LTG Cargo » Privacy note

Privacy note

AB LTG CARGO

PRIVACY NOTE

Last updated: 25 March 2022

AB LTG Cargo (hereinafter referred to as “LTG Cargo” or “The Company” or simply “we“) stores information about you in connection with the Processing of Data in connection with the General Data Protection Regulation of the European Union (referred to as “GDPR”[1]) and other data protection legislation.

1-Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).

1. What is contained in this Privacy Note?

This Privacy Note provides answers to the most important questions – how we collect, use, and store information about you. Please read this important information carefully and from time to time visit our website and read the latest version of the Privacy Note published there.

2. Who is responsible for protecting information about you?

AB LTG Cargo, legal entity code: 304977594, registered office address: Gelezinkelio str. 12, 02100 Vilnius, e-mail address: [email protected], telephone number: (8 5) 2692745.

3. Why and what information do we collect about you?

No.	Why do we collect information about you?	What information do we collect about you?	Why do we have the right to collect the information you provide?	How long do we use or store information about you?
3.1.	We conclude and execute agreements with you and fulfill the related tax obligations	Name, personal identification number and/or date of birth, address of residence, e-mail address, telephone number, authorisation period and number of authorisation, signature, relationship with the person represented, position, payer code, billing information, settlement period, debt information, bank account number, contract, additions to the authorisation, amendments and annexes, acts of acceptance, date of conclusion, contract number, place of conclusion and performance of the contract, information on the performance of the contract, termination information, extract of the central data bank of the Real Estate Register and, as regards the performance of the contract, communication with you, other information that may be necessary for the proper performance of the contract	We conclude a contract with you and fulfl our contractual obligations (Art. 6 (1)(b) GDPR) We must collect information according to the law (Art. 6.1.1.c. GDPR)	During the term of the contract
3.2.	To maintain relationships with the private or legal persons you represent	Name, personal identification number and/or date of birth, address of residence, authorisation, period and number of the authorisation, signature, relationship with th person represented, position, telephone number, e-mail address, name of the connecttion to our systems, all information you provide to the Company (e.g. information about the person you represent, contracts concluded, etc.) and, as far as the performance of the contract is concerned, communication with you, other information that may be necessary fot the proper performance of the contract	We have a legitimate interest (to maintain relations with the persons you represent) (Article 6(1)(f)) of the GDPR)	During the term of the contract
3.3.	For informing/questioning you about the Compnay’s services relevant to you	Name, function, telephone number, address, organisation represented, e-mail address	You agree that we will use information about you (Art. 6(1)(a) of the GDPR, Art. 69(1) of the Law on Electronic Communicatoins of the LR) or have purchased goods or services from us (Art. 69(2) of the Law on electronic communications of the LR)	2 years after the consent or the end of your relationship with us, unless you express your disagreement within this period
3.4.	When you have submitted to us an application, offer or complaint	Name, e-mail address, state, phone number, subject of request, request time, request content, query attachments, query response	We have your consent (Article 6(1)(a) of the GDPR, we are obligated to collect the information in accordance to the law (Article 6(1)(c), Article 29(1) of the Railway Transport Code of the Republic of Lithuania. We have a legitimate interest (to examine your enquiries, requests or complaints) (Article 6(1)(f)) of the GDPR)	1 year after last referral
3.5.	We record telephone conversations to ensure the quality of the services provided, to provide accurate information about the services provided and to provide advice, and to investigate inquiries, complaints and requests.	Telephone number, telephone records and data provided during conversations	We have a legitimate interest (to ensure the quality of customer service, to provide accurate information about the services provided and to provide advice, to ensure the appropriate quality of customer service, to examine requests, inquiries or complaints under Article 6(1)(f)) of the GDPR)	1 year after conversation with you
