LietuviųEnglish

Privacy Policy

GENERAL PROVISIONS

The personal data processing rules of the public institution “BĮ Klaipėdos kultūrų komunikacijų centras” (hereinafter – the Rules) establish the personal data processing rules of the public institution “BĮ Klaipėdos kultūrų komunikacijų centras” (hereinafter – the Institution).

The purpose of the Rules is to ensure compliance with, and implementation of, the General Data Protection Regulation (EU) 2016/679 (hereinafter – the GDPR) within the Institution.

The terms used in these Rules correspond to the terms used in the GDPR.
Employees of the Institution authorised to process personal data must comply with these Rules and must be familiarised with them against signature.

DEFINITIONS

Personal data – any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name and surname, an identification number, location data and an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
Data processing – any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination with other data, restriction, erasure or destruction;
Data controller – the public institution “BĮ Klaipėdos kultūrų komunikacijų centras”, company code 1882 04815.

GENERAL REQUIREMENTS FOR DATA PROCESSING

Personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject (the principle of lawfulness, fairness and transparency);
Personal data must be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes;
Personal data must be adequate, relevant and limited to what is necessary for the purposes for which they are processed (the principle of data minimisation);
Personal data must be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (the principle of accuracy);
Personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; and processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (the principle of integrity and confidentiality).

RIGHTS OF DATA SUBJECTS

Data subjects have the following rights:
The right to know about the processing of their personal data.

  • When collecting personal data, the data controller must provide information on the purposes for which the personal data are processed, and to whom and for what purposes they are provided.
    The right of access to one’s personal data.
  • A person has the right to contact the data controller and obtain information on the sources from which and the personal data about them that have been collected, for what purpose they are processed and to whom they are provided.
  • Having received a request, the Institution provides a written reply no later than within 30 calendar days from the date of the request.
    The right to request rectification of data.
  • If, having consulted their personal data, the data subject establishes that their personal data are incorrect, incomplete or inaccurate, the Institution must check the personal data without delay and, at the data subject’s request (in written, oral or other form), immediately rectify the incorrect, incomplete or inaccurate personal data and/or suspend the processing of such personal data, with the exception of storage.
    The right to request erasure of data (“the right to be forgotten”).
  • The data subject has the right to request that the data controller erase personal data without delay, and the data controller must erase the personal data without undue delay where one of the following circumstances applies:
    • Where the personal data are no longer necessary in relation to the purposes for which they were collected and processed;
    • Where the data subject has withdrawn the consent on which the processing is based and there is no other legal ground for the processing;
    • Where the personal data have been processed unlawfully.
      The right to restriction of processing;
  • The data subject has the right to request that the data controller restrict processing where the data subject contests the accuracy of the data, for a period enabling the data controller to verify that accuracy; where the processing of personal data is unlawful and the data subject opposes erasure of the data and requests the restriction of their use instead; or where the data controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims.
    The right to data portability.
    The data subject has the right to receive the personal data they have provided to the data controller in a structured, commonly used and machine-readable format.
    The right to object to the processing of personal data.
  • A person has the right to object (in writing, orally or in another form) to the processing of certain non-mandatory personal data. Such an objection may be expressed at the time of data collection by not filling in certain fields (lines) of an application, contract or questionnaire, or later, upon receipt of a request in any form from the data subject to stop the processing of certain non-mandatory personal data. In order for this right to be exercised, the data subject must be provided with information on which of their personal data are not mandatory to process.
    SPECIAL PROVISIONS

