Privacy policy

PERSONAL DATA CONTROLLER

The controller of your personal data is the Agricultural Cooperative Pienas LT, legal entity code: 302291237, registered address of the Company: Kokybės g. 1, Biruliškių k., LT-54469 Kaunas District, Lithuania, e-mail address: [email protected], telephone number: +370 37 210 518, registered in accordance with the procedure established by law, which complies with the applicable personal data processing legislation of the Republic of Lithuania and the European Union.

We respect your privacy and undertake to process and store your personal data fairly and lawfully.

This privacy policy (hereinafter referred to as the Privacy Policy) is intended for persons with an interest in AC Pienas LT (hereinafter referred to as the Company), provide products to the Company, intend to become members of the Company, visitors of  this website www.baltmilk.eu (hereinafter referred to as the Website), communicate with the Company on social networks or in any other way, or simply monitor activities of the Company on social networks.

By providing us with personal data on this Website or by browsing the Website, you confirm that you have become acquainted with this Privacy Policy and the processing of your data.

By contacting us, you express your will that the Company would contact you regarding your enquiry.

In this Privacy Policy, we inform you about the main principles of personal data processing, exercising the data subject’s rights, the processing of personal data and its purposes. Additional information may be provided in purchase and sales, service and other contracts, orders.

The provisions of this Privacy Policy shall be implemented and interpreted in accordance with the law of the Republic of Lithuania. 

The Privacy Policy shall not be applicable for the use of the websites of other companies. We recommend that you read the privacy notices of other service providers and contact them directly regarding the use of your personal data.

The employees of the Company, members of its management bodies shall be informed about the processing of their personal data in the Company's internal procedures.

THE KEY PRINCIPLES OF PERSONAL DATA PROCESSING

We process personal data in accordance with the personal data processing legislation of the European Union and the Republic of Lithuania.

The amount of personal data processed depends on the products you sell or purchase, the Company's legal relationship with you or other persons, as well as what information you provide when you purchase or sell products, visit the Website or the Company or contact the Company.

The processing of data is subject to the criterion of lawful processing: they are processed in order to take action at your request before concluding a contract or performing a contract; with your consent; when we are bound by the relevant legislation to process personal data; when the processing of personal data is in the legitimate interest of us or of a third party; in order to protect the vital interests of the data subject or another natural person.

We aim to ensure that personal data are processed accurately, fairly and lawfully, that data are processed only for the purposes for which they were collected, that they are processed in accordance with clear and transparent principles and requirements for the processing of personal data laid down in legal acts. 

GROUPS OF DATA SUBJECTS WHOSE PERSONAL DATA WE PROCESS

We process your personal data, if you belong to any of the following groups of persons:

a)    persons who submit applications in order to receive information about the Company, are interested in the conditions of becoming members of the Company; 

b)    natural persons who are members of the Company or persons authorised by them, or representatives of legal persons of Company members, contact persons;

c)    persons who sell raw materials and products to the Company, purchase products sold by the Company or conclude agreements with the Company;

d)    representatives of legal entities, contact persons when the Company concludes or intends to conclude agreements with legal persons or legal persons contact the Company with other enquiries or the Company itself contacts legal entities;

e)    persons who are interested in the Company's activities in social networks or monitor the Company's activities in social networks;

f)    persons who visit the Company, enter the territory of the Company;

g)    candidates for a job or placement;

h)    other persons with whom the Company maintains business relations, communicate through social networks, by e-mail or by other means;

i)    employees of the Company, members of its management bodies, buyers, suppliers.

SOURCES OF PERSONAL DATA

Personal data may be obtained directly from you when:

    you order products or enter into contracts with us on your own behalf or by representing others,

    you send your Curriculum Vitae (CV), other information related to employment, placement in the Company or otherwise contact the Company, 

    you communicate with us through social networks or simply follow our activities on social networks, 

    you visit the Company.

We may also obtain your personal data indirectly from our data processors or other external sources, the persons you represent.

You are not required to provide any personal data but it may be that certain actions, such as selling products, buying raw materials or invoicing, if personal data are not provided, will not be possible, you will not be able to become a member of the cooperative.

If you provide us with other personal data related to you, such as family members, company employees, etc., you must inform them of the transfer and the processing of their personal data and undertake actions to make them aware of this Privacy Policy.

