This privacy policy explains how the personal data of data subjects is collected and processed, how long it is kept and to whom it is disclosed, what rights data subjects have and whom to contact to exercise them or with any other question about the processing of personal data. Personal data is processed in accordance with the EU General Data Protection Regulation (EU) 2016/679 (the "Regulation"), the Law on Legal Protection of Personal Data of the Republic of Lithuania and other legislation on the protection of personal data.
Cosmos Construction UAB follows these main principles of data processing:
- personal data is collected only for clearly defined and lawful purposes;
- personal data is processed only lawfully and fairly;
- personal data is kept up to date;
- personal data is stored securely and for no longer than the purposes of processing or the law require;
- personal data is processed only by those employees of the Company who are authorised to do so by their job functions, or by duly authorised data processors.
1. Definitions
1.1. Data controller – Cosmos Construction UAB (the "Company"), company code 301635856, registered office at Gamyklos g. 16, Vilnius, Lithuania.
1.2. Data subject – any natural person whose data is processed by the Company. The data controller collects only the data of the data subject that is necessary for the Company's activities and/or when visiting, using or browsing the Company's websites, social media pages and similar (the "Website"). The Company ensures that the personal data collected and processed is secure and used only for a specific purpose.
1.3. Personal data – any information relating directly or indirectly to a data subject whose identity is known or can be determined directly or indirectly by means of the relevant data. Processing of personal data means any operation performed on personal data (including collection, recording, storage, editing, alteration, granting access, making requests, transfer, archiving and so on).
1.4. Consent – any freely given and informed indication by which the data subject agrees to the processing of his or her personal data for a specific purpose.
2. Sources of personal data
2.1. Personal data provided by the data subject. The data subject contacts the Company, uses the services provided by the Company, buys goods and/or services, leaves comments, asks questions, asks the Company for information and so on.
2.2. Personal data obtained when the data subject visits the Company's website, fills in forms on it or leaves contact details for any reason.
2.3. Personal data obtained from other sources, such as other institutions or companies, publicly available registers and so on.
3. Processing of personal data
3.1. By providing personal data to the Company, the data subject agrees that the Company will use the data collected to fulfil its obligations to the data subject and to provide the services the data subject expects.
3.2. The Company processes personal data for the following purposes:
3.2.1. Concluding and performing contracts with the data subject for services and goods provided or received by the Company; keeping contact details so that the data subject can be contacted; tax accounting and payment control. For this purpose the following data is processed:
- first name(s) and surname(s);
- contact details (telephone number, e-mail address);
- workplace and position (if the information is provided as a representative of a legal entity);
- residential address;
- bank account details (if a natural person provides services to the Company).
3.2.2. Ensuring the security of the Company's employees, other data subjects and property (video surveillance). For this purpose the following data is processed: video images. The video surveillance systems do not use facial recognition and/or analysis technologies, and the video data recorded is not grouped or profiled by individual data subject. Data subjects are informed of video surveillance by signs with a camera symbol and the Company's details placed before entering the monitored area and/or premises. Premises in which the data subject expects absolute privacy are not covered by the cameras.
3.2.3. Other purposes for which the Company is entitled to process the personal data of the data subject, where the data subject has given consent, where processing is necessary for the legitimate interests of the Company, or where the Company is required to process the data by law.
4. Disclosure of personal data
4.1. The Company undertakes to keep the data of data subjects confidential. Personal data may be disclosed to third parties only if this is necessary to conclude and perform a contract for the benefit of the data subject, or for other lawful reasons.
4.2. The Company may provide personal data to its data processors, who provide services to the Company and process personal data on its behalf. Data processors may process personal data only on the Company's instructions and only to the extent necessary to perform their contractual obligations properly. The Company uses only data processors that provide sufficient guarantees that appropriate technical and organisational measures are implemented so that processing meets the requirements of the Regulation and the rights of the data subject are protected.
4.3. The Company may also provide personal data in response to requests from courts or public authorities, to the extent necessary to comply with the law and the instructions of public authorities.
