What does this privacy notice mean?
In this Privacy notice, we provide you, the visitors of the website
https://www.ambergrid.lt/ (hereinafter - the Website), with information on how AB “Amber Grid” (legal entity code: 303090867, business address: Laisvės str. 10, LT-04215 Vilnius, the Republic of Lithuania) (hereinafter - the Company) processes your personal data that you provide to the Company by visiting the Company's registered office, the Website, by e-mail or by telephone.
What personal data do we collect about you?
If you visit the Company's website, registered office address, contact us in writing, by e-mail or by telephone, the Company will process this Personal data for the purposes set out below:
- The following data shall be processed for the purpose of examination of written applications (letters, complaints, requests and claims) of persons: name, surname, personal identification number, address, telephone number, e-mail address, signature, date and number of the application (registration number in the Company's document management system), information specified in the application (including special personal data); the result of the examination of the application, the outcome of the application, and any other information received during the communication with the applicant. Applications received shall be registered and kept in accordance with the procedures laid down by law.
- The following information for the purposes of concluding and executing contracts necessary for the provision of services and performance of duties by the Company as a transmission system operator, and for the purposes of executing and performing other activities of the Company: name, surname, personal identification number, telephone number, address, e-mail address, workplace, position, certificates of qualification and the right to carry out certain works, bank account number, and any other information related to the conclusion and execution of the contract, depending on the type of the contract concluded. This Personal data is processed for the performance of a contract concluded with the data subject or another legal entity, as well as for pre-contractual actions at the request of the data subject. For this purpose, the data shall be kept for a period of 10 (ten) years after the date of termination of the contract, unless other retention periods are prescribed by law.
- The following information is required for the purposes of organising and conducting the procurement: name, surname, personal identification number, date of birth, address, telephone number, position, of the representative of the supplier participating in the procurement, and, depending on the subject-matter of the procurement and the qualification requirements, any other personal data may be required (criminal record checks, verification of compliance with tax obligations, and any other qualification requirements relating to the subject-matter of the procurement, as specified in the procurement documents); the name, surname, personal identification number, date of birth, address, telephone number, job title, bank account number, copy of the successful supplier's representative, copy of the self-employed person's certificate, copy of the business licence (the successful supplier may be asked to provide: CV, copies of diplomas, certificates obtained, work experience, number of contracts completed, criminal record, certificates of settlement with VMI, “SoDra”, etc.). This Personal data is processed for the necessity to perform a contract concluded with the Data subject or for pre-contractual actions at the request of the Data subject. For this purpose, the data shall be kept for a period of 10 (ten) years after the date of termination of the contract. If a person does not consent to further processing of his/her personal data after the end of the selection process, his/her personal data shall be deleted by the Company after 5 (five) working days following the expiry of the deadline for appealing against the selection results.
- The following information is required for the purpose of selecting and administering the database and for the purpose of screening Candidates for employment with the Company: name, surname, date of birth, telephone number, place of work, e-mail address, place of residence (address), education, desired job, date of receipt of curriculum vitae, personal qualities, work experience: last place of employment, length of service, position held, other work experience; knowledge of foreign languages: language, reading, writing, speaking levels; ability to work with computer programs, other data and motivation, desired salary; other information in the curriculum vitae, letter of reference and/or motivational letter, declaration of interests. If the Candidate applies for a position for which the Employee's selection process involves the processing of special categories of Personal data, such as data relating to the employee's health and criminal record, and other special categories of Personal data, to the extent provided for by the Law on the Protection of the Objects of Importance to Ensuring National Security and the Law on Prevention of Corruption. This Personal data is processed on the basis of the Data subject's consent. For this purpose, the data will be kept for a maximum of 2 years after the date of consent. The documents of a candidate received by e-mail are automatically deleted after 3 (three) months, unless the candidate has agreed to a longer retention period.
- For the purpose of selection and administration of the database and for the purpose of screening of candidates applying to become members of the collegiate bodies of the Company and/or Group companies - name, surname, date of birth, telephone number, place of work, e-mail address, place of residence (address), education, date of receipt of curriculum vitae, personal characteristics, work experience: last place of employment, length of service in the previous company, position held, other work experience; knowledge of foreign languages: reading, writing, speaking levels; ability to work with computer programs, other data and motives, other information provided in the CV, recommendation and/or cover letter. If the candidate applies for a position in a collegial body of the Company and/or Group companies, for which special categories of Personal data are processed in the selection process, such as data related to the employee's health, criminal record and other special categories of Personal data to the extent provided for by the Law on the Protection of the Objects of Importance to Ensuring National Security and the Law on Prevention of Corruption. This Personal data is processed on the basis of the Data subject's consent. For this purpose, the data will be kept for a maximum of 2 years after the date of consent. The documents of a candidate received by e-mail are automatically deleted after 3 (three) months, unless the candidate has agreed to a longer retention period.
- For the purpose of organisation of the General Meeting of Shareholders of the Company and for the purpose of accounting of the shareholders' votes - name, surname, personal identification number of the shareholder or his/her authorised representative, and, if necessary, other necessary personal data confirming that the person has the right to vote or has received authorisation to vote. This data is collected and processed by the Company in accordance with the provisions of the Law on Companies of the Republic of Lithuania. For this purpose, the data will be kept for 10 years from the date of receipt.
