APPROVED:
By Order No. 55 of 31 December 2018
of the Director of the Public Institution ‘Kėdainiai Tourism and Business Information Centre’
31 December 2018
PRIVACY AND COOKIE POLICY OF THE PUBLIC INSTITUTION ‘Kėdainiai Tourism and Business Information Centre’
The Public Institution ‘Kėdainiai Tourism and Business Information Centre’ (hereinafter referred to as ‘the Centre’ or ‘we’) attaches great importance to the trust of our customers and all stakeholders. We want you to feel confident that, when you share your personal data with us, we take care of it and process it in accordance with the highest standards.
The Public Institution ‘Kėdainiai Tourism and Business Information Centre’ will responsibly assist all customers, employees and other individuals whose personal data it processes who wish to exercise their rights as data subjects, as provided for by personal data protection requirements.
We encourage you to read this Privacy Policy. If you still have any questions afterwards, please do not hesitate to contact us using one of the methods listed below.
I. General Provisions
The Centre is committed to protecting the privacy of all individuals and recognises that the protection of personal data is important to our clients and other individuals whose personal data we process (hereinafter referred to as ‘data subjects’); we therefore take the protection of each data subject’s privacy extremely seriously and with the utmost care.
We respect your privacy, and through the provisions set out in this Privacy Policy, we aim to inform you clearly and transparently about what personal data we collect and how we process it. We are the controllers of your personal data and, in certain situations, the processors.
The Centre processes personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC) (hereinafter referred to as the ‘GDPR’), the Law on the Legal Protection of Personal Data of the Republic of Lithuania, and other directly applicable legislation governing the protection of personal data, as well as the instructions of the competent authorities.
II. Definitions
Data Controller – The controller of your personal data is the Centre to which you have provided your personal data in connection with contractual or pre-contractual relations involving you, or whose Services you (or the legal entity of which you are considered a contact person or employee) intend to use or are using.
Client – A data subject, a natural person who uses, has used or has expressed an intention to use the Centre’s Services.
Company – A client of the Centre with whom a service provision contract has been signed and on the basis of which the Centre acts as a Data Processor.
GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
Personal data – any information relating, directly or indirectly, to a Customer or any other natural or legal person whose identity has been established or can be established, and whose data is processed in accordance with this Privacy Policy and applicable legislation (for example, a client’s contact person as a legal entity, an employee, etc.).
Processing – any operation performed on personal data (including collection, recording, storage, alteration, processing, retrieval, disclosure, transfer, etc.).
Services – any services offered or provided by the Centre.
III. How do we collect your data?
The information we collect about you depends on the products and/or services you order and/or use, and on the data you provide to us when you order goods and/or services or register on our website or social media platforms.
The Centre collects your personal data:
- which you provide (i.e. directly from the data subject), e.g. when you communicate with or have a legal relationship with our Centre, such as when you purchase goods, submit a request for a service, send us enquiries via our website or social media, or contact us to request information, etc.;
- which are generated when you use our services, for example, when you use our services (e.g. make a phone call, send a text message (SMS) or an email, visit our website, etc.);
- which we receive from other sources, for example, where there is a legal basis, from other institutions or companies (e.g. the State Social Insurance Fund Board under the Ministry of Social Security and Labour of the Republic of Lithuania (for the purpose of providing accounting services), the credit bureau UAB “Creditinfo Lietuva” (for creditworthiness assessment), publicly available registers, etc.);
- which we receive from persons who are not data subjects (for example, from you). (For example, when legal entities submit a request for services relating to their employees). In such cases, we require that data subjects be informed in advance of the disclosure of personal data to the Centre and of the purposes for which such personal data will be processed. Furthermore, in such cases, we require that, when providing personal data belonging not to yourself but to another data subject, you ensure that such data subject is made aware of our Privacy Policy;
- in cases where we enter into various contracts to which the Client is not necessarily a party or representative (for example, a contract with a legal entity specifying contact persons or representatives’ details);
- when you complete contact, registration or enquiry forms on the website. In such cases, the Centre may collect and process the personal data you provide, such as your first name, surname, telephone number, email address, organisation name, as well as other information you voluntarily provide. This data is processed for the purpose of responding to your enquiry, providing the requested information or services, administering registration for events, tours or other activities, and maintaining contact with you. Personal data is processed on the basis of your consent, for the purpose of taking action in response to your enquiry prior to the conclusion of a contract or during the course of a contractual relationship, and in accordance with the Centre’s legitimate interest in ensuring high-quality customer service. Data provided via contact forms is retained for no longer than is necessary to fulfil the purposes of processing the enquiry, except where legislation stipulates a longer retention period.
