Why is this privacy notice necessary?
AB “Vilkyškių pieninė”, company code 277160980, address Prano Lukošaičio g. 14, Vilkyškiai, LT-99254 Pagėgiai, Lithuania (hereinafter — the Company) is the controller of Your personal data. The Company, together with other companies (AB “Modest”, AB “Kelmės pieninė”, UAB “Kelmės pienas”, AB “Pieno logistika”, SIA “Baltic Dairy Board”), belongs to a group of companies (hereinafter — the Group of Companies or We). Therefore, this Privacy Policy contains information relating to processing personal data within the whole group of companies. When processing personal data for the purposes described in this Policy, the aforementioned group companies may, in certain cases, act as independent data controllers and/or joint data controllers.
We care about Your privacy and the protection of Your personal data, which is why We process personal data in accordance with the General Data Protection Regulation of the European Parliament and of the Council (EU) 2016/679 (hereinafter — the Regulation), the Law on the Legal Protection of Personal Data, as well as in accordance with other legislation regulating the protection of personal data, and in compliance with the standards and procedures established by the Vilkyškiai Group of Companies, which ensure that personal data are processed accurately, honestly, lawfully, transparently, and safely. Therefore, to ensure fair and transparent information to data subjects, in this privacy notice (hereinafter — the Notice), We provide You with up-to-date information about processing Your personal data by the Company.
In this notice, We describe which of Your personal data We collect and for what purposes We process it when You use Our services and/or visit Our administered websites or social media accounts or provide Us with Your personal data by other means. This notice also contains important information about protecting Your personal data and rights and how to exercise them. Therefore, please take the time to review this Notice, and, if You have any questions, please do not hesitate to contact Us using the contact details provided. Please note that We reserve the right to change the provisions of the Notice in the future. Changes to the Privacy Notice are effective as of the date of their posting, so We encourage You to review this Notice periodically.
What are personal data, and how are they processed?
Personal data means any information relating directly or indirectly to You where Your identity is known; or can be directly or indirectly established by reference to relevant data (e.g. full name, personal number, email address, phone number, etc.).
Processing of personal data means any operation performed on personal data, including collection, recording, storage, editing, modification, access, retrieval, transmission, archiving, etc.
When processing Your personal data, We adhere to the following principles of personal data processing:
- Your personal data shall be processed only to the extent necessary to achieve the relevant, clearly defined, and legitimate purposes, taking into account the protection of Your privacy;
- Your personal data shall be processed accurately, fairly, and lawfully and shall only be processed for purposes that are consistent with the purposes specified before Your personal data were collected;
- We process Your personal data in strict compliance with the clear and transparent requirements for the processing of personal data established by law;
- Your personal data shall be processed only in a form which permits Your identification for no longer than is necessary for the purposes for which the personal data are processed;
- The processing of Your personal data is subject to appropriate technical and organisational measures to ensure the security of personal data, including protection against unauthorised processing and against accidental loss, destruction, and damage.
What personal data do We process for what purposes?
We process only those personal data that are necessary to process for these purposes:
|
Purpose of processing: |
E-commerce (GymOn e-shop) |
|
Processed personal data: |
E-commerce is conducted on the Company’s GymOn e-shop (www.gymon.lt). Therefore, information about the personal data collected and processed on this e-shop is provided in the GymOn Privacy Policy. |
|
Conditions for lawful processing: |
|
|
Sources of data: |
|
|
Time limits for processing: |
|
Purpose of processing: |
Direct marketing (Sending personal offers, promotions, and other news) |
|
Processed personal data: |
In order to send You general and/or personalised marketing offers, We process the following personal data about You: (1) contact data (such as e-mail address, phone number); (2) other relevant data (such as Your full name, order data, usage data, etc.). |
|
Conditions for lawful processing: |
By subscribing to the direct marketing offered by Us and providing Us with Your data for this purpose, You consent to Us sending You direct marketing, and We, therefore, process Your personal data in accordance with Article 6(1)(a) of the Regulation, i.e., Your consent. |
|
Sources of data: |
We receive Your data directly from You and/or Your representative when You order Our direct marketing and/or consent to direct marketing by other means. |
|
Time limits for processing: |
Your data is processed/used/stored for this purpose for as long as Your consent is valid but no longer than five years from the date of Your consent. |
|
Purpose of processing: |
Communication with You (Handling enquiries) |
|
Processed personal data: |
In order to communicate with You and evaluate and resolve Your enquiries, and provide You with a response, We process the following personal data: (1) Your full name; (2) contact details (such as address, e-mail address, phone number); (3) the content of the enquiry. |
|
Conditions for lawful processing: |
By submitting Your enquiry to Us, You consent to Us having access to Your enquiry and to Our providing You with a response, and We, therefore, process Your personal data in accordance with Article 6(1)(a) of the Regulation, i.e., Your consent.