OBJECTIVES OF DATA PROCESSING

The purposes for which we process personal data include but are not limited to:

a)    conclusion and performance of contracts;

b)    administration of applications or other inquiries or in order to solve any issues that require data when you contact the Company;

c)    protection of our rights and legitimate interests, property, our employees and other persons in the Company's territory;

d)    promotion of the Company;

e)    recruitment of employees;

f)    internal administration;

g)    collection and administration of debts, lodging, enforcement of legal claims;

h)    maintaining relations with customers and partners, suppliers of products, members of the cooperative;

i)    accounting.

CATEGORIES OF PERSONAL DATA PROCESSED

The main categories of personal data that the Company may process for the aforementioned personal data processing purposes  include but not limited to: data subject's name, surname, telephone number,  e-mail address, address, production, farm data, quantity of milk sold per year, refrigerator capacity, number of cows, information that a person or person's representative familiarised with the terms of joining the cooperative, billing data, signature, information about membership in the Company, IP address, website browsing history and date, other information required for maintaining the relations, billing and contract administration, submission of legal requirements, the profile of data subject and other information on social media.

We also process video records and information obtained during your visit to the Company, other categories of data. More information on other categories of personal data is provided in separate sections of this Privacy Policy.

PROCESSING OF VIDEO RECORDS FOR THE PROTECTION OF PROPERTY AND INDIVIDUALS, FOR THE PREVENTION OF THEFT

We perform video surveillance in the Company's logistics, production facilities and territory in order to protect our own, your and other person's property, as well as the health and life of individuals on the basis of legitimate interests of the Company and third parties.

As part of video surveillance, we collect the following information: videos, date and time of video recording, location (Kokybės g. 1, Biruliškių k., LT-54469 Kaunas District).

We organise video surveillance in such a way that the area covered is not larger than necessary in the territory of the Company (the premises, part of the premises, part of the territory). The premises of the Company, entrances to the Company and the territory are monitored.

Video surveillance in premises and/or areas intended for private use by persons, i.e. toilets, showers, changing rooms, etc. is not conducted.

PROCESSING OF DATA OBTAINED DURING YOUR VISIT TO THE COMPANY FOR THE PURPOSE OF PROTECTING PROPERTY AND INDIVIDUALS, PREVENTING THEFT

For the purpose of the protection of property and individuals, prevention of theft, the Company carries out the visitors’ access control. Access control is performed when you enter the Company at: Kokybės g. 1, Biruliškių k., LT-54469 Kaunas District, Lithuania.

Our employee records your exit/entry into the Company, your name, surname, which company you have arrived from, the purpose of visit, time of arrival, time of departure, to which branch of the Company you have arrived. If your car enters the territory of the Company, our employee can check the contents of the car's luggage compartment. Such information shall not be recorded or stored in a material form after the inspection of the items, unless we suspect that unlawful actions have been carried out (including but not limited to, criminal acts, administrative offenses, damage cause to the Company's employees, service providers, third parties property or the Company’s property, health or life of individuals).

DATA ON SIGNIFICANT COMPANY EVENTS PROCESSED FOR THE PURPOSE OF PROMOTING THE COMPANY

We process your name, surname, photo, date the photo was taken, an event related to the importance to the Company in an electronic publication distributed by us, on the Website or in the Company's social media accounts. As a general rule, we seek your consent before processing your data for the purposes set out in this section unless such consent is impossible or excessively difficult to obtain (e.g. you are our former employee and we do not have your contact details in order to contact you). 

If you withdraw your consent, we will take the necessary measures to ensure that your personal data are not disclosed in an electronic publication or in any other way.

PERSONAL DATA PROCESSED FOR THE PURPOSE OF EMPLOYMENT OR PLACEMENT AT THE COMPANY

Potential employees of the Company (candidates, persons seeking employment), potential trainees shall provide the Company with the following personal data: CV, name, surname, contacts, cover letter. We inform you about the processing of your personal data as a potential employee, trainee, and the terms of data storage in job advertisements. You can find out about the processing of your personal data as a potential employee or intern in this section of the Privacy Policy.

If you contact us through social media, the social network manager may manage your interest in the positions announced by us for the purposes set out in the social network manager's policy.

Your personal data submitted when applying for a specific position announced by the Company are processed for the purpose of concluding an employment contract, a placement agreement with you as a potential employee, trainee.