You are not obliged to provide us with any of your personal data; however, if you choose not to do so, we may be unable to provide you with some of our services, sell you goods, etc.
IV. What personal data do we process about you?
The exact scope of the personal data processed depends on the type of service or your relationship with the Centre. The Centre’s main activities relate to:
- the provision of information, advisory and training services, as well as practical assistance to small and medium-sized enterprises, including, amongst other things, the organisation of professional development courses and seminars for entrepreneurs, the provision of accounting and consultancy services, and the development of business development and investment projects;
- providing information on tourism services, for example, organising trips or excursions for individuals within Lithuania or abroad, and developing tourist itineraries and projects.
We process your personal data in order to be able to provide and improve these Services, as well as:
- to inform you about our services that are relevant to you;
- to process and manage incoming enquiries, requests and complaints;
- to administer the Centre’s social media accounts;
- to protect the Centre’s rights and interests — where necessary, in the context of legal proceedings;
- to maintain relationships with the individuals or legal entities you represent.
In addition, the Centre processes the personal data of its clients and vendors/service providers who are representatives of companies and/or private individuals.
We process personal data relating to, amongst other things, the following main categories of data:
DATA CATEGORIES / DATA*
| Data category | Data |
|---|---|
| Identification data | First name, surname, identification number, date of birth, data confirming identity: details of an identity document (e.g. passport, identity card, document number, date of issue and expiry date). |
| Contact details | First name, surname, work or personal telephone number, work or personal email address. |
| Information based on the agreement concluded with the Company on the provision of accounting services | First name, surname, personal identification number, date of birth, social insurance number, gender, address, telephone number, email address, identity document details, salary and other regular income, information on social insurance contributions, bank account details, transactions of the data subject, duties, information about the employer, working time records, details of dependants, etc. |
| Information relating to payments, accounting and the monitoring of payments, debt management and debt recovery | First name, surname, address (for sending invoices, etc.), email address, personal identification number, telephone number, bank, bank account details, VAT registration number, information about services ordered and the charges for them, payment card details (if you pay for services by payment card), details of invoices issued and payment information (including services provided, invoice date, invoice number, amount due/amount paid, payment dates, payment status (paid/unpaid)), information relating to outstanding balances for services (including the date the balance arose and the amount outstanding) and so on. |
| Information relating to business consultancy issues, as well as the preparation of documentation for the Client’s participation in business projects | First name, surname, email address, telephone number, job title, employer details, content of consultations, etc. |
| Information relating to the provision of tourist information and services | First name, surname, date of birth or personal identification number (if you are registering to take part in, for example, a tour of the Lithuanian President’s residence), telephone number, email address, identity document details (for example, for travel outside Lithuania) and so on. |
| Consents and withdrawals by the data subject | Information on consents given to the Centre, their withdrawal, submission of withdrawals. |
| Interaction between the data subject and the Centre | Information received from the data subject when they contact the Centre by email via the ‘Contact Us’ sections on the Centre’s website or social media channels: email address, date, time, content of correspondence, IP address, etc. Correspondence with the data subject via email: emails, their dates and content, IP address. |
| Other personal information | Nationality, gender (for example, you intend to take part in a tour to Belarus), age (for example, you intend to make use of the priority area of financial support from the Business Support Fund intended for young people under 29), membership of a group of people in need of social support, or the category of older people, etc. (for example, when registering to take part in trips or excursions where concessions are available for certain groups of people). |
| Employment details | Details of employer (former employer), occupation, length of service, education, qualifications. |
| Family details | Marital status, dependants and/or family members. |
* The main categories of personal data processed and examples of such data are set out above; this list is not exhaustive.
