PRINCIPLES OF PERSONAL DATA PROCESSING
Effective from July 1, 2019
These Principles of Personal Data Processing (hereinafter referred to as the Principles) provide information on how “Startup Platform” processes personal data.
These Principles apply to the relationships between “Startup Platform” members, their representatives, and other persons who use, have used, have expressed intent to use, or are otherwise related to the services provided by the “Startup Platform.”
1. DEFINITIONS
- Startup Platform – a public institution “Startup Platform”, company code 305160232, which acts as a personal data controller.
- Member – any individual who uses, has used, or has expressed intent to use the services provided by the “Startup Platform.”
- Related person – an individual who is a representative or participant of a “Startup Platform” member that is a legal entity, or any other person connected with the services provided by the “Startup Platform” (e.g., visitor, guest, event participant, coordinator, speaker, mentor).
- Personal Data – any information directly or indirectly related to a Member and/or Related person.
- Processing – any operation performed on Personal Data (including collection, recording, storage, modification, access provision, inquiry submission, transfer, etc.).
- Swedbank Group – a limited liability company established in Sweden, Swedbank AB (publ.) and all legal entities directly or indirectly controlled by Swedbank AB (publ.) (subsidiaries). The list of Swedbank Group companies and branches in Lithuania is available online at www.swedbank.lt.
2. PERSONAL DATA PROCESSED BY “STARTUP PLATFORM”
Categories of personal data processed by “Startup Platform” regarding Members and Related persons:
- Identity data, such as – name, surname, personal code, date of birth.
- Contact data, such as – address, telephone number, email address.
- Data related to the Member’s/Related person’s activities – data related to the Member’s/Related person’s business or professional activities.
- Data related to the execution of the service contract, such as – services ordered and provided to the Member, information regarding the execution of the contract with the Member/Related person, information about payments for services.
- Data on interests and preferences – data on participation in “Startup Platform” events, provided feedback, and evaluations.
- Data collected using communication and other technical means, such as – data collected when visiting “Startup Platform” service provision locations (entry into premises and video surveillance data) or during communication via email, messages, and other communication channels, such as social networks; also, data related to visits to the “Startup Platform” websites or the use of other communication channels.
- Data obtained and/or created while fulfilling legal requirements, such as – data obtained in response to inquiries from law enforcement agencies, notaries, tax authorities, courts, or bailiffs, or data created in response to such inquiries.
- Data related to the evaluation of the Member’s and their activities’ reliability, such as – data necessary for the “Startup Platform” to assess the possibility of the Member’s membership in the “Startup Platform,” such as data on the Member’s property origin and business partners.
3. PURPOSES AND LEGAL GROUNDS FOR PERSONAL DATA PROCESSING
Personal data is processed for the purpose of: 3.1. Evaluating the possibility of a person’s membership in the “Startup Platform” and concluding a service contract with the Member;
Personal data processing for this purpose is based on the necessity to process data to perform the contract to which the Member is a party or to take steps at the request of the Member prior to entering into a contract.
The personal data of related persons who are representatives is processed to ensure the legitimate interest of the “Startup Platform” in concluding a service contract with the represented person.
3.2. Maintaining relationships with Members and Related persons and ensuring access to the services provided by the “Startup Platform”;
Personal data processing for this purpose is based on the necessity to process data to perform the contract to which the Member or Related person (e.g., mentor) is a party or to take steps at the request of the Member/Related person prior to entering into a contract.
The personal data of related persons who are representatives is processed to ensure the legitimate interest of the “Startup Platform” in providing services to the represented persons.
3.3. Protecting the interests of the “Startup Platform” and others: ensuring the safety of the “Startup Platform” and/or the Member and Related persons, and protecting the property of the “Startup Platform” and the Member (e.g., video surveillance and recording).
3.4. Submitting, executing, transferring, or defending legal claims;
Personal data processing for this purpose is based on the legitimate interest of the “Startup Platform” in defending its legal claims or responding to them, and the necessity to process Personal Data to fulfill a legal obligation applicable to the “Startup Platform.”
3.5. Fulfilling legal requirements;
Personal data processing for this purpose is based on fulfilling legal obligations applicable to the “Startup Platform.”
3.6. Preventing abuse of services, violations of “Startup Platform” internal rules, and other illegal activities;
Personal data processing for this purpose is based on the legitimate interest of the “Startup Platform” to ensure compliance with internal rules, prevent abuse, and illegal activities.
3.7. Performing direct marketing: offering services and seeking feedback;
Personal data processing for this purpose is based on the consent of the person receiving such direct marketing communications.