4.4. The Company guarantees that personal data will not be sold or rented to third parties.
5. Personal data of minors
5.1. Persons under 14 years of age may not provide any personal data through the Company's website. If a person is under 14 and wishes to use the Company's services, written consent to the processing of personal data from a parent or guardian must be provided before any personal information is submitted.
6. Retention of personal data
6.1. Personal data collected by the Company is kept in printed documents and/or in the Company's information systems. Personal data is processed for no longer than necessary to achieve the purposes of processing, or for no longer than required by the data subjects and/or the law.
6.2. Even if the data subject terminates the contract and stops using the Company's services, the Company must continue to keep the data subject's data in view of possible future claims or legal disputes until the retention periods expire.
7. Rights of the data subject
7.1. The right to receive information about the processing of data.
7.2. The right of access to the data processed.
7.3. The right to have data rectified.
7.4. The right to have data erased ("right to be forgotten"). This right does not apply where the personal data whose erasure is requested is also processed on another legal basis, such as processing necessary for the performance of a contract or for compliance with a legal obligation.
7.5. The right to restrict processing.
7.6. The right to object to processing.
7.7. The right to data portability. The right to data portability must not adversely affect the rights and freedoms of others. The data subject does not have the right to data portability in respect of personal data processed manually in structured filing systems, such as paper files.
7.8. The right not to be subject to a decision based solely on automated processing, including profiling.
7.9. The right to lodge a complaint about the processing of personal data with the State Data Protection Inspectorate of the Republic of Lithuania.
8. The Company must enable the data subject to exercise the rights listed above, except in the cases laid down by law where it is necessary to ensure state security or defence, public order, the prevention, investigation, detection or prosecution of criminal offences, important economic or financial interests of the state, the prevention, investigation and detection of breaches of official or professional ethics, or the protection of the rights and freedoms of the data subject or other persons.
9. How to exercise the rights of the data subject
9.1. To exercise his or her rights, the data subject may contact the Company:
- by submitting a written request in person, by post, through a representative or electronically – by e-mail: info@metalo-gaminiai.lt;
- orally – by telephone +370 652 28785;
- in writing – at Gamyklos g. 16, Vilnius, Lithuania.
9.2. To protect data from unlawful disclosure, the Company must verify the identity of the data subject on receiving a request to provide data or to exercise other rights.
9.3. The Company replies to the data subject no later than one month after receiving the request, taking into account the specific circumstances of the processing. Where necessary, this period may be extended by a further two months, taking into account the complexity and number of requests.
10. Responsibility of the data subject
10.1. The data subject must:
10.1.1. inform the Company of any changes to the information and data provided – it is important for the Company to have correct and valid information about the data subject;
10.1.2. provide the information necessary for the Company, at the data subject's request, to identify the data subject and make sure that it is communicating or cooperating with that particular data subject (provide an identity document, or identify themselves in the manner laid down by law or by electronic means that allow proper identification). This is necessary to protect the data of the data subject and other persons, so that information about the data subject is disclosed only to the data subject, without infringing the rights of others.
11. Final provisions
11.1. By providing personal data to the Company, the data subject agrees to this privacy policy, understands its provisions and agrees to comply with them.
11.2. As the Company develops and improves its activities, it may change this privacy policy unilaterally at any time. The Company may amend the privacy policy unilaterally, in part or in full, by announcing this on the website www.metalo-gaminiai.lt.
11.3. Additions or amendments to the privacy policy take effect from the day they are published, i.e. the day they are placed on the website www.metalo-gaminiai.lt.
12. Cookies and Google Analytics
12.1. The website uses Google Analytics (Google Ireland Ltd.) to understand how visitors use the website. Google Analytics cookies are set and the Google Analytics script is loaded only after you click "Accept" in the cookie notice. If you decline, no analytics cookies are set.
12.2. You can change your choice at any time with the "Cookie settings" link at the bottom of every page, or by deleting cookies in your browser.