LT

PRIVACY NOTICE

I. GENERAL PROVISIONS

1. This privacy notice (hereinafter referred to as “the Notice”) shall be applicable to the relationship between Kalnapilio-Tauro grupė UAB (hereinafter referred to as “the company”), legal entity code 121958128, registered at the address Taikos al. 1, 35147 Panevėžys, and natural persons who purchase goods from, provide services to or otherwise interact with the company (hereinafter referred to as “you”), including the use of the company’s website or communication with the company on social networks.

2. The company processes your personal data in accordance with the General Data Protection Regulation (EU) 2016/679, the Law of the Republic of Lithuania on the Legal Protection of Personal Data, other laws and subordinate legal acts.

3. The company shall ensure the protection of personal data in accordance with the requirements of the applicable legislation and the implementation of appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, accidental loss, alteration or destruction, or any other unlawful processing.

II. CONTACT INFORMATION

4. The controller of personal data is Kalnapilio-Tauro grupė UAB, legal entity code 121958128, address: Taikos al. 1, 35147 Panevėžys, e-mail: info@kalnapilis.lt, tel. No.: +370 5 262 7526, +370 45 505 223.

III. LEGAL BASIS AND PURPOSES OF THE PROCESSING OF YOUR PERSONAL DATA

5. The company processes personal data (name, surname, address and other data provided by the person to the company) provided by natural persons who have submitted their application, complaint, inquiry or otherwise contact the company in writing (including e-mail, mail, social networks, as well as in procedural documents), as well as the company’s reply on the legal basis of consent or legal interest (depending on the contents of the request, complaint, inquiry or other application and other circumstances), for the purposes of examination of and replying to that request, complaint, inquiry or other application.

6. The company processes the personal data of natural persons calling the number of the company’s call centre + 370 45 505 111 (the telephone number, call record and other data provided during the call) on the basis of its legitimate interest, for the purposes of examination and responding to the request and ensuring the quality of the service. Before the conversation, the calling person shall be informed of the intention to record the conversation.

7. The company processes the personal data of the company’s job candidates (name, surname, CV and other data provided to the company) on the basis of the company’s legitimate interest (selection for vacancies), selection for a particular position, to determine the suitability of the candidate for the job position. If the company obtains information on the candidate and/or candidate data from the websites of job-search service providers, career social networks and/or other entities providing job search, selection and/or intermediation services, the company shall consider that the candidate for the job at the company has already been informed of the processing of his/her personal data and has consented to such processing of his/her personal data by the entity (or his/her data are processed on another legitimate basis), which also includes the right to provide his/her personal data to potential employers (including the company) for the processing of candidate data during staff selection. The company may review job candidate profiles on career social networks (such as LinkedIn) and the information contained therein on the basis of a legitimate interest, in order to assess whether the information provided by the candidate to the company corresponds to the information made publicly available by the candidate on the professional social networks. If a candidate and the company conclude a contract, the data on the candidate obtained during the selection procedure shall be transferred to the employee’s file. If the candidate and the company do not conclude an employment contract, at the end of the selection, the company shall process the data relating to the candidate only if the candidate gives the company his/her explicit consent to process his/her data after the end of the selection, and such data shall be processed on the legal basis of consent, with the aim of inviting the candidate to participate in future selections of employees carried out by the company.

8. In order to protect the company’s assets, video surveillance is carried out on the basis of a legitimate interest in certain areas of coverage in the company’s territory. When performing video surveillance, the company collects the following information: videos, video capture date and time, location, your image. Information about video surveillance is provided in the displayed warning signs.

9. The company does not process special categories of personal data relating to you revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health data or data concerning sexual life or sexual orientation.

IV. PERIOD OF PROCESSING OF YOUR PERSONAL DATA

10. The company processes your data as long as it is necessary for the purpose for which the data have been obtained and are used. The company shall define the duration of the processing of personal data in accordance with the nature of the contracts concluded, the requirements laid down by the legal acts and/or the legitimate interest of the company:

10.1. The company processes the personal data (the telephone number, recording of the conversation and other data provided during the conversation) of the natural persons calling the number of the call centre +370 45 505 11 for the period of 30 days and, where the recording of the conversation is related to a dispute, this time limit may be extended until the final settlement of the dispute,

10.2. The company processes the personal data of its job candidates (their name, the data indicated in the CV and related data) received directly from the candidates as well as from internet job search portals, career social media accounts and/or other entities providing job search, selection and/or intermediation services until the end of the specific selection. If, at the end of the selection procedure, the candidate gives the company his/her explicit consent for further processing of his/her data in order to be able to invite him/her to participate in the future selection of company employees, the data shall be processed by the company for a period of 6 months from the date of such consent,

11. In other cases, the company shall define and determine the period of personal data processing taking account of the purpose of the processing of personal data, the requirements of law and/or the legitimate interest of the company, including, but not limited to, the interest in the processing and storage of personal data for the purposes of bringing a potential action of other claim.