If you apply for a specific position but are not offered a job or placement, your personal data will be destroyed at the end of the selection procedure for that specific position announced by the Company, unless your consent to save your personal data for the future employment opportunities in our Company is obtained. You may revoke your consent to the processing of personal data for the purpose specified in this section of the Privacy Policy at any time by clearly expressing your will in writing to the Company’s employee by contacting us by phone or e-mail.

PERIOD OF RETENTION OF PERSONAL DATA

Personal data shall be not be processed for longer than necessary for the purposes of the personal data processing or for longer than required by the data subject and/or legal acts.

As a general rule, we will store data for 10 years after the end of the contract or legal relationship fulfilling the legal requirements related to the archiving of documents and in order to establish, enforce or defend the legal claims of the Company.

Data provided by candidates, trainees after the end of a specific selection procedure, when an employment contract or placement agreement is not concluded or, if the candidate has submitted his/her data without applying for a specific position in the Company, shall, subject to the consent of data subject, be stored for 1 (one) year or until the data subject withdraws the consent for processing.

Records of video surveillance containing personal data shall be stored and processed for no longer than 2 weeks from the date of data capture/receipt.

If you have visited the Company, the personal data obtained during the access control are stored and processed for no longer than six months from the date of data recording/receipt.

Personal data collected for administrative purposes of applications for membership of the cooperative shall be stored for a period of 10 years.

If you withdraw the consent for data processing or the data processing period expires (when data are processed on the basis of your consent), only data confirming the fact of giving consent are stored for 10 (ten) years from the expiry date of the consent or the withdrawal in order to establish, enforce or defend the legal claims of the Company.

RECIPIENTS OF PERSONAL DATA

Your privacy is important to us, therefore, we will not share your personal data with others without your consent, except for the provision of your personal data to the following persons:

• in the event of a dispute, to persons providing legal services to us;
• auditors, other consultants;
• data processors involved;
• business partners;
• state institutions, law enforcement agencies and other persons in accordance with the procedure established by the legislation of the Republic of Lithuania.

We may also provide your data to protect your vital interests (for example, if you feel unwell on our premises and we have to seek medical help).

If we disclose your personal data to groups of data recipients other than those specified in this Privacy Policy, we will inform you about it no later than when disclosing the data for the first time, unless we have already provided such information to you in other documents.

ENSURING DATA SECURITY

We implement appropriate organizational and technical data security measures, including protection against unauthorized or unlawful processing of data and against unintentional loss, destruction or damage (principle of integrity and confidentiality). Access to personal data shall be limited to those persons for whom it is necessary for the performance of work functions or the provision of services.

PROCESSORS

Your personal data may be processed by processors that provide the Company with accounting, website hosting, data centre and/or server rental, IT maintenance, external audit and other services.

Processors shall have the right to process personal data only in accordance with our instructions and only to the extent necessary to achieve data processing purposes. With the help of processors we aim to ensure that processors have implemented appropriate organisational and technical data security measures and maintain the confidentiality of personal data.

RIGHTS OF THE DATA SUBJECT

As a data subject, you have the rights set out in this section.

The right to know (be informed) about the processing of your personal data.

When we receive information directly from you about the processing of personal data, we inform you at the time of the receipt of personal data:

• orally (if we communicate with you only orally, e.g. by phone);
• in writing (we consider that the information sent to you by e-mail is provided in writing, if we provide information about the processing of your personal data in job/ placement advertisements, we consider that you are familiar with the processing of your personal data for selection purposes).

If we do not receive your data directly from you, we will inform you about the processing of your personal data orally or in writing (as specified above) no later than one month after receiving the data, and if we use your personal data to communicate with you – no later than the first time we contact you.

The right of access to personal data and information how they are processed, i.e. to receive information on the period of retention of personal data, information from which sources and what personal data have been collected, for what purpose they are processed, to whom they are provided.

Upon receipt of your request, we will immediately but in any case no later than within one month from the receipt of the request, check whether your personal data are processed by the Company. Once we have determined that we process your personal data, we will provide you with information about it and a copy of the processed personal data in electronic format or on paper.

If necessary, we may extend the response period depending on the complexity and the number of your requests. We will inform you about this separately. If we decide to extend the period of response, you have the right to apply to the State Data Protection Inspectorate against the extension.

