Notice on personal data processing

Baltisches Haus UAB shall process your, as its client, supplier, your employees’ (representatives’) and your beneficial owners personal data under the following conditions:

Data controller and purpose. Baltisches Haus UAB, legal entity code 111543781, legal address Bokšto g. 6, Vilnius (Company), as data controller, shall collect and process personal data for the following purposes:

To conclude and perform the agreement concluded between you (your representative) and the Company;
To ensure the enforcement of international sanctions;
To conduct surveys. We always look for ways to improve the quality of service. That is why we might invite you to participate in a survey and use your feedback. You can unsubscribe from such surveys at any time by contacting us by e-mail at duomenuapsauga@balthaus.eu or by clicking the unsubscribe link in the e-mail containing the survey.

Data processed by the Company.

Your or your employees’ (representatives’) personal data that are processed for the purpose of concluding and performing the agreement concluded between you (your representative) and the Company:

identification data (name, surname, personal number, VAT number);
contact data (address of place of residence or business address, telephone number, e-mail address indicated by you (your representative));
financial data (current account number, credit institution);
data related to object of the concluded agreement (e.g., information about business activity to be carried out in leased or subleased premises; address, unique number, cadastral number, and area of leased or subleased premises; unique number of a building in which leased property is located; lease or sublease fee; the price of the objects to be acquired or disposed of, the price of the contract, the license plate number of the vehicle that is entitled to use the parking lot, etc.);
power of attorney (representation) data, including personal number, address of place of residence or business address, scope of authorisations of representatives;
communication with the Company, other data generated during the performance of the agreement (e.g., signature in documents, information about the condition of premises).

Personal data relating to you or your beneficial owners that are processed for the purpose of enforcing international sanctions:

identification data (name, surname, date of birth, nationality);
the ways in which the beneficial owners can exercise control over the legal person of which they are beneficial owners (percentage of shares held or, if control is exercised by other means, a description of the means of exercising that control);
other data provided in the extract from the Beneficial Owner Subsystem of the Information System for Participants in Legal Entities of the Republic of Lithuania (JANGIS) or data provided by you;
information obtained in the course of checking international sanctions lists;
other data necessary for the enforcement of international sanctions.

Your or your employees’ (representatives’) personal data that are processed for the purpose of conducting surveys:

identification data (name, surname);
contact data (telephone number, e-mail address indicated by you (your representative);
responses to our questions.

Basis for data processing.

Personal data of the Company’s clients, who are natural persons, (their representatives) that are processed for the purpose of concluding and performing the agreement concluded between you (your representative) and the Company shall be processed on the basis of the agreement concluded (to be concluded) with the Company.
Personal data of employees (representatives) of Company’s clients, who are legal entities, that are processed for the purpose of concluding and performing the agreement shall be processed on the basis of legitimate interest of the Company to carry out commercial activity (to perform concluded agreement).
The basis for processing of data of natural persons of the Company’s customers (their representatives) and of beneficial owners of the Company’s customers – legal entities, processed for the purpose of enforcing international sanctions, is the fulfilment of a legal obligation.
Personal data of the Company’s clients, who are natural persons, (their representatives) / personal data of employees (representatives) of the Company’s clients-, who are legal entities, that are processed for the purpose of conducting surveys shall be processed on the basis of legitimate interest of the Company to receive feedback from our clients and use it to improve the quality of service.
If necessary, we may process your personal data on different grounds with respect to personal data processing (e.g., to implement the requirements of legislation regulating tax, money laundering prevention, etc.).

Data source. The Company shall obtain personal data directly from you (at request or voluntary), from third parties (e.g., State Enterprise Centre of Registers) or the Company will generate data itself.

Data recipients. Personal data, to the minimum extent necessary in a specific case, may be transferred to entities administering joint files of debtors; financial institutions; State Enterprise Centre of Registers; notaries; State Tax Inspectorate; State Social Insurance Board Fund; insurance companies; debt recovery companies; bailiffs; legal consultants of the Company; auditors; courts; entities providing archiving services; providers of information systems which are used by the Company for the management of relationships with you; survey providers; Financial Crimes Investigation Service under the Ministry of the Interior in the cases prescribed by law; other persons engaged by the Company for the performance of the agreement with you, including companies within the Company’s group.

Data retention period.

Your or your employees’ (representatives’) personal data that are processed for the purpose of concluding and performing the agreement concluded between you (your representative) and the Company shall be retained for the entire term of validity of the agreement and 10 years following the expiry thereof; afterwards, personal data shall be destroyed (where the basis for further processing no longer exists).
Personal data of you (your representatives) or your beneficial owners which are processed for the purpose of enforcing international sanctions shall be stored for the duration of the contract and for 10 years after the end of the contract or business relationship, after which (in absence of grounds for further processing) shall be securely destroyed.
We will anonymize survey responses no later than within 3 months – this means that the responses will no longer be associated with you.

Data processing conditions. Personal data may be collected, stored, processed, including provided, in digital form, both in material and paper media, by any means of communication, including e-mail, by ensuring safe processing and limiting unauthorized access to personal data.

Your or your employees’ (representatives’) and your beneficial owners rights: 1) to contact the Company and request the access to his/her personal data and obtain a copy of processed personal data; 2) to request rectification of incorrect personal data; 3) to request erasure of personal data in the cases provided by the law or restrict processing thereof; 4) to request transfer of personal data; 5) on the basis of legitimate interest, when the Company processes personal data, to object the processing of data; 6) to contact the State Data Protection Inspectorate regarding unlawful processing of your personal data.

To exercise the aforementioned rights or in connection with any other matters related to processing of your personal data, you may contact the Company by e-mail duomenuapsauga@balthaus.eu.

When during the collaboration with the Company you receive personal data form the Company, you shall undertake:

to comply with the General Data Protection Regulation No. 2016/679 (GDPR) and other legislation regulating personal data processing, and to collaborate with the Company so that it could perform its obligations under the aforementioned legislation;
to notify the Company about any personal data safety breach related to the personal data transferred to you by indicating at least the circumstances of the breach and measures implemented to minimise the consequences.

When during the collaboration with the Company you transfer personal data, you shall undertake:

to notify all natural persons whose personal data are being transferred (employees, assignees, members of management bodies, employees or representatives of your suppliers, other persons) prior to transfer of personal data in the extent specified in GDPR, of the fact that their personal data may be transferred to the Company and may be processed by the Company for the purpose of conclusion and/or performance of the agreement between you and the Company, and, and at the Company’s request, to immediately provide supporting evidence;
to notify the Company about the obligation to update, erase or restrict processing of personal data transferred;
not to transfer to the Company personal data of any persons who have not been notified about data processing carried out by the Company.

Liability. You shall be liable for non-performance or improper performance of obligations assumed by this notification and shall compensate the Company any resulting damages, including compensation of sanctions imposed on the Company by the supervisory authorities.