Privacy Policy

Effective from 16.04.2024

1. SCOPE OF THIS POLICY

1.1 The following privacy policy (“Privacy Policy”) applies to all cases where law firms WIDEN (“WIDEN”, “we”, “us” or “our”) process personal data of natural persons (“Data Subject” or “you”) as controllers when providing legal services, operating and managing the website widen.legal (“Website”) or interacting with Data Subjects in any other way.

1.2 We are committed to protecting and respecting your privacy. Please read this Privacy Policy carefully to understand our rules and practices regarding processing personal data.

1.3 This Privacy Policy applies from the date as set above. We have the right to unilaterally make amendments to the Privacy Policy. In such case the amended Privacy Policy shall be made available on the Website.

2. DATA CONTROLLERS

2.1 WIDEN consists of three Baltic law firms. Depending on which law firm is providing you legal services or is fulfilling any other purpose stated in this Privacy Policy, the data controller is the corresponding law firm entity, acting as a separate individual data controller, if not explicitly indicated otherwise, meaning either:

Advokaadibüroo WIDEN OÜ, registry code 10992652, address Harju maakond, Tallinn, Kesklinna linnaosa, Rävala pst 4, 10143, who can be contacted any time by writing an e-mail at estonia@widen.legal;
ZAB WIDEN SIA, registry code 40203322202, address Krisjana Valdemara street 33 – 1, Riga, LV-1010 who can be contacted any time by writing an e-mail at latvia@widen.legal;
Advokatų profesinė bendrija WIDEN Legal, registry code 302585363, address Konstitucijos av. 7, Vilnius, LT-09308, who can be contacted any time by writing an e-mail at lithuania@widen.legal.

2.2 For avoidance of doubt – if data is processed under or in relation to the legal assistance agreement, then in such cases the data controller is always the law firm that is or will be providing you legal services under said contract.