In cases where You submit complaints, claims and/or notifications to Us via the helpline, We process personal data on the following grounds: (1) Article 6(1)(c) of the Regulation, i.e., to enforce applicable legal obligations (e.g., the Republic of Lithuania Law on Consumer Protection, etc.); (2) Article 6(1)(f) of the Regulation, i.e., to enforce the Company’s and (or) third party’s legitimate interests (e.g., for the purpose of filing, pursuing, or asserting a legitimate interest and/or claim). |
|
Sources of data: |
We receive Your data directly from You and/or Your representative when You send Us Your enquiries, via the contacts provided by Us (such as address, e-mail, phone, websites, etc.). |
|
Time limits for processing: |
Your enquiries (including mandatory personal data) will be kept for the duration of the enquiry and six months from the processing date. Information relating to complaints is kept for up to 3 years. |
|
Purpose of processing: |
Managing internal information channels (Handling whistleblower reports and communication on the Vilvi Group Helpline) |
|
Processed personal data: |
In order to be able to investigate reports sent by You about illegal actions and possible violations of legislation in the Company and to provide You with a reply and/or take appropriate action in response to the violation, We process the following personal data of You (the Whistle Blower): (1) Your full name; (2) personal number and/or date of birth; (3) place of work; (4) contact details (such as the address, e-mail address, phone number); (3) content of the report, including documents submitted, etc.
In cases where You communicate with Us via the Vilvi Group Helpline and report questionable practices of VILVI Group employees or business partners in the areas of business ethics, ethical employment, human rights, or environmental protection, and You agree to disclose Your identity (i.e., You submit the report non-anonymously), We will process the following personal data about You: (1) Your full name, (2) e-mail address, (3) phone number, (4) the content of the report, and/or any other information or documentation related to the report. It should be noted that You can provide information through the hotline completely anonymously (i.e., without disclosing Your identity), so if You do so anonymously, Your personal data will not be processed (with the exception of the content of the notification and/or other information and documents related to the notification).
In any event, the Company shall ensure the confidentiality of such communications. |
|
Conditions for lawful processing: |
We process personal data: (1) We administer the internal information channels and process the Whistleblower Notifications submitted by You on the following grounds: (1) Article 6(1)(c) of the Regulation, i.e., in order to comply with the legal obligations to which We are subject (e.g., Republic of Lithuania Law on the Protection of Whistleblowers, etc.); (2) Article 6(1)(f) of the Regulation, i.e., to enforce the Company’s and (or) third party’s legitimate interests (e.g., for the purpose of filing, pursuing, or asserting a legitimate interest and/or claim). |
|
Sources of data: |
We receive Your data directly from You when You send Us Your enquiries to Our internal information channels.
For more information on whistleblowing under the Republic of Lithuania Law on the Protection of Whistleblowers, see https://vilvigroup.lt/praneseju-apsauga/.
For more information on the VILVI Group Helpline, see https://vilvigroup.lt/pasitikejimo-linija/. |
|
Time limits for processing: |
Information about illegal actions and possible violations of legal acts in the Company (in accordance with the Republic of Lithuania Law on Whistleblowers) shall be stored for at least five years from the last decision taken during the examination of this information.
Information about questionable activities of VILVI Group employees or business partners in business ethics, ethical employment, human rights, or environmental protection shall be retained for at least one year from the last decision taken while examining this information. |
|
Purpose of processing: |
Organising games, competitions, and promotions (Handling enquiries) |
|
Processed personal data: |
In order for You to participate in Our games, competitions, and promotions, We need to process the following personal data: (1) Your full name; (2) contact details (e.g., e-mail address, phone number); (3) other data that We will ask You to provide in accordance with the rules of the competition, promotion, or game. |
|
Conditions for lawful processing: |
By entering games, competitions, and promotions organised by Us, and by submitting Your data for this purpose, You express Your consent to participate in the game, competition, or promotion, and We, therefore, process Your personal data in accordance with Article 6(a) of the Regulation, i.e., Your consent.
