside the EEA only:
- to companies certified under the EU–US Data Privacy Framework (European Commission adequacy decision), or
- under standard contractual clauses approved by the European Commission, or
- where your case requires a foreign lawyer or authority outside the EEA – only to the extent necessary for the establishment or defence of legal claims (Article 49(1)(e) GDPR).
The website, the client management system and the consultation booking system are hosted in the EU, in Germany.
7. Cookies and social media
We use strictly necessary cookies without consent, because without them the website, or its newsletter subscription forms, would not work. We set analytics and advertising cookies (Google Analytics, Google Ads) only if you consent to them in the cookie banner.
You can change or withdraw your consent at any time by clicking the cookie icon in the corner of the website. A full list of cookies, with their purpose and duration, is available in the cookie banner under “Preferences”.
The website contains links to our LinkedIn and Instagram accounts. When you open them, your data is processed by the operators of those platforms under their own privacy policies, except for the Instagram account statistics described below. When you send us an Instagram message or comment, it is also processed by Meta under its own privacy policy. We receive Instagram account traffic statistics from Meta; we are jointly responsible for this data with Meta Platforms Ireland Limited under its Page Insights Controller Addendum, with Meta assuming primary responsibility. You may also exercise your rights by contacting us – we will forward your request to Meta.
8. Your rights
You have the right to:
- obtain confirmation as to whether we process your data, and access it;
- request rectification of inaccurate data;
- request erasure of your data;
- request restriction of processing;
- receive the data you have provided in a machine-readable format and transmit it to another controller;
- object to the processing of your data on the basis of legitimate interest and for direct marketing purposes;
- withdraw your consent at any time; this does not affect the lawfulness of processing carried out before withdrawal.
Limitations on rights. We do not delete data while we are required by law to retain it or while it is needed to defend legal claims. We do not grant access to data that we process in another client’s case, as it is protected by attorney professional secrecy.
We respond to requests within 1 month. In complex cases, we may extend this period by a further 2 months, after informing you. Before acting on a request, we may ask you to verify your identity.
If you believe your data is being processed unlawfully, you may lodge a complaint with the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, LT-10312 Vilnius. We kindly ask you to contact us first – we can usually resolve the matter more quickly.
9. Security, automated decision-making and changes
We protect data using technical and organisational measures: encrypted connections, access rights limited to those who need them for their work, two-factor authentication and confidentiality undertakings. In the event of a personal data breach, we would notify the State Data Protection Inspectorate within 72 hours, unless the breach is unlikely to result in a risk. If a breach were likely to result in a high risk to your rights, we would also inform you.
We do not make automated decisions that produce legal effects concerning you. We group newsletter subscribers by where and on what topic they subscribed, so that we send relevant emails; this has no legal or similarly significant effects on you. Google builds advertising audiences only if you consent to advertising cookies.
We update this policy when our activities or the systems we use change. The latest version is always published on this page.