3.6.	We ensure the security of your health, life and trust and the property owned by the Company – in cases when you are filmed in the Company’s premises, their accesses, railway crossings, stations, and their access areas	Video (where appropriate, the image is recorded with sound)	We have a legitimate interest (security of property and persons) (Article 6(1)(f)) GDPR)	5 to 30 days (device dependent) (at railway crossings – up to 3 months)
3.7.	We may participate in legal proceedings relating to you	All information mentioned in this Privacy Note, documents and annexes sent to you, documents and annexes thereto, procedural documents, court orders, rulings, decisions	We have a legitimate interest (to defent the Rights of the Company in legal proceedings) (Article 6(1)(f)) of the GDPR	10 years after the termination of the contract with you or 10 years after the legal proceedings have ended
3.7.	We may participate in legal proceedings relating to you	Information on criminal offenses and convictions	Data is needed to assert, enforce or defent legal claims (Article 9(2)(f)) of the GDPR
3.8.	To investigate rail accidents or incidents	Witness in a rail transport accident, accident or incident: name, name of the person affected by a rail traffic accident, accident or incident, by order, sex, age, sobriety, personal actions, the name of the perpetrator of a railway accident, accident or incident and any other information we must handle under Order No 3-531(1.5 E) of 23 December 2015 of the Minister of Transport of the RL. , Annex 2 to the provisions on the reporting of accidents and incidents, the investigation of rail transport accidents, accidents and incidents and their response	We must collect information in accordance with the law (Article 6(1)(c) of the GDPR, Order No 3-531(1.5 E) of 23 December 2015 of the Minister of Transport of the LR, to approve the Regulations on the reporting of rail accidents and incidents, the investigation of rail accidents and incidents and their response)	10 years after a rail traffic accident, accident or incident
3.9.	To ensure the efficient and secure operation of our website	IP address, operating system version, settings of the device you are using, the time and duration of the start of the session, the request terms you enter on our website, and any information stored using cookies applied to your device (more about the cookies you use in section 11 of the Privacy Note).	We have a legitimate interest (to ensure the quality of our services, to improve and develop new services, to ensure that the Company’s website operates in a qualitatively secure manner and that the persons visiting it find relevant information) (Article 6(1)(f)) of the GDPR	60 days
3.10.	Through the hotline channels, you provide us with information on possible fraud, corruption, other crimes, violations of law, violations of employment duties	If the person provides the information by telephone not anonymously – the data shall indicate the name, surname, etc. of the person, the content of the message, the telephone number from which the call was made, the start, end, duration and other personal data if provided by the person. If a person provides information via email. by e-mail or via the websites www.litrail.lt, www.ltgcargo.lt – e-mail. postal address and additional information if the person provides information not anonymously – name, surname, telephone number, content of the message	We have a legitimate interest (to prevent fraud, corruption, other criminal offenses, violations of law, duties and other violations – to prevent the committed acts, to take measures to prevent future acts, etc.) (Article 6 (1) (f) of the GDPR)	1 year from the date of receipt of the information
3.11.	You are submitting a request to enforce the data subject’s rights under the BDAR and we are enforcing the request	Depending on what personal data you provide: name, surname, phone number, address, date of birth, email address, table number, legal partner code, copy of identity document, request for exercise of data subject’s rights, date of request, place of request, specified method of replying to the request, content of the request and other information provided in the data subject’s request, reply to the data subject , other information related to the exercise of the data subject ‘s rights.	We have a legal obligation to enforce the rights of data subjects – (Chapter III of the GDPR)	Applications are kept for 5 years from the date of the reply

4. What information do you have to provide to us and why?

Please review the answer to point 3 above – you must provide the information about you that is necessary in order to:

4.1 we would enter into agreements with you and fulfil our contractual obligations (for objective 3.1);

4.2. we would conclude contracts with the persons represented by you and fulfil our contractual obligations (for objective 3.2).

Failure to provide you with the information specified in paragraphs 3.1 and 3.2 will not be able to conclude contracts and fulfil contractual obligations with you and/or persons represented by you.