3. WHY WE PROCESS PERSONAL DATA, WHAT DATA, AND ON WHAT TERMS?

Why do we use your personal data?	Whose data we process?	What type of data do we use?	What allows us to use your personal data (legal basis)?	How long do we keep your personal information	Other important issues
Providing legal services
Why do we use your personal data?	Whose data we process?	What type of data do we use?	What allows us to use your personal data (legal basis)?	How long do we keep your personal information	Other important issues
To provide legal services (“Services”) to persons that are a client of WIDEN (“Client”)	Client – natural person	First and last name, main field of activity, personal identification number (in its absence, date of birth), address, postal address (if different from the above), telephone, e-mail, signature, Bank account number, date of the Service agreement’ signature, payment information, communication, any other personal data, the processing of which is necessary to fulfil the task given by the Client or to protect the Client’s legal interests (e.g. personal data that can be seen from evidence or documents, extracts from the register)	Processing of the Client’s data is necessary for the fulfilment of a contract concluded between us and the Client for provision of the Services	During the validity period of the Service agreement	It includes collecting evidence and analysing documents Data might be received directly or from public sources, such as registers or third persons
	Client – natural person	In certain cases health data, trade union membership and other special categories data where necessary for the proper performance of Services	Service contract and your explicit consent
	Representatives of the Client	Client representative’s first and last name, telephone, e-mail, job and position, communication, signature, other information, collected during performance of the Service agreement	Our legitimate interest to duly perform the Service Agreement
	Any other persons	Name, surname, personal code, date of birth, address, any other personal data, the processing of which is necessary to fulfil the task given by the Client or to protect the Client’s legal interests (e.g. personal data that can be seen from evidence or documents, extracts from the register)	§ 41(4¹)) of the Bar Association Act of Estonia in case of Advokaadibüroo WIDEN OÜ; Section 48 of Advocacy Law of the Republic of Latvia in case of ZAB WIDEN SIA; totality of professional rights and obligations (Article 6 (1) (e) of the GDPR) in case of Advokatų profesinė bendrija WIDEN Legal
	Any other persons	In certain cases health data, trade union membership and other special categories data where necessary for the proper performance of Services	Processing is necessary for the establishment, exercise or defence of legal claims and legal basis indicated right above
Communication with the potential client
Why do we use your personal data?	Whose data we process?	What type of data do we use?	What allows us to use your personal data (legal basis)?	How long do we keep your personal information	Other important issues
To communicate with the potential Client	Potential Client – natural person	Any data the person makes voluntarily available, usually being first and last name, e-mail address, information regarding the inquiry	taking steps at the potential Client’s request prior to entering into a contract	1 year after the last communication
To communicate with the potential Client	Potential Client’s representative	Client representative’s first and last name, telephone, e-mail, job and position, information regarding the inquiry	legitimate interest of the Client (in general cases protection of client interests)	1 year after the last communication
Newsletters and offers
Why do we use your personal data?	Whose data we process?	What type of data do we use?	What allows us to use your personal data (legal basis)?	How long do we keep your personal information	Other important issues
To send newsletters, offers and general information about the Services to you	Client/ representative of the Client	First and last name of the Client and/or the Client’s representative, if applicable, main field of activity, address, postal address (if different from the above), telephone, e-mail, job and position	If you are our Client, we use your e-mail on the basis of our legitimate interest to keep you in the loop of any information or advancements regarding the Services	During the validity period of the Service agreement and 1 year following its expiry	You always have the possibility to opt-out from receiving such data (e.g., unsubscribe button below each e-mail). If you opt-out, we shall no longer send such information.
	Client or other person who gives consent		Your consent	3 years
Meetings and events
Why do we use your personal data?	Whose data we process?	What type of data do we use?	What allows us to use your personal data (legal basis)?	How long do we keep your personal information	Other important issues
To organize meetings and events	Persons invited or participating in events	Names, surnames, e-mails addresses, telephone numbers, places of work and job titles	Our legitimate interest in inviting you to attend meetings and events	1 year after the event
Accounting duties
Why do we use your personal data?	Whose data we process?	What type of data do we use?	What allows us to use your personal data (legal basis)?	How long do we keep your personal information	Other important issues
To process settlement and other payments and complying with accounting rules	Clients	Client’s name, surname, payment details	Necessity to comply with the legal obligations to which we are subject	10 years
Agreements with suppliers and partners
Why do we use your personal data?	Whose data we process?	What type of data do we use?	What allows us to use your personal data (legal basis)?	How long do we keep your personal information	Other important issues
To conclude and execute agreements other than on provision of Services	Contractor -natural person	First and last name, personal identification number (in its absence, date of birth), address, postal address (if different from the above), telephone, e-mail, signature, bank account number, date of the agreement’ signature, payment information, communication, other information, collected during performance of the agreement	Processing of the data is necessary for the fulfilment of a contract concluded between us and you	During validity period of the agreement
	Contractor’s – legal person’s -representative	Client representative’s first and last name, telephone, e-mail, job and position, communication, signature, other information, collected during performance of the agreement	Our legitimate interest to duly perform the agreement	During validity period of the agreement
Money laundering and terrorist financing prevention
Why do we use your personal data?	Whose data we process?	What type of data do we use?	What allows us to use your personal data (legal basis)?	How long do we keep your personal information	Other important issues
Our legal obligation to assess the risk of money laundering and terrorist financing	Client natural person, managers, shareholders, ultimate beneficial owners, other persona participating in ownership structure	We process your personal data (taking into account, for example, your place of residence, field of activity, whether you are a person with a national background; in the case of a legal entity represented by you – its location, field of activity, transparency of management bodies and ownership structure) and the nature of the transaction Usually, we process such personal data as name, surname, citizenship, personal code, passport data, number of shares, position in the company	Legal obligations to which we are subject	8 years	We shall apply due diligence measures either in a simplified or enhanced manner.
Recruitment
Why do we use your personal data?	Whose data we process?	What type of data do we use?	What allows us to use your personal data (legal basis)?	How long do we keep your personal information	Other important issues
To select candidates	Candidates	Name, surname, preferred position, work experience (workplace, position, person who can recommend), education, other data provided in the CV, questionnaire or cover letter and / or other information provided by you, recommendation, given by previous employee	Your consent	2 days following the signing of the service or employment contract with the selected candidate
To select candidates	Persons, giving recommendations	Name, surname, job title, company, telephone, e-mail, recommendation	Our legitimate interest to select the most appropriate candidate	2 days following the signing of the service or employment contract with the selected candidate or 5 years in case the candidate gives consent for his data storage in our candidate data base
Management of candidate data base	Candidates	Name, surname, preferred position, work experience (workplace, position, person who can recommend), education, other data provided in the CV, questionnaire or cover letter and / or other information provided by you, recommendation, given by previous employee	Your consent	5 years
Management of candidate data base	Persons, giving recommendations	Name, surname, job title, company, telephone, e-mail, recommendation	Our legitimate interest to select the most appropriate candidate	5 years
Protection of confidential information and continuity of activities
Why do we use your personal data?	Whose data we process?	What type of data do we use?	What allows us to use your personal data (legal basis)?	How long do we keep your personal information	Other important issues
To protect our confidential information and the continuity of our activities	Our employees, lawyers and persons who send or receive letters from employees or lawyers	Name, surname, e-mail, address, date, content of information in electronic work media	It is our legitimate interest to ensure the confidentiality and uninterrupted operations	4 years for protection of confidential information, and 3 months for continuation of the activities	Sometimes we may review the correspondence of our employees, lawyers and legal assistants with Clients or contractors
Defending of our interests
Why do we use your personal data?	Whose data we process?	What type of data do we use?	What allows us to use your personal data (legal basis)?	How long do we keep your personal information	Other important issues
To enforce and defend our legal rights	Any persons whose data we collect for the purposes indicated in this Privacy Policy	Any of the categories of personal data listed above in this Privacy Policy, determined case-by-case according to the legal right we are entitled to execute	It is our legitimate interest to enforce and defend our legal rights if we see it as necessary.	10 years

