1. Introduction
This Privacy Policy (hereinafter referred to as the “Privacy Policy”) explains how UAB buhalterės.lt (hereinafter referred to as the “Company”) collects and processes the personal data of its clients, partners, employees and visitors to the website (online store) https://buhalteres.lt (hereinafter referred to as the “Website”), specifies the rights of data subjects and explains how these rights may be exercised. Digital products and other services (hereinafter referred to as the “Services”) are offered for purchase on the Website.
The Company respects and protects the privacy of its clients, partners and employees. This Privacy Policy explains what data we collect, the legal grounds on which we process it, how we ensure its security and what rights each individual has. Our objective is to ensure transparency so that everyone knows what happens to their data and can feel secure when using our Services.
The Company applies various technical and organisational measures to ensure data security, including access controls, data encryption, continuous monitoring of internal processes and employee training. We also cooperate with trusted partners and data processors and ensure that the standards they apply comply with our requirements.
The Client is responsible for the accuracy, correctness and completeness of the personal data provided when using the Website and for updating such personal data if it changes. Our privacy culture is based on transparency, responsibility and trust. We aim to integrate data protection principles into every process so that our Clients can be certain that their information is processed lawfully, responsibly and only to the extent necessary for the provision of the Services.
The Client must carefully read and familiarise themselves with this Privacy Policy before submitting an enquiry, placing an order or purchasing Services on the Website.
The Client may not order Services on the Website unless they have read and agreed to this Privacy Policy. If the Client does not agree with the Privacy Policy or any part thereof, they may not order Services on the Website. We process Personal Data in accordance with this Privacy Policy and applicable legislation, including the General Data Protection Regulation (EU) 2016/679 (hereinafter referred to as the “GDPR”) and the applicable personal data protection legislation of the Republic of Lithuania.
2. Personal Data Controller
UAB buhalterės.lt
Company registration number: 302546905
Address: Konstitucijos Ave. 7, LT-09308 Vilnius, Lithuania
Telephone number: +370 653 333 30
Email address: [email protected]
3. Client Account
The Client may place an order or order Services on the Website after registering on the Website.
When registering an account on the Website, the Client must provide their first name, surname, email address and telephone number and create a secure password.
The Client has the right to change the personal data in their account at any time or contact the Personal Data Controller with a request to delete the account.
4. Data We Collect
To provide high-quality Services and ensure a smooth experience, we collect only the personal data necessary for our activities. We process each category of data responsibly and only for clearly defined purposes.
- Identity data. First name, surname, date of birth, personal identification number, VAT identification number, copies of identity documents and other information. This data is required to properly identify the Client, prevent errors and provide the Services correctly.
- Contact details. Address, telephone number and email address. This data is used to contact individuals regarding the provision of Services, notify them about meeting times or changes and for other related purposes.
- Employment information. Position held, place of employment and contact details of the employer.
- Information concerning authorisations and representation. First names, surnames, dates of birth, personal identification numbers and addresses of representatives, as well as copies of documents.
- Questionnaire data. Data provided in questionnaires relating to the prevention of money laundering and international sanctions.
- Payment data. Bank account number and payment information. This data is processed solely to ensure secure payment for the Services and comply with legal accounting obligations.
- Electronic service and e-commerce usage data. Login ID, first name, surname, address, email address, telephone number, cookie data and information about the use of the Website. This data helps ensure the technical operation of the Website, tailor the Services to users’ needs and improve the user experience.
- Telephone conversation and email communication data. Recordings of telephone conversations and email correspondence may be used to improve the quality of customer service and investigate disputes or complaints.
- Job applicant data. Curricula vitae, cover letters and information about education and professional experience. This data is collected solely to assess applicants and make an informed decision during the recruitment process.
- Direct marketing data. Data required for newsletter subscriptions or other marketing activities. This data is processed only after obtaining the individual’s explicit consent, which may be withdrawn at any time.
Please note that we may obtain your data not only directly from you but also from other sources, such as public registers or partners, when this is necessary for the provision of Services or permitted by law.
5. Legal Grounds and Purposes
We process personal data only when there is a clear legal basis established by the General Data Protection Regulation and other applicable legislation. This ensures that your data is collected and used only for lawful purposes and only to the extent necessary.
- Performance of a contract. When you order our Services, we must process your data to provide the ordered accounting and related Services, administer your account and enquiries and ensure the delivery of the Services and their results.
- E-commerce purposes. When the Client purchases Services on the Website.
- Compliance with a legal obligation. As a service provider, we must comply with applicable legislation. This includes accounting and invoicing requirements, the retention of documents for the prescribed period and compliance with lawful requests received from public authorities.