3.8. Improving the quality of provided services and developing new services;
Personal data processing for this purpose is based on the legitimate interest of the “Startup Platform” to improve the quality of services and activities.
4. PERSONAL DATA RECIPIENTS
Personal data may be provided/received for the purposes mentioned above to: 4.1. State authorities and institutions, and other persons performing functions assigned to them by law (e.g., law enforcement or tax authorities); 4.2. Legal entities within the Swedbank Group; 4.3. Persons performing audits or providing legal and financial consultations to the “Startup Platform”; 4.4. Third parties managing registers (including the State Enterprise Centre of Registers managing the Population Register, Register of Legal Entities, etc.); 4.5. Debt collection companies, to whom claims regarding the Member’s debt are transferred, courts, non-judicial dispute resolution bodies, and bankruptcy administrators; 4.6. Persons engaged in startup promotion activities; 4.7. Personal data processors engaged by the “Startup Platform,” such as document archiving, printing, IT system maintenance, physical and technical security, marketing, and event organization service providers.
5. SOURCES OF PERSONAL DATA
Personal data is obtained directly from the Member or Related persons, such as when representing the Member, as well as from public registers listed in Section 4.4. Personal data may also be provided by third parties, such as law enforcement agencies or tax authorities, in performing their legal duties.
6. RETENTION PERIOD FOR PERSONAL DATA
Personal data of Members and Related persons who are representatives is processed for no longer than 10 years after the end of the business relationship with the Member. Personal data of Related persons, such as mentors and coordinators, is processed for no longer than 10 years after the end of the business relationship with the Related person. Personal data of visitors, guests, and event participants is processed for no longer than 90 days, while personal data related to participation in events or other activities organized by the “Startup Platform” is processed for no longer than 1 year.
7. PROFILING AND PERSONALIZED OFFERS
7.1. The “Startup Platform” performs profiling, i.e., processes Personal Data automatically to evaluate certain personal characteristics of the Member, and to analyze or predict, for example, the person’s choices, interests, determine the mode, nature, or field of activity. Profiling is used for analysis for direct marketing purposes. Such profiling is based on the Member’s consent.
7.2. If the Member has given consent to process Personal Data for direct marketing purposes, the “Startup Platform” may process Personal Data to provide general and personalized offers for services provided by the “Startup Platform.”
7.3. The “Startup Platform” ensures that the Member can withdraw consent for the processing of Personal Data for direct marketing purposes, including profiling, at any time.
8. RIGHTS OF MEMBERS AND RELATED PERSONS (AS DATA SUBJECTS)
Members and Related persons have the right to:
- Request the correction of their Personal Data if it is incorrect, incomplete, or inaccurate.
- Object to the processing of their Personal Data when the processing is based on the legitimate interest of the “Startup Platform” or a third party.
- Request the deletion of their Personal Data, processed based on their consent, when the data subject withdraws the relevant consent. This right does not apply if the Personal Data in question is processed on another legal basis.
- Restrict the processing of their Personal Data, for example, during the period when the “Startup Platform” evaluates whether the data subject has the right to request the deletion of their Personal Data.
- Obtain information about whether the “Startup Platform” processes their Personal Data and, if so, to access it.
- Receive the Personal Data provided to the “Startup Platform,” which is processed based on their consent or for the purpose of performing a contract, in a commonly used computer-readable format, to transfer it to another data controller.
- Withdraw their consent for the processing of Personal Data.
- Submit a complaint to the State Data Protection Inspectorate, whose website address is www.vdai.lrv.lt, if the data subject believes that their Personal Data is being processed in violation of their rights and legitimate interests.
9. CONTACT INFORMATION
9.1. Members and Related persons have the right to contact the “Startup Platform” to submit inquiries, withdraw consents, submit requests for the exercise of data subject rights, and complaints regarding the processing of Personal Data.
9.2. The contact details of the “Startup Platform” are published on the “Startup Platform” website www.rockitvilnius.com.
10. VALIDITY AND AMENDMENTS OF THE PRINCIPLES
10.1. Members and Related persons can familiarize themselves with these Principles on the “Startup Platform” website www.rockitvilnius.com.
10.2. The “Startup Platform” reserves the right to unilaterally amend these Principles at any time, informing Members and Related persons about the amendments by publishing them on the “Startup Platform” website and/or informing Members and Related persons by mail, email, or other means (e.g., by publishing in the press) no later than 30 calendar days before such amendments take effect.