Privacy policy
UAB LEOVIRA
PERSONAL DATA PROCESSING RULES
CHAPTER I
GENERAL PROVISIONS
- The rules of personal data processing of UAB LEOVIRA (hereinafter – the Company) or otherwise may
be referred to as the Privacy Policy (hereinafter – the Rules) regulate the purposes of processing personal data of natural persons whose
data are processed by the Company, establish the
procedure for exercising their rights, establish organizational and technical data protection measures,
regulate the use of a personal data processor. - These Rules have been prepared on the basis of:
2.1. The Law on the Legal Protection of Personal Data of the Republic of Lithuania (hereinafter – ADTAĮ);
2.2. The General Regulation on the Protection of Personal Data (hereinafter referred to as the BDAR);
2.3. Government of the Republic of Lithuania 2001 February 28 by resolution no. 228 “On Approval of the Remuneration Procedure for the Provision of
Data to the Data Subject and the Remuneration Procedure for the Collection of Data from Registered Data
Controllers”;
2.4. other legislation relating to the processing and protection of personal data. - These Rules shall apply to the automatic processing of personal data, as well as to the
non-automatic processing of personalized personal data files. These Rules
also set out the rights, duties and responsibilities of the Company’s employees in processing personal data. - The requirements of these Rules are obligatory for all employees of the Company (hereinafter – the Employees) who process personal data in the Company or become aware of them
while performing their duties .
These Rules must also be complied with by data processors who, while providing
data processing services to the Company, become aware of and process personal data, to the extent
not otherwise regulated by additional agreements with the Company and data processors.
CHAPTER II
KEY DEFINITIONS
- “Personal data” means any information relating to an identified
or identifiable individual, directly or indirectly, in particular by means of an
identifier such as a name, a personal identification number, a location data and an Internet
identifier, or one or more several characteristics of the physical, physiological, genetic,
mental, economic, cultural or social identity of that natural person. - “Data processing” means any
operation or sequence of operations on personal data or personal data sets carried out by automated or non-automated means,
such as collecting, recording, sorting, organizing, adapting or modifying,
extracting, accessing, using, disclosing, transmitting, distributing or otherwise making
them available, as well as collating or merging with other data,
restricting, deleting or destroying them. - Data controller – UAB LEOVIRA, which, when processing the data of natural persons and Employees
, determines the methods and means of using those data. - Data subject – Employees and other natural persons whose data are processed by UAB
LEOVIRA. - Data controller – entities that process personal data managed
by UAB LEOVIRA in accordance with the instructions of UAB LEOVIRA in accordance with the concluded service provision agreements.
APPROVED: 2018 of the General Director of
UAB LEOVIRA November 12 by Order No. 169 2
- Provision of data – disclosure of personal data by transmission or other making
available (except for publication in the media). - Internal administration – activities that ensure the independent
functioning of the data controller (structure management, personnel management,
management and use of available material and financial resources, clerical management). - Other terms used in the Rules shall be understood as they are defined in the ADTA and / or
BDAR.
CHAPTER III
PRINCIPLES AND OBJECTIVES OF THE PROCESSING OF PERSONAL DATA
- Employees, while performing their duties and processing personal data, must:
13.1. to process personal data lawfully, fairly and transparently;
13.2. to be collected for specified, explicit and legitimate purposes and not further processed in
a way incompatible with those purposes;
13.3. to comply with the principles of purposefulness, proportionality and minimization of the collection and processing of personal data
, not to require the provision of data that is not necessary, does not collect and does
not process redundant data;
13.4. ensure the accuracy of personal data and, if necessary for the processing of personal data, keep them up to
date; to correct, supplement, destroy or
suspend the processing of inaccurate or incomplete data;
13.5. to store personal data in such a form that the data subjects can be identified for
no longer than is necessary for the purposes for which the data were collected and processed;
13.6. to process personal data in such a way as
to ensure adequate security of personal data through appropriate technical or organizational measures, including protection against
unauthorized or unlawful processing of data and against unintentional loss,
destruction or damage (principle of integrity and confidentiality). - Accountant Jelena Kravčun is responsible for updating the data of data subjects in the Company.
- Information about the Data Subject must be provided if required by
law.
