PROCESSING OF PERSONAL DATA
Welcome to the website of GELVORA UAB, a company dealing with debt recovery and prevention www.gelvora.lt.The provisions presented below explain how GELVORA UAB processes, stores and uses personal data. By using the website www.gelvora.ltyou confirm that you have read these provisions on the processing of personal data. Should you have any further questions concerning the processing of personal data, please contact us by email email@example.com.
Data subjects have the right to send inquiries to GELVORA UAB, cancel their consents to the processing of personal data and submit requests for the exercise of their rights and/or complaints regarding the processing of personal data.
All contact details of GELVORA UAB are published on the website www.gelvora.lt. Contact details of the appointed Data Protection Officer: tel. +370 5 273 87 80, email: firstname.lastname@example.org. You can also contact us by regular mail to A. Juozapavičiaus g. 7, Vilnius, or visit our office located at the above address.
GELVORA UAB has the right to unilaterally amend these provisions on the processing of personal data at any time by informing the data subjects thereof on its website www.gelvora.ltat least twenty (20) calendar days before the effective date of the amendments.
1. Terms and Definitions:
1.1. Data Subject:a natural person whose personal data are processed by GELVORA UAB.
1.2. Personal Data:any information about a natural person who has been identified or who can be identified (data subject); and a natural person who can be identified is a person who can be directly or indirectly identified in particular by reference to an identifier (name and surname, national identification number, phone number, location data and/or online identifier) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.
1.3. Processing of Personal Data:any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
2. General Information
2.1. Websites www.gelvora.ltand www.infodebt.ltare the property of GELVORA UAB, registration number 125164834, address for correspondence: A. Juozapavičiaus 7, Vilnius.
2.2. These provisions lay down the main principles of Processing of Personal Data carried out by GELVORA UAB. Additional information about the Processing of Personal Data is provided in agreements concluded with GELVORA UAB and local regulatory documents of GELVORA UAB.
2.3. GELVORA UAB undertakes to comply with the principles of the Processing of Personal Data provided for in the applicable legislation (General Data Protection Regulation 2016/679, available at http://eurlex.europa.eu/legalcontent/LT/TXT/PDF/?uri=OJ:L:2016:119:FULL&from=EN, hereinafter – Regulation; Law on Legal Protection of Personal Data of the Republic of Lithuania (latest version), etc.) and apply the appropriate technical and organisational measures to protect the available Personal Data from unauthorised access, disclosure, accidental loss, alteration or destruction or other unlawful processing.
2.4. GELVORA UAB may use data processors for the Processing of Personal Data. The processors shall be required to comply with the legitimate instructions of GELVORA UAB and the applicable legislation as well as ensure the appropriate safeguards with regard to the protection of Personal Data.
2.5. Where legitimate purposes and basis for the Processing of Personal Data are ensured, GELVORA UAB shall have the right to collect data from public registers of the Republic of Lithuania and registers managed by private individuals who engage in lawful activities.
2.6. No cookies are used on the websites www.gelvora.ltand www.infodebt.lt.
3. Categories of the Processed Personal Data
Identity data:name, surname, national identification number, date of birth.
Contact details:address, phone number, email address, social network accounts.
Data provided by Data Subjects:information presented by Data Subjects.
Professional information:information about education, professional activities and position held.
Financial information:information about the available assets, income, liabilities.
Debt-related information:information about the existing debts and debt-related details, payments received.
Data from public registers:data received from the State Enterprise Regitra, State Enterprise Centre of Registers, Population Register Service, Mortgage Register, Register of Contracts, Register of Property Seizure Acts, Register of Wills and other lawfully operating public and private data registers (databases of joint personal data files), E-services Portal of Lithuanian Courts (Epp) and LITEKO electronic court system, database of Lithuanian bailiffs.
