These Personal Data Processing Rules (hereinafter the Rules) provide information on how the UAB EKOPRODUKTAS manages personal data in order to ensure compliance with and implementation of the Law on Legal Protection of Personal Data of the Republic of Lithuania, other laws and legal acts regulating the processing and protection of personal data.
UAB EKOPRODUKTAS employees that are authorized to handle personal data, must comply with these Rules and must be acknowledged with them by signing. The employees of the company, in the performance of their duties and in the processing of personal data, must observe the basic principles of personal data processing and the confidentiality and security requirements set forth in the normative acts and these Rules.
These Principles apply to UAB EKOPRODUKTAS, and the Customers who use, have used, expressed their intention to use or are otherwise related to the services provided by UAB EKOPRODUKTAS, interrelations, including relations with the Customers, which arose prior to the entry into force of these Principles.
The Data Subject is any natural person whose identity is known or may be determined, directly or indirectly, using data such as a personal code, one or more personal physical, physiological, psychological, economic, cultural or social characteristics, and the data of which is managed by UAB EKOPRODUKTAS.
Personal Data means any information relating to a natural person identified or identifiable (the data subject) in particular with an identifier, such as their name or last name, personal identification number, location data and Internet identifier, such as a given name, or one or more the attributes of that physical identity;
Data management means any operation or sequence of operations (such as collecting, recording, sorting, organizing, storing, adapting or modifying, extracting, accessing, using, disclosing during transmission, distribution or otherwise making it possible to use them, as well as matching or merging with other data, restriction, erasure or destruction) performed by automated or non-automated means with personal data or personal data sets.
UAB EKOPRODUKTAS is a legal entity that defines the purposes and means of processing the received data.
- General provisions
2.1 These Principles provide general provisions for the processing of Personal Data by UAB EKOPRODUKTAS. Additional information on personal data management may be provided in service contracts and other service-related documents.
2.2. The data provided by the Data Subject can also be used for marketing purposes, where the Data Subject expresses this will with Consent.
2.3. UAB EKOPRODUKTAS ensures the confidentiality of Personal Data in accordance with the requirements of the applicable legal acts and the implementation of appropriate technical and organizational measures for the protection of Personal Data against unauthorized access, disclosure, accidental loss, alteration or destruction or any other unlawful processing.
2.4. For the processing of Personal data UAB EKOPRODUKTAS can use data processors. In such cases, UAB EKOPRODUKTAS shall take the necessary measures to ensure that such data processors handle Personal Data in accordance with the instructions of the UAB EKOPRODUKTAS and the applicable legal acts and require the implementation of appropriate Personal data security measures.
- Personal data categories
Personal data may be obtained directly from Data and external sources, as the state and other third parties. The main categories (including, but not limited to) of Personal data collected by UAB EKOPRODUKTAS are:
Personal identity data such as name, surname, personal identification number, date of birth, identity document (passport, ID card) data.
Contact details like address, phone number, email address, communication language.
Data related to the profession such as data on education and professional activity.
Data related to the provision of services, such as data on performance or non-performance of contracts, transactions concluded, contracts in force or expired, service fees.
Data on behavioral habits, priorities and service satisfaction, such as data on the activity of using the services, the services provided to the Customer, personal settings, Customer’s feedback about the services, information about the way of life, interests, about whether the Customer is satisfied with the services.
Personal data, such as data on the health status of a person.
Health data – personal data relating to physical or mental health of a physical person, including data on the provision of healthcare services, which disclose information on the health status of that individual;
- Objectives and basis for the processing of personal data
The main goals pursued by UAB EKOPRODUKTAS in processing personal data are:
4.1 Maintenance of the relationship with the Data subjects and conclusion, execution and administration of contracts to access the services of UAB EKOPRODUKTAS.
Conclusion and execution of a contract with the Data subject, renewal of data on the Data subject in order to ensure their accuracy by using external and internal registers when necessary for execution of the contract or for the purpose of taking actions at the request of the Customer prior to the conclusion of a contract or performance of a legal obligation.
