Privacy Policy
1. What does this Privacy Policy mean?
This privacy policy (hereinafter the Privacy Policy) explains how EKSMA Optics, UAB (hereinafter the Company, we or us) processes your personal data for the purposes specified in this Privacy Policy and provides information about your rights and how to exercise them. Any person whose personal data is processed by the Company is hereinafter referred to as a Data Subject.
2. About the controller
Legal entity code: 300624547
Registered office address: Dvarčionių St. 2B, LT-10233 Vilnius, Lithuania
Email address: info@eksmaoptics.com
3. What is personal data?
Personal data means any information about a person collected by the Company that may be used to identify that person and that is stored electronically or in another form.
Personal data includes any information, including a person's first name, surname, address and IP address, that the Company collects for the purposes specified in this Privacy Policy or in a separate consent or agreement with the Company.
This also includes publicly available personal data that the Company may obtain when you contact it through social media or interact with its social media accounts.
When processing personal data, the Company complies with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (GDPR), the Law of the Republic of Lithuania on Legal Protection of Personal Data, the Law of the Republic of Lithuania on Electronic Communications, and other legislation governing the protection of personal data.
Below you can learn how we process your personal data: what personal data we process, the purposes for which we process it, how long we retain it, and what rights you have.
4. What rights do you have and how can you exercise them?
This section provides information about your rights in relation to our processing of your personal data and the circumstances in which you may exercise those rights. If you would like more information about your rights or wish to exercise them, please contact us at the email address specified in this Privacy Policy.
The Company will provide you with information on the action taken in response to your request to exercise your rights without undue delay and no later than 1 (one) month after receipt of the request. Taking into account the complexity and number of requests, this period may be extended by a further 2 (two) months. In that event, we will inform you of the extension and the reasons for it within 1 (one) month after receipt of the request. The Company will refuse to give effect to your rights only in the circumstances provided for by law.
4.1. Right of access to your personal data
We want you to understand fully how we use your personal data and not to experience any inconvenience as a result. We first provide information about how we process your personal data in this Privacy Policy (the right to be informed). You may contact us at any time to ask whether we process any of your personal data. If we retain or use your personal data in any way, you have the right to access it. To do so, submit a written request to the email address specified in this Privacy Policy and verify your identity (where such verification is required in the particular case).
4.2. Right to withdraw consent
If you have given us your explicit consent to the processing of your data, you may withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
4.3. Additional rights
Below we provide information about your additional rights, which you may exercise in accordance with the procedure described below.
4.3.1. You have the right to ask us to rectify any inaccuracies in the data we hold. In that event, we may ask you to verify the corrected information.
4.3.2. You have the right to ask us to erase your personal data. This right may be exercised in the circumstances provided for in Article 17 of the GDPR.
4.3.3. You have the right to ask us to restrict the processing of your personal data or not to process it:
- for the period needed to verify the accuracy of your personal data where you contest its accuracy;
- where our collection, retention or use of your personal data is unlawful, but you choose not to request its erasure;
- where we no longer need your personal data, but you need it for the establishment, exercise or defence of legal claims;
- for the period needed to determine whether our legitimate grounds for continuing to process your personal data override your interests where you have exercised your right to object to the processing.
4.3.4. You have the right to data portability in respect of data processed by automated means that we received from you, on the basis of your consent or for the purpose of entering into a contract, in a structured, commonly used and machine-readable format. If you exercise this right, at your request we will transmit a copy of the data you provided to you or to a controller of your choice.
4.3.5. You have the right to object to our use of your personal data in accordance with Article 21 of the GDPR. You have the right to object where your personal data is processed on the basis of legitimate interests (the legal basis for processing is stated alongside each processing purpose specified in the Privacy Policy) or for direct marketing purposes.
4.4. Right to request further information
We hope you understand that it is very difficult to address every possible method of collecting and using personal data. We strive to provide information that is as clear and comprehensive as possible and undertake to update this Privacy Policy when the way in which personal data is used changes. Nevertheless, if you have any questions about the use of your personal data, we will be pleased to answer them or provide any further information that we are able to disclose. If you have any specific questions or do not understand the information provided, please contact us.