5. Where do we get information about you from?

Most of the information you provide yourself, but we may receive some of the information from:

5.1. Joint-stock company Lietuvos geležinkeliai (for all purposes specified in Item 3);

5.2. Legal persons that you represent or employ (for the purpose specified in point 3.2);

5.3. AB Lietuvos paštas (for all purposes specified in Item 3.1);

5.4. VĮ Registrų centras (for all purposes specified in Item 3.1, 3.2).

6. To whom do we pass on information about you?

We will only share or transfer information about you with our partners, service providers, and the following entities to the extent necessary and permitted by applicable law, including for the reasons listed in Section 3:

6.1. LTG Cargo AB to the parent company of Lietuvos Geležinkeliai AB and its subsidiaries (data may be transferred for all purposes specified in Item 3);

6.2. Banks carrying out settlement operations (data to be transferred for the purposes specified in points 3.1 and 3.2);

6.3. Courts, supervisory, law enforcement and other public authorities (data may be transmitted for all purposes specified in point 3);

6.4. Lawyers, notaries, bailiffs, auditors, consultants, information technology surveillance service providers, providers of electronic communications services, insurance companies, archiving services and other services to companies providing the Company (data may be transferred for all purposes specified in point 3).

7. Will your data be transferred outside the European Economic Area?

In most cases, personal data are processed and transferred within the territory of the European Union and the European Economic Area², but where necessary for the provision of certain services, data may be transferred and processed outside those territories, subject to an adequate level of protection of personal data. For the reasons set out in section 6 of this Privacy Note, we disclose information about you as permitted by law and for the reasons set out in section 6 of this Privacy Note:

7.1. On the basis of the adequacy decision of the European Commission, the European Commission has recognised the country in which a third party is established and/or operates as ensuring an adequate level of protection of personal data;

7.2. We have signed a contract with a third party based on the Standard Contractual Clauses approved by the European Commission;

7.3. We have obtained the permission of the State Data Protection Inspectorate;

Other possible measure and derogation for the protection of personal data, where possible.

2 – The European Economic Area comprises all the Member States of the European Union plus Iceland, Liechtenstein and Norway.

8. What rights do you have?

The GDPR and other laws give you rights, provide for cases where you can exercise them, the procedures you need to comply with, as well as exceptions in which you may not exercise the rights granted. Once permitted by law, you can:

8.1. to access your personal data, i.e. receive a notification confirming whether LTG Cargo processes your personal data and, if processed, request access to the data processed and the information relating therein;

8.2. submit to us a request to correct or supplement inaccurate, incorrect information used when it is incomplete;

8.3. submit to us a request to delete information about you that we have if we use it illegally;

8.4. to submit to us a request to restrict the processing of existing information about you when you dispute the accuracy of the data or object to the processing of data, do not agree to the deletion of your unlawfully processed data, or the data you need in order to assert, enforce or defend legal requirements;

8.5. to object to the use of the data when we process your data for the legitimate interests of LTG Cargo and/or third parties;

8.6. submit to us a request to transfer /receive data that you have provided us under contract or consent to the processing and which we process by automated means in a shared electronic form;

8.7. to object to a fully automated decision, including profiling, if such decision-making may have legal effects or similar significant effects on you;

8.8. to withdraw the consents given to us regarding the use of information about you when we use the data on the basis of your consent;

8.9. lodge a complaint with the supervisory authority, in particular in the Member State where you are domiciled or the place where the alleged violation of the GDPR was committed and to apply for judicial remedies.The supervisory authority in the Republic of Lithuania is the State Data Protection Inspectorate (A. Juozapavičiaus St. 6, 09310 Vilnius; tel. (8 5) 271 2804, 279 1445; e-mail: [email protected]).

