General provisions
SE Lietuvos Airports, legal entity code 120864074, registered office address: Rodūnios kelias 10A, Vilnius, Lithuania, tel. No.: +37061244442, e-mail: (hereinafter - Lithuanian Airports) understands that the protection of personal data is important for our customers, suppliers, partners and other persons (hereinafter - data subjects) who cooperate or use the services of Vilnius, Kaunas or Palanga branches of Lithuanian Airports. For this reason, we take all necessary measures to ensure the privacy of each data subject and the exercise of personal data protection rights.
You can contact our appointed Personal Data Protection Officer on all data protection issues by e-mail.
This Privacy Notice provides all information about how we, as Data Controllers, process personal data, including information about the purposes of the processing of personal data and the legal basis, what data is collected and further processed, how long it is stored, to whom it is provided, what rights you have and where you can ask about their implementation or any other issues related to the processing of personal data.
The Privacy Notice applies to natural persons who cooperate with or use the services of any of all three branches of Lithuanian Airports (Vilnius, Kaunas and Palanga), visit our websites, social network accounts, or provide data to us for other purposes.
Our employees and members of the management body are informed about the processing of their personal data in accordance with the procedure established in the internal legal acts of Lithuanian Airports.
The Privacy Notice is prepared in accordance with the following legislation:
This Privacy Notice is an integral part of the data protection policy approved by Lithuanian Airports.
How do we collect your data?
Depending on the nature of our cooperation, we process personal data as follows:
For what purposes and what personal data do we process?
|
Purpose of data processing |
Legal basis for processing |
Data categories |
Duration of data storage |
|
Execution of contracts with suppliers, (sub)contractors |
Article 6(1) clause b of GDPR - performance of the contract |
Name, surname, personal identification number, date of birth, contact telephone, e-mail, address of representatives of suppliers, (sub)contractors. Name, surname, position, e-mail address, telephone number of the person signing the contract |
10 years after the end of the specific contract |
|
Administration of invoices from suppliers and (sub)contractors |
Article 6(1) clause c of GDPR - legal obligation |
Name, surname, position, address, e-mail address, telephone number |
10 years |
|
Training and information for natural persons, non-airport staff working on airport premises |
Article 6(1) clause c of GDPR - legal obligation |
Company, name, surname, e-mail, telephone number |
3 years |
|
Issuing permanent permits |
Legal obligation Article 6(1) clause c of GDPR |
Name, surname, personal identification number, nationality, telephone number, e-mail address, information on place of residence registered for the last 5 (five) years, place of work, reasons for unemployment, statements, confirmations, information on the functions for which the permit is required, name of the company, position, and confirmation of the accuracy of the personal data, criminal record, criminal convictions, date, certificates from third countries concerning good reputation, name of regime zone, reasons for permanent permit, name of training, date of completion of training, information on who carried out the training, make, model, registration number of the vehicle, owner of vehicle |
5 years |
|
Issuing temporary permits |
Legal obligation Article 6(1) clause c of GDPR |
Name, surname, information contained in the identity document (number, expiry date), e-mail, date of birth, telephone number, name of the company where the person is employed, period of time for which the temporary permit is issued, name of the area where the temporary permit is to be issued, the name of the employee of the company/establishment responsible for the person to whom the temporary permit is applied for and the name of the company, the name of the person accompanying the temporary permit holder, the make, model and registration number of the vehicle, and the name of the driver. |
6 months |
|
Issuing permits for driving motor vehicles |
Article 6(1) clause c of GDPR - legal obligation |
Driving licence number, name, surname, medical details, e-mail address and telephone number |
6 months |
|
Issuing permits for drone flights |
Article 6(1) clause c of GDPR - legal obligation |
Pilot’s licence number, telephone number, name, name of the customer |
5 years |
|
Authorisations to apply for permanent residence permits and permanent vehicle permits |
Article 6(1) clause c of GDPR - legal obligation |
Name, surname, position, e-mail, telephone number, specimen signature |
5 years |
|
Receipt of requests to be registered on the list of entities operating in the controlled area |
Article 6(1) clause c of GDPR - legal obligation |
Name, surname, position, date |
5 years |
|
Registration of media representatives for access to the Airport area |
Article 6(1) clause c of GDPR - legal obligation |
Company, name, surname, e-mail |
5 years |
|
Managing applications for tour groups |
Article 6(1) clause a of GDPR - consent |
Name, surname, personal identification number, date of birth of excursion participants |
1 year |
|
Video surveillance, implementation of aviation security measures, protection of Lithuanian airports’ assets and crime prevention |
Article 6(1) clause f of GDPR - legitimate interest, Article 6(1) clause c of GDPR - legal obligation |
Image, voice, other data visible in the video |
30 days |
|
Passenger screening for aviation security |
Article 6(1) clause c of GDPR - legal obligation |
Name, surname, flight number, flight time |
24 hours |
|
Recording telephone conversations for quality assurance purposes |
Article 6(1) clause f of GDPR - legitimate interest |
Call metadata: voice, time, duration, phone number, call content |
6 months |
|
Administration of damages, insured events |
Article 6(1) clause c of GDPR - legal obligation, Article 6(1) clause f of GDPR - legitimate interest |
Name, surname, personal identification number, information on damaged property, information provided by insurance company and aviation company |
10 years |
|
Carrying out direct marketing |
Article 6(1) clause a of GDPR - consent |
Name, surname, e-mail, telephone number, age, purpose of travel |
Until consent is withdrawn |
|
Sending newsletters |
Article 6(1) clause a of GDPR - consent |