5. Processing of personal data when using the online store
Purpose of processing | Personal data | Legal basis | Retention period | Other remarks |
Creation of an online store account, confirmation of registration, and account administration | First name Surname Email address Password Order history information | Article 6(1)(b) of the GDPR (contract) | 1 year after the last login | No data recipients are envisaged |
Issuing a VAT invoice | First name Surname Address (country, city, postcode, street address) Information about goods purchased (name, quantity, price) Organisation represented (when acting on behalf of an organisation) | Article 6(1)(c) of the GDPR (Article 80(1) of the Law of the Republic of Lithuania on Value Added Tax) | 10 years | Data recipient: the processor providing the system used by the Company to manage VAT invoices |
IT system security and protection against automated programs (bots), spam and abuse, and ensuring the security of the website and its users (use of CAPTCHA) | IP address Browser and device information User behaviour on the website (mouse movements and clicks), date and time | Article 6(1)(f) of the GDPR (legitimate interest in ensuring website security and protection against abuse) | Until the request has been checked (whether you are human) | Data recipient - processor: Google LLC |
Purchase and sale of goods (order fulfilment) | If you are purchasing as a natural person: First name Surname Address Contact details (telephone number, email address) Information about the goods purchased (name, quantity, price) | Article 6(1)(b) of the GDPR (entering into and performing a contract) | For the period during which the contract is entered into and performed
We will retain personal data for a longer period (10 years after the contract expires) only to comply with an archiving obligation (Article 6(1)(c) of the GDPR) for archiving purposes or for the purpose of defending the Company's rights and legitimate interests (Article 6(1)(f) of the GDPR) | Data recipients - controllers:
Data recipients - processors: Company providing IT consulting services
|
If you are a representative of the buyer (a legal person): First name Surname Organisation represented Business contact details | Article 6(1)(f) of the GDPR (legitimate interest in entering into and performing contracts with legal persons) |
6. Processing of customers' personal data when goods are purchased outside the online store
Purpose of processing | Personal data | Legal basis | Retention period | Other remarks |
Entering into contracts with customers (natural persons) and providing services | First name Surname Contact and identification data (telephone number, email address, address, personal identification number or date of birth) Information on whether the Data Subject is registered for VAT Payment data for goods (payment currency, bank, bank account number, payment method, payment term, etc.) Goods purchased, price of the goods, delivery address Signature in the contract and other related documents | Article 6(1)(b) of the GDPR (contract with the Data Subject) | For the period during which the contract is entered into and performed
We will retain personal data for a longer period (10 years after the contract expires) only to comply with an archiving obligation (Article 6(1)(c) of the GDPR) for archiving purposes or for the purpose of defending the Company's rights and legitimate interests (Article 6(1)(f) of the GDPR) | Data recipients - controllers:
Data recipients - processors: Company providing IT consulting services
|
Entering into contracts with customers (legal persons) and providing services | First name Surname Position Name of employer Details of representative status (authorisation number and date) Business telephone number and business email address Communications with representatives of the counterparty regarding performance of the contract Signature in contracts and other contract-related documents | Article 6(1)(f) of the GDPR (legitimate interest in entering into and performing a contract with customers that are legal persons) | For the period during which the contract is entered into and performed
We will retain personal data for a longer period (10 years after the contract expires) only to comply with an archiving obligation (Article 6(1)(c) of the GDPR) for archiving purposes or for the purpose of defending the Company's rights and legitimate interests (Article 6(1)(f) of the GDPR) | Data recipients - processors: Company providing IT consulting services Microsoft Ireland Operations Limited |
7. Administration of customer enquiries received through distributors, communication with distributor representatives, and performance of distribution agreements
Category of Data Subject | Personal data | Legal basis | Retention period | Other remarks |
Representatives of the distributor's customers (legal persons) | First name Surname Distributor's customer represented and business contact details | Article 6(1)(f) of the GDPR (the Company's legitimate interest in entering into and performing distribution agreements) | For the period during which the contract is entered into and performed
We will retain personal data for a longer period (10 years after the contract expires) only to comply with an archiving obligation (Article 6(1)(c) of the GDPR) for archiving purposes or for the purpose of defending the Company's rights and legitimate interests (Article 6(1)(f) of the GDPR) | The data is obtained from the distributor