- For the purpose of ensuring the security of the Company's headquarters and territorial units' employees and premises, as well as the security of objects important for ensuring national security - person's name, surname, signature, place of work shall be collected by means of the registration of the Company's visitors as they enter the Company's premises, and the image data of the persons who have been included into the area of the video surveillance. The retention period of the image data is 30 days. Access control records shall be kept for 6 months.
- For the purpose of publicising the activities - the Data subject's image, name, surname, place of work, position. This Personal data is processed on the basis of the Data subject's consent. For this purpose, the data is stored for 1 year after the date of consent.
- For the purpose of the market research - name, surname, e-mail address, phone number, information contained in the survey. This Personal data is processed on the basis of the Data subject's consent. For this purpose, the data is stored maximum for 3 years.
- Any other personal data that you may provide to us at any time by communicating with us, whether by e-mail, letter or telephone call, or by visiting us at our head office or territorial offices. This data shall be processed with the consent of the data subject and shall be kept for 2 (two) years after the date of consent.
How is your personal data processed?
Your personal data will be processed in accordance with the Law on Legal Protection of Personal Data of the Republic of Lithuania and other legal acts. Your personal data is processed responsibly and securely. The Company, both when establishing measures for the processing of personal data and during the processing of the data itself, shall implement appropriate technical and organisational data protection measures provided for in the legislation in order to protect the processed personal data against accidental or unlawful destruction, corruption, alteration, loss, disclosure, as well as against any other unlawful processing. The appropriate measures shall be determined in the light of the risks arising from the processing of personal data.
Who can we disclose your personal data to?
We may disclose your personal data to the parent company of the group of companies UAB “EPSO-G” to which AB „Amber Grid“ belongs, on the basis of legitimate interest, to the extent necessary for internal administration purposes.
We may disclose your personal data to personal data processors who provide services to us (perform work for us), i.e. information technology service providers, auditors, lawyers, consultants, and who process your data on behalf of the Company as a data controller.
Processors have the right to process personal data only on our instructions and only to the extent necessary. When we use data processors, we take all necessary measures to ensure that our data processors also have appropriate organisational and technical measures in place to ensure the security of personal data and to maintain the confidentiality of personal data.
Your data may be communicated to public bodies and institutions and to other persons exercising functions assigned to them by law.
What are your rights?
You have the right to:
- make a written request to us to provide you with information as to whether data relating to you are being processed and, if such data are being processed, you have the right to have access to your personal data and to the following information: the purposes of the processing; the categories of personal data concerned; the recipients of the data, or the categories of recipients to whom your personal data have been, or are likely to be, disclosed; and, where possible, the period of retention of the personal data or, where it is not possible, the criteria for the determination of that period;
- request the correct inaccurate or incomplete personal data relating to you;
- require us to delete your personal data. Nevertheless, this right is not absolute and may be based on any of the following grounds: the personal data is no longer necessary to achieve the purposes for which it was collected or otherwise processed; you have decided to withdraw your consent to the processing of your personal data where your personal data is processed solely on the basis of your consent and there is no other basis for processing your personal data; your personal data has been processed unlawfully; or your personal data is subject to an obligation to delete it;
- require restriction of the processing of your personal data where one of the following applies: You challenge the accuracy of the data for a period of time within which we can verify the accuracy of your personal data; the processing of your personal data is unlawful and you do not consent to the erasure of your personal data and instead request that we restrict its use; we no longer need your data for the purposes of the processing, but you need it to assert, exercise or defend legal claims. Where the processing of your personal data is restricted, we may only process such personal data, except for storage, with your consent or for the assertion, exercise or defence of legal claims and/or the protection of your rights or the rights of another person or for reasons of public interest;
- withdraw your consent to the processing of your personal data where personal data is processed solely on the basis of your consent;
- request that we transfer the personal data we process about you to another controller where this is technically feasible;
- lodge a complaint with us or the State Data Protection Inspectorate if you believe that your rights as a personal data subject have been and/or may be violated.
How can you exercise your rights?
In order to exercise your rights, please submit requests, complaints or claims to us in writing:
- by e-mail info@ambergrid.lt;
- by post to Laisvės str. 10, LT-04215 Vilnius, Lithuania;
- on arrival at the Company's registered office Laisvės str. 10, LT-04215 Vilnius, Lithuania.
We will respond to any requests, complaints or demands we receive in writing in accordance with the procedures and deadlines laid down by the law, and will endeavour to provide you with the information you need as soon as possible, but at the latest within 30 days of receiving your request. This period may be extended by a further two months if necessary, depending on the complexity and number of requests. The Company will inform you of the extension within one month of receipt of the request, together with the reasons for the delay.
If, upon receipt of a request, complaint or demand, we are suspicious as to the identity of the person making the request, we shall be entitled to ask for the identity document of the person making the request and/or to confirm the identity of the person making the request, in accordance with the procedure laid down by the law and/or by means of electronic communications which allow for the proper identification of the person.
If we fail to provide you with the necessary information and/or if you have a complaint about the processing of your personal data, you have the right to contact the State Data Protection Inspectorate by lodging a complaint.
How will we inform you of changes to the Privacy Notice?
We may update or change this Privacy Notice at any time. Such updated or amended Privacy Notice will be effective from the date of its posting on our Website. When we update the Privacy Notice, we will inform you of what we consider to be material changes by posting them on the Website.
