1. General provisions
1.1 MB Lion's Moustache (hereinafter referred to as the "Company"), while respecting the right to privacy of its customers, including visitors and purchasers of the website http://berrylights.lt (hereinafter referred to as the "Website") (hereinafter referred to as the "Customers"), undertakes to ensure the protection of their personal data and the enforcement of their rights as data subjects.
1.2 This Privacy Policy governs the basic principles and procedures for the collection, processing and storage of personal data of all the Company's customers.
1.3 By using the Company's Website or services or by purchasing goods offered by the Company, thereby providing the Company with your personal data, you agree to the provisions of this Privacy Policy (except for data processing activities which will require your separate consent). Customers are deemed to have read and understood the Privacy Policy when they register on the Site and tick the "tick" box below the text of this Policy in the customer system. The Privacy Policy can be consulted again on the Site at http://berrylights.lt/privatumo-politika/.
1.4 In processing your personal data, we comply with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ("Regulation"), the Law on Legal Protection of Personal Data of the Republic of Lithuania ("LPPD"), the Law on Electronic Communications of the Republic of Lithuania ("LERL"), and any other applicable legislation on the protection of personal data.
2. Terms used in this Privacy Policy
2.1. 'Personal data' means any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, a personal identification number, location data and an online identifier, or to one or more factors specific to the natural person's physical, physiological, genetic, mental, economic, cultural or social identity.
2.2 Data Subject - a natural person - a customer of the Company (including visitors to the Website) whose personal data is collected by the Company.
2.3 "Consent of the data subject" means any freely given, specific and unambiguous indication of the data subject's wishes, by means of a statement or an unambiguous action, by which he or she freely consents to the processing of personal data concerning him or her.
2.4 "Processing" means any operation or set of operations which is performed upon personal data or sets of personal data, whether or not by automated means, such as collection, recording, sorting, organisation, storage, adaptation or alteration, retrieval, access, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination with other data, restriction, erasure or destruction.
2.5 "Processor" means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Data Controller.
2.6.Data Controller - MB Liūtoūsas, a company established under the laws of the Republic of Lithuania, company code 304212854, registered office address Jūratės g. 33-8, Kaunas, LT-48310.
2.7 A cookie is a small piece of textual information that is automatically created when you browse the Website and stored on your computer or other device.
2.8. "Direct marketing" means the practice of offering goods or services to persons by post, telephone or other direct means and/or seeking their opinion on the goods or services offered.
3. What personal data do we collect about you?
3.1 The Company collects and further processes the following personal data provided by you when registering, ordering services and/or purchasing goods on the Website or ordering services in another way: name, surname, address, e-mail address, telephone number, data related to the provision of services, information on consent and non-consent to the processing of personal data for the purposes of direct marketing, passwords, any other data provided by you additionally on your own initiative when registering, ordering services and/or purchasing goods. Your personal data will be stored by the Company for the duration of our cooperation and for a period of 10 (ten) years after the end of our cooperation.
3.2.The collected personal data that you indirectly provide when registering, ordering services and/or purchasing goods on the Website will continue to be processed by the Company, i.e. these data are automatically collected from the computers and/or mobile devices you use when you log in to the Website: IP addresses and times of logins, the browser used by the user and the version of the browser used by him/her, the websites you visited before you came to our Website, data on the use of the services, etc. These data are stored by the Company for the duration of our cooperation and, depending on the data, for up to one year from the end of this period. This data may be stored for a longer period if there are other legal grounds for such storage period.
4. For what purposes is your personal data processed?
4.1 The Company processes your personal data for the following data processing purposes: identification of the Company's customers in its information systems, registration on the Website and logging into your account, processing and administration of the purchase of the services, administration of accounting documents related to the order of the services, contacting you, performance of contractual obligations, and for direct marketing purposes (with prior consent of the data subjects only).
5. How is your personal data processed?
5.1. The Company shall ensure that your personal data will: Processed in a lawful, fair and transparent manner; collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes; adequate, relevant and only as necessary to achieve the purposes for which it is processed as listed above; accurate and, where necessary, kept up to date; processed in such a way as to ensure, by appropriate technical and organisational measures, adequate security of the personal data, including against unauthorised or unlawful processing of the Personal Data, and against accidental loss, destruction or damage.
