Privacy policy

This notice is intended for users of the Lithuanian Data Portal (LDP) of the State Data Agency, dataportal.gov.lt, who visit the LDP, register on it and/or order services provided by the Agency.

This privacy notice applies only to the processing of personal data of LDP users. Information on other personal data processing activities carried out by the State Data Agency may be provided in separate privacy notices.

Who is the controller of users' personal data?

The State Data Agency (legal entity code 188600177, address: Gedimino Ave. 29, LT-01104 Vilnius, Lithuania).

What personal data of users does the State Data Agency process?

1. Registration and profile data

• user's first name and surname;
• email address(es);
• telephone number;
• the fact and date of creation of and joining an organisation, the date on which the information was updated, the reason for rejection, the name and code of the organisation, and the user's role in the organisation.

2. Service order data

The exact scope of personal data processed depends on the type of services used:

• first name, surname, email address and telephone number provided by the customer and/or an employee of their organisation or a third party;
• type of customer (e.g. individual, business, science and studies, public sector);
• selected type of service;
• organisation indicated by the customer and/or an employee of their organisation or a third party;
• other information related to the selected service order provided in the order form (e.g. time series of the requested data, purposes of use, tasks, legal basis);
• favourited and saved datasets and data products, as well as information concerning subscriptions to receive notifications about changes to them (e.g. subscription date, status, cancellation date).

3. Payment data

Where payments are made for services:

• data of the person to whom an invoice is issued and who makes the payment (first name, surname, email address, personal identification number);
• amounts payable and paid;
• payment dates;
• payment status;
• payment method;
• account number;
• payment identification data (e.g. transaction number);
• payment information;
• information contained in payment documents (e.g. invoices);
• other information contained in payment documents (e.g. a copy of a bank transfer).

4. Service administration data

Where services are ordered:

• information on services ordered;
• progress of service provision (e.g. statuses, stages);
• communication with the user (e.g. messages, comments, explanations);
• files uploaded by the user and information about them (e.g. file name, size, format, file content).

5. Security, audit and activity log data

• login and logout events, date and time;
• authentication method (e.g. login via the Electronic Government Gateway or by password) and authentication result (successful or unsuccessful login);
• IP address;
• personal identification number transformed using hashing;
• technical browser and device data (e.g. browser type and version, operating system, device identification information);
• user actions on the platform related to the use of the account and services;
• other technical records necessary to ensure information system security, traceability of activities and investigation of incidents.

6. Newsletter subscription data

• email address;
• subscription topic;
• data relating to consent to receive the LDP newsletter and the validity of such consent (fact, date and time of consent, fact, date and time of withdrawal of consent);
• data relating to newsletter distribution and subscription administration, including subscription status.

Where do users' personal data come from?

Personal data are obtained:

• directly from you when you complete the registration form, log in to the portal (e.g. via the Electronic Government Gateway), subscribe to or unsubscribe from the LDP newsletter, complete a service order form, provide details of an organisation or make payments;
• from your organisation, when it provides your data for the purpose of joining the organisation's account and/or obtaining a service;
• from payment service providers;
• from the Electronic Government Gateway for authentication and login purposes.

For what purposes and on what legal basis are users' personal data processed?

1. Account creation, user identification, access management and provision of ordered services

Personal data are processed for the purposes of creating an account, identifying the user, granting and managing access to the platform, accepting orders for services and providing such services.

The legal basis is:

• Article 6(1)(b) of the GDPR – where personal data are processed for the performance of a service ordered by the user or in order to take steps at the user's request prior to the provision of a service;
• Article 6(1)(e) of the GDPR – where personal data are processed for the purpose of providing public services laid down by law.

2. Administration of payments

Payment data are processed for the purposes of administering payments for services, payment accounting, preparation of accounting documents, calculation of taxes and fulfilment of other financial obligations imposed by law.

The legal basis is:

• Article 6(1)(b) of the GDPR – insofar as the processing relates to the provision of paid services;
• Article 6(1)(c) of the GDPR – where processing is necessary for compliance with a legal obligation to which the controller is subject.

3. Administration of services

Service administration data are processed for the purposes of administering services, communicating with users, ensuring service quality (including the sending of surveys), handling requests and complaints, resolving disputes and ensuring traceability of activities.

The legal basis is:

• Article 6(1)(b) of the GDPR – where personal data are processed for the performance of a service ordered by the user or in order to take steps at the user's request prior to the provision of a service;
• Article 6(1)(e) of the GDPR – where personal data are processed for the purpose of providing public services laid down by law and handling user requests and complaints relating to the provision of such services;
• Article 6(1)(f) of the GDPR – where personal data are processed for the purposes of the legitimate interest in ensuring and improving the quality of services provided, including the sending of service quality surveys.

4. Security, audit and activity logs

Security, audit and activity log data (including login data, platform activity and technical events) are processed for the purposes of ensuring information system security, investigating incidents, preventing unlawful activities, ensuring traceability and preserving evidence.