|
Until consent is withdrawn |
|
Organisation of lotteries |
Article 6(1) clause f of GDPR - legitimate interest, Article 6(1) clause a of GDPR - consent |
Participants’ social account details, winner's e-mail, telephone number, address for delivery of winnings |
Until the end of the lottery |
|
Administration of Lithuanian Airports’ websites and social networks |
Article 6(1) clause f of GDPR - legitimate interest |
Opinions and comments on social networks, name, surname, nickname |
Opinions and comments posted on social networks are not deleted |
|
Information collected by cookies |
Article 6(1) clause a of GDPR - consent |
The specific information collected by cookies can be found in the cookie management window |
The duration of the activity of specific cookies can be found in the cookie management window |
|
Dealing with passenger enquiries, complaints and sharing their experiences |
Article 6(1) clause b of GDPR - performance of the contract, Article 6(1) clause a of GDPR - consent |
Name, surname, e-mail, telephone number, flight details, damage suffered, bank account number and other information provided by the passenger |
6 months |
|
Provision of services to very important persons, as provided for in the internal regulations of Lithuanian airports |
Article 6(1) clause b of GDPR - performance of the contract |
Name, date of arrival/departure, time, flight number, airport of departure/arrival, name of the person(s) picking up/dropping off the passengers, information on the vehicle(s) picking up/dropping off the passenger(s), their model, registration number(s) |
6 months |
|
Participation in the Lithuanian Airports Privilege Programme - Privilege Card |
Article 6(1) clause a of GDPR - consent |
Name, surname, date of birth, e-mail, telephone number, address, visit history |
1 year after expiry of the privilege card |
|
Business Club administration |
Article 6(1) clause b of GDPR - performance of the contract |
Name, surname, flight number, class, loyalty card number, flight time |
3 months |
|
Fast Track service |
Article 6(1) clause b of GDPR - performance of the contract |
Action records - Passenger's passage date, time, airline, name, surname |
3 months |
|
Administration of user accounts and orders for the e-shop VNO.lt/e-shop.lt |
Article 6(1) clause b of GDPR - performance of the contract |
Name, surname, telephone number, e-mail, address. |
5 years since the last active actions on your account |
|
Provision of parking services |
Article 6(1) clause b of GDPR - performance of the contract |
Name, surname, e-mail, vehicle registration number, photo, traffic accident information, parking time, date |
10 years |
|
Conducting public property auctions |
Article 6(1) clause b of GDPR - performance of the contract |
Name, surname, personal identification number, address, telephone number, e-mail, name, surname, telephone number, e-mail of the authorised person, payment order details |
10 years |
|
Keeping records of services provided |
Article 6(1) clause c of GDPR - legal obligation |
Name, surname, position, address, e-mail address, telephone number |
10 years |
|
Debt administration |
Article 6(1) clause f of GDPR - legitimate interest |
Name, surname, personal identification number, amount of debt |
5 years, from the date of repayment of the debt |
|
Selection of candidates for vacant positions |
Article 6(1) clause a of GDPR - consent, Article 6(1) clause f of GDPR - legitimate interest |
Name, surname, telephone number, e-mail, CV data, motivational letter |
If no consent has been obtained, until the end of the selection process If consent is given - 6 months. |
|
Selection of candidates for vacant positions |
Article 6(1) clause f of GDPR - legitimate interest |
Content of the recording of the job interview (oral test) |
1 year |
|
Purpose of recruitment of candidates |
Article 6(1)(C) of the GDPR - legitimate interest for the purpose of compliance with a legal obligation to which the controller is subject, and Article 6(1)(A) of the GDPR - consent (in the case of a check pursuant to the Law on the Protection of Objects of Importance to Ensuring National Security), and in accordance with Appendix 11.1 of the EC Regulation 1998/2015 |
Name, surname, personal number, date of birth, residence history for the last 5 years, employment history for the last 5 years, phone number, e-mail, ID document information (type, number, validity, copy), photograph, nationality, education, information on whether the person has been recognised as incapacitated or as having limited capacity in any field or is subject to compulsory medical measures, whether the person has been registered in a health care institution for alcoholism or drug addiction in the last 3 years, whether the person has a history of mental disorders and any other information provided by the competent authorities |
3 years from the end of employment |
|
Authorisation of unescorted access to the aerodrome for employees of contractors/subcontractors/suppliers |
Article 6(1)(C) of the GDPR - legitimate interest for the purpose of compliance with a legal obligation to which the controller is subject, and Article 6(1)(A) of the GDPR - consent (in the case of a check pursuant to the Law on the Protection of Objects of Importance to Ensuring National Security) |
Name, surname, personal number, date of birth, information on whether the person has been recognised as incapacitated or as having limited capacity in any field or is subject to compulsory medical measures, whether the person has been registered in a health care institution for alcoholism or drug addiction in the last 3 years, whether the person has a history of mental disorders and any other information provided by the competent authorities |
1 year |
|
Managing the working relationship between the members of the audit committee and the members of management |
Article 6(1) clause a of GDPR - consent, Article 6(1) clause f of GDPR - legitimate interest |
Name, surname, telephone number, e-mail, salary, length of service, list of related persons (board members and audit committee). Contract, personal identification number, address, bank account, hours worked, total hours |
10 years |
|
Event organisation |
Article 6(1) clause a of GDPR - consent |
Company name, position, name, surname, e-mail address, telephone number |
6 months |
|
Keeping records of authorisation of the airports’ users‘ committee |
Article 6(1) clause c of GDPR - legal obligation |
Name, surname, enterprise/company, position, personal identification number, duration of authorisation |
10 years |
How do we protect your data?