6. Your rights as a data subject
6.1 You have the following data subject rights set out below, which we will exercise upon receipt of a request from you (by email to info@berrylights.lt; by post to Jūratės g. 33-8, Kaunas, LT-48310.), upon proper confirmation of your identity:
6.1.1. have access to their personal data and how it is processed,
6.1.2. to request the rectification of inaccurate personal data relating to you,
6.1.3. to request that incomplete personal data be completed,
6.1.4. request that the Company erase the personal data relating to you if:
6.1.5. they are no longer necessary for the purposes for which they were collected or otherwise processed;
6.1.6. you withdraw your consent and there is no other legal basis for processing your personal data;
6.1.7. the processing of personal data was unlawful;
6.1.8. and on other grounds set out in the Regulation;
6.1.9. request that the Company restrict the processing of your personal data;
6.1.10. to receive the personal data relating to you that you have provided to the Company in a structured, commonly used and computer-readable format (you also have the right to ask the Company to transfer your personal data to another data controller);
6.1.11. to object to the processing of personal data relating to you (e.g. for direct marketing or otherwise).
6.2 Please be informed that if you believe that your rights as a data subject have been violated, you may file a complaint with the State Data Protection Inspectorate. More information about the State Data Protection Inspectorate and the complaints procedure can be found here: https://www.ada.lt/
7. Processing of personal data for direct marketing purposes
7.1 We will only send you Company newsletters by email and/or enquire about the quality of existing services with your prior consent and in accordance with the Regulation.
7.2 The following personal data is processed for direct marketing purposes: name, surname, email address.
8. To whom is your personal data provided?
8.1 Access to your personal data by employees of the Company shall only be granted on a need-to-know basis for the performance of their duties and only after the employee has undertaken to comply with confidentiality requirements.
8.2 The Company may disclose your personal data to: law enforcement authorities where there is a legal basis for doing so, in response to official requests from public authorities and the courts, but only after ascertaining the legitimacy of these requests, other third parties with your consent. Data processors who provide services to the Company and process your personal data on behalf of the Company and for the benefit of the Company or you:
8.3 We only use processors who ensure that appropriate technical and organisational measures are implemented in such a way that processing complies with the requirements of the Regulation and that your rights as data subjects are protected.
8.4 We note that the processors referred to above have the right to process your personal data only on our instructions.
8.5 The Processor may not engage another Processor without the prior specific or general written consent of the Company.
8.6 Your personal data may be transferred to other countries (including third countries) in connection with the provision of relevant services to you, but only with your consent.
9. Cookies used
9.1 In order to provide you with a more convenient and efficient browsing experience and to provide you with useful offers, we use the following Cookies on the Website:
"Google Analytics"
10. Links on the website
10.1 The Website will contain links to third party websites, legislation and social networking sites. It should be noted that third party websites linked to the Website are subject to the privacy policies of those websites and the Company accepts no responsibility for the content of the information provided by those websites, their activities and the provisions of their privacy policies.
RIGHTS OF DATA SUBJECTS
THE INFORMATION HAS BEEN PREPARED AND IS PRESENTED ON THE BASIS OF THE COMMON
DATA PROTECTION REGULATION EU 2016/679
Please be informed that the data of the data subjects are collected, processed and stored by MB Liūto ūsas (data controller), company code 304212854, registered office address Jūratės g. 33-8, Kaunas, LT-48310. These data are collected for the following purposes:
1. for the purpose of carrying out the functions, services and obligations of the company and contracts, or for pre-contractual action;
2. to comply with a legal obligation to which the controller is subject;
3. for the legitimate interests of the controller or a third party;
4. to protect the vital interests of the data subject or another natural person;
5. for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
All personal data provided by the Client (including special personal data) are processed and stored in accordance with the provisions of the Law on Legal Protection of Personal Data of the Republic of Lithuania, the EU Regulation 2016/679 and the Service Provider's local legal acts regulating the processing and protection of personal data. The Service Provider undertakes to ensure the security of the personal data processed by implementing appropriate technical and organisational measures to protect the personal data against unlawful destruction, accidental alteration, disclosure and against any unauthorised processing.
In accordance with the requirements of the EU 2016/679 Regulation, we are required to obtain your consent for the processing and storage of your data before we can provide you with services. This consent is given by signing a separate consent form which contains precise information about the types of data processed, the purposes of the processing, the retention periods, and the potential recipients and processors who may process the data in the course of providing or assisting in the provision of the services, or in the course of cooperating with our company.
RIGHTS OF DATA SUBJECTS
1. DATA SUBJECT'S RIGHT TO KNOW THE DATA AND HOW THEY ARE HANDLED (Article 15 of the REGULATION)
A data subject who has provided the controller or processor with a document proving his or her identity or who has provided proof of his or her identity by means of a procedure established by law or by means of electronic communications which permit the proper identification of the person concerned, shall have the right to obtain from the controller a confirmation as to whether or not the personal data concerning him or her are being processed, and, if such personal data are being processed, to have access to his or her own personal data, the sources from which and the nature of the collection of his or her personal data, the purpose for which they are being processed, and the data to which they are being provided and have been provided for the past 1 year. Where personal data are transferred to a third country, the data subject has the right to be informed of the appropriate safeguards in relation to the transfer. The controller shall provide a copy of the personal data processed free of charge, upon request, once per calendar year. For any other copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means and unless the data subject requests otherwise, the information shall be provided in the usual electronic format.