CHAPTER IV
PURPOSE, SOURCES, PROVISION AND STORAGE OF DATA PROCESSING
- Personal data of the Company’s Data Subjects shall be processed:
16.1. for the purpose of internal administration;
16.2. for the purpose of the provision of services, performance of a contract, consultancy or the protection of persons and property. - Rules 16.1. p. for the purpose specified, such personal data of the Employees is collected and
processed as is necessary for the
purpose of concluding, executing and terminating the employment contract with them (name, surname, personal identification number, date of birth,
address of residence, social security number, identity document data) ,
e – mail address, telephone number, data on education, professional experience,
qualifications, position, salary, bank account number, hours worked, accrued,
used leave, marital status, citizenship, image (photos)). Photos of the Company’s
Employees and information about their professional experience and education may be posted
On the Company’s website at www.leovira.lt, in order to ensure the legitimate
interests of the Company to inform and acquaint the Company’s customers and partners with
the provided services / goods and their quality.
APPROVED: 2018 of the General Director of
UAB LEOVIRA November 12 by Order No. 169 3
- The Company’s processing of data in accordance with Rule 16.1. p. for the specified purpose, personal data is
obtained directly from the Employees. The Company does not transfer this data to any data
recipients, except in cases provided by law, when such transfer would be required by legal acts
or a binding decision of a court or other institution. Employee data is stored in
accordance with the requirements established by legal acts (
index of general terms of storage of documents approved by the Chief Archivist of Lithuania). When processing data in accordance with Article
16.1. p. for the purpose specified, obtains the data on the basis of performance of the contract and / or consent
. - The Company’s processing of data in accordance with Rule 16.2. p. The following personal data may be collected and processed from Data Subjects for the purposes specified
: name, surname, personal identification number, date of birth,
address of residence, identity document data, e-mail
data, telephone number, gender, date of application, address, image and other data necessary for
the performance of the contract or provided by the Data Subject himself. - 16.2 of these Rules when processing data by the Company. p. for this purpose, this data is obtained
directly from the Data Subjects themselves or from the video cameras.
CHAPTER V
PROCESSING OF STAFF DATA FOR INTERNAL ADMINISTRATION
- For the purposes of internal administration, the Company processes the following personal Data: name, surname,
date of birth, address, personal identification code, passport or identity card data, social
insurance number, bank account number, tel. number, e-mail p. address, state of health
(data of a personal medical certificate for work), education, image or other data
necessary for internal administration and data which must be processed in accordance with
the requirements of the applicable legal acts. - Employee Data is obtained directly from the Data Subjects, the State Tax
Inspectorate under the Ministry of Finance of the Republic of Lithuania, SODRA. - Employee Data is systematically processed in a database, which is accessible to
the Company’s administration, employees of the company providing accounting services and IT
service providers. - Sodra is a regular recipient of Employee Data. Data are provided to the Social Security through the
Electronic Policyholder Support System (EDAS). - Employee Data may be transferred to other Third Parties only upon their request and
on a legitimate basis for the transfer.
CHAPTER
VI DATA PROCESSING OF CANDIDATES FOR VACANCIES
- The Company manages the following data of persons who wish to participate in the
selection of employees by the Company Data: name, surname, date of birth, address, tel. number, e-mail p. address,
education, other data specified in the
documents submitted by the candidates to the Company, including CV. - In the event that the legal acts of the Republic of Lithuania provide for additional restrictions on the
information that may be processed about candidates, the Data Controller shall ensure that
only the personal data of candidates that may be processed are processed. - The basis for data processing is Consent. Candidates for vacancies are given a
meeting (by tacit action) to process their data only until the end of the selection.
At the end of the selection, the data of the candidates not selected for the vacancy shall be deleted,
unless the candidates give their explicit consent to the processing of the data at the end of the selection.
APPROVED: 2018 of the General Director of
UAB LEOVIRA November 12 by Order No. 169 4
- The purpose of data processing is internal administration.
- Candidates’ data are obtained directly from the candidates themselves.
- Data from candidates shall not be provided to other Third Parties unless at their request and on a
legitimate basis for transfer.
