LTGPrivacy Notice
AB LIETUVOS GELEŽINKELIAI PRIVACY NOTICE
Last updated on 18 August 2023
AB Lietuvos geležinkeliai (hereinafter referred to as the LTG or the Company or simply us) protects your personal information while processing the data in accordance with the provisions of the Regulation of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (hereinafter referred to as the GDPR¹). This LTG Privacy Notice (hereinafter referred to as the Privacy Notice) provides detailed information in this regard.
¹ Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).
1. What is included in this Privacy Notice?
In this Privacy Notice, we provide answers to the most important questions, i.e., how we collect, use and store information about you. Please read this important information carefully and visit our website at https://ltg.lt from time to time as well as read the latest version of the Privacy Notice published there.
2. Who is responsible for protecting information about you?
AB Lietuvos geležinkeliai, legal entity code: 110053842, address of registered office: Geležinkelio g. 16, 02100 Vilnius, e-mail: info@ltg.lt, tel. (8 5) 269 2038.
3. Why and what information we collect about you?
|
No. |
Why do we collect information about you? |
What information we collect about you? |
Why do we have the right to collect the information you provide? |
How long do we use or store information about you? |
|
3.1. |
We conclude and execute contracts with you, fulfil the related tax obligations, and provide information related to the execution of the contract. |
Name and surname, personal number and/or date of birth, address of the place of residence, email address, phone number, copy of identity document, self-employment certificate number, power of attorney, validity period and number of the power of attorney, signature, relationship with the represented person, represented person, position, payer code, settlement information, settlement period, debt information, bank account number, contract, its additions, amendments, and annexes, handover certificates, conclusion dates, contract number, place of conclusion and performance of the contract, information about contract performance, contract termination information, an extract from the central data bank of the real estate register and, as far as the performance of the contract is concerned, communication with you, other information that may be necessary for the proper performance of the contract. |
We conclude and execute a contract with you (Article 6(1)(b) of GDPR), we are required to collect information by law (Article 6(1)(c) of GDPR) |
For the duration of the contract.
10 years after the end of the contract |
|
3.2. |
We maintain relations with natural persons or legal entities represented by you |
Name and surname, personal number and/or date of birth, address of the place of residence, email address, power of attorney, validity period and number of the power of attorney, signature, relationship with the represented person, represented person, position, phone number, email, login name for our systems, all information that you provide to the Company (e.g. information about the person you represent, the contract concluded, etc.) and, as far as the performance of the contract is concerned, communication with you, other information that may be necessary for the proper performance of the contract. |
We have a legitimate interest (to maintain relations with the persons you represent) (Article 6(1)(f) of GDPR) |
During the term of validity of the Contract and 10 years after the end of the Contract. |
|
3.3. |
You submit a request, offer or complaint to us by general email, or through other electronic communication channels. |
Name, surname, email, country, phone number, subject of the request, time of receipt of the request, content of the request, attachments to the request, correspondence history, other provided information related to the submitted request, response to the request. |
We have your consent Article 6 (1)(a) of GDPR, we are required to collect information by law (Article 6(1)(c) of GDPR, Article 29(1), Article 29(3)(5) of the Railway Transport Code of the Republic of Lithuania), we have a legitimate interest (to examine your inquiries, offers or complaints) (Article 6 (1)(f) of GDPR) |
1 year after the last application |
|
3.4. |
We record telephone conversations in order to ensure the quality of the services provided, to provide accurate information about the services provided and to provide consultations, to examine requests, complaints, and applications |
Phone number, records of telephone conversations and data provided during conversations. |
We have a legitimate interest (to ensure the quality of client service, to provide accurate information about the services provided and to provide advice, to ensure the appropriate quality of client service, to examine requests, complaints and applications, Article 6 (1)(f) of GDPR |
1 year after the conversation with you |
|
3.5. |
We ensure the safety of your property managed by the right of your health, life and property and managed by the Company’s right of trust, when you are filmed on the Company’s premises, their accesses, level crossings, stations and their access areas |
Video material (in some cases, the image is recorded together with the sound). |
We have a legitimate interest (security of property and persons) (Article 6(1)(f) GDPR) |
Up to 30 days |
|
3.6. |
We may be involved in legal proceedings relating to you |
All the above information, documents sent to you and their attachments, documents you have submitted and their attachments, procedural documents, court orders, rulings, decisions. |