We do not process sensitive data relating to your health, ethnic origin, religious or political beliefs, except where required by law, or in specific cases where, for example, you yourself disclose such data whilst using the Centre’s Services.
We only collect data about children if they use the Centre’s services or if you provide us with information about your children whilst using our services.
V. Why the Centre collects and processes personal data
Provision of services
The first and most important reason why we need your personal data relates to the provision of services.
There is certain personal data that we require in all cases, regardless of the Service you choose — for example, information enabling us to identify you, or contact details, etc. However, due to the nature of certain Services, additional information is required in order to provide them. For example, in order to provide advice on business matters and to prepare the documents required to obtain financial support from business support funds, we process personal data such as your first name, surname, email address, telephone number, long-term assets held, financial liabilities, information stated in your annual tax return, etc.
Compliance with the requirements set out in laws and other legal acts
Compliance with the requirements of the Accounting Act, the Tourism Act, the Regional Development Act, the Act on the Submission of Reports and Notifications to Public Authorities, the Data Breach Notification Act, the Act on the Prevention of Money Laundering and Terrorist Financing, and other legislation.
We are also obliged to submit reports to public authorities, such as the State Tax Inspectorate, social security authorities or other institutions. The data we include in these reports depends on the requirements of the law(s) or legal acts with which we comply.
The Centre’s legitimate interest
The Centre strives to meet your expectations — to ensure the uninterrupted provision of services, high-quality customer service and the best possible experience when interacting with us — which is why we process your personal data for the purposes set out below:
- Marketing, direct marketing (only with the customer’s consent);
- Maintaining customer relationships;
- Improving customer service;
- Improving the quality of products and services.
You have the right to object at any time to the processing of your personal data for the purposes of direct marketing. To exercise this right, please contact us using the contact details provided below.
You may also opt out of receiving newsletters and all other promotional and marketing communications by clicking the link provided in the email or by following any other instructions set out in such direct marketing communications.
Once we have received your withdrawal of consent, we will immediately begin making the necessary changes; however, this may take up to 5 working days, so during this period you may still receive our offers, and we may continue to process your personal data for marketing purposes.
VI. How do we protect your data?
The Centre places particular emphasis on data security; therefore, we implement the necessary measures in accordance with the requirements of current legislation and have responsibly put in place organisational and technical data security measures to help protect personal data against accidental or unlawful destruction, alteration, disclosure or any other unlawful processing.
Such measures include technical measures, such as the selection and configuration of suitable computer systems and IT infrastructure, and the protection of staff, data and files, as well as organisational measures, such as restricting access to these systems, files, devices and documents.
VII. To whom do we transfer your data?
We may only disclose your personal data in strict compliance with data protection requirements, only in justified cases and only to recipients who undertake to protect it appropriately.
We may disclose your personal data to:
- Data processors (subcontractors) who provide services to us (carry out work) and process your personal data on behalf of the Centre, which acts as the data controller. Data processors are only authorised to process personal data in accordance with the Centre’s instructions and only to the extent necessary for the proper fulfilment of the obligations set out in the contract concluded with the Centre. The data processors we engage operate in the following main areas: providers of advertising and marketing services, IT service providers, website maintenance service providers, and providers of customer service, accounting, legal and administrative services.
- Suppliers or partners providing legal, auditing and other professional services.
- Partners organising tourist trips or excursions, when you register to take part in them.
- Government bodies, law enforcement or supervisory authorities, where such an obligation is provided for by law or where it is necessary to protect the Centre’s rights and legitimate interests.
In certain cases, your personal data may be transferred outside the Republic of Lithuania, the European Union (EU) or the European Economic Area (EEA) when we use the services of international providers (for example, Google LLC (USA) and Meta Platforms, Inc. (USA)).
In such cases, the Centre ensures that personal data is transferred in accordance with the requirements of the GDPR and with appropriate safeguards in place, including the Standard Contractual Clauses (SCCs) approved by the European Commission or other lawful data protection mechanisms.
The Centre takes all reasonable measures to ensure that all data recipients process personal data securely, confidentially and solely for the purposes for which the data was transferred.
