Privacy Statement

Privacy Statement

This Privacy Statement (hereinafter referred to as the Statement) provides the information, on how AB „Energijos skirstymo operatorius“, legal entity code 304151376, registered office address: Aguonų str. 24, LT-03212 Vilnius, Lithuania (hereinafter referred to as the Company) manages personal data.

The provisions of the Statement shall apply to the following natural persons, whose personal data are processed by the Company:

• the clients, who are or were using, have expressed their intention to use, or are otherwise associated with the services provided by the Company (hereinafter referred to as the Clients);
• persons who have applied to the Company by submitting requests or claims either directly, via self-service websites, online chats or by means of remote communication, including phone and e-mail;
  • persons, who have visited the Company’s website, etc.

Terms and Definitions

The terms and abbreviations used in this Privacy Statement shall have the following meanings:

• Personal Data shall mean any information related to the natural person, who can be identified either directly or indirectly (e.g., name, surname, contact details, etc.).
• Person shallmean the natural person (data subject), whose data are processed (e.g., the Company’s Clients, persons, who have applied to the Company by submitting requests or claims, users of the Company’s website or self-service website, etc.).
• Data processing shall mean any action performed with the personal data of the Person (e.g., collection, recording, storage, granting of access, transfer, etc.).
• Services shall mean any goods or services provided by the Company.

Other terms used in the Statement shall be understood as they are defined in the legal acts governing personal data protection (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation (EU) 2016/679), the Law on the Legal Protection of Personal Data of the Republic of Lithuania, etc.).

Purposes and legal grounds of Personal Data processing

The Company shall process the Personal Data only for particular purposes and on the grounds laid down in the legislation:

• when it is necessary to process the data in order to enter into and/or execute the contract concluded with the person;
• the person has given the permission to process their data for one or several particular purposes;
• the Company must process the Personal Data following the requirements of the legislation;
• the Personal Data must be processed for to the Company’s lawful interest.

Principle objectives of the Company in processing the Personal Data:

• The performance of the functions of the operator of natural gas and electricity distribution system (network) provided for in the legal acts. The Company shall process Personal Data in performing distribution system (network) operator’s functions and obligations and exercising distribution system (network) operator’s rights provided for in legal acts.
• The performance of the functions of guaranteed natural gas and electricity supply provided in the legal acts. The Company shall process Personal Data in performing guaranteed natural gas and electricity supply functions and obligations and exercising guaranteed natural gas and electricity supply rights provided for in legal acts.
• The provision of services, conclusion and execution of contracts. The Company shall process Personal Data in order to ensure the proper conclusion and execution of contracts on electricity and natural gas distribution and other contracts (hereinafter – Contracts) with the Clients, provision of services or supply of goods to the Clients on the basis of the contracts, including the proper notification of the Client about the issues related to the goods, services or contract, on the basis of the contract or legal acts.
• Reconstruction of the existing equipment of the Company, installation, operation, maintenance and management of new distribution systems (networks) of the Company, connection of the new users and/or producers (Clients) equipment to the Company’s distribution system (network) on the ground of the consent, contract or legal acts.
• The administration of settlements. The Company shall process Personal Data related to payments for the Services provided on the grounds of the contract or legal acts.
• Debts management. In case of the debt, the Company shall process Personal Data related to the debt and perform actions for recovery on the grounds of the contract, legal acts and legitimate interest.
• The resolution of questions provided. The Company shall process Personal Data while examining and solving submitted questions and complaints, in accordance with the contract, consent or legal acts.
• The control of the quality on the Services being provided by the Company. The Company shall process Personal Data in order to ensure the quality of Services being provided: by recording phone calls, when the Clients use client service channels or when the Company’s employees phone the Clients on the ground of the legitimate interest or the consent.
• Assessment of the Clients’ experience, opinion, providing offers and news (direct marketing): the Company may process Personal Data by sending surveys, providing offers or giving news on the Services being provided and informing about on ongoing events on the grounds of personal consent. The person may withdraw the given consent at any time in the Company’s self-service account or by e-mail: [email protected], calls by client service number 1852 or in the client service area. 
• Safety of persons and objects. In order to ensure safety of its employees, Clients and other persons or objects, the Company may perform video recording on the ground of the legal acts or legitimate interest.
• Other purposes. The Company may process the Personal Data for other purposes if the consent of the person’s consent was submitted, the Personal Data must be processed on the grounds laid down in legislation, or on the grounds of the legitimate interest.

In all the aforementioned cases, the Company shall process Personal Data only in the scope necessary to achieve the clearly defined and legal purposes, in consideration to the requirements of Personal Data protection.