4.2 Asking for the Data subject’s opinion, market research and collection of statistical data
Offering of services for the Data subject by UAB EKOPRODUKTAS, or UAB EKOPRODUKTAS’ responsibly chosen partners, including personal offers with the consent of the Data subject or in pursuit of UAB EKOPRODUKTAS legitimate interest to offer additional services.
4.3 Compliance with legal obligations and identification
In compliance with the requirements of legal acts and international agreements, in order to act at the request of the Data subject prior to the conclusion of a contract or performance of a legal obligation or in pursuit of UAB EKOPRODUKTAS legitimate interest to ensure the proper management of risk and organization.
4.4. Prevention of the abuse of services and assurance of proper provision of services
In order to allow access to and control over the use and operation of electronic channels, to prevent unauthorized access and its unlawful use, for the purpose of securing information when it is necessary for execution of the contract, in order to take actions at the request of the Data subject prior to the conclusion of a contract or performance of a legal obligation, or in pursuit of UAB EKOPRODUKTAS legitimate interest related to the creation of possibility to use electronic services of UAB EKOPRODUKTAS, their use and control of their operation.
In order to improve the technical means of information technology infrastructure, ensure the adaptation of the service to the equipment used, create new UAB EKOPRODUKTAS services, testing and upgrading technical equipment and IT infrastructure, in pursuit of UAB EKOPRODUKTAS legitimate interest to develop technical tools and IT infrastructure.
4.5 Filing, executing and protecting legal requirements
For the purpose of filing, executing, assigning and protecting legal requirements, in cases when it is necessary for execution of the contract, in order to take actions at the request of the Customer before the conclusion of the contract or performance of a legal obligation, or in pursuit of UAB EKOPRODUKTAS legitimate interest related to the execution of legal requirements.
4.6 Compliance with the principles of personal data management
While processing personal data, the main principles of processing personal data must be respected:
• Personal data must be handled accurately, honestly and lawfully;
• Personal data must be collected for the purposes specified in these Rules and then handled in a manner compatible with these purposes;
• Personal data must be accurate and kept up-to-date, if necessary, for the processing of personal data;
• Personal data must be identical, suitable and only to the extent that is necessary for them to be collected and further processed;
• Personal data must be stored for no longer than what is required by the data processing objectives.
- Personal data recipients
Personal data is transferred to recipients, such as:
5.1 Public bodies and institutions and other persons carrying out the functions assigned to them by law (e.g. law enforcement agencies, bailiffs, notaries, tax administration, UAB EKOPRODUKTAS supervisory authorities, financial crime investigation institutions).
5.2. Legal entities belonging to UAB EKOPRODUKTAS group.
5.4 UAB EKOPRODUKTAS auditors, legal and financial advisers, authorized data managers.
5.5 Third parties managing registers (including credit registers, Population register, Register of Legal Entities, securities registers or other registers processing personal data), or which mediate providing personal data from such registers.
5.6 Debt collection companies to which requirements to Data subject information are transferred.
- Geographical area of processing
6.1 As a general rule, personal data is processed within the territory of the European Union / European Economic Area (EU / EEA), but may, in certain cases, be transferred and processed outside the EU / EEA.
6.2 Personal data may be transferred and processed outside the EU / EEA area, where the transfer is necessary for the conclusion and execution of the contract or Customer has given its consent, and if appropriate safety measures are implemented. Appropriate safety measures include:
• A contract has been concluded that includes standard terms or other approved clauses adopted by the EU Commission, codes of conduct, certificates, etc., approved in accordance with the General Data Protection Regulation;
• A country outside the EU / EEA, where the recipient of Personal data exists, ensures an adequate level of protection of personal data by a decision of the EU Commission;
• The recipient is certified in accordance with the Data Protection Agreement between the EU and the United States (US) (also known as the “Privacy Shield”) (applicable to recipients located in the US)
6.3. Upon request, the Customer may receive further information on the transfer of Personal Data outside the EU / EEA.
- Period of protection of personal data and confidentiality
7.1 Personal data is processed for no longer than is necessary. The period of personal data storage is defined considering the nature of the contracts concluded with the Data subject, legitimate interest of UAB EKOPRODUKTAS, or legal requirements.
