Privacy notice
Introduction
This Privacy Notice explains how we collect, use, share, and protect your personal data in connection with our legal practice and related activities. We are committed to protecting your privacy and complying with the applicable data protection law.
This notice applies to you if you are:
- a client or a client representative;
- a prospective client or their representative;
- an individual connected to the relevant legal matter, such as a counterparty or opposing counsel;
- a job candidate;
- a supplier or a supplier representative;
- a participant in our events and seminars; and
- a visitor to our website.
Who we are
We are Marija Gligorević and Anja Gligorević, attorneys at law from Belgrade, Resavska 40v/10. We are independent legal practitioners and joint controllers of your personal data.
We have entered into an arrangement designating Anja Gligorević as responsible for compliance with the data protection obligations applicable to our data processing activities. Anja Gligorević is the primary point of contact for data subjects and supervisory authorities. You may nevertheless contact either controller to exercise your rights and each controller remains liable for compliance with their data protection obligations.
What personal data we process and why
For a detailed overview of our processing activities, including the categories of personal data processed, purposes, legal bases, and retention periods, please refer to Section XII of this Privacy Notice.
Where we collect personal data from
We collect personal data:
- directly from you, when you communicate with us, provide information or documents relevant to a legal matter, apply for a job, enter into an agreement with us, register for or attend an event, or interact with our website (see our Cookie Policy);
- from our client or prospective client, where we obtain information needed to advise on a legal matter, including about individuals connected to that matter, such as a counterparty or opposing counsel;
- from an entity you represent, where we have a relationship or otherwise interact with a legal entity, such as a client, supplier, or counterparty of a client, and you act as its representative;
- from publicly available sources, as part of our work on legal matters, professional activities, and checks we carry out, including public registers, court records, professional networking platforms, and other publicly available websites; and
- from other third parties, where they provide us with information in connection with a legal matter, commercial relationship, or recruitment process, such as opposing counsel, other professional advisors, or HR service providers.
When we collect personal data directly from you, you may be required to provide some of that information where this is required by law or necessary for us to enter into or perform a contract with you. Such cases are identified in Section XII of this Privacy Notice. Failure to provide the required data may mean that we are unable to carry out the relevant activity, including, for example, providing legal services, considering a job application, or entering into a supplier agreement.
Legal bases for processing
Depending on the purpose of the processing and our relationship with you, we may rely on one or more of the following legal bases:
- performance of a contract, where processing is necessary for the performance of a contract with you or to take steps at your request prior to entering into a contract;
- legal obligation, where processing is necessary for compliance with a legal or regulatory obligation to which we are subject;
- legitimate interests, where processing is necessary for our legitimate interests or those of a third party, provided that such interests are not overridden by your interests or fundamental rights and freedoms; or
- consent, where you have given us your consent to the processing for a specific purpose.
Where we process special categories of personal data, we will also rely on an applicable additional condition permitting such processing, such as where the processing is necessary for the establishment, exercise, or defence of legal claims, or is based on your explicit consent.
For a detailed overview of our processing activities, including the categories of personal data processed, purposes, legal bases, and retention periods, please refer to Section XII of this Privacy Notice.
Who we share personal data with
We may share your data with:
- courts, regulators, tax authorities, business registries, law enforcement authorities, or similar agencies;
- notaries, certified translators, expert witnesses, mediators, or arbitrators;
- third parties involved in a matter, such as opposing parties and counsel;
- professional advisors, such as accountants, auditors, lawyers, and professional consultants;
- IT and administrative service providers, such as cloud storage and case management software, IT support, and HR services; and
- organisations that compile legal directories and rankings, publish legal content, or organise events.
International transfers of personal data
We may transfer personal data to:
- the Netherlands, in connection with our use of cloud storage and email services;
- the United Kingdom, to organisations that compile legal directories and rankings, publish legal content, or organise events; and
- the United States, through our use of cookie services.
The transfer of personal data to these countries is permitted without additional safeguards on the following grounds:
- the Netherlands and the United Kingdom are parties to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108); and
- the European Commission has adopted an adequacy decision recognising an adequate level of protection for transfers to the United States under the EU-U.S. Data Privacy Framework, under which our recipient is certified.
We may also transfer personal data to countries other than those listed above where this is necessary in connection with a specific matter, for example, where a client, counterparty, or their advisors are located outside Serbia. In such cases, we ensure that the applicable transfer mechanism is in place on a case-by-case basis.
Further information on the safeguards applied to a specific transfer is available upon request.
