Privacy Policy

This website is operated by Sviridenko & Partners SIA, a law firm registered in Latvia. We are the controller of the Personal Data described in this policy, which means we decide why and how it is processed.

Sviridenko & Partners SIA
Registration No. 40203032119
Krišjāņa Valdemāra iela 33A-4A, Riga, Latvia
Email: mail@sviridenko.law
Telephone: +371 67 373 020

Where this policy says we, us or the firm, it means Sviridenko & Partners SIA.

This policy describes how we process Personal Data in connection with:

• our clients, former clients and prospective clients, their representatives, beneficial owners and contact persons, and other people connected with a matter we handle;
• our obligations under anti-money laundering and counter-terrorism and proliferation financing legislation (AML/CTPF), including customer due diligence (KYC), and under international and national sanctions legislation;
• enquiries and other communications you send us through this website, by email, by telephone or in person;
• newsletters, events and other marketing activities;
• our pages on social media;
• applications for positions at the firm;
• the use of this website, including cookies.

We process Personal Data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC, the GDPR) and the Personal Data Processing Law of the Republic of Latvia (Latvijas Republikas Fizisko personu datu apstrādes likums), together with the professional obligations that apply to us as a law firm.

Depending on how you deal with us, we may process the following categories of Personal Data:

• Contact information: name, address, telephone number, email address, and details of your organisation such as your employer, position and work contact details.
• Identity and due diligence information: date of birth, personal identification number, citizenship, details of identification documents (for example, passport data), other documents needed to verify identity or the origin of funds (for example, bank statements), information about beneficial owners, whether you are a politically exposed person (PEP), a family member or close associate of one, and the results of sanctions and adverse media screening.
• Matter information: details of your matter and your requests, documents in the case file and our communications with you about it. This also covers information about other people, such as your customers, staff or counterparties, that you give us or that we obtain in connection with the matter. Where the matter requires it, this may include special categories of Personal Data (for example, health data) or data relating to criminal convictions and offences.
• Billing and payment information: invoices, payment history, and bank details for you or your organisation.
• Communication information: the content of your enquiries, emails and other correspondence with us.
• Marketing preferences: the areas of law and industry sectors you are interested in, and how you would like to hear from us.
• Recruitment information: your CV, cover letter, education, work experience, references and any other information you choose to send us when applying for a position.
• Website usage information: information generated when you use the website, such as device and browser details and how you navigate the site. Anything beyond what is strictly necessary is collected only through cookies you have allowed (see section 6).

We limit the Personal Data we collect to what is necessary for the purpose for which it is collected.

Most of this information comes from you directly: through the website, by email, by telephone or in person. We may also receive or obtain it:

• from the person or organisation acting on your behalf or engaging us, such as your employer or the client we act for;
• from public registers (for example, the Register of Enterprises of the Republic of Latvia and registers of beneficial owners), official sanctions lists and other publicly available sources, including the media;
• from providers of identity verification, sanctions, PEP and adverse media screening services that we use to meet our AML/CTPF and sanctions obligations;
• from courts, public authorities, counterparties, other advisers and other third parties in the course of our work on a matter;
• from recruitment agencies and referees, where you apply for a position with us.

As a law firm we are required by law to identify our clients and, where applicable, their beneficial owners before we begin acting for them, so some of this checking happens before any engagement starts.

Every purpose for which we process Personal Data has a legal basis under the GDPR.

