Privacy Policy

In this notice (the Notice) we explain the general principles on how Urniežius and Partners Law Firm ("ULF") (the Firm, we, our or us) collects and uses information obtained when you visit our website www.ulf.lt (the Website), use any of our services (the Services) or otherwise communicate with us — when you contact us on social media, attend our events, apply for a job and in other cases.

When you communicate with us through the Website or use our Services, we may expressly ask you (the Client or you) to confirm that you agree to this Notice.

In this Notice, "your Personal Data" means any information that can be used to directly or indirectly identify you, contact you or determine your location as an individual (the Personal Data).

We process Personal Data in accordance with this Notice and the applicable laws, including the General Data Protection Regulation (2016/679) (the GDPR) and the Lithuanian Law on Legal Protection of Personal Data (the Data Protection Laws).

If you disclose to us any Personal Data relating to a third party (e.g. your employee, board member, partner, contract counterparty), you must ensure that they are familiar with this Notice.

1. Scope of the Notice

This Notice describes how we process Personal Data relating to:

• all matters concerning our existing, former and prospective clients;
• newsletters, events and other marketing initiatives;
• cookies used on our Website;
• all our legal obligations under the GDPR, Data Protection Laws and other applicable laws (including obligations relating to AML/CFT, know-your-customer (KYC) or international and national sanctions screening procedures);
• security on the Firm's premises.

2. Data controller

The controller of your Personal Data is:

Urniežius and Partners Law Firm ("ULF"), a Lithuanian law firm with its registered office at Klaipėdos 2-17, LT-01118 Vilnius, Lithuania. Email: info@ulf.lt, phone: +370 686 56 860.

For matters relating to personal data processing, please contact privacy@ulf.lt.

3. Legal basis for processing your personal data

We process your Personal Data:

• based on your consent;
• to perform the legal services agreement concluded with you;
• to comply with our legal obligations; and/or
• based on our legitimate interest in ensuring the quality of our legal services, protecting our financial interests, sharing information about our services and events, maintaining client and partner relationships, providing quality client service, understanding how visitors use our Website and improving it, and recruiting the best employees.

We process your Personal Data only for the purposes for which it was collected. Where processing is based on your consent, you may withdraw it at any time. However, this may limit the provision of legal services if the data is required by law.

Only employees who must process Personal Data in performing their professional duties will have access to it. Your Personal Data will not be stored or processed longer than is necessary for the purposes set out above.

We have implemented appropriate technical and organisational measures to ensure secure processing — confidentiality and integrity.

4. Categories of personal data processed

4.1. Data related to the provision of legal services

We collect information provided to us by you or on your behalf, or information we obtain ourselves in providing professional legal services. Categories include:

Information about the Client, their representative and the transaction — name, surname, date of birth, identity document details, contact details, address, information about entities related to the Client (company name, legal entity code, powers of attorney), transaction-related information and other case-related information, including special categories of Personal Data.

Purpose: conflict of interest checks, providing legal services and fulfilling legal obligations to perform client identification (KYC) and sanctions screening.
Legal basis: (i) the legal services agreement; (ii) legal obligations under anti-money laundering and sanctions enforcement laws; (iii) legitimate interests (quality services and feedback).

Information about the ultimate beneficial owner and politically exposed persons (PEP). Purpose: AML/CFT and sanctions screening procedures. Legal basis: (i) legal obligations; (ii) legitimate interests in protecting our business.

Information about the transaction and for invoicing. Purpose: invoicing for legal services, fulfilling accounting and tax obligations. Legal basis: (i) the legal services agreement; (ii) legal obligations (accounting and tax); (iii) legitimate interests in receiving timely payment.

4.2. Marketing data

We may send you news about the Firm, services, legal developments and upcoming events. We may use your name, surname, email and other information for communication.

Basic data: name, surname, email, address, marketing preferences.
Purpose: sending event invitations, newsletters, client satisfaction surveys, greetings, legal news relevant to your field.
Legal basis: for existing clients — legitimate interest in direct marketing; for prospective clients — your consent.

Event registration data: basic data, company name, attendance confirmation. Legal basis: legitimate interest (free events) or contract performance (paid events).

Correspondence and event imagery (photos, video) — processed on the basis of legitimate interest.

4.3. Security data

Some of our premises may be monitored by CCTV. Purpose — ensuring safety of persons and property, crime prevention. Legal basis — legitimate interest.

4.4. Cookie data

We use cookies to obtain information about your use of our Website. More information — in the Cookie Policy.

5. Your rights as a data subject

We have a legal obligation to ensure that your Personal Data is accurate and up to date. Please inform us of any changes to your Personal Data we process.

You may exercise the following rights at any time:

• Right of access — to obtain information on whether we process your Personal Data, categories and purposes.
• Right to rectification — of inaccurate or incomplete Personal Data.
• Right to object — to processing for certain purposes, including marketing or processing based on legitimate interest.
• Right to erasure — subject to legal exceptions.
• Right to data portability — to receive data in a structured, commonly used and machine-readable format.
• Right to withdraw consent — at any time.
• Right to object to marketing — to opt out of our communications.

When we provide legal services, our legal obligations and the rules of the Lithuanian Bar may prohibit the disclosure or deletion of data we hold and process.

If you believe your Personal Data is being processed improperly or that your rights as a data subject have been infringed, you may lodge a complaint with the Lithuanian State Data Protection Inspectorate (vdai.lrv.lt).

6. Recipients of your personal data

When providing legal services, we may transfer Personal Data to third parties — during legal proceedings and litigation, as well as in providing legal services. We may transfer your data to partners and institutions where the law requires or where specific services so require.

In addition to legal services, we use third-party service providers (IT, accounting, security, translations) acting as data processors. They receive Personal Data only to the extent necessary to provide services. We have data processing agreements in place with such processors.

We may need to transfer your Personal Data to other recipients — local or state authorities, courts, other data controllers (e.g. other law firms), depending on the scope of the Services.

7. Sources of personal data

We obtain most Personal Data directly from you. We may also collect your Personal Data from publicly available sources and registers, other Clients, social media, where necessary for legal services, marketing or in the event of a dispute. We may engage a third party for remote identification and verification services for anti-money laundering purposes.

8. Data storage and retention periods

We will retain your Personal Data no longer than necessary to achieve the purposes for which it is collected.

Retention period criteria: the type of Personal Data; whether a dispute has arisen; obligations under the law to retain data.

• Information about the Client and the transaction — no less than 10 years from the end of the legal relationship.
• Information about UBO and PEP persons — no longer than 8 years from the end of the legal relationship.
• Invoicing information — no longer than 10 years from the transaction.
• Event registration data — no longer than 10 years.
• Correspondence data — no longer than 10 years from first correspondence.
• Event data — no longer than 10 years.
• Security data — no longer than 1 month.
• Cookie data — see the Cookie Policy.

Upon expiry of the retention period, we will delete Personal Data, except where required to retain it longer under applicable law or for resolving legal disputes.

9. Location of processing your data

We primarily store and process Personal Data in the European Union. Occasionally we may need to transfer and store your Personal Data outside the EU if non-EU lawyer consultations are required when performing a Client's instruction.

We take all necessary precautions to ensure Personal Data is processed securely and in compliance with data protection laws — for example, based on a European Commission adequacy decision or standard data protection clauses.

If you have any questions or complaints about the processing of your Personal Data, please contact us at privacy@ulf.lt.

10. Changes to the Notice

We may amend this Notice if our data processing practices and data protection best practices change. We will publish the latest version on our Website and, where material, will notify you of any changes.

Last updated: 1 June 2026.