The purpose of this Privacy Policy is to inform how personal data of data subjects is collected and processed, to explain how long it is stored, to whom it is disclosed, what rights data subjects have, and where to turn regarding the exercise of those rights or other matters related to personal data processing.
Personal data is processed in accordance with the General Data Protection Regulation (EU) 2016/679 (hereinafter - the "Regulation"), the Law on Legal Protection of Personal Data of the Republic of Lithuania, and other legal acts governing personal data protection.
UAB "SURFWAX" follows these core principles of data processing:
- personal data is processed lawfully, fairly, and transparently (principle of lawfulness, fairness, and transparency);
- personal data is collected only for clearly defined and legitimate purposes (purpose limitation principle);
- personal data processed is adequate, relevant, and limited to what is necessary for the purposes for which it is processed (data minimization principle);
- personal data is kept accurate and up to date (accuracy principle);
- personal data is stored securely and for no longer than necessary for the purposes of processing or as required by law (storage limitation principle);
- personal data is processed using appropriate technical and organizational measures to ensure proper security of personal data (integrity and confidentiality principle).
1. DEFINITIONS
1.1. Data Controller - UAB "SURFWAX" (hereinafter - the "Company"), legal entity code 305862698, VAT payer code LT100014279915, registered address Konstitucijos pr. 15, Vilnius.
1.2. Data Subject - any natural person whose data is processed by the Company. The Data Controller collects only the data of the data subject that is necessary for carrying out the Company's activities and/or when visiting, using, or browsing the Company's websites, etc. (hereinafter - the "Website"). The Company ensures that the personal data collected and processed will be secure and used only for a specific purpose.
1.3. Personal Data - any information directly or indirectly related to a data subject whose identity is known or can be directly or indirectly identified using relevant data. Processing of personal data means any operation performed on personal data (including collection, recording, storage, editing, alteration, granting of access, requesting, transferring, archiving, etc.).
1.4. Consent - any freely given and informed indication by which the data subject agrees to have their personal data processed for a specific purpose.
2. SOURCES OF PERSONAL DATA
2.1. The data subject provides personal data themselves. The data subject contacts the Company, uses the Company's services, purchases goods and/or services, participates in a loyalty program, lotteries or contests, leaves comments, asks questions, subscribes to newsletters, contacts the Company requesting information, etc.
2.2. Personal data is obtained when the data subject visits the Company's website. The data subject fills in forms on the website or, for some other reason, leaves their contact details, etc.
2.3. Personal data is obtained from other sources. Data is obtained from other institutions or companies, publicly available registers, etc.
3. PROCESSING OF PERSONAL DATA
3.1. By providing personal data to the Company, the data subject agrees that the Company may use the data collected to fulfill its obligations to the data subject and provide the services the data subject expects.
3.2. The Company processes personal data for the following purposes:
3.2.1. Conclusion and performance of contracts for services and goods provided to/received by the data subject;
3.2.2. Retention of contact details to ensure the ability to reach the data subject;
3.2.3. Tax accounting and payment control. For this purpose, the following data is processed: first and last name(s); contact details (phone number, email address); residential address; bank account details (if services are provided to the Company by a natural person).
3.2.4. Administration of inquiries, comments, and complaints. For this purpose, the following data is processed: first and last name(s); contact details (phone number, email address); address; text of the question, comment, or complaint.
3.2.5. Direct marketing, administration of loyalty cards. For this purpose, the following data is processed: first and last name(s); city; contact details (phone number, email address).
3.2.6. E-commerce. For this purpose, for customer/buyer identification, the following data is processed: first and last name(s); age (to determine whether the person is of legal age); gender; contact details (phone number, email address); address.
3.2.7. For contacting the customer/buyer: contact details (phone number, email address).
3.2.8. To determine the customer's/buyer's country for VAT purposes: IP address.
3.2.9. To complete the purchase: payment details for the product/service (bank account number, payment method, etc.); purchase history (products and/or services purchased, price, quantity); order date; receipt number.
3.2.10. For the purpose of ensuring the safety of the Company's employees, other data subjects, and property (video/audio surveillance). For this purpose, the following data is processed: video footage. The video/audio surveillance systems do not use facial recognition and/or analysis technologies, and the video data captured is not grouped or profiled by specific data subject (individual). Data subjects are informed of video surveillance by information signs bearing a video camera symbol, displayed before entering the monitored area or premises. Premises where a data subject would expect absolute privacy are not within the field of view of the cameras.
3.2.11. For other purposes for which the Company has the right to process the data subject's personal data - where the data subject has given consent, where processing is necessary for the Company's legitimate interest, or where the Company is obligated to process the data under applicable legal acts.