VIII. How long do we store your data?
Personal data is stored in accordance with applicable legislation and for no longer than is necessary to fulfil the purposes of data processing. The Centre ensures and takes all necessary measures to ensure that no outdated or unnecessary information is stored, and that personal data and other information about data subjects is kept up to date and accurate.
IX. What are your rights?
The GDPR and other legislation grant you rights, set out the circumstances in which you may exercise them, the procedure you must follow, and the exceptions where you cannot do so. Where permitted by law, you have the right to:
- submit a request to us asking whether the Centre is processing data relating to you and, if so, to request access to the data being processed and any related information;
- send us a request to rectify inaccurate or incorrect information, or to have it completed if it is incomplete;
- submit a request to us to delete the information we hold about you if we are using it unlawfully;
- submit a request to us to restrict the processing of the information we hold about you — if you contest the accuracy of the data or object to its processing, do not agree to the erasure of your data processed unlawfully, or require the data to establish, exercise or defend legal claims;
- object to the use of your data — where we do so on the basis of the Centre’s legitimate interests and/or those of third parties;
- send us a request to transfer (receive) the data that you have provided to us in accordance with a contract or with your consent, and which we process by automated means, in a commonly used electronic format;
- withdraw your consent to our use of your personal data — in cases where we process data on the basis of consent obtained from you.
To exercise the above rights, you may contact the Centre using the contact details provided below.
Information regarding your personal data is provided free of charge and only if we are able to identify you, i.e. verify that we are communicating with you specifically. If your requests are manifestly unfounded or excessive due to their repetitive nature, the Centre reserves the right to charge a reasonable fee to cover the administrative costs associated with providing the information, notifications or actions requested, or to refuse to act on such a request.
X. Who can you contact?
If you have any questions or are unsure about how the Centre processes your personal data, or if you wish to exercise any of your rights, please feel free to contact us:
- by telephone on +370 655 22245;
- by email pareigunas@kedainiutvic.lt (you can send us a request signed with an electronic signature); or
- by post: 6-3 Džiujois Rinkas Street, LT-57248 Kedainiai.
Contact details of the Data Protection Officer: pareigunas@kedainiutvic.lt
If we are unable to reach a mutual solution, you have the right to contact the State Data Protection Inspectorate (www.ada.lt), which is responsible for supervising and monitoring compliance with legislation governing the protection of personal data.
XI. For candidates applying for positions at the Centre
When we collect CVs from potential candidates via job portals, such as CVonline, CVlt, LinkedIn and so on, we retain these CVs for no longer than one year from the date the recruitment process is completed (i.e. after an employment contract has been signed with the selected candidate).
If you send us your CV to the Centre’s email addresses at a time when no recruitment is being advertised – i.e. when we are not looking for new staff – we do not collect or store your CV, but destroy it immediately.
For the purposes of the Centre’s legitimate interests:
- the contact details of the Centre’s employees (first name, surname, position, work email address and work telephone number) are published openly;
- moments from the Centre’s events, excursions, trips and so on, in which Centre staff always take part, are captured in photographs and published on the Centre’s website or on social media; therefore, if you find these rules unacceptable, please consider this rule carefully before applying for a job at the Centre.
XII. How will I be informed of changes to this Policy?
As we continually improve and develop our Services, we may from time to time make changes to this Privacy Policy.
This Privacy Policy may be updated to correct errors, add information, provide further clarification or comply with new legislation or technical requirements. Such changes will not result in any restriction of your rights.
In the event of significant changes to this Privacy Policy, we will publish an updated version of the Policy on our website. For this reason, we recommend that you visit our website from time to time, where you will always be able to find the most recent version of this Privacy Policy.
XIII. How do we use cookies?
Yes, the Centre uses cookies — small text files that are stored on your computer, smartphone or other device to improve the website’s performance and make it easier to use. You can read the Centre’s cookie policy here.
If you are already using or plan to use our ‘Visit Kėdainiai’ mobile app, which can be downloaded free of charge from the Google Play Store (Android) and the App Store (iOS), please familiarise yourself with the privacy policies of these platforms — Google Play and the App Store.