The scope (categories) of processed Personal Data

The main categories of Personal Data and data which are processed by the Company for the purposes and on the legal grounds set out above:

• Identification data – name, surname, personal identification number, date of birth, etc.
• Contact data – address, phone number, e-mail address, etc.
• Data related to provision of the Services, conclusion and execution of contracts entered into – information about the Services being provided, contract data, order and consumption data, data received by the Company directly from the persons, via self-service websites and online chats, or by remote communication means (phone, e-mail, mobile applications), etc.
• Payment data – amounts payable, outstanding debts, payment history, etc.
• Financial data – amounts payable to the Company, outstanding debts, payment history, etc.
• Data of video and audio records – video data recorded in the Company’s units, audio data recorded during phone conversations, etc.
• Data of cookies – information about the person’s location with a precision of a city, the person’s preferences, his behaviour on the Company’s website or self-service, interests, etc. (more detailed information about the cookies used by AB „Energijos skirstymo operatorius“ is available in the „Cookie Policy“).
  
• Other data processed by the Company on the legal grounds provided for in the legal acts.

Receipt of Personal Data

The Company shall process the Personal Data provided by the persons themselves, received when the Clients are using services provided by the Company (e.g., electricity/natural gas consumption, payments data) or which the Company receives from other sources (e.g., registers managed by the state or private entities) or third parties (e.g., electricity, natural gas suppliers), to the extent necessary on the grounds of the contract, consent, legal acts or legitimate interest of the Company.

The Company shall have the right to collect and process Personal Data from VĮ Registrų Centras (the State Enterprise Centre of Registers) for the purpose and on the ground of the conclusion of contracts for the provision of services, in accordance with the legal acts of the Republic of Lithuania, as well as when the Company is performing the functions and obligations provided in the legal acts, e.g., ensuring appropriate technical condition of electrical structures and equipment; safe, ensuring reliable and effective operation of the system (network); organizing and coordinating projection and connection works of electrical equipment; remunerating compensation for the servitudes imposed in favour of the Company.

Submission of Personal Data

Following the requirements of the legislation, the Company may transfer the processed Personal Data to the receivers of data belonging to the following categories:

• Electricity and natural gas suppliers. In order to ensure proper fulfilment of contracts for providing electricity and natural gas distribution services, the Company may transfer the processed Personal Data (identification data, contact data, readings of electricity/natural gas meters, etc.) and other information necessary for performance of the functions of companies supplying electricity and natural gas in accordance with the legal acts.
• Service providers. The Company may transfer the processed Personal Data to third persons acting in the name and/or under the instruction of the Company, that provide the Company with client service, software maintenance, design, labour and work, surveying of Clients, accounting and other services to the Company, in order to ensure appropriate provision, management and development of the Company’s Services. In such cases, the Company shall take necessary measures in order to ensure that the engaged service providers (data processors) are processing Personal Data only for the purposes, for which those were provided, while ensuring proper technical and organizational safeguards, in accordance with the Company’s instructions and requirements of effective legal acts.
• Public authorities, law enforcement agencies and supervisory institutions. The Company may transfer the processed Personal Data to public authorities or law enforcement institutions (e.g., police, prosecutor’s office, the Financial Crime Investigation Service, supervisory institutions (e.g. the National Energy Regulatory Council, etc.), when it is mandatory in accordance with effective legal acts or in order to ensure the legitimate interests of the Company or third parties.
• Debt administration enterprises, processing consolidated data of debtors, and managing joint databases. If the Client fails to properly and timely perform the payments to be made by the Client in accordance with the Contract, the Company, having informed the Client by post or e-mail 30 days in advance, has the right to provide the Client’s Personal Data to the data controllers who process the consolidated data of debtors, debt management and recovery enterprises, courts, notaries, and bailiffs.
  • Other third parties. The Company may provide Personal Data to other data recipients on the legal grounds defined in the legal acts.

Storage of data

The Company shall process the Personal Data no longer than required by the objectives of data processing or as indicated in the applied legislation, if they shall establish a longer period for storage of data.

In order to determine the period for storage of data, the Company shall apply the criteria that shall correspond to the obligations defined in the legal acts, also with regard to right of a person, e.g., it shall envisage such a period for storage of a data, during which the requirements related to the contract’s execution may be submitted, if any, or the period necessary to implement and protect legitimate interests of the Company.

The data of phone records and online chats will be retained with a maximum retention time of 6 months from the recording, after which the data shall be destroyed automatically, unless it is necessary to preserve the data for further processing, i.e., to investigate an incident or to defend legal demands. In such a case, the Personal Data shall be processed until aforementioned data processing purposes are achieved.

The Company shall undertake all the necessary measures to make sure that Personal Data is processed precisely, fairly and legally, only for the set purposes, in strict compliance with clear and transparent requirements of Personal Data processing defined in the legal acts.

Applied protection measures

The Company shall ensure the confidentiality of the Personal Data in accordance with the requirements of the legislation in force and implementation of appropriate technical and organisational measures intended for the protection of the Personal Data from illegal access, disclosure, accidental loss, modification or destruction or other illegal processing.