12. The retention of your personal data beyond the period defined in the notification can only take place if:

12.1. There is a reasonable suspicion of wrongful act in respect of which investigation is pending,

12.2. Your data are necessary for the proper examination or resolution or settlement of a dispute or complaint,

12.3. This is necessary on another statutory basis, under other conditions or in other cases provided for in the legislation.

V. SOURCES OF YOUR PERSONAL DATA

13. The company may obtain personal data directly from you (for example, as you make telephone calls to the company and by other methods).

14. In certain cases, the company may obtain personal data from the company’s clients (natural and legal persons) who/which provide services to the company, such as persons providing employee selection services.

15. In certain cases, the company may obtain personal data from other data controllers, public authorities and bodies (such as law enforcement authorities, bailiffs), as well as judicial and out-of-court dispute resolution bodies.

16. The list of sources of personal data referred to in this Section is not exhaustive.

VI. TRANSFER AND PROCESSING OF YOUR DATA

17. In some cases, the legal requirements allow of oblige the company to disclose (transfer) personal data to third parties:

17.1. public authorities and bodies performing the functions vested in them by legal acts (such as law enforcement authorities, bailiffs, etc.), as well as courts and out-of-court dispute resolution bodies,

17.2. as well as in other cases not indicated in this notice, in accordance with the requirements laid down by the legal acts.

18. The company may engage processors for the processing of personal data. In such cases, the company shall take the necessary measures to ensure that the processing of personal data by such processors complies with the requirements of confidentiality, the company’s instructions and the applicable legal acts, by implementing appropriate technical and organisational measures for the protection of personal data.

VII. GEOGRAPHICAL AREA OF PROCESSING OF THE PERSONAL DATA RELATING TO YOU

19. Normally the company processes personal data within the territory of the European Union (EU) and the European Economic Area (EEA).

VIII. YOUR RIGHTS

20. You have the following rights:

20.1. The right to know (be informed) of the processing of the personal data relating to you,

20.2. To request the company to access to the processed personal data relating to you. Please note that the right of access may be restricted by legal acts and restrictions on the exercise of rights provided for therein, the protection of privacy and personal data of other persons and other reasons. The right of access may not be applicable to information which constituted the company’s trade secret and/or confidential information, to internal assessments of the company and related materials,

20.3. The right to request the company to correct any incorrect, inaccurate or incomplete personal data relating to you,

20.4. The right to restrict the processing of your personal data until the company has verified the lawfulness of the processing of your personal data upon your request,

20.5. The right to request the company to erase your personal data processed on the legal basis of your consent if such consent is withdrawn. This right shall not be applicable if the personal data requested to be erased are processed on a different legal basis, such as performance of the contract and/or compliance with the requirements of legal acts,

20.6. The right to request the company to transfer your personal data to another controller or to provide them to you directly in a structured, commonly used and machine-readable format (applicable to the personal data you have provided processed on the basis of your consent or a contract entered into with you). The right to transfer data may not be applicable to the company’s trade secrets, internal evaluations of the company and related materials. After having exercised the right to transfer your personal data the company shall not automatically delete the data in its possession. If you wish the company to delete your data, you must apply for the exercise of the right to erasure of your personal data,

20.7. The right to withdraw your consent, which shall not affect the processing of your personal data prior to the withdrawal of your consent,

20.8. The right to object to the processing of your personal data on the basis of a legitimate interest, unless there are legitimate reasons for such processing or for the establishment, exercise or defence of legal claims,

20.9. The right to lodge a complaint with the State Data Protection Inspectorate if you believe that the processing of your personal data breaches the right to the protection of personal data (for more information, please visit the website https://vdai.lrv.lt/, or contact the Inspectorate at the address L. Sapiegos g. 17, 10312 Vilnius or via e-mail ada@ada.lt). Before submitting a complaint to the supervisory authority, we recommend that you contact the company using the contact information provided in Section II of this notice in order to duly address your issue.

IX. EXERCISE OF YOUR RIGHTS

21. Your request to exercise of the aforementioned rights, as well as any complaint, notice, enquiry or other letter relating to the protection or processing of personal data (hereinafter referred to as “the request”) may be submitted as follows:

21.1. At the company’s headquarters located at the address Taikos al. 1, Panevėžys, or A. Goštauto g. 40B, Vilnius, by submitting a written application. Please note that you will be asked to present your identity document by an employee of the company for the verification of your identity,

21.2. By sending your application signed using your electronic signature via email info@kalnapilis.lt.

22. The company shall be entitled to refuse to provide the information you have requested if the request is unjustified or excessive.

23. The company will respond to your request within 1 month of receipt of the request the content of which complies to the applicable requirements. In exceptional cases, after informing you and indicating the circumstances, the company may extend this time limit for 2 additional months.