- Legitimate interest. In certain cases, we process data to ensure the security and efficiency of our activities. The principal purposes include debt administration, the defence of legal claims, business analysis and internal administration.
- Consent. Certain activities may only be carried out after obtaining your explicit consent. These include sending newsletters and other direct marketing communications, using cookies on the Website and retaining job applicant documents for a longer period after the recruitment process.
You may withdraw your consent at any time. In such a case, we will cease processing your data for the purpose specified in the consent.
6. Data Retention Periods
| Data category | Retention period | Explanation |
|---|---|---|
| Conclusion and performance of contracts with clients or suppliers who are natural persons | For the duration of the contract | First name, surname, date of birth, personal identification number, VAT identification number, address, bank account number and copies of identity documents. Legal basis: Article 6(1)(b) of the GDPR — performance of a contract. Data may be transferred to data processors. |
| Conclusion and performance of contracts with clients or suppliers who are legal entities | For the duration of the contract | Representatives’ first names, surnames, positions, dates of birth, personal identification numbers, email addresses and telephone numbers, copies of identity documents and the content of correspondence. Legal basis: Article 6(1)(f) of the GDPR — legitimate interest. Data may be transferred to data processors. |
| Provision of accounting and other professional services involving third-party data | For the duration of the contract | Data contained in Clients’ documents and required for the provision of Services, such as payroll data. Legal basis: Article 6(1)(f) and Article 6(1)(c) of the GDPR. Data may be transferred to data processors. |
| Management of the Company’s own accounting records, rather than those of its Clients | For the periods established by accounting and other legislation and the Index of General Document Retention Periods | Data specified in invoices and accounting documents. Legal basis: Article 6(1)(c) of the GDPR — compliance with a legal obligation. Data may be transferred to data processors. |
| Archiving | 10 years after the expiry of the contract | Data processed for the purposes of concluding and performing contracts and providing Services. Legal basis: Article 6(1)(c) of the GDPR, in accordance with paragraphs 6.1 and 10.37 of the Index of General Document Retention Periods. Data may be transferred to a company providing archiving services. |
| Defence of legal claims | 10 years | Data processed for the purposes of contracts and the provision of Services. Legal basis: Article 6(1)(f) of the GDPR — legitimate interest. Data may be transferred to courts, public authorities responsible for resolving disputes, lawyers and other providers of legal services. |
| Newsletter consent data | For as long as the consent remains valid | Data is processed only for as long as the individual wishes to receive communications. |
| Website usage data and cookies | Up to 2 years | This data helps ensure the technical operation of the Website and improve the user experience. |
| Telephone conversation recordings | Up to 365 days, unless required for an investigation | Used to improve service quality and investigate disputes or complaints. |
| Job applicant data | Up to 30 calendar days after the end of the recruitment process, unless consent is given for longer retention | This enables us to conduct the recruitment process and assess the applicant. Longer retention is possible only with the applicant’s consent. |
| Other data | For no less than the period required by law or for as long as necessary to achieve lawful purposes | For example, when necessary to defend legal claims or comply with specific legislation. |
We retain personal data for as long as necessary to achieve the specified purposes or for as long as required by law. After the retention period has expired, the data is securely deleted or anonymised.
7. Data Recipients
Your personal data may be transferred only where this is necessary to carry out lawful activities, ensure the quality of the Services or comply with legal requirements. The Client agrees that their personal data may be transferred to partners when fulfilling the Client’s order or purchasing a Service offered on the Website or online store.
Public authorities. Data is provided only when required by law or pursuant to an official request, for example to the State Tax Inspectorate, the State Data Protection Inspectorate or other authorities authorised by law.
Service providers and partners. We engage partners who help ensure the operation of our business processes. These may include:
- IT and data centre service providers;
- payment and banking service providers;
- audit firms;
- recruitment and personnel administration companies;
- marketing, advertising and communication partners;
- providers of consulting, legal or other specialised services;
- intermediaries processing Client payments and listed on the Website, including Paysera, Swedbank, SEB, Luminor, Citadele, Revolut, Artea, Urbo and the LKU Credit Union Group.
Responsibility for data security. All service providers act in accordance with our instructions and have signed data processing agreements that ensure appropriate data protection. They are not entitled to use the data for their own purposes.
Transfers outside the EU/EEA. Where data must be transferred to third countries outside the European Union or European Economic Area, we ensure that the safeguards required by the GDPR are applied, such as:
- standard contractual clauses approved by the European Commission;
- an adequacy decision, where the European Commission has recognised that a country ensures an adequate level of data protection;
- additional technical measures, such as data encryption.
