1.1. protect your personal data from unauthorized use;
1.2. define our responsibilities as data controller in managing your personal data;
1.3. indicate what personal data are being processed, the purposes of the processing, the period for which the personal data will be stored, as well as the legal basis for the processing and any other information we are required to provide under applicable law;
1.4. inform you, as a data subject, about your rights related to the processing of your data.
2.1. Personal data – any information relating to an identified or identifiable natural person (data subject); identifiable natural person means a person who can be identified, directly or indirectly, in particular by reference to an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person;
2.2 Data subject – a natural person whose personal data are processed;
2.3. Data controller – a natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of data processing; when purposes and means of such data processing are determined by the Union or laws of a Member State, data controller or the specific criteria for its designation may be determined by the Union or laws of a Member State.
3. When processing your personal data, we follow the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter – General Data Protection Regulation), the Law on the Legal Protection of Personal Data of the Republic of Lithuania, as well as other laws and legal acts regulating the processing and protection of personal data.
CONTROLLER AND HIS CONTACT DETAILS
4. Personal data controller is UAB “Idėjos partneriai”, company code 304375463, office address Vokiečių str. 5-14, Vilnius (hereinafter – UAB “Idėjos partneriai”).
5. UAB “Idėjos partneriai” contact details for matters relating to the processing of personal data – Agneta Kleizienė. By using this contact data or by contacting the registered office of UAB “Idėjos partneriai”, you may inquire about the processing of personal data. An application for exercising your rights may be submitted in accordance with the clause 10.1.
6. UAB “Idėjos partneriai” contact details to inform about possible data protection breaches: firstname.lastname@example.org
PURPOSES, BASICS AND TERMS OF PROCESSING PERSONAL DATA
7. Information below provides UAB “Idėjos partneriai” categories, goals, and legal processing basics of processed personal data.
7.1. Your account (registration and administration)
|Data categories||Name, surname, e-mail, telephone, password (encrypted), list of goods (goods, price, date), account actions, including technical data (login information, such as when you last logged in;), loyalty card data specified in p. 7.2. (if you have registered a card), the information you provide when ordering direct marketing specified in p. 7.2. or 7.4. (if you ordered it), email details, for example, when you asked to be reminded of your password.|
|Legal basis for data processing||Your consent, which is considered received when you activate your account.|
|Period of data processing||For as long as you use the account. We may keep your consent and proof of it for a longer period of time, if necessary, in order to defend yourself against claims or lawsuits.|
To create an account, you must agree to the terms and conditions and provide your personal information. If you do not agree to the terms and conditions and do not provide personal information, you will not be able to create an account.
By registering your account, you confirm that you are at least 18 years old and that the personal information provided is accurate and correct. It is very important that the information you provide is accurate and correct. If you provide incorrect (false) data, forget it or do not update the changed data, it may be difficult for us to ensure the provision of services, and there may be problems in exercising your rights. If you notice any inaccuracies, correct them immediately.
7.3. Direct marketing
|Data categories||If you created an account: name, surname, email, email interaction (information about whether the newsletter was read, when, how many times it was read (opened), whether it was forwarded, what operating system and email server (its location) were used), a list of favorite items, in addition at your choice: gender, children, city, language.|
If you did not create an account: name, surname, email, email interaction (information on whether the newsletter was read, when, how many times it was read (opened), whether it was forwarded, what operating system and e-mail server (its location) were used).
|Legal basis for data processing||With your consent, we process personal data for direct marketing purposes, and based on our legitimate interest in selecting and offering goods and services that meet your needs, we carry out profiling.|
|Period of data processing||As long as your consent to receive offers and news is valid. We may keep your consent and proof of it for a longer period of time, if necessary, in order to defend yourself against claims or lawsuits.|
We can only send you news about goods and services, offers and promotional materials if you agree to receive this information. If you have agreed to receive offers and news by filling in the registration form, we process your personal data by providing you with offers and information, such as general newsletters, information about offers, discounts or sales, or by asking for your opinion on services and products, etc. We do this because it is important for us to adapt the offers to your needs.
If you have agreed to receive direct marketing communications by email, in order to understand whether the information we send you is relevant, we collect statistical information about newsletters sent (we monitor whether you read the newsletter, when, how many times you read or opened it, or forwarded it to others, which operating system and email server (its location) you used).
In addition, if you have created an account and provided additional optional data, based on profiling, we will send you specially selected offers of goods and services, i.e. by age, gender, children, list of favourite goods. You can unsubscribe from direct marketing notifications in your account by clicking the unsubscribe link in the email or contacting by contacts provided below.