We have a legitimate interest (to defend the Company’s rights in legal proceedings) (Article 6(1)(f) of GDPR) |
10 years after the end of the contract with you or 10 years after the end of legal proceedings |
|
Information on criminal offences and convictions. |
The data is necessary in order to assert, enforce or defend legal claims (Article 9(2)(f) of GDPR) |
|||
|
3.7. |
We investigate railway transport disasters, traffic accidents or faults |
Witness to a rail transport accident, traffic accident or incident: name, name of the victim of the rail transport accident, traffic accident or incident, gender, age, sobriety, actions of the person, name of the perpetrator of the rail transport accident, traffic accident or incident, and any other information we are required to process under an applicable legal obligation. |
We are obliged to collect information in accordance with the law (Article 6(1)(c) of the GDPR, Order No. 3-176 of the Minister of Transport and Communications of the Republic of Lithuania of 29 March 2021 on the approval of the description of the classification of railway transport disasters, accidents and incidents, the procedure of reporting and providing information about them. |
10 years after the railway transport disaster, traffic accident, or fault |
|
3.8. |
We ensure the efficient and secure operation of our website |
IP address, version of the operating system, parameters of the device you use, session start time and duration, terms of requests you enter on our website, other statistical data and any information stored using cookies applied on your device (more about the cookies used read in Clause 11 of the Privacy Notice). |
We have a legitimate interest (to ensure that the Company’s website operates in a quality and secure manner and that visitors find information relevant to them) (Article 6(1)(f) of GDPR) |
Up to 2 years (more about the storage terms of the cookies used read in Clause 11 of the Privacy Notice). |
|
3.9. |
Through the trust line, you provide us with information regarding possible fraud, corruption, other criminal acts, violations of law, violations of work duties |
If a person provides information by phone, and not anonymously, the data is indicated by the person himself/herself – name, surname, etc., the content of the message, the phone number from which the call was made, the start, end, duration of the call and other personal data, if the person indicates them when providing information. If a person provides information by email (prevencija@bekorupcijos.lt) ) or using the website ltg.lt – email and additional information if the person does not provide information anonymously – name, surname, phone number, message content. |
We have a legitimate interest (prevention of fraud, corruption, other criminal acts, violations of the law, work duties and other violations - to prevent acts committed, to take measures to prevent acts in the future, etc.) (Article 6 (1)(f) of GDPR) |
1 year from the date of receipt of Information |
|
3.10. |
You submit a request to implement the rights of data subjects provided for in the GDPR and we ensure the implementation of the request |
Depending on what personal data you provide: name, surname, phone number, address, date of birth, email, register number, code of legal partner, copy of identity document, request for the exercise of the rights of the data subject, date of request, place of request, specified method of submitting a response to the request, content of the request and other information provided in the request of the data subject, response to the data subject, other information related to the exercise of the data subject’s rights |
We have a legal commitment (to ensure the implementation of the rights of data subjects – (Chapter III of GDPR) |
Requests are stored for 5 years from the date of submission of the response. |
|
3.11. |
Receive feedback from business customers and their representatives on the services provided by the Company in order to evaluate their experience and improve the quality of services. |
Name, surname, email, name of the company represented, work email address, name of the service provided, date of contact for participation in the feedback survey, answers provided during the survey (opinion on the services provided). |
Legitimate interest (GDPR Article 6(1)(f)) to evaluate the experience of business customers with regard to the services provided and to improve the quality of services in the future. |
Personal data is stored for 2 years after the invitation is sent. |
4. What information must you provide and why?
Please see the answer to point 3 above – you must provide the information about yourself that is necessary in order to:
4.1. conclude contracts with you and fulfil contractual obligations (for the purpose referred to in clause 3.1);
4.2. conclude contracts with the persons you represent and fulfil contractual obligations (for the purpose referred to in clause 3.2);
4.3. conclude employment contracts with you and fulfil contractual obligations (for the purpose referred to in clause 3.1);
If you do not provide the information specified in clauses 3.1 and 3.2, we will not be able to conclude contracts and fulfil contractual obligations with you and/or the persons you represent.
5. Where do we get information about you?
You provide most of the information yourself, but we may receive some information from:
5.1. AB Lietuvos geležinkeliai (for all the purposes referred to in clause 3);
5.2. Legal entities that you represent or are employed by (for the purpose referred to in clause 3.2);
5.3. AB Lietuvos paštas (for the purpose referred to in clause 3.1);
5.4. the State Enterprise Centre of Registers (for the purpose referred to in clauses 3.1, 3.2).