    Personal data are processed at the Institution for the following purposes:
  • performance of contracts with suppliers of services / works,
  • performance of contracts with residents of the Culture Factory,
  • organisation of events,
  • preparation of reports,
  • ensuring the security of persons and property (see the Video Data Processing Rules),
  • attracting investment,
  • maintaining relations with state and municipal enterprises, associated structures, educational institutions and businesses,
  • internal administration of the institution,
  • archiving purposes.
    For the purpose of performing contracts with suppliers of services / works, the following data are collected: company details, the name and surname of the company’s representative, the representative’s e-mail address and telephone number.
    For the purpose of performing contracts with residents of the Culture Factory, the following data are collected: company details, the name and surname of the company’s representative, the representative’s e-mail address and telephone number. If the resident is a natural person, then the name and surname of that natural person, place of residence, telephone number and e-mail address.
    For the purpose of organising events, the following data are collected: the name and surname of the natural person, the name of the company they represent, telephone number and e-mail address.
    For the purpose of preparing reports, data obtained in the performance of contracts with suppliers of services / works, in the performance of contracts with residents of the Culture Factory and in the organisation of events are processed.
    For the purpose of ensuring the security of persons and property, video data are collected at the Culture Factory.
    For the purpose of attracting investment, the following data are collected: company details, the name and surname of the company’s representative, the representative’s e-mail address and telephone number.
    For maintaining relations with state and municipal enterprises, associated structures, educational institutions and businesses: the name and surname of the natural person, the name of the company represented, telephone number and e-mail address.
    For the purpose of the institution’s internal administration, the following data are collected: the employee’s name and surname, personal identification number, social insurance number, citizenship, address, telephone number, e-mail address, curriculum vitae, marital status, position, data on appointment (transfer) to a position and dismissal, data on education and qualifications, data on training, data on leave, wages, severance payments, compensation and benefits, information on hours worked, incentives and penalties, information on work performed and tasks completed, the number, date of issue and expiry date of the passport or identity card of a citizen of the Republic of Lithuania, and the authority that issued the document.
    Personal data must be stored for no longer than is required by the purposes of the processing.

    Procedure for collecting and storing data:
  • Data from contracts with suppliers of services / works are stored in virtual storage.
  • Data from contracts with residents of the Culture Factory are stored in virtual storage.
  • Data collected during the organisation of events are stored in virtual storage.
  • Data collected for the purpose of attracting investment are stored in the contact list of the project management system.
  • When a representative or representatives of the Institution meet with state and municipal enterprises, associated structures, educational institutions and businesses and receive a person’s business card, that person’s data are entered into the contact list in the virtual project management system.
  • For the purpose of the institution’s internal administration, employees’ data are stored in the accounting software.
    Transfer of data to third parties:
  • Data may be transferred to institutions supervising the activities of the Institution. The Institution is directly subordinate to the Administration of Klaipėda City Municipality.
  • Data may be transferred to institutions to which the Institution must submit reports on activities funded by the European Union.
  • Employees’ data are transferred to the State Social Insurance Fund Board and to the State Enterprise Centre of Registers.

    CONFIDENTIALITY AND SECURITY PROVISIONS

Employees of the Institution must observe the principle of confidentiality and keep secret any information relating to personal data of which they have become aware in the performance of their duties. The obligation to keep personal data secret also continues after moving to another position and after the termination of employment or contractual relations.
By order of the director, the Institution designates the employees who may work with personal data. Employees may consult and use only those documents and data files which they have been authorised to consult and process.
Employees must take measures to prevent the accidental or unlawful destruction, alteration or disclosure of personal data, as well as any other unlawful processing, by keeping documents and data files properly and securely and avoiding the making of unnecessary copies. If an employee has doubts about the reliability of the security measures in place, they must contact their direct supervisor so that the existing security measures can be assessed and, if necessary, the acquisition and installation of additional measures initiated;
Employees who process personal data, or from whose computers the virtual file storage containing personal data can be accessed, must use passwords. Passwords must be changed periodically, at least once every three months, and also in certain circumstances (for example: a change of employee, a threat of intrusion, a suspicion that the password has become known to third parties, and so on). An employee working on a particular computer may know only their own password.
Employees’ computers on which data subjects’ data are stored may not be freely accessible from other computers on the network. The antivirus software on these computers must be kept continuously updated.
The Institution ensures the security of its wireless internet network; guests of the Institution connect to the wireless network using “guest”-type passwords.
STORAGE OF DATA IN THE ARCHIVE

Archived data must be stored in a locked room.
The data controller must ensure that the archive is not accessible to unauthorised persons.
FINAL PROVISIONS

All employees are familiarised with these rules against signature.
The rules are published on the Institution’s website.