By registering for direct marketing offers, you confirm that the personal data provided is accurate and correct and that you are at least 18 years old.
7.4. CCTV surveillance
|Data categories||Image and other personal data caught on CCTV.|
|Legal basis for data processing||Security of company assets, information, employees and third parties, as well as the prevention, control and detection of illegal activities and to ensure the effective investigation of such cases.|
|Period of data processing||CCTV recordings shall be kept for a maximum of 25 days, unless the record contains information required as evidence in a civil, administrative or criminal case or necessary for an investigation. In such cases, recordings may be kept for the time necessary to fulfil those purposes and destroyed immediately when they are no longer needed.|
In order to ensure the protection of the company’s property, information, property, health and life of our employees and other persons, we have CCTV surveillance in the stores. Due to the location of the CCTV cameras, we cannot guarantee that you will be able to enter the premises without providing this type of personal data without entering the CCTV surveillance area.
Our CCTV surveillance systems do not use facial recognition and / or analysis technologies, and the image data captured is not grouped or profiled according to a specific person.
7.5. Inquiries, complaints, requests and feedback
|Data categories||Name, surname, address, email, telephone, description of the complaint or other request, circumstances, as well as documents confirming the complaint, claim or feedback, etc., loyalty card number, purchase history.|
|Legal basis for data processing||Duty to analyse and respond to consumer complaints or inquiries, as well as a legitimate interest in evaluating your feedback to improve the quality of our operations and services.|
|Period of data processing||Up to 12 months.|
We receive your personal data when you submit complaints, requests, inquiries, suggestions, comments, requirements, feedback by mail, email or otherwise contact us. We use your data only to properly and objectively analyse your complaint or other inquiry, provide you with the necessary information, answer your questions, resolve your requests or requirements.
Personal data may be stored for a longer period if the complaint or request, inquiry, suggestion, remark, claim, feedback is not analysed or is still pending during that period of time, and if the personal data is necessary to protect our or third parties’ legitimate interests.
CASES WHEN WE DISCLOSE YOUR DATA AND THIRD PARTIES
8. We do not transfer your personal data to any third parties without your prior consent, except as described below. We may disclose your personal information:
8.1. We may transfer your data for processing to third parties who assist us in the execution and administration of services, provide us with services related to the administration of complaints and other inquiries. Our data controllers may process your personal data only in accordance with our instructions and may not use them for other purposes or transfer them to other persons without our consent. In addition, they must ensure the security of your data in accordance with applicable law and written agreements.
8.2. We transfer your personal data to state and municipal authorities and other persons performing the functions assigned to them by law upon their request, as well as when the provision of data is required by law or in order to express, enforce or defend legal requirements in our legitimate interest.
PERSONAL DATA PROTECTION
9. We process data using the capabilities of modern technology, taking into account existing privacy risks and available organizational, financial and technical resources. The data is stored securely and is accessible to a limited number of individuals.
YOUR RIGHTS UNDER APPLICABLE LAW
10. The General Data Protection Regulation and other legislation give you rights and provide you with the cases in which you can exercise them, the procedures you have to follow and the exceptions when you will not be able to do so. When the law allows it, you can:
10.1. Submit a request for confirmation whether we process the data relating to you and, if so, request access to data processed and related information;
10.2. Submit a request to correct inaccurate, incorrect information used or to supplement it when it is incomplete;
10.3. Submit a request to delete information we hold about you if we use it illegally;
10.4. Submit a request to restrict the processing of information held about you – when you dispute the accuracy of the data or object to the processing of data, you do not agree to the deletion of your unlawfully processed data, or you need that data to express, enforce or defend legal claims;
10.5. Disagree on the use of data, when we do so, based on our legitimate and / or third-party’s interests;
10.6. Submit a request to transfer (receive) data that you have provided to us under the contract or with consent / by expressing consent and which we process by automated means in a shared electronic form;
10.7. Revoke the consent given to us regarding the use of your information, when we use the data based on your consent;
10.8. File a complaint with the supervisory authority, in particular in the Member State where you are domiciled or where the alleged infringement of the said Regulation has taken place, and seek judicial remedies.
To exercise these rights, please contact us in writing or contact the Data Protection Officer, see contacts below.
If you consider that the way we process your personal data does not comply with the applicable legislation, you have the right to contact the State Data Protection Inspectorate (www.ada.lt).