How long we keep personal data
For a detailed overview of our processing activities, including the categories of personal data processed, purposes, legal bases, and retention periods, please refer to Section XII of this Privacy Notice. We may retain your personal data for longer than the periods indicated in Section XII where necessary to establish, exercise, or defend legal claims or in connection with actual or anticipated legal proceedings.
Your rights
Under applicable data protection laws, you have the following rights:
- right of access: you can request information about our processing of your personal data and ask us for copies of your personal data;
- right to rectification: you can ask us to rectify inaccurate information, or to complete incomplete information about you;
- right to erasure: you can ask us to erase your personal data in certain circumstances;
- right to restriction of processing: you can ask us to restrict the processing of your personal data in certain circumstances;
- right to object to processing: you can object to the processing of your personal data where we rely on legitimate interests as our legal basis;
- right to data portability: you can request your personal data in a structured, commonly used and machine-readable format and transmit it to another organisation or to yourself, under certain conditions;
- right to withdrawal of consent: you have the right to withdraw your consent for processing at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
- right to lodge a complaint: you can lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia if you believe that your rights have been violated.
To exercise your rights, you may use the contact details provided in Section XII of this Privacy Notice.
Security
We implement appropriate technical, organisational, and personnel measures to protect your personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage, including encryption, access controls, secure authentication, backups and recovery measures, confidentiality obligations, physical security measures, and regular testing and review of our security measures.
Contact
If you have any questions about the processing of your personal data or wish to exercise your data subject rights, please use the contact details below. Anja Gligorević is responsible for compliance with our data protection obligations and is the primary contact for data subjects and supervisory authorities, but you may contact either controller directly.
Anja Gligorević
Resavska 40v/1011000 BeogradDetailed overview of processing activities
| Categories of personal data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Identification data (name, address, ID/passport number)Contact data (email, phone)Role/position, where you act as a representative of a client that is a legal entity | Client onboarding and communicationMaintaining client records | Performance of a contract with a client that is a natural personLegitimate interests in performing our contract with a client that is a legal entity | Retained permanently, in line with our professional record-keeping obligations |
| Anti-money laundering and conflict-check data (name, address, ID/passport data, source-of-funds information, beneficial ownership data, information about business activities, transactions, and legal matters) | Identifying and verifying clientsAssessing and managing conflicts of interestMaintaining client records | Legal obligation under anti-money laundering and attorneys-at-law legislation | 5 years from the end of the engagement or transaction, per statutory anti-money laundering requirements2 years from the end of the engagement, in line with our professional record-keeping obligations |
| Case-related data (matter details, correspondence, documents)Special category data, such as health data, where relevant to the matter | Providing legal advice and representationRetaining records and documents entrusted by clients | Performance of a contract with a client that is a natural personLegitimate interests in performing our contract with a client that is a legal entityLegal obligation to retain records and documents entrusted by clientsEstablishment, exercise, or defence of legal claims; or explicit consent | Documents and evidence relevant to the matter are generally retained permanently; other correspondence not constituting evidence is generally retained for 2 years following conclusion of the matter, in line with our professional record-keeping obligations |
| Financial and billing data (name, email, phone, invoice details, payment information, bank details, billing correspondence) | Invoicing and accounting | Performance of a contract with a client that is a natural personLegitimate interests in performing our contract with a client that is a legal entityLegal obligation to retain accounting records | Retained for the period applicable to the relevant record under accounting legislation, generally 5, 10 or 20 years from the end of the relevant financial year, depending on the type of record |
| Name, email, phoneRole/position, where you act as a representative of a client that is a legal entityInformation about our relationship with you or the organisation you represent | Inviting clients and their representatives to events, requesting feedback, and communicating about our services and activities | Legitimate interests in maintaining professional relationships, developing our practice, and obtaining feedback | 3 years from the last interaction with you |
- Identification data (name, address, ID/passport number)Contact data (email, phone)Role/position, where you act as a representative of a client that is a legal entity
- Client onboarding and communicationMaintaining client records
- Performance of a contract with a client that is a natural personLegitimate interests in performing our contract with a client that is a legal entity
- Retained permanently, in line with our professional record-keeping obligations
- Anti-money laundering and conflict-check data (name, address, ID/passport data, source-of-funds information, beneficial ownership data, information about business activities, transactions, and legal matters)
- Identifying and verifying clientsAssessing and managing conflicts of interestMaintaining client records