CHAPTER VII
DATA PROCESSING OF SERVICE PROVIDERS AND RECIPIENTS
- Although the main providers and recipients of the Company’s services are legal entities, in
some cases the data of natural persons are also processed. The Company handles the following data of the persons with
whom service contracts have been concluded Data: name, surname, date of birth, address, personal identification
code, other data necessary for concluding and executing the contract. - The basis and purpose of data processing is the conclusion and performance of the contract.
- Data are obtained directly from the Data Subject.
- Public institutions and IT service providers are regular recipients of data. Data may only be transferred to other
third parties at their request and on a lawful
basis.
CHAPTER VIII ADMINISTRATION, EVALUATION AND EXAMINATION
OF REQUESTS, INQUIRIES AND COMPLAINTS
- The Company handles the following inquiries or complaints of persons who submit a request, complaint on the Company
‘s website Data: name, telephone number, e-mail p. address, details
provided in the request, inquiry or complaint. - The basis for data processing is consent and / or a legitimate interest.
- The purpose of data processing is the administration, evaluation and examination of requests, inquiries and complaints of individuals .
- The regular recipients of the Data are the IT service providers. Data shall not be provided to other Third Parties
unless at their sole request and on a legitimate basis for transfer.
CHAPTER IX
PROTECTION OF PERSONS AND PROPERTY, PREVENTION AND DETECTION OF ILLEGAL ACTIVITIES
(VIDEO SURVEILLANCE)
- The purpose of video surveillance is to ensure the security of the Employees and visitors, the general order,
to protect the property of the Data Controller, its Employees and visitors. - Video surveillance in the Company is performed at Žarijų st. 4, Vilnius. The image is monitored
in the premises and outdoor area owned by the Company (hereinafter – the Territory). - The video surveillance shall be continuous and the cameras shall be installed in such a way that the video surveillance of the video
surveillance is carried out in a larger part of the premises than is necessary and there is no more video
data than is necessary. - Video surveillance shall not be carried out in premises where the Data Subject has a reasonable expectation
of absolute protection of privacy and where such surveillance would degrade human dignity (eg
toilets, changing rooms, etc.). - Employees shall be informed about the video surveillance by acquainting them with these
Rules and informing them about the personal data processed by them. - The Data Controller shall inform the Employees and other persons about the performed Video
Surveillance by posting information boards and signs in the Territory. Before entering
APPROVED: 2018 of the General Director of
UAB LEOVIRA November 12 by Order No. 169 5
The following information must be clearly and properly provided to the Data Subject: i)
Name, company code, contact information (address and / or
telephone number) of the Data Controller; (ii) a link to a website containing these rules.
- Video data may be submitted by the data controller to a pre-trial investigation institution,
a prosecutor or a court in connection with administrative, civil or criminal cases in their possession, as
evidence or in other cases established by legal acts.
CHAPTER X
COOKIES
- In order to improve the quality of browsing the website www.leovira.lt and the services provided on it, the Company
uses cookies on it. The Company’s website may use
third-party analytics cookies – Google Analytics. - The following cookies are used or may be used on the Company’s website.
| The name of the cookie | Description | The moment of creation | Expiry date | Data used |
| CMSSESSIDX | A standard cookie used to support a user session | At the time of entering the page | Until the website window is closed | Session data |
| _utma, _utmb, _utmc | Tracking cookies from Google Analytics. The information is sent to the server anonymously. Cookies identify unique visitors and track user sessions. For more information, see On the Google website. | At the first entry to the page | Respectively 30 minutes, 6 months, 2 years | Statistical accounting result. Meter accounting is done through Google Analytics. |
| _utmz | Tracking cookies from Google Analytics. The information is sent to the server anonymously. | At the first entry to the page | Until the browser is closed | Statistical accounting result. Meter accounting is done through Google Analytics. |
| _ga | A unique ID is used to compile statistics about how a visitor is using the site. | At the first entry to the page | 2 years | Unique identifier |
| _gid | A unique ID is used to compile statistics about how a visitor is using the site. | At the time of entering the page | Until the browser is closed | Unique identifier |
| _gat | Used to increase the speed of Google Analytics queries. | At the time of entering the page | Until the browser is closed | Unique identifier |
| _gat_UA-57763338-1 | A cookie collects information about user behavior on a website and is used to distinguish unique users by assigning them a unique identifier (ID). | At the time of entering the page | 8 p.m. | Unique identifier |
| ads / ga-audiences | Uses Google AdWords to re-engage visitors who are most likely to convert into customers based on their online behavior on sites. | At the time of entering the page | Until the browser is closed | Unique identifier |
| collect | Used to send data to Google Analytics about a visitor’s device and behavior. Tracks visitor on devices and marketing channels. | At the time of entering the page | Until the browser is closed | Statistical accounting result. |
| eCookieAccept | The cookie is stored when the user agrees to our cookie policy | When a user clicks “I Agree” to the site’s cookie policy | 1 year | Unique identifier |
APPROVED: 2018 of the General Director of
UAB LEOVIRA November 12 Order No. 169 6 which is used to compile statistics on how a visitor uses the site. _gid Logs a unique ID that is used to generate statistics about how a visitor is using the site. On page access Until the browser is closed Unique identifier _gat Used for Google Analytics query speed
increase.
