Privacy policy
Last updated — 27 August 2026
1. Who processes your data
The data controller is the professional partnership of attorneys “Morkūnas Legal Bureau” (legal entity code 301499541), Konstitucijos pr. 9-87, LT-09308 Vilnius, Republic of Lithuania.
For any question about data protection: info@morkunas.eu, +370 698 44575.
The firm has not appointed a data protection officer — it is under no such obligation under Article 37 of the General Data Protection Regulation (GDPR).
2. What data we process
When you contact us through the website form or by email: your name, your email address and the description of your situation that you provide. We ask for nothing else and collect nothing else.
When a legal engagement begins: the data needed to provide legal assistance — identity and contact details, information about the project or dispute, the people involved and the documents. The scope of that data is determined by the matter itself.
Technical data: when you visit the site, the server records ordinary connection logs (IP address, time, browser type). On your own device we store only your chosen language, your chosen theme, and a flag recording that you have seen the notice about those settings. We use no tracking cookies.
There is currently no visitor analytics on this website. If analytics is introduced, this policy will be updated to name the tool and the data it records — before that tool starts operating.
3. Why we process it and on what basis
| Purpose | Legal basis |
|---|---|
| To answer your enquiry | Steps taken at your request prior to entering into a contract — GDPR Art. 6(1)(b) |
| To check for a possible conflict of interest | Legitimate interest and professional duties — GDPR Art. 6(1)(f) |
| To provide legal services | The legal services contract — GDPR Art. 6(1)(b) |
| To identify the client for anti-money-laundering purposes | Legal obligation — GDPR Art. 6(1)(c); the Law of the Republic of Lithuania on the Prevention of Money Laundering and Terrorist Financing |
| To issue invoices and keep accounts | Legal obligation — GDPR Art. 6(1)(c) |
| To keep the website running and secure | Legitimate interest — GDPR Art. 6(1)(f) |
We carry out no direct marketing. We send no newsletters. We do not sell data and do not pass it on for advertising purposes.
4. Legal professional privilege
The information you entrust to us is protected by more than data protection law. It is protected by legal professional privilege under the Law on the Bar of the Republic of Lithuania — a separate and stricter regime, with no time limit.
The same principle applies where you approach the firm but no legal engagement follows. Confidentiality applies from the first message.
5. Who the data may be disclosed to
Data reaches only those parties without which the firm cannot operate:
- the website hosting provider — hosting the site and running the contact form (Vercel Inc.; the site and the form function run on servers in the European Union);
- HOSTEX — the firm’s email and server services;
- Haya (haya.lt) — invoicing and bookkeeping.
A data processing agreement under Article 28 GDPR is in place with each of them.
In the course of providing legal services, data is disclosed to courts, arbitral institutions, state authorities, the opposing party or its representatives to the extent required by the conduct of the matter or by law. Where a project calls for other experts, they are brought in only with your prior consent.
6. Where the data is processed
Data is processed and stored within the European Economic Area.
If a particular project required data to be transferred outside the EEA (for example, by instructing a lawyer in a non-EU state), that is done only on a legal basis under Chapter V GDPR and only to the extent your matter requires.
7. How long we keep it
| Data | Retention period |
|---|---|
| An enquiry not followed by an engagement | 6 months, then deleted |
| The minimum record needed for conflict checks (name, opposing party) | 10 years |
| Case and project material | 10 years from the end of the legal relationship |
| Client identification data | 8 years from the end of the relationship — the period set by law |
| Accounting documents | 10 years — the period set by law |
| Server connection logs | 30 days |
Once the period ends the data is deleted or destroyed, except where law requires it to be kept longer, or where it is needed to bring or defend a legal claim.
8. Your rights
You have the right to: access your data; have inaccurate data corrected; have data erased; have its processing restricted; object to processing based on legitimate interest; receive your data in a portable format; withdraw consent where processing is based on it.
Write to info@morkunas.eu. We reply within one month.
Limits. Legal professional privilege and statutory retention duties may restrict the exercise of some of these rights. In practice that means we cannot delete case material we are required to keep, and we cannot disclose information covered by another client’s privilege. In every case we explain the reason in writing.
9. Cookies and technical data
We use no tracking, marketing or profiling cookies.
Only three things are stored on your device: your chosen language, your chosen theme (light or dark) and a flag recording that you have seen the notice about those settings. They are held in your browser, are never sent to us, and are removed whenever you clear your browser data.
10. Complaints
If you believe we are handling your data improperly, we would ask you to come to us first — most questions are resolved faster than a procedure.
You also have the right to lodge a complaint with the State Data Protection Inspectorate of Lithuania: vdai.lrv.lt.
11. Changes to this policy
If this policy changes, we publish the new version on the website and state the date it was updated. Where the changes are material, we notify existing clients personally.