4. DISCLOSURE OF PERSONAL DATA
4.1. The Company undertakes to maintain confidentiality with respect to data subjects. Personal data may be disclosed to third parties only when necessary to conclude and perform a contract for the benefit of the data subject, or for other legitimate reasons.
4.2. The Company may provide personal data to its data processors, who provide services to the Company and process personal data on the Company's behalf. Data processors may only process personal data in accordance with the Company's instructions and only to the extent necessary to properly fulfill the obligations set out in the contract. The Company engages only those data processors that provide sufficient guarantees that appropriate technical and organizational measures will be implemented in such a way that processing meets the requirements of the Regulation and ensures protection of the data subject's rights.
4.3. The Company may also provide personal data in response to requests from courts or state institutions, to the extent necessary to comply with applicable legal acts and instructions from state institutions.
4.4. The Company guarantees that personal data will not be sold or rented to third parties.
5. PROCESSING OF MINORS' PERSONAL DATA
5.1. Persons under 14 years of age may not provide any personal data through the Company's website. If a person is under 14 years of age and wishes to use the Company's services, written consent from a parent or guardian for the processing of personal data must be provided before submitting personal information.
6. PERSONAL DATA RETENTION PERIOD
6.1. Personal data collected by the Company is stored in printed documents and/or the Company's information systems. Personal data is processed for no longer than necessary to achieve the purposes of processing, or for as long as required by data subjects and/or applicable legal acts.
6.2. Even if a data subject terminates their contract and stops using the Company's services, the Company is still required to retain the data subject's data due to potential future claims or legal proceedings, until the data retention periods expire.
7. RIGHTS OF THE DATA SUBJECT
7.1. The right to obtain information about data processing.
7.2. The right to access the data being processed.
7.3. The right to request correction of data.
7.4. The right to request erasure of data ("the right to be forgotten"). This right does not apply if the personal data requested to be erased is also processed on another legal basis, such as where processing is necessary for the performance of a contract or compliance with a legal obligation.
7.5. The right to restrict data processing.
7.6. The right to object to data processing.
7.7. The right to data portability. The right to data portability shall not adversely affect the rights and freedoms of others. The data subject does not have the right to data portability for personal data processed by non-automated means in structured files, such as paper files.
7.8. The right not to be subject to a decision based solely on automated processing, including profiling.
7.9. The right to lodge a complaint regarding personal data processing with the State Data Protection Inspectorate.
8. The Company must create the conditions for the data subject to exercise the above-mentioned rights, except in cases established by law where it is necessary to ensure state security or defense, public order, the prevention, investigation, detection, or prosecution of criminal activity, important state economic or financial interests, the prevention, investigation, and detection of breaches of professional or official ethics, or the protection of the rights and freedoms of the data subject or other persons.
9. PROCEDURE FOR EXERCISING DATA SUBJECT RIGHTS
9.1. To exercise their rights, the data subject may contact the Company: by submitting a written request in person, by post, through a representative, or by electronic means - by email: surfwax@surfwax.lt. The request must be legible, signed by the data subject, and may use a free-form request. Or in writing - to the address: UAB "SURFWAX", Konstitucijos pr. 15, Vilnius.
9.2. To protect data from unlawful disclosure, upon receiving a data subject's request to provide data or exercise other rights, the Company must verify the identity of the data subject.
9.3. The Company's response is provided to the data subject no later than one month from the date of receiving the data subject's request, taking into account the specific circumstances of personal data processing. This period may be extended by a further two months if necessary, taking into account the complexity and number of requests.
10. RESPONSIBILITY OF THE DATA SUBJECT
10.1. The data subject must: inform the Company of any changes to the information and data provided, as it is important for the Company to have accurate and up-to-date information about the data subject; and provide the necessary information so that, upon the data subject's request, the Company can identify the data subject and confirm that it is indeed communicating or cooperating with that specific data subject (provide an identity document or use electronic communication means that allow proper identification of the data subject, as required by law). This is necessary to protect the data of the data subject and other persons, so that disclosed information about the data subject is provided only to the data subject, without infringing on the rights of others.
11. FINAL PROVISIONS
11.1. By providing personal data to the Company, the data subject agrees to this Privacy Policy, understands its provisions, and agrees to abide by them.
11.2. As the Company's activities develop and improve, the Company has the right to unilaterally amend this Privacy Policy at any time. The Company has the right to unilaterally amend the Privacy Policy, in whole or in part, by publishing notice of such changes on the website.