The legal basis is:

• Article 6(1)(e) of the GDPR – where processing is necessary for the performance of public administration functions and for ensuring information system security.

5. Newsletter distribution

Personal data are processed for the purpose of sending the Agency's newsletter.

The legal basis is:

• Article 6(1)(a) of the GDPR – your consent. Subscription to the newsletter is voluntary; however, in order to receive it, you must provide the personal data necessary for sending the newsletter.

To whom may users' personal data be disclosed?

Your personal data may be disclosed to:

• payment service providers and banks (e.g. Paysera);
• the General Information System for Administration of Accounts (SABIS);
• the National Shared Functions Centre (NBFC);
• IT service providers, including Microsoft, when providing information technology services and using their tools;
• task management systems (e.g. JIRA/Atlassian) and the manufacturers and suppliers providing support for such systems;
• providers of hybrid cloud infrastructure, including the State Cloud (GovCloud) environment (the State Digital Solutions Agency);
• data processors engaged to provide newsletter distribution, subscription administration and related technical services. The SendGrid email delivery service is used to send newsletters, and the email address necessary for newsletter delivery is transferred to this service provider;
• the Document Management General Information System (DBSIS);
• courts, pre-trial investigation authorities, supervisory authorities and other controllers where required by law or where such disclosure is necessary and proportionate for legitimate purposes.

Are personal data transferred outside the European Union/European Economic Area (EU/EEA)?

When using information technology services provided by certain service providers, personal data may be transferred to or otherwise processed outside the EU/EEA.

Such transfers are carried out in accordance with the requirements of Chapter V of the General Data Protection Regulation and subject to lawful data transfer safeguards, such as an adequacy decision adopted by the European Commission or Standard Contractual Clauses.

How long will users' personal data be processed?

Your personal data will be processed for 2 years following the date on which the last service was provided.

Payment data will be retained and processed for 10 years following the payment date.

Security, audit and activity log data will be retained for 2 years from the date on which they were created, unless a longer retention period is necessary due to an ongoing incident investigation, judicial proceedings or requirements laid down by law. Thereafter, personal data will be anonymised.

Personal data contained in accounts that remain inactive for 2 years (i.e. where the user does not log in) will be deleted after 2 years of inactivity.

If you subscribe to the LDP newsletter, the Agency will retain your personal data for the duration of your consent, until you withdraw it. Once you unsubscribe from the newsletter, your personal data will be deleted immediately.

What technical and organisational measures are used to protect users' personal data?

In order to ensure the security, confidentiality, integrity and availability of the personal data processed, the Agency applies appropriate technical and organisational data protection measures.

Such measures include, inter alia:

• access controls for personal data (user authentication and management of access rights);
• data encryption and secure data transmission;
• monitoring of information systems and their operation and measures for detecting incidents;
• implementation of the principles of data minimisation and limitation of storage periods;
• protection of systems and data against unauthorised access, loss, disclosure or destruction.

The measures are reviewed regularly and updated where necessary, taking into account technological developments, identified risks and legal requirements.

What rights do users have and how can they exercise them?

Users, as data subjects, are entitled to:

• the right to obtain information about the processing of their personal data;
• the right of access to their personal data;
• the right to request rectification of their personal data;
• the right to request erasure of their personal data ("the right to be forgotten");
• the right to restrict the processing of their personal data;
• the right to object to the processing of their personal data;
• the right to withdraw consent at any time where personal data are processed on the basis of consent. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal;
• the right to lodge a complaint concerning the Agency's actions or failure to act with the State Data Protection Inspectorate or the Regional Administrative Court.

You may discontinue using the LDP and request that your personal data no longer be retained at any time, provided that the retention of such data is not necessary for the performance of a contract or provision of a service.

You may withdraw your consent to receive LDP newsletters by:

• clicking the "Unsubscribe from newsletter" link in an email message received from the Agency;
• contacting the State Data Agency by email at [email protected] and requesting removal from the newsletter recipient list, indicating the email address used to subscribe to the newsletter.

The procedure for exercising the rights referred to above is laid down in the State Data Agency's Rules on the Exercise of Data Subjects' Rights, published on the Agency's website: https://vda.lrv.lt/lt/asmens-duomenu-apsauga/asmens-duomenu-apsauga-vda/.

Data Protection Officer

For questions relating to the processing of personal data and the exercise of data subject rights, you may contact the Data Protection Officer of the State Data Agency by email at [email protected].

If you believe that the State Data Agency, when processing your personal data, has infringed the requirements of legislation governing the protection of personal data, you have the right to lodge a complaint with the State Data Protection Inspectorate at L. Sapiegos St. 17, Vilnius, by email at [email protected], or via its website at vdai.lrv.lt.

However, before lodging a complaint, we recommend that you first contact the Data Protection Officer of the State Data Agency at [email protected] so that we can examine and respond to any questions you may have.