Lithuanian Airports have implemented proper technical and organizational measures to ensure an appropriate level of security in data processing. We guide the selection and implementation of the technical and organizational measures to ensure the security of data processing:
To whom do we provide your data?
Lithuanian Airports uses only those data processors that ensure compliance with the GDPR and the same level of personal data security as set out in our personal data protection policy.
Here is a list of categories of data recipients at Lithuanian Airports:
Do we provide your data outside the European Union and the European Economic Area?
We ensure that your data is processed in accordance with the requirements and standards established by the legal acts of the European Union and we inform you that your data is processed only within the European Union and the European Economic Area.
Consequences of non-submission
You have the right to refuse to provide your personal data, but the provision of your personal data is necessary and mandatory for the purposes set out in this Privacy Notice, so if you do not provide your personal data, we will not be able to achieve the purposes listed.
What rights do you have and how can you exercise them?
In accordance with the provisions of the GDPR, you, as a data subject, can exercise these rights:
1. The right of access to personal data. I.e. to submit a request for information on whether your personal data is processed, and if personal data is processed, you have the right to access your processed personal data.
2. The right to correct personal data. I.e. to submit a request to correct your personal data if you find that the personal data we process is incorrect, incomplete or inaccurate.
3. The right to delete data (a right “to be forgotten”). I.e. to request the deletion of your personal data if you believe that your data has been processed illegally or fraudulently.
4. The right to restrict data processing. I.e. to make a request to restrict (suspend) the processing of your personal data, except for storage - in case, for example, you request the rectification of your personal data (while the accuracy of personal data is checked and / or corrected), if it is established that personal data is processed unlawfully and you do not consent to the deletion of the data and you have expressed your consent to the processing of your personal data, etc.
5. The right to data transfer. I.e. to submit a request to transfer your personal data, which is processed by automated means, to you and / or another data controller in a systematic, commonly used and computer-readable format.
6. The right to object to data processing. I.e. to object to the processing of personal data where the processing is carried out on a legal basis or on a legal basis in the public interest.
7. The right to request that you are not subject only to a decision based on automated data processing, including profiling, which has legal consequences for you or which has a significant effect on you in a similar way;
8. The right to withdraw a consent given to us at any time, with regard to the processing of personal data, for example for direct marketing.
You can exercise your rights:
The request must be legible, signed, state the name, address and other details of the data subject in the desired form of communication, information on which of the data subject's rights and to what extent the data subject wishes to exercise.
We will provide a response to your request no later than within 30 (thirty) calendar days from the date of receipt of the request. In exceptional cases requiring additional time, we will, after notifying you, have the right to extend the deadline for submission of the requested data or examination of other requirements specified in your request to 60 (sixty) calendar days from the date of your request.
Where can you submit questions regarding personal data?
If you have any questions regarding the information provided in this Privacy Notice or the protection of your personal data and the exercise of your rights at Lithuanian Airports, please contact our data protection representative in any way convenient for you:
If a solution that is suitable for both parties cannot be found, you have the right to contact the State Data Protection Inspectorate at the address: L. Sapiegos str. 17, Vilnius.
Cookies
A cookie is a small text file that a website saves in the browser of your computer or mobile device when you visit the website. It allows your website to "remember" your actions and options (such as registration name, language, font size, and other display options) for a period of time so that you don't have to re-enter them each time you visit the site or browse its various pages.
The information collected by cookies allows us to ensure that you can browse more conveniently, as well as learn more about the behavior of website users, analyze trends and improve the website.
You can find out what cookies are used on this page and how to manage them in the cookie control panel of each page.
Final provisions of the Privacy Notice
The Privacy Notice is adjusted at the discretion of the Data Controller or in the event of a change in the requirements of applicable legislation.
The current version of the Privacy Notice is published on the website, so it is recommended that you read the latest version.
Latest version: 07-04-2022.