7.2 The employees of the company, who have been ordered by the manager to process Personal data, must observe the principle of confidentiality and keep confidential any information relating to Personal data with which they became aware during the performance of their duties, unless such information is public in accordance with the provisions of applicable laws and regulations. The obligation to protect the confidentiality of personal data applies equally after the transition to another position, upon termination of employment or contractual relations.
7.3 The head of the company shall appoint a responsible employee by appointment, who shall upon signing, introduce the newly recruited staff with the Rules and ensure the implementation of these Rules. (Depending on the scope of the data processed and the compatibility of the assigned functions, the Company may appoint one or several responsible employees.)
7.4 Employees may only access and use documents and data files that they have been authorized to access and process.
7.5 The employees of the company must take measures to prevent accidental or unlawful destruction, alteration, disclosure of personal data, as well as any other unlawful processing, by keeping documents and data files in an appropriate and safe manner and avoiding unnecessary duplication.
7.6 Employees, who automatically process personal data or from which computers there is a possible access to the areas of the local network where personal data is stored, must use the generated passwords. Passwords must be changed periodically, at least once every three months, as well as in certain circumstances (e.g. when an employee changes, in the event of an intrusion threat, suspicion that the password has become known to third parties, etc.). An employee of the company working on a specific computer can only know his/her own password.
- Rights of the Customer as a Data subject
The rights of the data subject guaranteed to him/her in respect of the processing of his/her Personal Data include the right to:
8.1 Demand to correct his/her Personal Data if they are incorrect, incomplete or inaccurate. To demand correcting, destroying his/her Personal data or stopping his/her personal data processing operations when the data are incorrect, incomplete or inaccurate, or processed by violation of the provisions of the regulatory acts.
8.2 Disagree on the processing of his/her Personal Data, provided that the basis for the processing of personal data is legitimate interests, including profiling for direct marketing purposes (e.g. receipt of marketing proposals or participation in surveys).
8.3 Require the deletion of his/her Personal Data, which is processed only with his/her consent, if the Data Subject withdraws the corresponding consent. This right does not apply if the Personal Data requested to be erased is also handled on another legal basis, such as the processing necessary for the performance of the contract or the obligations under the applicable law.
8.4 Restrict the processing of his/her Personal Data in accordance with the applicable legislation, e.g. for the period during which UAB EKOPRODUKTAS will assess whether the Customer has the right to request for his/her Personal Data to be erased.
8.5. Receive information on whether or not UAB EKOPRODUKTAS manages his/her Personal Data and, if so, to get acquainted with them.
8.6 Obtain his/her own Personal Data that is processed on the basis of his/her consent or execution of the contract, in written or generally used electronic form and, if possible, transfer such data to another service provider (data portability).
8.7 To cancel his/her consent to process Personal Data.
8.8 Not agree to be covered by a fully automated decision, including profiling, if such decision making has legal consequences or a similar significant effect on the Customer. This right does not apply in the event if such decision making is necessary for the purpose of concluding or executing a contract with the Customer, is permitted by applicable law, or the Customer has given explicit consent thereto.
8.9. Submit a complaint regarding the processing of personal data to the State Data Protection Inspectorate, the website of which is www.ada.lt, if the Customer considers that his/her Personal Information is being processed in violation of his/her rights and legitimate interests in accordance with the applicable legislation.
- Contact information
9.1. The data subject has the right to apply to UAB EKOPRODUKTAS in order to submit inquiries, cancel given permissions, submit requests for the execution of the rights of the Data Subject and complaints regarding the processing of personal data.
9.2 The contact details of UAB Ekoproduktas are published on the website of UAB EKOPRODUKTAS at www.ekoproduktas.com.
9.3 The contact details of the Data Protection Officer appointed by UAB EKOPRODUKTAS are published on the website of UAB EKOPRODUKTAS at www.ekoproduktas.com
- Validity and modification of the principles
10.1 Customers can get acquainted with these Rules on the website of UAB EKOPRODUKTAS at www.ekoproduktas.com.
10.2. UAB EKOPRODUKTAS has the right at any time to unilaterally change these Rules, informing the Customer about the changes by publishing them on the website of UAB EKOPRODUKTAS.
10.3. The Company’s Personal Data Processing Rules are prepared in two languages – Lithuanian and English.