4. Legal Basis of the Processing of Personal Data
4.1. Conclusion and performance of agreements;
4.2. Legitimate interests of GELVORA UAB;
4.3. Fulfilment of legal obligations of GELVORA UAB;
4.4. Consent of the Data Subject.
5. Purposes of the Processing of Personal Data
5.1. Pre-trial debt recovery (debt administration) under assignment agreements.
5.2. Debt prevention and solvency assessment.
5.3. Acquisition, exercise and transfer of rights of claim.
5.4. Provision of legal services.
5.5. Protection of interests of Data Subjects and/or GELVORA UAB.
5.6. Compliance with legal requirements and administration of inquiries related to the Processing of Personal Data.
5.7. Organisation and implementation of the Company’s activities.
5.8. Electronic monitoring of workstations in the Company.
5.9. Storage of the Company’s documents and electronic data.
5.10. Accounting and performance of tax liabilities.
6. Rights of the Data Subject
Data Subjects may exercise any of the rights listed below only after they are properly identified, i.e. after submitting a paper or electronic request of the appropriate form to GELVORA UAB or filling in the appropriate inquiry form at www.gelvora.lt or visiting the office of GELVORA UAB and presenting their identity documents:
6.1. The right to know whether any of their Personal Data are processed and, if so, to have access to such data and other information: data sources, basis for processing, purposes of processing, data recipients (over the past year), procedure for the storage of data, etc.;
6.2. The right to request rectification of incorrect, incomplete or inaccurate Personal Data;
6.3. The right to object to the Processing of Personal Data, if the basis for such processing is legitimate interests of GELVORA UAB and appropriate legal grounds for such request exist;
6.4. The right to request deletion of Personal Data, if they are processed in an unlawful or unfair manner or if such data were received based on the consent of the Data Subject and the Data Subject withdrew such consent;
6.5. The right to limit the Processing of Personal Data in accordance with the applicable legislation;
6.6. The right to receive a set of all their Personal Data processed in electronic databases of GELVORA UAB (based on consent or for the purposes of performance of agreements) in a structured and commonly used electronic format. Where possible, Data Subjects shall have the right to request GELVORA UAB to transfer this set of data to another data controller stating the grounds or motives of such request (right to data portability). The aforementioned set of data may be presented in PDF or MS Excel file format. It can also be attached to the printed reply to the Data Subject’s inquiry. The right of data portability is not connected with the deletion of data;
6.7. The right to withdraw consent to the Processing of Personal Data;
6.8. The right to file a complaint regarding the Processing of Personal Data to the State Data Protection Inspectorate or court, if the Data Subject believes that his/her Personal Data are processed in violation of his/her rights and legitimate interests.
Having received a request of the Data Subject regarding exercise of his/her rights, GELVORA UAB shall present a reply within thirty (30) calendar days after the request date. GELVORA UAB may extend this deadline by up to ninety (90) calendar days by giving a reasoned notification to the Data Subject.
7. Recipients of Personal Data
Where legitimate purposes and basis for the disclosure of Personal Data are ensured, Personal Data may be transferred to the following recipients:
7.1. Public authorities and institutions, other persons performing functions provided for in laws (for example, courts, law enforcement authorities, bailiffs, notaries public, institutions investigating financial crimes);
7.2. Customers of GELVORA UAB;
7.3. Entities providing legal, financial, archiving, postal, information technology services, i.e. processors authorised by GELVORA UAB;
7.4. Other third parties who have legitimate interest.
All data recipients are required to have legitimate interest to receive the data and ensure the appropriate organisational and technical measures for the protection of Personal Data. Furthermore, prior to receipt of Personal Data from GELVORA UAB, data recipients shall undertake in writing to comply with the obligation not to disclose Personal Data to unauthorised third parties (confidentiality obligation).
8. Transfer of Personal Data outside the European Union
8.1. GELVORA UAB processes Personal Data within the European Union.
8.2. In exceptional cases, Personal Data may be transferred outside the European Union, where this is necessary to conclude and perform an agreement or consent of the Data Subject was received, and if the appropriate technical and organisational measures provided for in the General Data Protection Regulation 2016/679 are ensured.
8.3. Non-EU country in which the recipient of Personal Data resides shall be required to ensure adequate level of protection of Personal Data according to the criteria approved by the European Commission.
9. Personal Data Retention Period
9.1. Personal Data shall be retained in accordance with the procedure prescribed by the Regulation and Law on Legal Protection of Personal Data of the Republic of Lithuania in line with the principle of limitation: Personal Data are retained only for a period and to the extent this is necessary for the Company to achieve the legitimate purposes of the Processing of Personal Data provided for in the Policy. Where legitimate purposes of the Processing of Personal Data no longer exist, Personal Data shall be destroyed.
9.2. Personal Data processed by the Company are also subject to the retention time limits provided for in the Order No. V-100 of 09/03/2011 of the Chief Archivist of Lithuania on the general time limits of document retention and other legislation.
10. Profiling and Automated Individual Decision-making
10.1. Profiling: any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements, where this has immediate legal or financial consequences to the natural person.
10.2. GELVORA UAB does not perform profiling or automated individual decision-making. All decision-making processes in the Company involve people.
11. Existing Technical and Organisational Measures to Ensure Data Protection
In line with the requirements of the Regulation, GELVORA UAB has introduced the following technical and organisational measures to secure Personal Data and minimise the risk of loss and leakage of such data or other violations of data processing:
11.1. internal and external data encryption;
11.2. compliance with the requirement of pseudonymisation of data provided for in Article 32(1) of the Regulation;
11.3. introduction of data leakage prevention program;
11.4. application of technical and software measures to restore conditions and possibility to use the processed Personal Data in case of physical or technical damage;
11.5. physical and electronic control of the employee access to the processed Personal Data;
11.6. various means of securing entry into the Company’s premises.
12. Data Protection Officer
12.1. GELVORA UAB has an appointed Data Protection Officer. Contact details: +370 5 273 87 80; email@example.com.
12.2. The appointed Data Protection Officer meets the applicable qualification requirements and undertakes to ensure security of confidential information.
12.3. Key functions of the Data Protection Officer:
12.3.1. giving advice to the employees of GELVORA UAB on issues related to the protection of Personal Data, informing them about the requirements of the Regulation and other legislation;
12.3.2. communicating and ensuring appropriate response to inquiries and claims of Data Subjects;
12.3.3. supervising and controlling compliance with the requirements of the Regulation within GELVORA UAB; where necessary, collecting the required information, carrying out audits and investigations to identify or prevent violations of the protection of Personal Data;
12.3.4. consulting on matters related to data security impact assessment and monitor such assessment within GELVORA UAB;
12.3.5. cooperating with the State Data Protection Inspectorate and acting as a contact person for all matters related to the protection of Personal Data in GELVORA UAB;
12.3.6. replying to inquiries of Data Subjects;
12.3.7. the Data Protection Officer shall also have other rights and obligations provided for in the applicable legislation and local legislation of GELVORA UAB.