Privatumo politika - Slėnis Trakuose

General provisions

This privacy policy ("Privacy Policy") Privacy policy) contains information about how UAB Kempingas slėnyje, UAB, legal entity code 181209770, registered office address Slėnio g. 1, LT-21121 Trakai (hereinafter referred to as - "the Company") Company) processes personal data.

The provisions of the Privacy Policy apply to natural persons whose data is processed by the Company:

Customers (including employees and/or representatives of legal entities to which the Company provides its services) who use, have used, have expressed an intention to use or are otherwise connected with the services provided by the Company ("the Company") Clients);
to persons who contact the Company by means of requests, claims, directly or by means of remote communication, including by telephone or email;
persons who visit the Company's websites, etc.

Definitions

Terms and abbreviations used in this Privacy Policy have the following meanings:

Personal data - any information relating to a natural person who can be identified, directly or indirectly (e.g. name, contact details, etc.).
Data Subject - the natural person (data subject) whose data is being processed (e.g. customers of the Company, persons who contact the Company by submitting requests, claims, users of the Company's website, self-service website and other portals/websites operated by the Company, etc.).
Data processing - any action taken in relation to Personal Data (e.g. collection, recording, storage, access, transfer, etc.).
Services - any services provided by the Company.
Supervisory authority - National Data Protection Inspectorate.

Other terms used in the Privacy Policy shall be understood as defined in the legal acts regulating the protection of personal data (General Data Protection Regulation (EU) 2016/679 (hereinafter referred to as the "Regulation", the Law on Legal Protection of Personal Data of the Republic of Lithuania, and others).

Purposes and legal bases for processing personal data

The Company processes Personal Data only for specific purposes, in accordance with the legal grounds established by law:

On the basis of the performance of the Treaty, where the processing of personal data is necessary for the conclusion and/or performance of the Company's obligations to the Client under the contract entered into.
On the basis of a legal requirement where the Company is obliged to process your personal data, e.g. for tax accounting purposes, for the purpose of providing personal data to public authorities, etc..
On the legal basis of consent, where you give your explicit consent to the processing of personal data for one or more specific purposes, e.g. processing of personal data of job applicants, sending marketing communications.
On the basis of legitimate interest, where personal data is processed for the purposes of the legitimate interest of the Company, e.g. video surveillance for the purpose of ensuring the protection of the assets and/or objects under its control.

The main purposes for which the Company processes Personal Data are:

Service delivery, contract drafting and execution. The Company processes Personal Data in order to ensure the proper conclusion and performance of contracts with customers, the provision of services or goods to customers on the basis of contracts, including the proper information of the customer on matters relating to the goods, services and the contract, on the basis of the contract or legal requirements.
Preparing commercial proposals. The Company processes Personal Data in order to make a commercial offer to a customer for a service the customer wishes to purchase.
Debt management. In the event of a debt, the Company shall process Personal Data relating to the debt and shall carry out recovery actions on the basis of the contract, legal requirements and legitimate interest.
Addressing the issues raised. The Company shall process personal data in connection with the handling and resolution of questions, complaints, on the basis of contract, consent or legal requirements.
Direct marketing and customer experience evaluation. The Company may process Personal Data (name, surname, email address, email interaction information) for the purpose of providing profiled offers and news about the Services, information about ongoing events, and enquiries about the quality of the Services provided. These data are processed and information is only sent to the Individual if the Individual has provided consent to direct marketing and profiling. For profiling purposes, in order to identify whether the information sent is relevant to the Customer and to offer content tailored specifically to the Customer's needs, the Company may process information about the interaction of the direct marketing e-mails sent (whether the message was read, when and how many times).
Credit and risk assessment. With the consent of the Client, the Company may process Personal Data for the purpose of assessing credit risk and determining which Services the Company may offer to the Client and on what terms.
Security of persons and objects. The Company may carry out video surveillance, access control, automatic scanning of car number plates on the basis of the Company's legitimate interest in order to ensure the safety of its employees, its property and objects.
Finding and organising recruitment and selection of candidates. The company processes, on the basis of consent, candidates' identity and contact data, as well as data relating to candidates' qualifications, professional skills and business characteristics.
Other objectives. The Company may process Personal Data for other purposes if it has obtained the consent of the individual, is obliged to process the Personal Data in order to comply with the requirements of the law, or has the right to process the data for legitimate interest.