- Legal obligation under anti-money laundering and attorneys-at-law legislation
- 5 years from the end of the engagement or transaction, per statutory anti-money laundering requirements2 years from the end of the engagement, in line with our professional record-keeping obligations
- Case-related data (matter details, correspondence, documents)Special category data, such as health data, where relevant to the matter
- Providing legal advice and representationRetaining records and documents entrusted by clients
- Performance of a contract with a client that is a natural personLegitimate interests in performing our contract with a client that is a legal entityLegal obligation to retain records and documents entrusted by clientsEstablishment, exercise, or defence of legal claims; or explicit consent
- Documents and evidence relevant to the matter are generally retained permanently; other correspondence not constituting evidence is generally retained for 2 years following conclusion of the matter, in line with our professional record-keeping obligations
- Financial and billing data (name, email, phone, invoice details, payment information, bank details, billing correspondence)
- Invoicing and accounting
- Performance of a contract with a client that is a natural personLegitimate interests in performing our contract with a client that is a legal entityLegal obligation to retain accounting records
- Retained for the period applicable to the relevant record under accounting legislation, generally 5, 10 or 20 years from the end of the relevant financial year, depending on the type of record
- Name, email, phoneRole/position, where you act as a representative of a client that is a legal entityInformation about our relationship with you or the organisation you represent
- Inviting clients and their representatives to events, requesting feedback, and communicating about our services and activities
- Legitimate interests in maintaining professional relationships, developing our practice, and obtaining feedback
- 3 years from the last interaction with you
| Categories of personal data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Identification data (name, address, ID/passport number)Contact data (email, phone)Role/position, where you act as a representative of a client that is a legal entityCase-related data (matter details, correspondence, documents) provided during the prospective client stageSpecial category data, such as health data, where relevant to the matter | Responding to inquiries, assessing whether to take on a matter, sending offers | Pre-contractual steps where the prospective client is a natural personLegitimate interests in assessing potential engagementsEstablishment, exercise, or defence of legal claims; or explicit consent | Retained for the applicable retention periods for client data, if a client relationship is established2 years from the last interaction with you, if a client relationship is not established |
| Anti-money laundering and conflict-check data (name, address, ID/passport data, source-of-funds information, beneficial ownership data, information about business activities, transactions, and legal matters) | Identifying and verifying prospective clientsAssessing and managing conflicts of interestMaintaining client records | Legal obligation under anti-money laundering and attorneys-at-law legislation | 5 years from the end of the engagement, transaction, or relevant activity, per statutory anti-money laundering requirements2 years from the end of the engagement or relevant activity, in line with our professional record-keeping obligations |
- Identification data (name, address, ID/passport number)Contact data (email, phone)Role/position, where you act as a representative of a client that is a legal entityCase-related data (matter details, correspondence, documents) provided during the prospective client stageSpecial category data, such as health data, where relevant to the matter
- Responding to inquiries, assessing whether to take on a matter, sending offers
- Pre-contractual steps where the prospective client is a natural personLegitimate interests in assessing potential engagementsEstablishment, exercise, or defence of legal claims; or explicit consent
- Retained for the applicable retention periods for client data, if a client relationship is established2 years from the last interaction with you, if a client relationship is not established
- Anti-money laundering and conflict-check data (name, address, ID/passport data, source-of-funds information, beneficial ownership data, information about business activities, transactions, and legal matters)
- Identifying and verifying prospective clientsAssessing and managing conflicts of interestMaintaining client records
- Legal obligation under anti-money laundering and attorneys-at-law legislation
- 5 years from the end of the engagement, transaction, or relevant activity, per statutory anti-money laundering requirements2 years from the end of the engagement or relevant activity, in line with our professional record-keeping obligations
| Categories of personal data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Identification data (name, address, ID/passport number)Contact data (email, phone)Company, role/position, where relevant | Providing legal advice and representation to our clientCorrespondence and negotiation | Legitimate interests in providing legal advice and representation to our client | Retained permanently, in line with our professional record-keeping obligations |
| Case-related data (matter details, correspondence, documents)Special category data, such as health data, where relevant to the matter | Providing legal advice and representation to our client | Legitimate interests in providing legal advice and representation to our clientEstablishment, exercise, or defence of legal claims | Documents and evidence relevant to the matter are generally retained permanently; other correspondence not constituting evidence is generally retained for 2 years following conclusion of the matter, in line with our professional record-keeping obligations |
- Identification data (name, address, ID/passport number)Contact data (email, phone)Company, role/position, where relevant