2. DATA SUBJECT'S RIGHT TO REQUEST DELETION OF INCORRECT DATA (Art. 16 of the REGULATION)
The data subject shall have the right to have inaccurate personal data concerning him or her rectified by the controller without undue delay. Taking into account the purposes for which the data were processed, the data subject shall have the right to have incomplete personal data completed, including by means of a supplementary statement.
3. THE RIGHT TO REQUEST THE DELETION OF DATA ("RIGHT TO BE DAMAGED") (Art. 17 of the REGULATION)
The data subject shall have the right to require the controller to erase the personal data concerning him or her without undue delay and the controller shall be obliged to erase the personal data without undue delay if one of the following grounds can be relied upon:
(a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
(b) the data subject withdraws consent and there is no other legal basis for processing the data;
(c) the data subject objects to the processing in accordance with Article 21;
(d) the processing of personal data was unlawful;
(f) the personal data were collected when the data subject was under the age of 16 and the minor's data were collected without the consent of the parent or guardian.
However, these rights do not apply if the processing is necessary:
(a) to exercise the right to freedom of expression and information;
(b) for compliance with a legal obligation imposed by Union or Member State law to which the controller is subject which requires the processing of data, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(c) for reasons of public interest in the field of public health;
(d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes;
(e) for the purpose of bringing, pursuing or defending legal claims.
4. THE RIGHT TO DETERMINE DATA PROCESSING (Article 18 of the REGULATION)
The data subject shall have the right to require the controller to restrict processing where one of the following applies:
(a) the personal data subject contests the accuracy of the data for a period of time within which the controller may verify the accuracy of the personal data;
(b) the processing of the personal data is unlawful and the data subject does not consent to the erasure of the data and instead requests the restriction of their use;
(c) the controller no longer needs the personal data for the purposes of the processing, but the data subject needs them for the establishment, exercise or defence of legal claims; or
(d) the data subject has objected to the processing, pending verification that the controller's legitimate reasons override those of the data subject.
5. RIGHT TO DATA RELEASE (Article 20 of the REGULATION)
The data subject shall have the right to obtain the personal data concerning him or her which he or she has provided to the controller in a structured, commonly used and computer-readable format, and shall have the right to have those data transmitted to another controller, and the controller to whom the personal data have been provided shall not prevent this, where:
(a) the processing is based on consent;
(b) the data are processed by automated means.
This right must not adversely affect the rights and freedoms of others.
In exercising his or her right to data portability, the data subject shall have the right to have the personal data transmitted directly from one controller to another controller, where technically feasible.
This right shall not apply where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
6. THE RIGHT TO OBJECT TO AND WITHDRAW YOUR CONSENT TO PROCESSING (ARTICLE 21 OF THE REGULATION)
The data subject shall have the right to object at any time, on grounds relating to his or her particular case, to processing of personal data concerning him or her where such processing is carried out pursuant to Article 6(1)(e) or (f), including profiling on the basis of those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for the purposes of such marketing, including profiling insofar as it relates to such direct marketing.
Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
Where personal data are processed for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1), the data subject shall have the right to object, on grounds relating to his or her particular case, to processing of personal data concerning him or her, except where processing is necessary for the performance of a task carried out on grounds of public interest.
Note: Data subjects' rights are subject to various limitations, which you can find out more about by contacting the contacts below. Please be aware that your refusal to consent to the processing of your data may restrict or terminate your ability to use our services if we are unable to perform our services or obligations without your data. However, if the processing of your data for direct marketing purposes is suspended, you will continue to be able to use our services, but you will no longer be able to receive direct marketing-related communications about discounts or similar.
7. THE RIGHT TO LODGE A COMPLAINT WITH A DATA PROTECTION SUPERVISORY AUTHORITY.
Data processing and protection in the Republic of Lithuania is supervised and controlled by the State Data Protection Inspectorate (SDPI). If you decide that the company has violated your rights to data processing, you have the right to contact the State Data Protection Authority by phone or email:
8. FINAL PROVISIONS
If you wish to exercise your rights, a member of our staff will provide you with a form indicating your preferences regarding the processing of your data by the company. We will respond with a decision within 30 calendar days. For more information on the rights of the data subject, please contact:
Company replies. Person responsible for data processing Tel. +37065385356 and email info@berrylights.lt