As a general rule, we will provide you with the information free of charge. However, if your requests are manifestly unfounded or disproportionate, in particular because of their repetitive content, or if you wish to receive a copy of the processed personal data in other than electronic or paper form prepared by the Company, we shall be entitled to charge you a fee, which consists of the administrative expenses of the Company’s submissions of notifications or actions requested.

In addition, if your requests are manifestly unfounded or disproportionate, we have the right to refuse to execute them.

At your request, the information may be provided orally, allowing access to the document, submitting a certificate, an extract from the document or a paper copy of the document, an electronic medium, access to the information file. If you do not specify a form for submitting information in your request, we will provide you with it in the same format as the request received. 

The right to request rectification of personal data and suspend the processing of such personal data, in case you find that data are incorrect, incomplete or inaccurate

We shall immediately notify you of the rectification, destruction or suspension of the personal data processing whether or not carried out at your request. We will also inform data recipients about personal data rectified or destroyed at your request, suspended processing of personal data, unless it would be impossible or excessively difficult to provide such information. In this case, at your request, we will provide you with information on such data recipients.

The right to demand the destruction of personal data or to restrict the processing of data in the event that the data subject finds that personal data are being processed unlawfully or dishonestly

We shall immediately notify you of any restriction on data processing performed or not performed at your request. 

The personal data subject to the restriction shall be stored. We will inform you by electronic communications before lifting the restriction. We will also inform data recipients of the restricted data processing at your request, unless this proves impossible or requires disproportionate effort. In this case, at your request, we will provide you with information on such data recipients.

The right to object to the processing of personal data, except where such personal data are processed in the legitimate interest of the controller or of a third party to whom the personal data are disclosed, provided that the interests of the data subject are not overriding

If you object to the processing of personal data, further processing shall only take place if it is reasonably decided that the reasons for processing the personal data take precedence over your interests, rights and freedoms, or if your personal data are necessary to assert, enforce or defend legal requirements.

The right to withdraw given consents for data processing

You have the right to withdraw all your consents to the processing of personal data at any time when the basis for the processing of your personal data is the consent given to the Company.

The right to be forgotten

We have the right to reject your request in cases provided for by law, including but not limited to the cases covered by Article 17(3) of the Regulation.

If we satisfy your request and the personal data (deleted at your request) have been transferred to the data recipients, we will inform these data recipients, unless this proves impossible or requires disproportionate effort. 

Upon your request, we will provide information about such data recipients.

The right to data portability

You have the right to request that your personal data processed by automated means on the basis of consent or contract, be transferred to another controller or to you in a structured, commonly used and computer readable format, if technically possible. When contacting us about your right to data portability, you must indicate whether you wish your personal data to be transferred to you or another controller.

If we satisfy your request and you wish the data to be transferred by digital medium, we will provide you with your personal data processed by the Company on a single-use CD-ROM provided by you and reimbursing you the purchase price of this medium or provided by the Company.

You do not have the right to data portability with regard to personal data that are processed manually in structured files, such as paper files.

Personal data transferred at your request are not automatically deleted. If you so wish, you must contact the Company regarding the exercise of the right to erasure of your personal data (the "right to be forgotten").

The right to object only to automated data processing including profiling

You have the right to know and be informed according to what logic personal data are processed automatically and what the consequences of such processing may be, if the data are processed only in an automated way.

When you request a review of a decision based on automated data processing (if such decisions have been made by the Company regarding your personal data), we will perform a thorough evaluation of all relevant data including the information you provide.

The right to file a complaint against the processing of personal data to the State Data Protection Inspectorate or a competent court

You can appeal our actions or omissions related to the implementation of the data subject's rights to the State Data Protection Inspectorate at A. Juozapavičiaus g. 6, Vilnius, el. e-mail address: [email protected], website: www.ada.lt and to the competent court of the Republic of Lithuania. You have the right to complain against the actions or omissions of the Company yourself or through a duly authorised representative or non-profit organisation or association that meets the requirements of Article 80 of the Regulation.

The right to compensation for damage resulting from infringement of data subject's rights

If you have suffered material or non-material damage as a result of a violation of the data subject's rights, you shall have the right to compensation and for the award of it you have to apply to the competent court of the Republic of Lithuania.