Data recipients - processors: Company providing IT consulting services
|
Representatives of the distributor | First name Surname Business contact details | Article 6(1)(f) of the GDPR (the Company's legitimate interest in entering into and performing distribution agreements) | For the period during which the contract is entered into and performed
We will retain personal data for a longer period (10 years after the contract expires) only to comply with an archiving obligation (Article 6(1)(c) of the GDPR) for archiving purposes or for the purpose of defending the Company's rights and legitimate interests (Article 6(1)(f) of the GDPR) | The data is obtained from the distributor Data recipients - processors: Company providing IT consulting services
|
8. Information on the processing of personal data for purposes related to purchasing goods or services from other persons
Purpose of processing | Personal data | Legal basis | Retention period | Other remarks |
Entering into and performing contracts with suppliers that are natural persons (counterparty data) | First name, surname, personal identification number and address of the service provider who is a natural person; number of the service provider's business certificate/individual activity certificate; bank account number; and personal data specified in documents relating to performance of the contract. | Article 6(1)(b) of the GDPR (contract) | For the term of the contract
We will retain personal data for a longer period (10 years after the contract expires) only to comply with an archiving obligation (Article 6(1)(c) of the GDPR) for archiving purposes or for the purpose of defending the Company's rights and legitimate interests on the basis of the Company's legitimate interests (Article 6(1)(f) of the GDPR) | Data recipients: electronic signature service providers and processors engaged by the Company that provide the Company with systems for processing your personal data.
|
Entering into and performing contracts with suppliers that are legal persons (data of counterparties and persons associated with them) | First name, surname, position, basis of representation, email address, telephone number, and content of correspondence | Article 6(1)(f) of the GDPR (legitimate interests) | For the term of the contract
We will retain personal data for a longer period (10 years after the contract expires) only to comply with an archiving obligation (Article 6(1)(c) of the GDPR) for archiving purposes or for the purpose of defending the Company's rights and legitimate interests (Article 6(1)(f) of the GDPR) | Data recipients: electronic signature service providers and processors engaged by the Company that provide the Company with systems for processing your personal data. We may obtain the data directly from you, your employer, or the person who authorised you.
|
9. Recruitment
During the recruitment process, we collect and process the following personal data for recruitment purposes on the basis of your consent: current employer, email address, date of birth, address, education, surname, telephone number, first name, position sought, date of receipt of your CV, information about your personal qualities, work experience (most recent employer, length of service with that employer, positions held and other work experience), foreign-language proficiency (language and reading, writing and speaking levels), ability to use computer software, other information provided in your CV, reference and/or cover letter, and salary expectations. You give your consent by sending your CV and/or cover letter to the Company or its service provider, or by completing an application form on the website. If you do not provide your CV and/or cover letter, we will be unable to assess your suitability for the position offered.
With your consent, we will contact your current employer. We will contact your former employer on the basis of our legitimate interest in selecting a suitable candidate and Article 5(3) of the Law of the Republic of Lithuania on Legal Protection of Personal Data in order to verify information about your qualifications, professional abilities and work-related qualities (for example, work results, relationships with clients and/or colleagues, performance evaluations, etc.). On the basis of our legitimate interest in selecting a suitable candidate, we will also collect information from publicly available professional social media profiles. You may withdraw your consent at any time or, as applicable, object to our contacting your former employer by notifying us at the email address specified in Section 2 of the Policy.
When a particular recruitment process has ended, we undertake to erase and/or destroy your personal data within 3 business days after an agreement is signed with the selected candidate or a decision is made to end the recruitment process.
On the basis of our legitimate interest, for recruitment purposes we will process data relating to a person identified by a candidate (first name, surname, email address, telephone number and information provided by that person), namely a former or current employer or a person providing a reference, and the information provided by that person. In this case, our legitimate interest is to select a suitable candidate for the position. We will destroy this data within 3 days after an agreement is signed with the selected candidate or a decision is made to end the recruitment process.