3.1. If the entry of any personal data has been made mandatory before or during provision of the Services, then the submission of the respective personal data is required for entering into the agreement between us and you (or the Client represented by you) or for performing the respective agreement. As such, in these cases the submission of personal data is mandatory and if it is not submitted, it is impossible either to enter into said agreement or perform the agreement. If the entry of personal data has not been made mandatory and the submission of personal data is not required from you in any other way, the submission of personal data is voluntary and non-submission does not have any direct adverse consequences for you.

4. DISCLOSING PERSONAL DATA

4.1. We shall not transfer your personal data to third parties except for the following cases:

to persons providing services to us, where it is necessary to fulfil the Client’s order (e.g. e-mail service provider, server service provider, translation agency, experts, bankruptcy trustees, accountants, etc.);
to persons to whom the transmission of personal data is intrinsically necessary for the provision of the Service (e.g. to courts, regulatory bodies etc.);
to any other Widen law firm in case they are not data controllers (as specified in section 2) and transmission of personal data is necessary for the provision of the Service.

4.2 All authorized third-party processors to whom we transmit personal data shall ensure the protection of personal data as required by the legislation regulating the protection of personal data.

4.3 Furthermore, we shall send personal data to a relevant institution requiring personal data, if we are under a duty to disclose or share such personal data in order to comply with any legal or regulatory obligation or request deriving from the law.

5. COOKIES ON THE WEBSITE

5.1 Cookies are files with small amount of data which are stored on your relevant device when visiting the Website.

5.2 Cookies remember your actions and preferences and thereby enable us (as the operator and manager of the Website) to provide the best possible experience when you visit the Website. Without the cookies, the full functionality of the Website may be unavailable. As a general rule, the cookies used by us do not collect any personal data.

5.3 In general, we use cookies to make your experience on the Website as smooth and convenient as possible and to maintain the functionality of the Website. To be more specific, we use:

Strictly Necessary Cookies. These cookies are essential in order to enable the use the Website. Without these cookies the Website would not be usable. These cookies are related to the basic operation of the Website, for example, to protect us from unauthorized commands from malicious websites. It is not possible to use the Website without these cookies. These cookies are stored for 1 year;
Functionality Cookies. These are the cookies which enable the Website to function as it is intended to. For example, we use session cookies which enable the Website to remember the your choices and recognize you between sessions. The session cookies are stored for 2 weeks;
Analytical Cookies. In order to improve experience at the Website, evaluate the performance of the content and fix technical issues or errors, we use analytical cookies, including from third parties, such as Google Analytics, Facebook Pixel. These cookies collect information such as the number of visits or returning visits to the Website and are used to generate aggregate data. Such cookies may track your activity on the internet via online identifiers. Depending on the type of the cookie it can be stored for days, months or years.

5.4 Regarding cookies you have the following rights:

refuse the use of cookies by not giving consent or by withdrawing the consent;
refuse the use of cookies by selecting the appropriate settings on the browser;
delete the cookies already stored on your device.

5.5 However, the Strictly Necessary Cookies are used in any case on the basis of our legitimate interest and without your consent because the usage of the Website is not possible without them. Usage of the Website without any other cookies is possible but, in such case, the full functionality of the Website may be limited.

6. YOUR RIGHTS AS A DATA SUBJECT

6.1 You have the right to contact us by writing an e-mail at international@widen.legal to exercise the Data Subject’s rights concerning processing of personal data. Such rights include the:

right to request access of personal data;
right to request rectification of personal data;
right to request erasure of personal data;
right to request restriction of processing of personal data;
right to object to processing of personal data, when data is processed on the basis of legitimate interest or processing is necessary in the exercise of official authority vested in the controller (Article 6 (1) (e) of the GDPR);
right to request portability of personal data;
right that decisions are not taken concerning you which are based on automated decision-making, if applicable;
right to withdraw a consent, if personal data is processed based on consent;
right to lodge a complaint with the relevant supervisory authority (Estonian Data Protection Inspectorate – https://www.aki.ee/en; Data State Inspectorate of Republic of Latvia – https://www.dvi.gov.lv/en; State Data Protection Inspectorate of Lithuania – https://vdai.lrv.lt/).