In all of the above cases, the Company shall process Personal Data only to the extent necessary for the achievement of the relevant clearly defined and legitimate purposes, taking into account the requirements of the protection of personal data.

Scope of Personal Data processed (categories)

The main categories of Personal Data and the data processed by the Company for the purposes and on the legal grounds listed above:

Identity or identification data - name, surname, personal identification number, date of birth, etc.
Contact details - address, phone number, email address, etc.
Data relating to the provision of the Services and the conclusion and performance of contracts - contract data.
Payment data - amounts owed to the company, outstanding debts, payment history, account and/or payment card details, etc.
Credit and risk assessment data - information about liabilities and debts owed to third parties, where the Company assesses the solvency of a client before providing services to them.
Video surveillance, access control, automated scanning of car number plates, captured to ensure the security of the property and/or objects under its control.
Cookie data - information about visitor behaviour on the Company's website or self-service etc. More detailed information about the use of cookies can be found in the „view site information“ function of the Company's website, but not in this Policy.
Other data processed by the Company on the basis of legal grounds established by law

Provision of personal data

The Company may, in accordance with legal requirements, transfer the Personal Data processed to the following categories of recipients:

For service providers. The Company may transfer the Personal Data processed to third parties acting on behalf of and/or at the direction of the Company to provide customer support, software maintenance, design, contracting, accounting, payment assurance, mailing and other services to the Company in order to ensure the proper provision, management and development of the Company Services. In such cases, the Company shall take the necessary measures to ensure that the service providers (data processors) used process the Personal Data provided only for the purposes for which it was provided, ensuring appropriate technical and organisational security measures, in accordance with the Company's instructions and the requirements of applicable law.
For government, law enforcement and regulators. The Company may provide the processed Personal Data to government or law enforcement authorities (e.g. police, prosecutor's office, Financial Crimes Investigation Service, etc.) when required to do so by applicable law or to safeguard the legitimate interests of the Company or third parties.
For debt collectors, persons/companies managing joint databases. If the Client fails to make payments due under the Agreement in a proper and timely manner, the Company shall have the right to provide the Client's personal data to the controllers of joint debtor data files, debt management and collection companies, courts, notaries, bailiffs, upon 30 calendar days' notice by mail or e-mail.
Other third parties. The Company may provide Personal Data to other recipients in accordance with the lawful grounds defined by law.

As a general rule, the Company stores Customer Data in the territory of the European Union or the European Economic Area (EU/EEA). Should there be cases where Customer Data should be transferred outside the EU/EEA, this shall only be done if at least one of the following conditions is met:

The European Commission has recognised that the country to which the data is transferred ensures an adequate level of protection of personal data;
There is a data processing contract in accordance with the standard terms and conditions approved by the European Commission;
Codes of conduct and other safeguards in accordance with the Regulation are respected.

Data storage

The Company shall not process Personal Data for longer than the stated purposes of the processing or the applicable legislation, if such legislation provides for a longer retention period.

The Company shall apply criteria for determining the retention period which are in line with the obligations laid down in the legislation, taking also into account the rights of the individual, e.g. by providing for a retention period during which claims relating to the performance of the contract may be brought, if any, etc.

More detailed information on the retention periods for the relevant categories of data can be obtained by contacting privatumas@sba.lt or by post to „Kempingas slėnyje“, Slėnio g. 1, LT-21121 Trakai.

Applicable security measures

The Company shall ensure the confidentiality of Personal Data in accordance with the requirements of applicable law and the implementation of appropriate technical and organisational measures to protect Personal Data against unauthorised access, disclosure, accidental loss, alteration or destruction, or other unauthorised processing.

