This Privacy Policy (the "Policy") describes how the law firm Lex Law Office protects the privacy and personal data of its clients and website visitors.

If you have questions regarding this Policy or if you have any requests related to the processing of your personal data, you can contact us by e-mail at info@lexlaw.ee.

This Policy can be updated and changed. Lex Law Office will inform website visitors about updates by placing a new version of the privacy policy on the website, along with the dates when modifications were introduced.

We process your personal data on the following bases:

• on the basis of your consent, which is expressed by your active actions, i.e. addressing us and provision of personal data, or by any other active actions;
• for pursuing our legitimate interests (e.g. to operate and administer the website, to inform our clients about services offered, etc.);
• in order to comply with the obligations imposed on us by legislation.

I. PROCESSING OF CLIENTS' PERSONAL DATA

Lex Law Office seeks to ensure that personal data is processed accurately, fairly and lawfully and only for the purposes for which it was collected, in accordance with the principles and requirements of personal data processing established in legal acts. Based on these principles, we can process the following client data:

• Personal data (first name, surname, represented company, job title);
• Contact details (e-mail address, residential address, telephone numbers);
• Other data you provide in the course of conclusion and performance of the legal services agreement with us;
• Personal data that is required to be processed by the law firm in order to comply with applicable legal obligations;
• Other data we collect from legitimate sources in provision of legal services.

Regardless of the way in which we collect data, this data will only be processed to the extent necessary to ensure the proper provision of legal services, the related purposes, as well as the fulfillment of legal obligations binding on us.

II. PERSONAL DATA PROCESSING FOR DIRECT MARKETING PURPOSES

Lex Law Office processes your personal data for direct marketing purposes in the following cases:

• when it obtains your explicit consent to such processing (the basis for data processing is your consent);
• when you are a Lex Law Office client without expressly objecting to processing of your data for direct marketing purposes, for marketing of similar services (the basis for data processing is the legitimate interest of Lex Law Office to inform clients about the services offered).

For the purposes of direct marketing, we process the following personal data: your name, email address, phone number.

Your personal data for direct marketing purposes can be processed in the following ways:

• you can receive a newsletter by e-mail with our offers and news in the field of law;
• you can receive invitations to events and similar information by e-mail;
• in order to invite you to an event relevant to you, we may contact you by phone.

We inform you that you can opt out of our newsletters at any time. You can do that by contacting us by e-mail info@lexlaw.ee.

We collect statistical information about sent newsletters: we monitor whether you read the newsletter, when and how many times you have read it or have opened it, if you have forwarded it to others, what operating system and e-mail server (its location) you use.

You can also at any time refuse to receive information about events or any other information we send by sending us an email at info@lexlaw.ee.

III. PERSONAL DATA PROCESSING WHEN YOU PROVIDE OUR QUESTIONS, OTHER INFORMATION

Lex Law Office processes your data also in cases when you contact us via the general office e-mail of Lex Law Office, presenting a query, submitting questions or sending information by contacts indicated on our website or on social networks.

Please observe at least the following minimum requirements for the protection of your personal information: do not indicate personal data (e.g. first name, surname, address, telephone number, e-mail, personal identification code, date of birth, bank account number, car license plate number, real estate data, health data, other special (sensitive) data, etc.) either in the subject line of a letter, request or query or in the names of the attached files; do not indicate either your or another person's personal identification code, health and other special (sensitive) data, financial data, other excessive or unnecessary data in the text of the letter, query or request, in the text of the file (attachment) sent, and indicate any other personal data only to the extent necessary for the purposes for which the letter, request or query is sent.

Lex Law Office processes your data in these cases in order to administer queries and complaints, to ensure the quality of the services we provide, protecting and defending its rights and legitimate interests. You provide your data to us on the basis of your consent, which is expressed by your active steps, i.e. by contacting us.

IV. PERSONAL DATA PROCESSING FOR RECRUITING PURPOSES

You can send your data to the Lex Law Office email info@lexlaw.ee in order to join the Lex Law Office team.

Please comply with personal information protection requirements and do not send us excessive information.

Please be advised that we will process personal data you present for the purpose of personnel selection, based on your consent, expressed by submitting this data.

Please note that in order to evaluate your candidacy, we may contact the former employers you have indicated for their recommendations and may ask them about your qualifications, professional skills and business qualities. We can request such information from your current employer only if we have your separate consent for this.

If, after considering your candidacy, we choose a candidate who is more qualified to meet our requirements, we may request your separate consent for the purpose of storing your personal data collected at the time of selection and using it for the purpose of conducting other personnel selections and contacting you accordingly.

If we obtain such a consent of yours, we will retain your personal data as described above for two years from the date of the consent. Once you have given such a consent, you are entitled to withdraw it at any time, without prejudice to lawfulness of data processing based on such a consent until the withdrawal of the consent. If you exercise this right, we will immediately take action to destroy your personal data.