Rights of the persons

A person that has contacted the Company and the personal identity of which was determined by the Company, shall have the right to:

1.      be introduced to their Personal Data processed by the Company;

2.      require the rectification of inaccurate, incorrect or incomplete Personal Data;

3.      ask the Company to destroy their Personal Data or to suspend, except for the storage, the actions of processing of the Personal Data, if the processing violates requirements of the applied legislation or the Personal Data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;

4.    receive Personal Data related to them that was submitted by the person to the Company in a structured, commonly used, and machine-readable format;

5.  ask the Company to delete the Personal Data processed by the Company when the Personal Data is processed violating the requirements of the applied legislation or when the Personal Data is no longer necessary in order to achieve objectives, for which it was collected or processed in another manner;

6.      limit the processing of their Personal Data in accordance with the applied legislation, e.g., for the period, during which the Company shall assess, whether the person has the right to ask their Personal Data to be deleted;

7.      disagree with the processing of their Personal Data and (or) in a case, where the Personal Data is processed on the grounds consent – to withdraw the given consent on the processingof the Personal Dataat any time, with no effect on the lawfulness of processing based on consent before its withdrawal.

The consent for direct marketing may be withdrawn by sending us an e-mail to: [email protected], or by calling client service phone: 1852 and +370 697 61852 (when calling from abroad) or on self-service website.

Implementation of the persons’ rights

The persons may make inquiries about this Privacy Statement or Personal Data processing performed by the Company in writing by the following address: Aguonų str. 24, LT-03212 Vilnius, Lithuania; by e-mail: [email protected]; client service phone numbers: 1852 and +370 697 61852 (when calling from abroad). The calls to number 1852 are toll-free, while the price of calls to the long number from abroad depends on the rates applied by the network operator.

The contact details of the Company’s data protection officer: [email protected]

For the purposes of the implementation of his rights in accordance with the General Data Protection Regulation (EU) 2016/679, the person shall submit to the Company a written request in a person, by post, through a representative or by means of electronic communication. The request shall be readable, signed by the person, contain the first name and surname, residential place address, and contact details of the person for communication and information on for which reasons, which rights and to which extent the person wishes to implement as well as information on which way the person wishes to receive the reply.

When submitting the request, the person must confirm his identity:

• if the request is submitted directly, to an employee of the Company’s unit responsible for servicing of individuals, the person must present a personal identity document;
• if the request is submitted by post, the request shall be attached with a notarised copy of the personal identity document;
• if the request is submitted through the representative, the representative shall indicate his first name and surname as well as contact details for communication, by which the individual’s representative wishes to receive the reply and the first name, surname, and personal identification number of the represented person and present a notarised copy of the personal identity document and a copy of the document of the representation document certified in accordance with the established procedure;
• if the request is submitted by means of electronic communication, the request shall be signed by a qualified e-signature or formed by electronic means which allow ensuring integrity and inalterability of the text.

The Company may refuse to undertake actions under the person’s request if such request is obviously unjustified and non-proportional.

Not later than within one month from the day of receipt of the request, the Company shall provide the person with a reply indicating information about the actions taken upon receipt of the request, in accordance with Articles 15-22 of the General Data Protection Regulation (EU) 2016/679. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests under consideration. Within one month from the receipt of the request, the Company shall inform the person of any such extension, while indicating reasons for the extension.

The Company has the right to refuse to provide the person with information requested by that person if:

• the Personal Data was collected directly from the person and that information has already been provided to the person;
• the Personal Data was received not from the person himself;
• the provision of the information requested by the person is impossible or would require non-proportional efforts;
• where the Personal Data must remain confidential subject to an obligation of professional secrecy regulated by the law of the European Union or the Republic of Lithuania, including the obligation to protect professional secret.

In implementation of the person’s right to access the Personal Data processed by the Company, the Company:

• shall have the right to request the person to specify the submitted request, if the Company is processing a big quantity of information related to that person;
• shall provide the person with information to the extent as not to infringe the rights of other persons if certain information about the person is also related with other persons.

If the issues related with the processing of Personal Data carried out by the Company and (or) personal rights shall not be solved, the person shall have the right to contact and to submit a claim to the State Data Protection Inspectorate.  

Obligations of the persons

When providing their Personal Data to the Company, the persons confirm that they are familiarised themselves with the terms of the Personal Data processing provided in this Privacy Statement and do not object that the Company shall processes the Personal Data provided by the persons, the data and information provided by the persons are correct and accurate, and that the Company shall not be liable for the submission and processing of excessive data, if such data are provided by the person to the Company through negligence.

The person undertakes to inform the Company about any changes in the submitted data or other related information.

Validity and amendments of the Privacy Statement  

The main Personal Data processing provisions are provided in this Privacy Statement. Additional information, how the Company is processing Personal Data, may be provided in the Company’s contracts, other documents, website www.eso.lt, on self-service website, or by remote client service channels (phone, e-mail, etc.).

The Company has the right to amend and/or supplement this Privacy Statement unilaterally. The Company shall post the changes in this Privacy Statement on the Company’s website. In certain cases, the company may also inform the persons about changes by e-mail or otherwise (e.g., by a press release).