1. Overview
This Privacy Notice explains how your personal data is processed when you visit our website https://aregrazu.com (the "Website") or use our services (the "Services").
UAB Nomad Law, company code 305295301, registered at J. Basanaviciaus str. 26, LT-03224 Vilnius, Lithuania (the “Firm” or “we”) processes your personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation) and other applicable laws.
By using our Website or contacting us, you confirm that you have read and accepted this Privacy Notice.
2. Purposes and retention period of your personal data processing
2.1 Support services
We process your personal data to respond to your inquiries or consultation requests. Your data may be stored for up to 2 years from our last contact, unless a contractual relationship is established.
2.2 Provision of the requested Services
If you request services and we proceed, your data is processed to provide those services and stored for up to 10 years following the end of the contractual relationship, unless longer retention is required by law. If no contract is formed, we retain your data for up to 2 years after last contact.
2.3 Direct marketing
We may use your data to inform you of our services, events, or relevant updates. If you consent, we may retain your data for up to 2 years, or until you withdraw consent.
2.4 Recruitment
We process candidates' data to assess their suitability for open roles. We retain this data for 6 months unless the candidate consents to a longer period. If hired, the data is retained as part of internal records in accordance with applicable law.
2.5 Administering and improving the Website
We may process limited technical data to ensure the Website functions properly and securely. See our Cookie Policy for more details.
If you do not provide the Firm with the personal data necessary in order to achieve the above indicated purposes, the Firm may not be able to keep a contact with you, continue contractual relationship, provide Services or perform other related functions.
3. Categories of Personal Data We May Process
The personal data we collect depends on your interaction with our Website, the services you seek, or your participation in our recruitment process. We may process the following categories of data:
- Identification Data: Name, surname, photograph, nationality, identity document details (including copies), country of tax residence, and identification-related audio/video recordings.
- Contact Data: Phone number, residential address, email address.
- Professional and Financial Data: Occupation, sources of income, countries linked to professional activity, origin of funds, income level, bank account details, and transaction history.
- Service-Related Information: Services of interest, relevant personal or business needs, and related background.
- Relationship Data: Information about connections to politically exposed persons (PEPs) or legal entities.
- Communication Records: Written or electronic correspondence, chat logs, timestamps, and service execution history.
- Recruitment Data: CVs, education and qualification details, professional social media profiles (e.g., LinkedIn), and interview assessments.
- Technical and Usage Data: Browser and device details (IP address, operating system, screen resolution, time zone), location data (country, city), internet service provider, and behavioral usage patterns on the Website (pages visited, time spent, links clicked, etc.).
This information is collected only to the extent necessary to provide services, respond to inquiries, or assess recruitment applications.
4. How we collect your personal data
The Firm collects your personal data directly from you or from the third parties when:
- you contact us;
- you use our Website.
5. Legal basis for personal data processing
We process your personal data based on at least one of the following grounds:
- you have given consent;
- processing is necessary for contract performance or steps prior to it;
- processing is necessary for compliance with legal obligations;
- processing is necessary for our or third party’s legitimate interests.
6. Personal data recipients
We may disclose your personal data either on our own initiative or in response to a lawful request to the below indicated personal data recipients which are also obliged to comply with the requirements of GDPR, laws and other mandatory legal requirements:
- banks, financial institutions;
- professional advisors;
- third party service providers (e.g. IT, translation, fraud detection);
- courts, attorneys, authorities;
- other service providers involved in the Firm’s operations.
Personal data may also be provided when:
- required to comply with a legal obligation;
- necessary for inquiries of public interest;
- based on legitimate interests of requester.
If transferred outside the EEA, we ensure GDPR compliance through adequacy decisions, safeguards, binding rules, etc.
7. Data security
We apply technical and organizational measures to safeguard personal data. While we take all reasonable steps, please be cautious when transmitting sensitive data over email or the internet.
8. Cookies
Cookies are small files stored on your device. Please read our Cookie Notice for details.
9. Your data protection rights
You have certain legal rights in relation to the processing of your personal data:
- Right to access data (GDPR Art. 15);
- Right to rectify inaccuracies (Art. 16);
- Right to erasure (Art. 17);
- Right to restrict processing (Art. 18);
- Right to data portability (Art. 20);
- Right to object (Art. 21);
- Right not to be subject to automated decision-making (Art. 22).
To exercise your rights, identity verification may be required. Requests may be refused if excessive or manifestly unfounded.
We’ll respond to your data rights request within 1 month, with a possible 2-month extension if needed. If you submit your request electronically, we’ll reply the same way. You can also file a complaint with the Lithuanian State Data Protection Inspectorate if you believe your data is being misused.
10. Final provisions
If you have questions or wish to exercise your rights, contact us at advisory@aregrazu.com.
We may revise this Privacy Notice from time to time. Continued use of the Website implies acceptance of the updated terms.