• To provide legal services. This covers taking you on as a client, carrying out conflict checks, preparing and concluding an engagement, and doing the work. The basis is the contract with you, or steps you ask us to take before entering into one (Article 6(1)(b) of GDPR). Where our client is an organisation and you are its representative, contact person or another person connected with the matter, the basis is our legitimate interest in acting for that client (Article 6(1)(f) of GDPR). Where special categories of Personal Data are involved, we process them only where (i) this is necessary for the establishment, exercise or defence of legal claims (Article 9(2)(f) of GDPR), (ii) you have given your explicit consent (Article 9(2)(a) of GDPR), or (iii) the data has been manifestly made public by the data subject (Article 9(2)(e) of GDPR).
• To meet our AML/CTPF and sanctions obligations. This includes identifying clients and their beneficial owners, carrying out customer due diligence and ongoing monitoring, screening against sanctions and PEP lists, and reporting to the competent authorities where the law requires it. The basis is legal obligation (Article 6(1)(c) of GDPR).
• To meet our other legal obligations, including tax and accounting requirements and responding to lawful requests from public authorities. The basis is legal obligation (Article 6(1)(c) of GDPR).
• To run our practice. This includes managing client files and keeping clients informed of important deadlines, invoicing, managing payments and recovering unpaid amounts, handling complaints and suggestions, maintaining and improving service quality, internal planning, accounting and reporting, and keeping backup copies of our documents to ensure the security and continuity of our work. The basis is our legitimate interests (Article 6(1)(f) of GDPR).
• To establish, exercise or defend legal claims. The basis is our legitimate interests (Article 6(1)(f) of GDPR).
• To answer your enquiries. The basis is steps you ask us to take before entering into a contract (Article 6(1)(b) of GDPR) or our legitimate interest in responding to communications sent to us (Article 6(1)(f) of GDPR).
• To run our social media pages. This covers communicating with people who interact with our pages on LinkedIn and using the page statistics the platform provides. The basis is our legitimate interests (Article 6(1)(f) of GDPR).
• To consider job applications. The basis is steps you ask us to take before entering into a contract (Article 6(1)(b) of GDPR). If you would like us to keep your application for future vacancies, the basis is your consent (Article 6(1)(a) of GDPR).
• To keep this website working and secure, through strictly necessary cookies. The basis is our legitimate interests (Article 6(1)(f) of GDPR).
• To understand how the website is used, through analytics cookies. The basis is your consent (Article 6(1)(a) of GDPR).

Where we rely on legitimate interests, you can object to the processing (see section 10). Where we rely on consent, you can withdraw it at any time; this does not affect the lawfulness of processing carried out before withdrawal.

Where the law requires us to collect information before acting for you and it is not provided, we may be unable to take on or continue the matter.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. Where we use screening tools, their results are reviewed by a member of our team.

Cookies that are strictly necessary for the website to work are set when you visit it. Any cookie that is not strictly necessary — including any used for analytics or marketing — is set only if you choose to allow it.

Using this website does not by itself mean you have consented to non-essential cookies. You can give or refuse that consent when you first visit the site, and you can change your choice at any time.

Which cookies we set, what each one does and how long it lasts are described in our Cookie Policy.

We share Personal Data only where necessary, limited to what the recipient needs, and always subject to our duty of professional confidentiality:

• Service providers acting on our behalf. These include providers of IT, cloud storage and backup, email and communication services, website hosting and maintenance, screening tools, accounting and translation services. They act as our processors: they may use Personal Data only on our instructions and under a data processing agreement that requires them to keep it confidential and secure (Article 28 of GDPR).
• Analytics providers. Google Analytics, where you have allowed analytics cookies. See our Cookie Policy.
• Social media providers. Where you interact with our social media pages, the platform operator also processes your data under its own privacy policy.
• Others involved in your matter, where the matter requires it or you ask us to. This may include courts, notaries, bailiffs, other law firms including lawyers in other jurisdictions, experts, counterparties and banks processing payments.
• Our professional advisers, such as auditors and insurers, who are bound by duties of confidentiality.
• Public authorities and other persons entitled by law. We share information with them on a justified request, in the manner and to the extent the law requires. This includes reports we are required to make to the Financial Intelligence Unit of Latvia and other competent authorities under AML/CTPF and sanctions legislation; the law may prohibit us from telling you that such a report has been made.
• Others where necessary to protect our legitimate interests, including to establish, exercise or defend legal claims.

We generally process Personal Data within the European Economic Area. Some of our service providers, including Google LLC (website analytics), may process it outside the EEA. Personal Data may also be transferred outside the EEA where a matter requires it, for example where we work with lawyers, courts or counterparties in other countries.