9. How can you exercise your rights?

In order to exercise your rights under clause 8 of this Privacy Note, you must::

9.1. personally present the request for the exercise of the rights of the data subject (hereinafter referred to as the Application)³ to the office of the Company or to the Data Protection Officer at the addresses specified in item 13 of this Privacy Note (the application must be accompanied by an identity document);

9.2. to send the Request to the Company or Data Protection Officer at the postal addresses specified in Item 13 of this Privacy Note (a copy of the identity document, certified by a notary or other procedure established by legal acts must be attached to the Application);

9.3. submit a request to the Company or data protection officer with the e-mail addresses specified in clause 13 of this Privacy Note (the request submitted by e-mail must be signed with a secure electronic signature).

3-The recommended application form for the exercise of the data subject’s rights is available here.

10. Do you profile me and make automated decisions?

The Company may profile you for statistical purposes, as well as to prevent sending of unwanted marketing offers, we assign you categories according to the date of conclusion of the contract, the term of the contract, the status of the contract.

11. Does your website leave cookies on my computer or device?

Yes, we use cookies as shown in the table below. Cookies are small text files stored in your device’s browser (e.g. computer, mobile phone, tablet) when you browse websites. Other technologies, including data that we store in your browser or device, identifiers related to your device and other software, may be used for similar purposes. Cookies are widely used to make websites work or work better and more efficiently.

Name	Period	Purpose
GUEST_LANGUAGE_ID	1 year	Store information about the language of the visitor for the page
JSESSIONID	Until the end of the session	Store session data necessary to ensure functionality of the site and maintain the visitor session
__utma	2 years	Store information about the number of visits to the page
__utmb	1 day	Store information about the page opening time
__utmc	Until the end of the session Until you delete it	Store information about the time the page closes
__utmt	1 year	Store information about the time on which the page consent was downloaded
__utmz	6 months	Store information, whether the visitor visited the page using the search function, or learned about the page from other sources
COMPANY_ID	Until the end of the session	Provide and store a visitor’s user ID so that one visitor can be properly separated from another
ID, USER_UUID	Until the end of the session Until you delete it	Store visitor ID information to support automatic sign-in functionality
__cfduid	1 month	Store visitor identification information on the cyber security platform cloudflare.com.
cookieconsent_status	1 year	Store information about whether a cookie message has been displayed

12. How can I manage cookies?

You can configure your browser to opt out of some or all of the cookies or to request your permission before they are accepted. Please note that deleting cookies or disabling the use of cookies in the future may prevent certain Web Parts or Features of our Web Pages from being accessed. For information about how you can change your browser settings, go to www.allaboutcookies.org/manage-cookies.

For more information about third-party cookies and management capabilities, please refer to these third-party cookie notifications.

13. How do I contact the Company or the Data Protection Officer?

If you have questions, comments or complaints about how we collect, use and store information about you, or whether you want to exercise your rights as a data subject, you can contact:

13.1. Company at: Gelezinkelio st. 12, 02100 Vilnius, tel. (8 5) 2692745, e-p. [email protected];

13.2. Data Protection Officer at: Prusu str. 1 Vilnius, e-p. [email protected].

Cookie	Duration	Description
_ga	2 years	This cookie is installed by Google Analytics. The cookie is used to collect information about how visitors use our website. The cookie store information anonymously and assign a randomly generated number to identify unique visitors.
_gid	1 day	This cookie is installed by Google Analytics. The cookie is used to store information of how visitors use a website and helps in creating an analytics report of how the website is doing. The data collected including the number visitors, the source where they have come from, and the pages visited in an anonymous form.

Cookie	Duration	Description
__cfduid	1 month	The cookie is set by the CloudFlare service to identify trusted web traffic. It does not correspond to any user id in the web application, nor does the cookie store any personally identifiable information.
_GRECAPTCHA	5 months 27 days	This cookie is set by Google. In addition to certain standard Google cookies, reCAPTCHA is necessary to distinguish humans from bots.
cookielawinfo-checbox-analytics	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-necessary	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-performance	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy	11 months	The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.