PROCEDURE FOR APPLYING TO THE COMPANY IN EXERCISING THE RIGHTS OF THE DATA SUBJECT

You have the right to apply for the exercise of the data subject's rights orally or in writing by submitting an application in person, by post or by electronic means using the contacts specified in this Privacy Policy. If you have decided to contact us in writing, we recommend that you complete the application form, which you can download following this link: http://www.pienaslt.lt/privatumo-politika/Duomenu-subjekto-prasymo-forma.docx 

If you apply orally or submit the application in writing for the exercise of your rights as data subject, you must confirm your identity by presenting an identity document. Failure to do so will prevent us from accepting your applications and your data subject's rights will not be exercised. This provision shall not apply, if you request information on the processing of personal data in accordance with Articles 13 and 14 of the Regulation.

If you have decided to apply in writing for the exercise of your rights as the data subject by submitting an application by post, you must submit together with it a copy of the identity document certified by a notary or other procedure established by the legal acts.

If your personal data, such as your name, surname have changed, you must provide copies of the documents confirming the change; if they are sent by post, they must be certified by a notary or other procedure established by legal acts. 

If you decide to submit your application electronically, the application must be signed with a qualified electronic signature or be made by electronic means ensuring the integrity and irreplaceability of the text. This provision shall not apply, if you request information on the processing of personal data in accordance with Articles 13 and 14 of the Regulation.

The applications for the exercise of the data subject's rights must be legible, signed and contain your name, address and/or other contact details for communication or for the response. 

You can exercise your rights yourself or through a representative. If you decide to exercise your rights through a representative, your representative must indicate in the application his or her name, surname, address and/or other contact details by which the representative wishes to receive a reply, as well as your name, surname and other details required for the proper identification of the data subject and must provide a document certifying the representation or a copy thereof.

If we have any doubts about your identity or other data, we shall have the right to request additional information necessary to verify it.

You have the right to contact the Company's Data Protection Officer in all matters related to the processing of personal data and the exercise of your rights as the data subject. When contacting the Company's Data Protection Officer by post, we recommend you write on the envelope that the correspondence is addressed to the Company's Data Protection Officer.

If you do not follow the procedure set out in this section for contacting us, we will inform you of this no later than within 7 calendar days from the receipt of your application and indicate any shortcomings. If you fail to correct or inform the Company of the reasons, why the specified deficiencies cannot be remedied, we will not process your application.

In case of objective circumstances that do not allow the specified deficiencies to be remedied, we may decide, having assessed such circumstances, to accept your application and examine it.

We will consider your application to be defective, if by applying in writing you have not complied with the application form provided in this section of the Privacy Policy.

COMPANY ACCOUNTS IN SOCIAL MEDIA

The Company has created and maintains accounts on social media Facebook and LinkedIn. All information you provide via social media on Facebook and LinkedIn (including messages, the use of “Like” and “Follow” fields and other communications) or obtained by visiting Company’s accounts on social media (including information obtained through cookies used by social network managers) is controlled by the social network manager. Therefore, we recommend that you read the privacy notices of social network managers and contact them directly regarding the use of your personal data.

As the administrator of the Company’s Facebook and LinkedIn accounts, we select the appropriate settings based on our target audience, performance management and promotion goals. By giving the Company the ability to create and administer a social network account, the social network manager may have limited  the ability to change certain, essential settings and, thus we cannot influence, what information the social network manager collects about you.

All such settings, both selected by the Company and set by the social network manager, may affect the processing of your personal data when using social media, visiting the page or reading messages of the Company on social media networks. Even if you only view our messages on social media, the social network manager may receive certain personal data, such as the type of terminal device you use and your IP address.

Typically, a social network manager processes your personal data (even that we collect when selecting additional account settings) for purposes set by the social network manager in accordance with their privacy policy. However, when you use the social network to communicate with the Company, visit the Company's account on the social network or monitor the records therein, the Company also receives information about you. The amount of data we receive depends on the account settings we choose, the agreements with the social network manager on additional services and the cookies set by the social network manager.

Facebook social network manager collects data on what type of content you see, what you do on Facebook, who you interact with, how often and for how long you interact with them, how active you are on the social network and other data, including information about the terminal device you are using. To learn more about Facebook’s privacy policy, click here: https://www.facebook.com/policy.php.

LinkedIn social network manager collects data on what type of content you see, what you do on the LinkedIn social network, information about your education, who you interact with, and other data. To learn more about LinkedIn’s privacy policy, click here: https://www.linkedin.com/legal/privacy-policy.