On page access Until the browser
is closed Unique Identifier _gat_UA57763338-1 The cookie collects information about user behavior on the site and is used to distinguish unique users by assigning them a unique identifier (ID). At the time of entering the page at 8 p.m. Unique identifier ads / gaaudiences Uses Google AdWords to re- engage the most likely visitors to convert to
customers
based on the online behavior of
visitors to the sites. Page Login Until Browser Closes Unique Identifier collect Used to send data to Google Analytics on Page Logout Until Browser Closes Statistical accounting result.
APPROVED: 2018 of the General Director of
UAB LEOVIRA November 12 Order No. 169 of the 7 visitor’s facility and behavior. Tracks visitor on devices and marketing channels.
- Companies collect data on the actions of visitors and their browsing habits on the
website. - For more information, please visit: http://www.google.com/analytics.
- To learn how to disable tracking of web pages with Google Analytics
cookies, you can visit: http://tools.google.com/dlpage/gaoptout. - Data is transmitted to IT service providers and Google. Data shall not be provided to other Third Parties
unless at their sole request and on a legitimate basis for transfer. - The website does not provide for the possibility to choose not to accept the use of cookies,
therefore, in order to prevent the processing of personal data, Data Subjects should delete
cookies manually and stop using the page.
CHAPTER XI
DATA RETENTION TERMS
- The data controller shall apply the following terms of storage of personal data:
Nr. Purpose of processing personal data Retention period
1. Processing of employee data for internal
administration purposes
Up to 50 years after the
end of the employment contract, in accordance with the General
Document Retention Period
Index
2.
Processing of personal data of job candidates
Until the end of the competition
3.
Processing of personal data of job candidates after obtaining their permission to process the data
after the end of the competition. years from the date of receipt
of the curriculum vitae 4. Provision of services Data shall be processed within the time limits provided for in legal acts, ie no more thanthan 10 years 5. Administration, evaluation and processing of
requests, inquiries, complaints 6 months from the date of receipt of the life request 6. Cookies to improve the quality of use of the site The duration of the cookie’s stay on the computer depends on the type of cookie. 7. Protection of persons and property, prevention and detection of illegal acts with the help of video cameras for 14 days.
APPROVED: 2018 of the General Director of
UAB LEOVIRA November 12 by Order No. 169 8
- Exceptions to the above retention periods may be made to the extent that such
deviations do not infringe the rights of Data Subjects, comply with legal requirements and are
properly documented.
