4. Purposes and tasks of processing; categories of personal data4.1. Personal data is processed for the performance of a user agreement and/or other agreements with the user, for ensuring the operation of the Website and for providing the functionality made available through it.
4.2. The purposes of processing apply to the following categories of subjects: Website visitors and persons having an agreement with VLO Law Firm. In particular:
Data | Subject | Purpose / legal basis | Retention period | Method of destruction |
Name, telephone, e-mail | Website visitor | assessment of a legal enquiry and preparation of a commercial proposal | 3 years from the last interaction, unless another period is required by law | deletion from the Operator’s systems |
Cookies and usage statistics | Website visitor | improvement of service quality and Website updates | up to 1 year from the date of the last visit or the provider’s period | deletion from the Operator’s or provider’s systems |
4.3. The following actions are performed with respect to the data indicated above: collection, recording, systematisation, accumulation, storage, refinement, extraction, use, transfer, anonymisation, blocking, deletion and destruction, both by automated means and without automation.
4.4. Personal data is processed for the following tasks:
providing legal services to the user;
identifying the user when performing an agreement or other agreements;
ensuring Website functionality and presenting informational and advertising materials;
performing the Operator’s obligations;
conducting marketing, statistical and other research on the basis of anonymised data;
displaying informational materials using anonymised analytics data;
the Firm’s business purposes, including monitoring Website effectiveness, security and fraud prevention;
technical support for users;
sending automatic electronic messages.
4.5. Access to personal data is granted only to employees and engaged persons of VLO Law Firm who need such data to perform their duties. Such persons are required to maintain confidentiality.
4.6. The Operator may transfer data to third parties: cloud and hosting providers; CRM, analytics and service providers; payment systems; state authorities as required by law; local consultants and contractors, where necessary for legal support. The list and scope of data transferred are determined by a processing instruction, agreement or law. If a cross-border transfer requires notice, permission or other formalities, the Operator performs them in the established manner.
4.7. The Company takes necessary organisational and technical measures to protect data against unlawful or accidental access, destruction, modification, blocking, copying, distribution and other unlawful actions.
4.8. Personal data is processed lawfully and fairly, within specific, predetermined and lawful purposes. Storage is limited to the periods necessary for the purposes of processing, unless otherwise required by law.
4.9. The Operator must provide the subject with information about their data, take protection measures and stop processing at the subject’s request, unless otherwise required by law.
4.10. Localisation and cross-border transfer of data: when collecting data, the Operator takes into account applicable legal requirements for localisation and storage of data; cross-border transfer is carried out in cases and in the manner permitted by law, using organisational, contractual and technical protection measures. The user is notified that Telegram, WhatsApp and other messengers may process messages and identifiers on their own infrastructure.
4.11. The Operator takes measures to identify, investigate and mitigate the consequences of personal-data security incidents and, if required by law, notifies the competent authority and/or affected data subjects.
4.12. The Operator may keep records of operations performed with personal data, indicating the date, basis and person performing the operation, and store such information for the periods established by internal rules and law.