6. Who do we transfer information about you to?
We transfer or share information related to you with partners, service providers, as well as the entities listed below only to the extent that it is necessary and permitted by applicable laws, as well as for the reasons listed in Clause 3:
6.1. Banks carrying out settlement operations (data transmitted for the purposes referred to in clauses 3.1 and 3.2);
6.2. Judicial, supervisory, law enforcement and other public authorities (data may be transferred for all the purposes referred to in clause 3);
6.3. Lawyers, notaries, bailiffs, auditors, consultants, information technology maintenance service providers, electronic communication service providers, insurance companies, companies providing archiving services and other services to the Company (data may be transferred for all the purposes referred to in clause 3).
We note that the Company selects as data processors only those persons who have provided the Company with a sufficient guarantee that they apply appropriate technical and organisational measures that ensure the safe processing of personal data and the appropriate level of data protection in accordance with the applicable European Union legislation.
7. Will your data be transferred outside the European Economic Area?
In most cases, personal data is processed and transferred within the territory of the European Union and the European Economic Area², but if necessary for the provision of certain services, data may be transferred and processed outside the mentioned territories, when an adequate level of personal data protection is observed. When permitted by law and required for the reasons specified in Clause 6 of this Privacy Notice, we disclose information about you:
7.1. In accordance with the decision of the European Commission on adequacy, meaning that the European Commission has recognised the country in which the third party is established and/or operates as ensuring an adequate level of personal data protection;
7.2. We have signed a contract with a third party based on the Standard Contractual Terms approved by the European Commission;
7.3. We have obtained the permission of the State Data Protection Inspectorate;
7.4. Using, if possible, other possible personal data protection measures and derogations.
² The European Economic Area is made up of all the member countries of the European Union plus Iceland, Liechtenstein and Norway.
8. What rights do you have?
The GDPR and other legal acts grant you rights, provide cases when you can use them, the procedure you must follow, as well as exceptions in which cases you cannot use the granted rights. Where permitted by law, you may:
8.1. have access to your personal data, i.e., receive a notification confirming whether LTG processes your personal data and, if it does, request access to the processed data and related information;
8.2. submit a request to us to correct inaccurate, incorrect information used or supplement it when it is not complete;
8.3. submit a request to us to delete the information we have about you if we use it illegally;
8.4. submit a request to us to limit the processing of available information about you, when you dispute the accuracy of the data or object to data processing, you do not agree to the deletion of your illegally processed data, or you need the data in order to assert, fulfil or defend legal claims;
8.5. object to the use of data when we process your data in pursuit of the legitimate interests of LTG and/or third parties;
8.6. submit a request to us to transfer (receive) data that you have provided to us pursuant to a contract or by giving consent for data processing and which we process by automated means in a commonly used electronic form;
8.7. object to the application of fully automated decision-making, including profiling, if such decision-making may have legal consequences or similar material impact on you;
8.8. withdraw the consents given to us regarding the use of information about you, when we use the data based on your consent;
8.9. submit a complaint to a supervisory authority, primarily in the member state where you have your permanent residence or the place where the suspected GDPR violation was committed and apply for judicial remedies. In the Republic of Lithuania, you may appeal to the State Data Protection Inspectorate acting as a supervisory authority (L. Sapiegos Str. 17, Vilnius; email: ada@ada.lt), but we recommend contacting us first, and we will try to solve all your requests together with you.
9. How could you enforce your rights?
In order to enforce your rights specified in Clause 8 of this Privacy Notice, you must:
9.1. personally deliver the request to exercise the rights of the data subject (hereinafter referred to as the Request³)14 to the Company’s headquarters or to the data protection officer at the addresses specified in Clause 14 of this Privacy Notice (a document confirming personal identity must be submitted for inspection together with the Request);
9.2. submit the Request to the Company or the data protection officer to the postal addresses specified in Clause 14 of this Privacy Notice (the Request must be accompanied by a copy of the document confirming the identity of the person, certified by a notary public or in the way specified by other legal acts);
9.3. submit the Request to the Company or the data protection officer at the email addresses specified in Clause 14 of this Privacy Notice (the request submitted by email must be signed with a secure, qualified electronic signature).
³ It is recommended to use the Request to exercise data subject rights form here (in the original language).
10. Do we profile you and make automated decisions?
The Company may profile you for statistical purposes, and in order to prevent the sending of unsolicited marketing offers, we categorise you according to the date of conclusion of the contract, the term of validity of the contract, and the status of the contract.