CHAPTER XII
RIGHTS OF DATA SUBJECTS AND PROCEDURES FOR THEIR EXERCISE
Ensuring the rights and awareness of data subjects
- Data subjects have the right to:
56.1. know (be informed) about the processing of your personal data;
56.2. upon submission to the Company of an identity document or by electronic means of communication that
allow proper identification of a person, access to his personal data and their processing,
obtain information from which sources and what personal data is collected, for what purpose they are
processed, to whom data recipients are provided and provided for at least the last 1 year,
as well as to receive a copy of the documents containing their personal data;
56.3. require the rectification, erasure or restriction of the processing of personal data, with the exception of
storage where the data are processed in breach of legal requirements;
56.4. not consent to the processing of his personal data;
56.5. to require the transfer of data to another data controller or to submit it directly to the Data
Subject in a form convenient for them (the data provided to the Company by the Data Subject itself);
56.6. lodge a complaint with the supervisory authority;
56.7. revoke the consent given (if personal data are processed on the basis of consent). - In all cases, the Company must provide information to the Data Subject (except in cases
where the Data Subject already has such information):
57.1. its name, legal entity code and registered office;
57.2. the contact details of the Data Protection Officer, if any;
57.3. for what purposes and on what legal basis the personal data of the Data Subject are processed;
57.4. data recipients, their categories;
57.5. the data retention period or the criteria used to determine that period;
57.6. other additional information (what personal data the Data Subject must
provide and what are the consequences of not providing the data, about the Data Subject’s right
access to your personal data and the right to request the correction of incorrect, incomplete,
inaccurate personal data) to the extent necessary to ensure the fair processing of personal
data without prejudice to the rights of the Data Subject;
57.7. on the transfer of his personal data to third parties at the latest by the time the
data are first provided and if the Data Subject was not aware that the data would be
transferred to another party.
Procedure for exercising the rights of the data subject - The Company must:
58.1. to enable the Data Subject to exercise the rights of the Data Subject specified in Chapter XII of these Rules
, except for cases established by law when it is necessary to ensure state
security or defense, public order, prevention, investigation, detection or
prosecution of criminal offenses, important economic or financial interests, official
or prevention, investigation and detection of violations of professional ethics,
protection of the rights and freedoms of the Data Subject or other persons;
APPROVED: 2018 of the General Director of
UAB LEOVIRA November 12 by Order No. 169 9
58.2. Data subjects regarding the implementation of the rights specified in Chapter XII of these Rules must
contact the Company’s administration at the following contacts: 8 5 264 0381 or by e-mail
info@leovira.lt.
58.3. The Company must ensure that all necessary information is provided to the Data Subject
in a clear and comprehensible manner.
58.4. The response must be provided to the data subject no later than within 20 (twenty) working
days from the date of receipt of the request. If the provision of data to the Data Subject is refused, a
reasoned and reasoned reply must be provided to the Data Subject regarding the non-execution of his / her request.
- The Company must immediately inform the data recipients about
the personal data corrected or destroyed at the request of the Data Subject, the processing of personal data has been suspended,
unless it would be impossible or excessively difficult to provide such information (due to the
large number of Data Subjects, data period, unreasonable costs) .
In this case, the State Data Protection Inspectorate must be notified immediately. - The Company shall provide data to the Data Subject free of charge. In certain cases (when the
Data Subject manifestly abuses its rights, unreasonably repeated
requests for information, extracts, documents), such provision of information and data to the
Data Subject may be charged in accordance with the requirements of legal acts and
the fees set by the Company.
Provision of data to data recipients - The Company shall provide data of data subjects to data recipients only without prejudice to
the requirements established by legal acts and ensuring the confidentiality of personal data in accordance with
the concluded agreement or a one-time request of the data recipient. - In case of one-time data provision, the Company, when providing personal data upon
the request of the data recipient, gives priority to the provision of data by electronic means. - The provision of personal data to state and municipal institutions and bodies, when these
institutions and bodies receive personal data for the
performance of control functions established by law upon a specific request, shall not be considered as the provision of data to data recipients.
CHAPTER XIII
ORGANIZATIONAL AND TECHNICAL
MEASURES FOR THE PROTECTION OF PERSONAL DATA
- The Company makes every effort to ensure that the Company’s organizational and technical data
security measures comply with the requirements of the BDAR. In order to protect personal data from
accidental or unlawful destruction, alteration, disclosure, or any other unlawful
processing, the following infrastructural, administrative and telecommunication
(electronic) measures shall be applied:
64.1. proper layout and maintenance of technical equipment, maintenance of information systems, network
management, ensuring the security of the use of the Internet and other information technology
measures:
64.2. access to the Data and the right to perform Data Processing Actions is granted only to those
For employees who need access to personal data in accordance with their position and
the functions they perform.