The Company also searches for candidates on LinkedIn and other recruitment websites/portals, as well as through referrals from our employees. For the purpose of searching for candidates on LinkedIn, job portals and other public sources, the Company processes the following personal data of potential candidates (persons who meet the search criteria): first name, surname, and other information provided in their LinkedIn profile or profile on another search platform. Personal data is not retained separately; selected persons are simply asked for consent to participate in the Company's recruitment process.
When our employees refer you to us as a potential candidate, we process the following information about you: first name, surname, the position for which you are recommended, and contact details (telephone number and/or email address).
Personal data is processed on the basis of the Company's legitimate interests (Article 6(1)(f) of the GDPR).
We obtain the data directly from you, from publicly available sources, and from our employees who refer you as a potential candidate.
10. Protection of the Company's property and persons and recording evidence of incidents (video surveillance)
To protect the property of the Company, its customers and employees, and other persons within the monitored area, the Company conducts video surveillance. Video surveillance is carried out on the basis of the legitimate interests of those persons and the Company. In conducting video surveillance, the Company processes the following personal data: image, movement trajectory and items carried by persons.
The Company processes video data only for as long as necessary to achieve the purposes for which the video data is processed.
The Company processes video data only for as long as necessary to achieve the purposes for which the video data is processed. Video data may be retained for a longer period where there are reasonable grounds to believe that it may be required for the investigation of a criminal offence or another incident occurring on the Company’s premises, in the building in which those premises are located, or within the monitored area, or of any other event that has caused damage to the Company. In such cases, the video data will be retained until a final decision relating to the criminal offence has been issued by the relevant law enforcement authority or court, or until a decision or conclusion has been issued by the persons investigating or examining the incident or other event that caused damage to the Company.
The recipient of your personal data is the processor engaged by us: the security company hired by the Company.
11. Defence of legitimate interests
On the basis of its legitimate interest (Article 6(1)(f) of the GDPR) in defending its rights, including in civil disputes, the Company processes the first names, surnames and personal identification numbers of parties to proceedings or their employees, the circumstances of the case, other case-related information, and publicly available information.
On the basis of its legitimate interests (Article 6(1)(f) of the GDPR), the Company also processes any personal data specified in this Privacy Policy that is necessary for entering into and performing contracts and for defending the Company's rights and legitimate interests. As the general limitation period is 10 years, personal data processed for the purpose of entering into and performing contracts will be retained for 10 years after the contracts expire.
On the basis of its legitimate interests (Article 6(1)(f) of the GDPR), the Company also processes your personal data specified in consents to personal data processing and data confirming that consent was given, as well as personal data contained in documents giving effect to a Data Subject's rights or recording the Company's refusal to give effect to them, for the purpose of defending the Company's rights and legitimate interests. This data is retained for 3 years from the end of the calendar year in which the processing of personal data ended and/or the Data Subject's rights were exercised (or the Company refused to give effect to them).
In order to comply with the archiving obligation (Article 6(1)(c) of the GDPR), personal data processed for the purpose of defending the Company's rights and legitimate interests is retained for archiving purposes for 5 years from the date of the final decision.
When personal data is processed for this purpose, the recipients are courts, law enforcement authorities, public authorities that resolve disputes, parties to disputes, lawyers, and other providers of legal services.
12. Internal administration of the Company (exercise of shareholders' rights)
For internal administration purposes (upon receiving a shareholder's request to exercise the right to information), the Company may disclose to that shareholder any personal data recorded in the documents provided to the shareholder. The disclosure is made in compliance with a legal obligation applicable to the Company (Article 6(1)(c) of the GDPR), and the personal data is processed only until it is disclosed to the shareholder.
13. Contact us
You can contact the Company in several ways: by telephone or email, through social media accounts, using the contact form on the website, or by sending a letter to the Company's registered office. All communications are received, reviewed and answered by us or our service providers. If you contact us, we may process the data you provide, namely your email address, first name and surname (if provided), username (if the enquiry is sent through a social media account), employer (if provided), and the date, time, recipient, sender (where a communication is addressed to you) and content of sent and received communications.