Where Personal Data is transferred outside the EEA, we make sure it remains protected in one of the following ways:

• an adequacy decision adopted by the European Commission;
• standard contractual clauses adopted by the European Commission;
• standard data protection clauses adopted by a supervisory authority and approved by the European Commission;
• other appropriate safeguards or applicable derogations permitted under GDPR.

We keep Personal Data in accordance with the defined purposes and legal bases for processing, for as long as at least one of the following criteria applies:

• we have a legal obligation to keep the data for a specified period under applicable law;
• this is necessary to pursue our legitimate interests;
• this is necessary to perform our contractual obligations;
• the data subject’s consent to the relevant processing remains in force.

After the retention period mentioned in this section, we will delete the respective Personal Data, unless we are obliged to retain it for a longer period in order to comply with obligations deriving from applicable laws, or these data are necessary to resolve legal disputes.

Copies of documents may remain in our backup systems for a limited time after deletion from our active systems. During that time they are put beyond use and protected by appropriate safeguards, and they are deleted at the end of the backup cycle.

We have a legal obligation to ensure that your Personal Data is kept accurate and up to date. We kindly ask you to assist us in meeting it by informing us of any changes that have to be made to any of your Personal Data that we are processing.

You have the following rights with respect to our processing of your Personal Data:

1. Right of access: to be told whether we process your Personal Data and, if we do, to receive a copy of it together with information about the processing, including the categories of Personal Data concerned and the purposes of the processing.
2. Right to rectification: to have inaccurate Personal Data corrected and incomplete Personal Data completed.
3. Right to erasure: to have your Personal Data erased, subject to the exceptions provided by law, where, for example, it is no longer necessary for the purposes for which it was collected, it has been processed unlawfully, or it must be erased to comply with a legal obligation.
4. Right to restriction: to have our use of your Personal Data limited, for example while its accuracy is being checked.
5. Right to object: to object to processing based on our legitimate interests and, at any time, to processing for direct marketing purposes.
6. Right to data portability: where we process your Personal Data on the basis of your consent or a contract and the processing is carried out by automated means, to receive it in a structured, commonly used and machine-readable format and to have it transmitted to another controller, where technically feasible.
7. Right to withdraw consent: where processing is based on your consent, to withdraw it at any time. This does not affect the lawfulness of processing carried out before withdrawal.
8. Opting out of marketing: every marketing message we send gives you the opportunity to opt out of further messages. You can also opt out at any time by contacting us.

Your rights may be limited where the law requires it. In particular, our professional confidentiality obligations and our obligations under AML/CTPF and sanctions legislation may prevent us from disclosing or erasing certain Personal Data, or may otherwise restrict the exercise of your rights. If we cannot meet a request in full, we will tell you why, unless the law prevents us from doing so.

Making a request

You can submit a request in writing in either of the following ways: in person at our office at the address in section 12, presenting an identity document; or by email to mail@sviridenko.law, signed with a secure electronic signature.

We may need to confirm your identity before we act, so that we do not disclose your information to someone else.

We answer within one month of receiving your request. Where a request is complex or we receive many requests, we may extend this by up to two further months, and we will tell you if we do. Requests are free of charge unless they are manifestly unfounded or excessive.

Complaints

If you have a complaint about how we process your Personal Data, or would like to know more about our processing, please contact us using the details in section 12. You also have the right to lodge a complaint with a supervisory authority if you consider that your Personal Data is being processed unlawfully or your rights have been infringed. In Latvia, this is Datu valsts inspekcija (www.dvi.gov.lv), Elijas iela 17, Rīga, LV-1050, email pasts@dvi.gov.lv.

We may update this Privacy Policy from time to time to reflect changes in our processing or in the law. The “Last updated” date at the top of this page indicates the most recent revision. The current version published on this website is the version in force. Where changes are material, we will draw attention to them on this website or, where appropriate, inform you directly.

For any questions or requests regarding this Privacy Policy or the processing of your Personal Data, please contact us at:

Sviridenko & Partners SIA
Krišjāņa Valdemāra iela 33A-4A, Riga, Latvia
Email: mail@sviridenko.law
Telephone: +371 67 373 020