64.3. the security of the premises where personal data is stored is ensured (only authorized
persons have access to the relevant premises).
64.4. if a computer or Electronic Communication Device is assigned to a specific Employee, such
Computer / Electronic Communication Device (s) must be password protected.
APPROVED: 2018 of the General Director of
UAB LEOVIRA November 12 by Order No. 169 10
Passwords must be changed periodically, as well as in certain circumstances
(change of employee, threat of burglary, suspicion that the password has become
known to third parties, etc.).
64.5. the protection of personal data against unauthorized access to the internal computer
network by electronic means is ensured.
64.6. the use of secure protocols for the transmission of personal data over external
data networks is ensured.
64.7. strict compliance with the norms set by the Fire Protection Service;
64.8. proper organization of work and other administrative measures;
64.9. the necessary data security measures are implemented, taking into account the
results of the risk assessment;
64.10. data backup and recovery;
64.11. ensure recovery of data from the last available backup data in case of
loss of data due to hardware failure, software error
or other data integrity failure;
64.12. other measures.
65.
The Head of the Company Donatas Virbickas is responsible for the implementation, control and assurance of these planned organizational and technical data security measures.
- Employees who process personal data shall be bound by the obligation of confidentiality and shall keep
confidential any relevant information which they obtain in the course of their duties. This
obligation remains in force upon transfer to another position in the Company or upon termination of employment or
contractual relationship with the Company. - Employees may process personal data automatically only after they have been granted
access to the relevant information system. Access to personal data may only be
granted to a person who needs personal data to perform his or her functions.
Upon termination of the employment relationship, the Employee’s access rights to the registers and other programs are
revoked. - Employees may transfer documents containing personal data only to those
Employees who have the right to work with personal
data in accordance with their duties or individual assignments. - Employees performing data processing functions of the Data Subject shall prevent
accidental or illegal processing, shall keep documents properly and securely (avoiding
the accumulation of unnecessary copies with the Data Subject’s data, etc.). Copies of documents
containing the data subject’s data must be destroyed in such a way that
their contents cannot be reproduced and identified. - Employees on whose computers the Data is stored or from whose computers
access to the Company’s information systems in which the Data is stored
must use passwords on their computers; Users of the “guest” type, ie not protected by
passwords, are prohibited. These computers also require the use of
a screen saver with a password. - Unless necessary, files with Data shall not be reproduced digitally, ie
copies of files shall be made on local computer disks, portable media,
remote file storage, etc. - The security control and deletion of personal data contained in external data carriers and electronic mail
after their use shall be ensured by transferring them to databases. - Accountant Jelena Kravčun must ensure:
73.1. control of unauthorized access to the server premises;
73.2. protection of the Company’s internal computer network.
APPROVED: 2018 of the General Director of
UAB LEOVIRA November 12 by Order No. 169 11
- Employees must organize their work in such a way as to restrict, as far as possible, the access of other
persons to the personal data processed. This provision shall be implemented:
74.1. without leaving documents with processed personal data or a computer that can be used
to open files with personal data without supervision so that the
information contained in them can be read by Employees who do not have the right to work with specific personal
data, students or other persons;
74.2. keeping documents in such a way that they (or fragments thereof) cannot be read by random persons;
74.3. if documents containing personal data, to other Employees, divisions, institutions
transmitted by persons who do not have the right to process personal data, or by post or
courier, they must be transmitted in a sealed opaque envelope. This paragraph shall
not apply if the said notices are served in person and in confidence. - Accountant Jelena Kravčun for managing personal data breaches and responding to them.
CHAPTER XIV
FINAL PROVISIONS
- All Employees of the Company must get acquainted with these Rules.
- The Rules, their amendments or supplements are published on the Company’s website
www.leovira.lt. - Employees, if their personal data changes, inform the Company’s
administration about it in writing, by the following contacts: 8 5 264 0381 or by e-mail info@leovira.lt, which will
update and update the data within 3 (three) working days at the latest. personal data in
files and in dedicated databases. - The accountant Jelena Kravčun is responsible for the supervision of the observance of the provisions of the Rules and the control
and periodicity of the implementation of the provisions regulated therein, at least once a year, reviewing and updating the Rules as necessary.