We note that when you send your CV or other personal data to us to our general office email address, when there is no ongoing recruitment, we have the right to store and use such data for the purposes of later recruitment for up to 1 year.

If you see a job ad relevant for you on the Company's or job search websites, we invite you to apply, writing directly at the e-mail address indicated in the ad.

Please observe at least the following minimum requirements for the protection of your personal information by sending data to us: do not indicate excessive or unnecessary personal data either in the subject line of the letter or query, or in the attached CVs, in motivational letters, in other files: personal identification code, health or other special (sensitive) data, financial data, bank account number, family member data, car licence plate number, real estate data, and indicate any other personal data only to the extent necessary for the purposes for which the message is sent.

V. PERSONAL DATA PROCESSING ON THE WEBSITE

In case you visit our website, Lex Law Office can process the visitor's IP address, network and location data when the visitor provides them. Data is collected on the basis of user consent by use of cookies and other similar technologies.

Cookies are small text files (up to several KB) that your web browser places on your computer, tablet, or other smart device when visiting our website. Cookies are designed to ensure the efficient and safe operation of the site and to analyze your habits in order to make the site functioning convenient, efficient and meet your needs and expectations.

In the table below we present the main cookies used by Lex Law Office website, which help us track the number of visitors and their periodicity in visiting the site.

All information about the cookies used on this site, their purpose, validity and the data used is given in the table below:

You can control the use of cookies by changing your browser settings. For more information on how to remove cookies as well as other useful information related to the use of cookies, visit the website. http://www.allaboutcookies.org/.

We use the Google Analytics Website Analysis Service to capture and analyse the statistical data on use of the site. You can learn more about Google Analytics and the information that these tools allow us to collect here: https://support.google.com/analytics/answer/6004245?hl=en. You can use the Google Analytics opt-out browser add-on if you want Google Analytics tools to not capture information about your web browsing.

Please note that the essential and analytical cookies are a precondition for using the website. If you opt out of these cookies, we cannot be sure how our website will function, if at all.

VI. DATA PROCESSORS. DATA RECIPIENTS

Please be advised that Lex Law Office will use certain service providers (data processors) to process your personal data. Such data processors are: a company providing data center services, companies providing services and performing analysis of web browsing or activities online, companies providing advertising, marketing services, companies that create, provide, support and develop software, companies providing information technology infrastructure services, communications services companies and other service providers to whom your personal data is disclosed only to the extent necessary for provision of their services. We use dedicated service providers for sending newsletters and other information.

We inform you that certain data on your visit in our website (IP address, cookies, technical information of the browser you use, other information on your browser activities and browsing the website), for the purposes of statistics, analysis of the browsing on the website and related purposes, may be transmitted or made available to entities both in the European Economic Area and outside it (for example, when we use the Google Analytics service, such an entity is a United States company). Please note that in non-EEA countries personal data may be subject to less protection than in EEA countries, but we will carefully consider the conditions under which such data will be processed and stored after transfer to the above entities.

VII. DATA RETENTION

Your personal data processed for the purpose of direct marketing will be kept for 2 years from the last communication with you (if a separate consent was obtained) or the date of fulfillment or expiry of the agreement.

Please be advised that we will keep personal data you presented for personnel selection purposes until the end of a specific selection, unless we have received a separate consent to a longer term storage.

Your personal data, in pursuit of our legitimate interest in collecting evidence about requests received, the replies to them, as well as the services provided and the contact we had, is retained, depending on the type of data and circumstances, as long as it is in line with the purposes for which it was collected.

Longer storage of your personal data may take place when:

• it is necessary in order that we can defend ourselves against claims, demands or actions and exercise our rights;
• there is a reasonable suspicion of an unlawful act that is being investigated;
• your data is necessary for the proper resolution of a dispute, a complaint;
• for backup copies and other similar purposes;
• under other statutory grounds.

Your personal data will be destroyed within a reasonable time after the specified deadline.

VIII. DATA SUBJECTS' RIGHTS

With respect to your personal data you have the following rights:

• to get familiar with your personal data and how it is processed;
• to demand correcting incorrect, inaccurate or incomplete data, erasing your personal data or restricting the processing of your personal data when personal data is processed without complying with legal requirements or when there is another legal basis;
• to demand to transfer your personal data to another data controller or provide it directly to you in a convenient form (applicable to that personal data that you submitted and that is processed by automated means on the basis of the agreement or consent);
• to object to processing of your personal data if it is processed on the basis of a legitimate interest, unless there are legitimate reasons for such processing or for the purpose of making, pursuing or defending legal claims;
• in cases where your personal data is processed on a separate consent basis, you have the right at any time to withdraw your consent to processing of your personal data.

In cases where you consider that your personal data is being processed illegally or your rights in connection with data processing are violated, you have the right to contact the relevant data protection authority and file a complaint (contacts of individual state supervisory authorities are available here).

Lex Law Office recommends contacting us before submitting a formal complaint (info@lexlaw.ee) in order to find the right solution for a problem.