If You win a game, competition, and/or promotion organised by Us, We process Your data to award the prize or other gift, as well as to ensure the correct fulfilment of Our tax obligations, and We, therefore, process Your personal data in accordance with Article 6(c) of the Regulation, i.e., in accordance with a legal obligation imposed on Us. |
|
Sources of data: |
We receive Your data directly from You when You participate in competitions, games, or promotions organised by Us. |
|
Time limits for processing: |
We will process/store this data for the period specified in the rules of the specific game, competition, or promotion. |
|
Purpose of processing: |
Communication on social networks |
|
Processed personal data: |
In order to communicate with You on social networks, We process the following personal data: (1) Your full name (name); Information about communication on Your account (likes, follows, comments, shares, etc.); (2) Photos (profile pictures and/or photos with the Company tagged); (3) The message sent; (4) Information about the message (time of receipt of the message, content of the message, attachments to the message, correspondence history, etc.); (5) Information about participation in organised events and/or games (participation, non-participation, interest, fulfilment of the rules of the game, etc.); (6) Information about the Company’s evaluation of the message (rating score, testimonial, etc.); or any other information that You may have provided. |
|
Conditions for lawful processing: |
By communicating with Us and/or visiting the accounts administered by Us, You express Your consent for Us to access and respond to Your communications. Therefore, We process Your personal data in accordance with Article 6(1)(a) of the Regulation, i.e., Your consent. |
|
Sources of data: |
We receive Your data directly from You (on Your social network account) when You communicate with Us and/or visit the social network accounts We administer. |
|
Time limits for processing: |
We process the personal data provided by You until the moment of withdrawal of Your consent (i.e., deletion of the provided personal data from Your account), but only after deleting the Company’s account. Please note that personal data will only be processed on the social network manager’s platform, so the platform manager determines the exact terms and conditions of processing. |
|
Other information: |
Please note that personal data provided on social networks are processed jointly with the social network managers (i.e., on Facebook, Instagram, and LinkedIn platforms). Therefore, the social network manager also receives the communication You provide to Us. Accordingly, in order to learn more about the processing of personal data on a specific social network, We suggest that You read the privacy policy of the controller of the specific social network: (1) Facebook privacy policy; (2) Instagram privacy policy; (3) LinkedIn privacy policy; (4) |
|
Purpose of processing: |
Contract drafting and execution (including commercial liaison) |
|
Processed personal data: |
We process the following personal data when entering into and/or performing contracts with natural persons and/or legal entities (e.g., milk suppliers and/or buyers, etc.):
When the contract is with a natural person: (1) full name; (2) contact details (e.g., address, e-mail address, phone number); (3) business or trade licence number; (4) current account number; (5) signature; (6) billing history.
When the contract is concluded with a legal person, the legal person’s representative, and/or employee: (1) Your full name; (2) contact details (e.g., e-mail address, phone number); and (3) the position You hold. |
|
Conditions for lawful processing: |
In the case of contracts for the provision of specific services and/or the purchase of goods, We, therefore, process personal data in accordance with Article 6(1)(b) of the Regulation, i.e., for the performance of the contract concluded with You, or for pre-contractual steps.
Where a contract for the provision of services and/or goods is concluded with a legal person, We process personal data in accordance with the condition of the lawfulness of processing referred to in Article 6(1)(f) of the Regulation, i.e., for legitimate interests in concluding and performing contracts with legal persons and maintaining commercial relations. |
|
Sources of data: |
We obtain Your data from the persons (natural and/or legal persons) entering into specific contracts when the contract is concluded. |
|
Time limits for processing: |
We will process/store this data for the duration of the contract and ten years after the end of the contract. |
|
Purpose of processing: |
Bookkeeping (for invoices issued to and/or received from customers/contractors) |
|
Processed personal data: |
As part of Our accounting activities, We process invoices issued to and received from Our customers and/or contractors and therefore need to process this personal data:
Where the client/contractor is a natural person: (1) Full name; (2) VAT number (if VAT registered); (3) individual company code/business licence no. /individual activity certificate no.; (4) address; (5) contact details (e-mail address and/or phone number); (6) current account number; (7) billing history; (8) signature (where provided).