Automated decision-making and profiling

The company does not process personal data by means of automated individual decision-making as provided for in Article 22 of the Regulation. The Company only carries out profiling (i.e. automated processing of personal data where personal data is used for the purpose of evaluating certain personal aspects relating to an individual), which does not give rise to legal consequences or similar significant effects for the Individual. The Company carries out profiling in order to manage the sending of unsolicited and irrelevant marketing offers by categorising customers according to the type of services they use, the method of payment, etc.

Rights of individuals

The person contacting the Company has the right to:

To access your Personal Data processed by the Company;

Request the rectification of incorrect, incomplete or inaccurate Personal Data;
Request the destruction of Personal Data or the suspension of the processing of Personal Data if it is carried out in violation of legal requirements or if the Personal Data is no longer necessary for the purposes for which it was collected or otherwise processed (except for storage, if this is required by legal requirements);
Receive Personal Data relating to him or her that he or she has provided in a structured, commonly used electronic format;
To object to the processing of your Personal Data and/or, where Personal Data is processed on the basis of consent, to withdraw your consent to the processing of your Personal Data at any time, without prejudice to the lawfulness of the processing based on consent prior to the withdrawal of consent. You may withdraw your consent to direct marketing:

by contacting the addressee privatumas@sba.lt;
Camping in the Valley, UAB, Slėnio g. 1, LT-21121 Trakai;
by using the „Unsubscribe“ cancellation functionality in the electronic information message you receive.
lodge a complaint with the Supervisory Authority regarding the processing of Personal Data.

Enforcement of individuals' rights

Individuals may contact the Company's processing of personal data directly by mail to Kempingas slėnyje, UAB, Slėnio g. 1, LT-21121 Trakai, or by coming directly to the Company's registered office.

Contact details of the Data Protection Officer: privatumas@sba.lt

In order to exercise his or her rights under the Regulation, a person must submit a request to the Company in person, by post, by a representative or by electronic means.

The person making the request must prove his or her identity:

if the request is made directly to the employee, the person must provide proof of identity;
if the application is submitted by post, it must be accompanied by a copy of an identity document certified by a qualified electronic signature;
if the application is submitted through a representative, the representative shall indicate his/her name, surname, address and the contact details of the contact details by which the person's representative wishes to receive the reply, as well as the name and personal identification number of the represented person, and shall provide a copy of the representative's identity document certified by a qualified electronic signature, as well as a copy of the document confirming the representation or of the representation document certified by law;
if the application is submitted by electronic means, the application must be signed by a qualified electronic signature or made by electronic means which ensure the integrity and unalterability of the text.

The company may refuse to act on a person's request if the person's request is manifestly unfounded or disproportionate.

The undertaking shall provide the person with a reply within one month of receipt of the request at the latest, containing information on the action taken on the request in accordance with Articles 15 to 22 of the Regulation. That period may be extended by a further two months, if necessary, depending on the complexity of the request and the number of requests being processed. The undertaking shall inform the person within one month of receipt of the request of the extension of the time limit for examining the request, stating the reasons for the extension.

Duties of persons

By submitting their personal data to the Company, individuals confirm that they are duly acquainted with the terms and conditions of personal data processing set out in this Privacy Policy, they do not object to the Company's processing of the personal data provided by the individuals, the data and information provided by the individuals are accurate and correct, and the Company is not liable for the submission and processing of redundant data if the individual negligently submits the data to the Company.

The person undertakes to inform the Company of any changes to the data provided or other relevant information.

Validity and changes to the Privacy Policy

This Privacy Policy sets out the main provisions for the processing of personal data. Additional information on how the Company processes personal data can be found in the Company's contracts and other internal documents of the Company.

In the event of changes in legal requirements and/or changes in the Company's business processes, services, etc., the Company has the right to unilaterally review and update this Privacy Policy. The Company will inform you of the changes to the Privacy Policy by posting them on the Company's website.