11. Does our website leave cookies on your computer or device?
Yes, we use cookies as indicated in the table below. Cookies are small text files stored in the browser of your device (e.g. computer, mobile phone, tablet) when you browse websites. Other technologies, including data we store on your browser or device, identifiers associated with your device, and other software, may be used for similar purposes. Cookies are used extensively to make websites work or work better and more efficiently.
|
Title |
Period |
Purpose |
|
AWSALB |
7 days |
Load balancer for AWS. The cookie is used to make the user’s path more efficient. This cookie does not process personal data. |
|
AWSALBCORS |
7 days |
Load balancer for AWS. The cookie is used to make the user’s path more efficient. This cookie does not process personal data. |
|
AWSALBTG |
7 days |
Load balancer for AWS. The cookie is used to make the user’s path more efficient. This cookie does not process personal data. |
|
AWSALBTGCORS |
7 days |
Load balancer for AWS. The cookie is used to make the user’s path more efficient. This cookie does not process personal data. |
|
_ga |
1 year 1 month 4 days |
Tracking cookie from Google Analytics. This cookie is used to collect personalised information about how visitors use the website. By using the cookie, a unique ID is registered and used to identify unique visitors to the page. |
|
_ga_VRNLS6XJKT |
2 years |
Tracking cookie from Google Analytics. This cookie is used to collect personalised information about how visitors use the website. By using the cookie, a unique ID is registered and used to identify unique visitors to the page. |
|
_ga_* |
1 year 1 month 4 days |
Google Analytics sets this cookie to store and count page views. |
|
_gid |
24 h |
Tracking cookie from Google Analytics. The cookie collects information about user behaviour on the website and is used to report statistical information about the website. Anonymised data about the number of visitors, location of visitors and reviewed pages are collected. |
|
cf_clearance |
8 months |
The cookie is set by CloudFlare services to identify reliable Internet traffic. It does not correspond to any user ID in the web application and does not store any personally identifiable information. |
|
pll_language |
1 year |
The functionality cookie of the multilingual plugin is used to store information about the language preferences of the visitor’s page. |
|
cookieyes-consent |
1 year |
The cookie is set by the GDPR cookie consent plugin. This cookie is used to store the user’s consent to the use of cookies. |
|
TS01* |
Session |
Wix sets this cookie for security and anti-fraud purposes. |
|
wpEmojiSettingsSupports |
Session |
WordPress sets this cookie when a user interacts with emojis on a WordPress site. It helps determine if the user's browser can display emojis properly. |
12. How can cookies be managed?
By visiting the (www.ltg.lt) website, you can choose whether you want to use cookies. You can manage cookies on the website itself and/or delete them according to your preferences in your browser. You can refuse the use of optional cookies on the website, which are not mandatory, but the website may not work with full functionality.
You can choose which cookies you want to accept and which to reject in your browser settings. You can delete any cookies already on your computer, and most browsers can prevent cookies from being saved. The location of these settings depends on the browser you are using.
If you do not agree to cookies being saved on your computer or other device, you can withdraw your consent at any time by changing the settings on the website and deleting the saved cookies in your browser. If you choose to delete cookies, remember that all the options you have set will also be removed. In addition, if cookies are completely blocked, many websites (including www.ltg.lt) may not function properly. For these reasons, we do not recommend disabling mandatory cookies.
13. How to remove cookies from a device?
To prevent your personal data from being processed with the help of cookies, you can change the settings of your internet browser so that cookies are not accepted or delete saved cookies.
You can change the cookie settings in your browser at any time. All browsers have the option to delete cookies. More detailed instructions depend on the browser you are using, you can find them in the options menu of the browser you are using:
Cookie settings in Internet Explorer
Cookie settings in Safari web and iOS
For more information see https://www.allaboutcookies.org/
We reiterate that removing or blocking the cookies used may affect the operation of the website and some of its functionalities, as well as may negatively affect the use of the services available on the portal.
To get more information about cookies and how to manage or remove them, just visit https://www.allaboutcookies.org/ and your browser’s help page.
14. How to contact the Company or the Data Protection Officer?
If you have questions, comments, or complaints about how we collect, use and store information about you, or if you want to exercise your rights as a data subject, you can contact:
14.1. The Company, at the address: Geležinkelio g. 16, 02100 Vilnius, tel.: (8 5) 269 2038, email: info@ltg.lt;
14.2. Data Protection Officer, at the address: Pelesos g. 10 Vilnius, email: dap@ltg.lt
15. Candidate’s Privacy Notice