Privacy Statement
This Privacy Statement (hereinafter referred to as the Statement) provides the information, on how AB „Energijos skirstymo operatorius“, legal entity code 304151376, registered office address: Aguonų str. 24, LT-03212 Vilnius, Lithuania (hereinafter referred to as the Company) manages personal data.
The provisions of the Statement shall apply to the following natural persons, whose personal data are processed by the Company:
Terms and Definitions
The terms and abbreviations used in this Privacy Statement shall have the following meanings:
Other terms used in the Statement shall be understood as they are defined in the legal acts governing personal data protection (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation (EU) 2016/679), the Law on the Legal Protection of Personal Data of the Republic of Lithuania, etc.).
Purposes and legal grounds of Personal Data processing
The Company shall process the Personal Data only for particular purposes and on the grounds laid down in the legislation:
Principle objectives of the Company in processing the Personal Data:
In all the aforementioned cases, the Company shall process Personal Data only in the scope necessary to achieve the clearly defined and legal purposes, in consideration to the requirements of Personal Data protection.
The scope (categories) of processed Personal Data
The main categories of Personal Data and data which are processed by the Company for the purposes and on the legal grounds set out above:
Receipt of Personal Data
The Company shall process the Personal Data provided by the persons themselves, received when the Clients are using services provided by the Company (e.g., electricity/natural gas consumption, payments data) or which the Company receives from other sources (e.g., registers managed by the state or private entities) or third parties (e.g., electricity, natural gas suppliers), to the extent necessary on the grounds of the contract, consent, legal acts or legitimate interest of the Company.
The Company shall have the right to collect and process Personal Data from VĮ Registrų Centras (the State Enterprise Centre of Registers) for the purpose and on the ground of the conclusion of contracts for the provision of services, in accordance with the legal acts of the Republic of Lithuania, as well as when the Company is performing the functions and obligations provided in the legal acts, e.g., ensuring appropriate technical condition of electrical structures and equipment; safe, ensuring reliable and effective operation of the system (network); organizing and coordinating projection and connection works of electrical equipment; remunerating compensation for the servitudes imposed in favour of the Company.
Submission of Personal Data
Following the requirements of the legislation, the Company may transfer the processed Personal Data to the receivers of data belonging to the following categories:
Storage of data
The Company shall process the Personal Data no longer than required by the objectives of data processing or as indicated in the applied legislation, if they shall establish a longer period for storage of data.
In order to determine the period for storage of data, the Company shall apply the criteria that shall correspond to the obligations defined in the legal acts, also with regard to right of a person, e.g., it shall envisage such a period for storage of a data, during which the requirements related to the contract’s execution may be submitted, if any, or the period necessary to implement and protect legitimate interests of the Company.
The data of phone records and online chats will be retained with a maximum retention time of 6 months from the recording, after which the data shall be destroyed automatically, unless it is necessary to preserve the data for further processing, i.e., to investigate an incident or to defend legal demands. In such a case, the Personal Data shall be processed until aforementioned data processing purposes are achieved.
The Company shall undertake all the necessary measures to make sure that Personal Data is processed precisely, fairly and legally, only for the set purposes, in strict compliance with clear and transparent requirements of Personal Data processing defined in the legal acts.
Applied protection measures
The Company shall ensure the confidentiality of the Personal Data in accordance with the requirements of the legislation in force and implementation of appropriate technical and organisational measures intended for the protection of the Personal Data from illegal access, disclosure, accidental loss, modification or destruction or other illegal processing.
Rights of the persons
A person that has contacted the Company and the personal identity of which was determined by the Company, shall have the right to:
1. be introduced to their Personal Data processed by the Company;
2. require the rectification of inaccurate, incorrect or incomplete Personal Data;
3. ask the Company to destroy their Personal Data or to suspend, except for the storage, the actions of processing of the Personal Data, if the processing violates requirements of the applied legislation or the Personal Data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
4. receive Personal Data related to them that was submitted by the person to the Company in a structured, commonly used, and machine-readable format;
5. ask the Company to delete the Personal Data processed by the Company when the Personal Data is processed violating the requirements of the applied legislation or when the Personal Data is no longer necessary in order to achieve objectives, for which it was collected or processed in another manner;
6. limit the processing of their Personal Data in accordance with the applied legislation, e.g., for the period, during which the Company shall assess, whether the person has the right to ask their Personal Data to be deleted;
7. disagree with the processing of their Personal Data and (or) in a case, where the Personal Data is processed on the grounds consent – to withdraw the given consent on the processingof the Personal Dataat any time, with no effect on the lawfulness of processing based on consent before its withdrawal.
The consent for direct marketing may be withdrawn by sending us an e-mail to: [email protected], or by calling client service phone: 1852 and +370 697 61852 (when calling from abroad) or on self-service website.
Implementation of the persons’ rights
The persons may make inquiries about this Privacy Statement or Personal Data processing performed by the Company in writing by the following address: Aguonų str. 24, LT-03212 Vilnius, Lithuania; by e-mail: [email protected]; client service phone numbers: 1852 and +370 697 61852 (when calling from abroad). The calls to number 1852 are toll-free, while the price of calls to the long number from abroad depends on the rates applied by the network operator.
The contact details of the Company’s data protection officer: [email protected]
For the purposes of the implementation of his rights in accordance with the General Data Protection Regulation (EU) 2016/679, the person shall submit to the Company a written request in a person, by post, through a representative or by means of electronic communication. The request shall be readable, signed by the person, contain the first name and surname, residential place address, and contact details of the person for communication and information on for which reasons, which rights and to which extent the person wishes to implement as well as information on which way the person wishes to receive the reply.
When submitting the request, the person must confirm his identity:
The Company may refuse to undertake actions under the person’s request if such request is obviously unjustified and non-proportional.
Not later than within one month from the day of receipt of the request, the Company shall provide the person with a reply indicating information about the actions taken upon receipt of the request, in accordance with Articles 15-22 of the General Data Protection Regulation (EU) 2016/679. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests under consideration. Within one month from the receipt of the request, the Company shall inform the person of any such extension, while indicating reasons for the extension.
The Company has the right to refuse to provide the person with information requested by that person if:
In implementation of the person’s right to access the Personal Data processed by the Company, the Company:
If the issues related with the processing of Personal Data carried out by the Company and (or) personal rights shall not be solved, the person shall have the right to contact and to submit a claim to the State Data Protection Inspectorate.
Obligations of the persons
When providing their Personal Data to the Company, the persons confirm that they are familiarised themselves with the terms of the Personal Data processing provided in this Privacy Statement and do not object that the Company shall processes the Personal Data provided by the persons, the data and information provided by the persons are correct and accurate, and that the Company shall not be liable for the submission and processing of excessive data, if such data are provided by the person to the Company through negligence.
The person undertakes to inform the Company about any changes in the submitted data or other related information.
Validity and amendments of the Privacy Statement
The main Personal Data processing provisions are provided in this Privacy Statement. Additional information, how the Company is processing Personal Data, may be provided in the Company’s contracts, other documents, website www.eso.lt, on self-service website, or by remote client service channels (phone, e-mail, etc.).
The Company has the right to amend and/or supplement this Privacy Statement unilaterally. The Company shall post the changes in this Privacy Statement on the Company’s website. In certain cases, the company may also inform the persons about changes by e-mail or otherwise (e.g., by a press release).