Where the client/contractor is a legal person, the representative, and/or employee of the legal person: (1) full name; (2) position held; (3) signature (when provided). |
|
Conditions for lawful processing: |
After We have provided You with goods and/or services and received payment for them, We have to comply with the obligations imposed on Us by law to keep proper accounting records and documents. Therefore, We process Your personal data in accordance with Article 6(1)(c) of the Regulation, i.e., it is necessary for the processing of data to comply with the applicable legal obligation (as stipulated by the Laws of the Republic of Lithuania on Accounting and Value Added Tax). |
|
Sources of data: |
We receive this personal data when You (a natural person) or Your employer/principal (a legal person) provide it to Us to bill Us for purchasing Our goods and services; or when You directly submit the invoices to Us. |
|
Time limits for processing: |
We will process/store this data for ten years from invoicing/receipt and/or payment date. |
|
Purpose of processing: |
Video surveillance (Ensuring the security of property and persons) |
|
Processed personal data: |
In order to ensure the security of property and/or persons on the Company’s and/or the Group’s premises, We carry out video surveillance and process the following Your personal data:
(1) Video footage (including persons, vehicles, etc.); (2) Technical data (e.g., date, duration, etc.).
|
|
Conditions for lawful processing: |
In the course of Our activities, We aim to ensure the security of property and/or persons by video surveillance. Therefore, We process personal data captured by a video camera in accordance with Article 6(1)(f) of the Regulation, i.e., the processing of data is necessary for the purposes of Our legitimate interests in the protection of Our property. |
|
Sources of data: |
We receive this data directly from You (captured by CCTV cameras) when You visit the areas and/or premises managed by Us. You will be informed that the area is monitored by CCTV cameras by means of information signs before You enter the monitored area (e.g., at the entrance or other prominent points). |
|
Time limits for processing: |
We retain video recordings and other related personal data for 14 days from the recording date or for the retention period specified in the information notice about the video surveillance. After this period, the records are automatically deleted.
Video recordings of the circumstances of an event (such as damage to and/or theft of property, breach of public order, or other breaches of the law) may be kept as evidence for an appropriate period (i.e., for the entire duration of an out-of-court, pre-trial, or judicial dispute) and/or provided to law enforcement authorities. |
|
Purpose of processing: |
Staff recruitment (staff search) |
|
Processed personal data: |
We process the following personal data about You (candidates) in the course of recruitment: (1) Full name; (2) financial expectations of the candidate; (3) details of the candidate’s education, qualifications, work experience, or other information provided by the candidate (e.g., CV, cover letter, etc.). See ‘Processing of applicants’ personal data’ below for more information. |
|
Conditions for lawful processing: |
By participating in the recruitment process and/or submitting Your data to Us (e.g., CVs, cover letters, etc.), You agree that We may assess the suitability of Your candidature and provide You with information about the recruitment process.
If You are not selected at the end of the selection process, We may ask You for Your additional consent to process the data to allow Us to reconsider Your application and offer You new Career opportunities in future recruitment processes.
For this purpose, We process Your personal data in accordance with Article 6(1)(a) of the Regulation, i.e., with Your consent. |
|
Sources of data: |
We receive this personal data directly from You when You provide Us with Your data for this purpose. |
|
Time limits for processing: |
We will process/store this data for as long as necessary to achieve a specific purpose, but at most one month from the end of the selection.
If You consent to continue processing Your personal data to consider Your application in other recruitment exercises, We will retain this data for five years from the date of Your consent. |
Processing of applicants’ personal data
In the course of recruiting for vacancies within the Group of Companies, We may collect and process the data that You provide when filling in a questionnaire, CV, cover letter, or other document and submitting it to Us electronically or by visiting the offices of the Group of Companies, as well as the data that We may receive from other persons, to assess the suitability of Your application.
The personal data processed may include the following categories of data: (1) general information about the applicant (full name, date of birth, address, information about the applicant’s experience, education, information about skills and competencies, acquired permits or other rights, and other information); (2) references, testimonials from current and/or former employers; (3) information about the applicant’s assessment (results of the interview with the applicant, opinion of the person(s) conducting the selection process, applicant’s testing results, etc.); (4) special categories of data (data on the applicant’s health) — We may collect and process this data only if and to the extent necessary to achieve the purpose (i.e., to assess the applicant’s ability to work, compliance with the specific requirements of the job) and to the extent permitted by law).
In order to assess the suitability of Your application and to obtain information about Your qualifications, professional skills, and business qualities, We may contact Your former employers (after informing You in advance) or, in exceptional cases, Your current employer (but only with Your consent) and process the information received accordingly.
The Group of Companies acts as joint controllers when processing the personal data of applicants for positions. The Company exercises your rights as a data subject, but You may contact any of the joint controllers regarding the data subject’s rights.
To whom can We transfer Your personal data?