8. Audio Recordings
Telephone conversation recordings. We record telephone conversations in order to:
- ensure a high standard of customer service;
- accurately investigate Client complaints or disputes;
- protect the rights of Clients, employees and partners.
Recordings are retained for up to six months unless they are required in connection with a specific dispute or investigation, in which case the retention period may be extended.
9. Client Surveys and Feedback
Client surveys. To ensure the quality of the Services we provide and improve the Client experience, we may send a short customer service evaluation survey after the provision of a specific Service.
The legal basis is our legitimate interest under Article 6(1)(f) of the GDPR in ensuring that our Services meet Clients’ expectations and that their quality is continuously improved.
Recipients may always opt out of this type of communication by using the link provided in the email or contacting us at [email protected].
10. Processing of Job Applicant Data
We process the personal data of job applicants solely for the purposes of the recruitment process, including assessing their experience, qualifications and suitability for a specific position.
- The data processed generally consists of information provided by the applicant, including their CV, cover letter and information obtained during an interview, as well as data that we are required to process under applicable legislation.
- Information concerning the applicant’s qualifications, professional skills or work experience may be obtained from a former employer only after notifying the applicant in advance. Such information may be obtained from the applicant’s current employer only after receiving the applicant’s explicit consent, in accordance with Article 5(3) of the Law on the Legal Protection of Personal Data.
- Applicant data is retained for up to 30 calendar days after the end of the recruitment process unless the applicant gives explicit consent to its longer retention for future recruitment processes.
- With the applicant’s consent, the data may be retained in the applicant database for up to one year. The applicant may withdraw their consent at any time.
11. Data Security Measures
UAB buhalterės.lt is committed to protecting your personal data and implements appropriate technical and organisational measures to ensure that the data is processed securely and protected against unlawful or accidental destruction, loss, alteration, disclosure or other unlawful processing.
Personal data is generally processed and stored within the territory of the European Union and the European Economic Area. If data needs to be transferred outside the EU or EEA, such transfer will take place only subject to the safeguards required by the GDPR, such as standard contractual clauses.
Although we take all reasonable measures to protect your data, we must point out that the transmission of data over the internet always involves a certain level of risk for which the Company cannot assume full responsibility.
If a personal data breach occurs that is likely to result in a high risk to your rights or freedoms, we will promptly notify you and the State Data Protection Inspectorate, as required by the GDPR.
11. Cookies
Our Website uses cookies, which are described in our Cookie Policy.
12. Rights of Data Subjects
Every individual whose data we process has the right to the protection of their data. This means that you have the right to:
- receive information about how your data is processed, the purposes of processing, how long it is retained and to whom it may be disclosed;
- access your data, including receiving a copy of it and knowing what information about you is held in our systems;
- request the correction or completion of inaccurate or incomplete data;
- request the deletion of data, also known as the “right to be forgotten”, where the data is no longer required or is being processed unlawfully;
- restrict data processing, for example while the accuracy of the data is being verified or a dispute is being resolved;
- transfer data to another data controller where the data is processed by automated means on the basis of consent or a contract;
- object to the processing of data where it is carried out on the basis of a legitimate interest or for direct marketing purposes;
- withdraw consent at any time, in which case the data will no longer be processed for the relevant purpose.
To ensure transparency, we respond to all requests concerning the exercise of your rights no later than within 30 calendar days from the date on which the request is received. In complex or time-consuming cases, this period may be extended by up to two months. We will inform you of such an extension within the first month.
If we decide not to comply with your request, we will always clearly specify the grounds for our refusal. If you disagree with our response, you have the right to lodge a complaint with the State Data Protection Inspectorate at www.vdai.lrv.lt.
13. Exercise of Rights and Complaints
To exercise your rights, you may submit a request using the method most convenient for you:
- By email: [email protected]
- By post: Konstitucijos Ave. 7, LT-09308 Vilnius, Lithuania
- By visiting our registered office and confirming your identity
14. Final Provisions
Our Website may contain links to websites operated by other organisations. Please note that we do not control these websites and therefore cannot be held responsible for their content or privacy practices. We recommend reviewing the privacy policy of each third-party website before providing your data.
This Privacy Policy takes effect from the date of its publication on the Website. The Privacy Policy does not constitute an agreement between the Company and you concerning the processing of Personal Data. Through this Privacy Policy, the Company informs you about the principles governing the processing of your personal data by the Company.
We may amend the Privacy Policy at any time. Amendments and additions to the Privacy Policy take effect upon their publication on the Website.
The Policy is updated whenever this becomes necessary due to changes in circumstances, legislation or data processing activities. We recommend reviewing our Privacy Policy periodically.