- Providing legal advice and representation to our clientCorrespondence and negotiation
- Legitimate interests in providing legal advice and representation to our client
- Retained permanently, in line with our professional record-keeping obligations
- Case-related data (matter details, correspondence, documents)Special category data, such as health data, where relevant to the matter
- Providing legal advice and representation to our client
- Legitimate interests in providing legal advice and representation to our clientEstablishment, exercise, or defence of legal claims
- Documents and evidence relevant to the matter are generally retained permanently; other correspondence not constituting evidence is generally retained for 2 years following conclusion of the matter, in line with our professional record-keeping obligations
| Categories of personal data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Identification data (name, address)Contact data (email, phone)CV data (education, work history, languages, skills)References, cover letters, and other information provided by the job candidate | Assessing the job application and suitability for the role | Legitimate interests in recruitmentPre-contractual steps for shortlisted candidates | 6 months from notification of the recruitment outcome |
| Interview notes and assessment results | Evaluating candidates and making a hiring decision | Legitimate interests in recruitment | 6 months from notification of the recruitment outcome |
| Application data retained for future opportunities | Considering you for future vacancies | Consent | 1 year from notification of refusal |
- Identification data (name, address)Contact data (email, phone)CV data (education, work history, languages, skills)References, cover letters, and other information provided by the job candidate
- Assessing the job application and suitability for the role
- Legitimate interests in recruitmentPre-contractual steps for shortlisted candidates
- 6 months from notification of the recruitment outcome
- Interview notes and assessment results
- Evaluating candidates and making a hiring decision
- Legitimate interests in recruitment
- 6 months from notification of the recruitment outcome
- Application data retained for future opportunities
- Considering you for future vacancies
- Consent
- 1 year from notification of refusal
| Categories of personal data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Identification data (name, address, ID/passport number)Contact data (email, phone)Role/position, where you act as a representative of a supplier that is a legal entityCorrespondence | Establishing and managing the supplier relationship, contract administration | Performance of a contract with a supplier that is a natural personLegitimate interests in performing our contract with a supplier that is a legal entity | 2 years from the end of the engagement |
| Financial and billing data (name, email, phone, invoice details, payment information, bank details, billing correspondence) | Invoicing and accounting | Performance of a contract with a supplier that is a natural personLegitimate interests in performing our contract with a client that is a legal entityLegal obligation to retain accounting records | Retained for the period applicable to the relevant record under accounting legislation, generally 5, 10 or 20 years from the end of the relevant financial year, depending on the type of record |
- Identification data (name, address, ID/passport number)Contact data (email, phone)Role/position, where you act as a representative of a supplier that is a legal entityCorrespondence
- Establishing and managing the supplier relationship, contract administration
- Performance of a contract with a supplier that is a natural personLegitimate interests in performing our contract with a supplier that is a legal entity
- 2 years from the end of the engagement
- Financial and billing data (name, email, phone, invoice details, payment information, bank details, billing correspondence)
- Invoicing and accounting
- Performance of a contract with a supplier that is a natural personLegitimate interests in performing our contract with a client that is a legal entityLegal obligation to retain accounting records
- Retained for the period applicable to the relevant record under accounting legislation, generally 5, 10 or 20 years from the end of the relevant financial year, depending on the type of record
| Categories of personal data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Name, email, phoneCompany, role/positionRegistration data (event or seminar details, date)Attendance data | Organising and administering events or seminars, providing materialsManaging attendance and follow-up | Legitimate interests in organising and administering our events and seminarsLegitimate interests in managing attendance and logistics | 2 months after the event |
| Photographs or recordings, where taken | Communicating about our professional activities | Legitimate interest in maintaining our professional presence and reputation | 5 years after the event |
| Name, email, phoneCompany, role/positionEvent or seminar participation history | Sending related communications or invitations | Consent | 2 years from the last attendance at one of our events or seminars |
- Name, email, phoneCompany, role/positionRegistration data (event or seminar details, date)Attendance data
- Organising and administering events or seminars, providing materialsManaging attendance and follow-up
- Legitimate interests in organising and administering our events and seminarsLegitimate interests in managing attendance and logistics
- 2 months after the event
- Photographs or recordings, where taken
- Communicating about our professional activities
- Legitimate interest in maintaining our professional presence and reputation
- 5 years after the event
- Name, email, phoneCompany, role/positionEvent or seminar participation history
- Sending related communications or invitations
- Consent
- 2 years from the last attendance at one of our events or seminars
For information about our use of cookies and similar technologies, please see our Cookie Policy.