We may transfer and/or provide access to personal data processed for these purposes to the following categories of recipients to:
(1) Other data controllers who need the data for the provision of the Services or to comply with their legal obligations (e.g., companies belonging to the Group of Companies);
(2) Data processors who provide services and process Your data on behalf of, in the interests of and on behalf of the Company and/or its Group of Companies (e.g., information technology, software maintenance and administration service, security service providers, etc.). Data is only provided to these recipients based on personal data processing agreements, which include specific processing instructions and appropriate organisational and technical measures complying with confidentiality and security requirements for processors;
(3) Competent public and/or law enforcement authorities (e.g., prosecutors, courts, police, or other supervisory authorities). Also, for persons providing legal services. Data may only be provided to these recipients if required to do so by applicable law and only in accordance with the procedures provided for by law, to safeguard Our rights and the safety of Our customers, employees and/or resources, and to assert, submit, and/or defend legal claims.
We note that Your personal data is only provided to third parties that ensure appropriate conditions for the processing and protecting personal data. Your personal data is not transferred to third countries (i.e., outside the European Union or the European Economic Area).
Rights of the data subject
You have the following rights:
- To request access to Your personal data processed and to obtain a copy of that data;
- To request the rectification of incorrect, incomplete, or inaccurate personal data and/or to restrict the processing of such personal data (except for storage);
- To request the erasure of Your personal data that are unlawfully, fraudulently, or excessively processed and/or to restrict the processing of such personal data (except for storage);
- To object to the processing of Your personal data when such data is processed or intended to be processed;
- To withdraw Your consent at any time where Your personal data is processed based on consent (e.g., for direct marketing, recruitment, or other purposes). However, it is important to note that the withdrawal of consent does not affect the lawfulness of the processing carried out before the moment of withdrawal of consent;
- To request the receipt of Your personal data (in a structured, commonly used, and computer-readable format) and/or its transfer to another controller where this is technically feasible (‘right to data portability’).
- To complain to the State Data Protection Inspectorate (ada@ada.lt) regarding Our actions and/or omissions in processing Your personal data;
We do not apply solely automated processing, including profiling, to make decisions based on data processing that could lead to legal consequences for You or similarly affect You significantly.
To exercise the data subject’s rights referred to above, please get in touch with Our Data Protection Officer by e-mail at duomenuapsauga@vilvi.eu. You can also apply for the exercise of Your data subject rights in other ways (e.g., by submitting a written request directly or by registered mail).
Please note that to exercise Your rights as a data subject, You must verify Your identity in one of the following ways:
(1) when applying directly, provide valid proof of identity;
(2) by submitting the request electronically (by e-mail: duomenuapsauga@vilvi.eu), authenticated by means of electronic communications which allow the proper identification of the person (e.g., mobile signature, qualified electronic signature, etc.);
(3) by submitting the application by post or courier, accompanied by a copy of a valid identity document, certified per the procedure laid down by law.
We will respond to Your request regarding the exercise of data subjects’ rights as soon as possible, by one month from the date of Your request. Depending on the complexity and number of requests, this period may be extended by two months if necessary. You will be notified of such an extension within one month. The information You request will be provided free of charge. However, if We see that Your requests are manifestly unfounded or disproportionate, particularly because of their repetitive content, We have the right to charge a reasonable fee (i.e., to request reimbursement of administrative costs) or to refuse to act on such a request from the data subject.
If You have any questions about the information contained in this Policy and/or would like to express Your dissatisfaction or complaints about the privacy provisions, please get in touch with Us first by e-mail: duomenuapsauga@vilvi.eu.
How do We take care of the security of Your personal data?
The Company and its Group of Companies use appropriate organisational and technical personal data security measures to protect Your personal data against accidental or unlawful disclosure, destruction, alteration, or other unauthorised acts. These measures are chosen to consider the risks to Your rights and freedoms as a data subject.
In this case, We ensure strict access control to the personal data We process and grant access to those employees of the Company who need the personal data to carry out their work and monitor the use of the access granted. The Company and its Group of Companies secure access to Your personal data with passwords of an appropriate level and enter into confidentiality agreements with persons who have access to Your personal data.
When We use data processors, We take all necessary measures to ensure that Our data processors also have appropriate organisational and technical measures in place to ensure the security of personal data and to maintain the confidentiality of personal data.
Employees of the Company and Group of Companies who have access to personal data are aware of the requirements for protecting personal data and ensuring the confidentiality of personal data processed.
Who to contact if You have questions?
If You have any questions regarding the terms and conditions of this Privacy Notice or any other questions, please feel free to contact Us at the e-mail address provided below: duomenuapsauga@vilvi.eu.