This data will be processed on the basis of your consent (Article 6(1)(a) of the GDPR) in order to answer your questions and consider your suggestions. You may withdraw your consent at any time. If you do not provide your contact details or withdraw your consent, it will not be possible to contact you or respond to your enquiries.
Correspondence is retained for 1 year after receipt of the message, except where another retention period is specified in the Privacy Policy or by law.
All personal data that you provide when communicating with us is used only for the purposes specified above and to review communications and administer and manage communication flows. We undertake not to use your personal data in any publication in a manner that would make you identifiable without your explicit consent.
Please note that we may need to contact you by post, email or telephone. Please notify us of any changes to your personal data.
14. Newsletter and direct marketing
We process your email address and, where provided, your first name, surname, company, country, language and marketing preferences in order to administer newsletter subscriptions and send newsletters, product information, event information and other direct marketing communications. We may also process the subscription date, consent record, delivery status, email opens and link clicks in order to demonstrate consent, manage delivery and measure the effectiveness of our communications.
We process this data on the basis of your consent (Article 6(1)(a) of the GDPR). If you do not provide the required contact details and consent, we will be unable to send direct marketing communications to you. You may withdraw your consent at any time by using the unsubscribe link in any newsletter or by contacting us at the email address specified in this Privacy Policy. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
The data recipient and processor used to administer our subscriber list and send newsletters is MailerLite Limited. Subscriber data is retained until you withdraw your consent or object to direct marketing. We may retain the minimum information needed to record your opt-out and evidence of the consent previously given for 3 years from the end of the calendar year in which consent was withdrawn, for the purpose of demonstrating compliance and ensuring that no further marketing communications are sent.
15. Website analytics advertising chat and cookie linked processing
When you use our website, cookies and similar technologies may process your IP address, cookie and online identifiers, browser and device information, approximate location, referring page, pages viewed, clicks, session duration, advertising and conversion information, and other information about how you interact with the website. If you use the website chat, we also process the content of your messages and any contact details that you choose to provide.
We use this data to operate and secure the website, remember your preferences, provide chat functionality, analyse website traffic and performance, measure advertising and campaign results, personalise advertising, and provide social-media features. Strictly necessary technologies are used on the basis of our legitimate interest in operating and securing the website (Article 6(1)(f) of the GDPR). Analytics, preference and marketing technologies are used only where you have given consent (Article 6(1)(a) of the GDPR).
Recipients of this data may include our cookie-consent, analytics, advertising, social-media and chat service providers, including Cookiebot by Usercentrics, Google, Meta, LinkedIn and Tawk.to. The current technologies, providers, purposes and retention periods are listed in our Cookie Policy. You may give, refuse or withdraw consent at any time through the cookie settings available on the website. Some providers may process data outside the EU/EEA. Where this occurs, data is transferred in accordance with Chapter V of the GDPR, including on the basis of an adequacy decision or Standard Contractual Clauses, as applicable.
16. Visitor identification
Where you have accepted marketing cookies, we use the Retention.com visitor-identification service, implemented through the Reb2B technology. Cookies and similar technologies may associate activity on our website with personal information that Retention.com or its partners already hold about you, including an email address. The data processed may include your IP address, browser and device information, online identifiers, referring page, pages viewed, interactions, and the date and time of your visit.
We and service providers acting on our behalf may use this information to identify business visitors, understand interest in our products, measure marketing activity and send relevant marketing communications. This processing is based on your consent (Article 6(1)(a) of the GDPR) and does not take place unless you accept marketing cookies. Retention.com and its technology providers are recipients of the data for this purpose.
You may withdraw your consent at any time through the cookie settings on our website. You may also opt out of Retention.com visitor identification at https://app.retention.com/optout. Relevant cookies are retained for the periods stated in our Cookie Policy. Other visitor-identification data is retained only for as long as necessary for the marketing purpose or until you withdraw consent or opt out, subject to any period required to demonstrate compliance with legal obligations.
17. Social media
Information that you provide to us through social media (including messages, use of the Like and Follow buttons, and other communications) is controlled by the social network operator.
Our website contains links to our social media accounts (hereinafter the Social Accounts). The Company currently maintains accounts on the Facebook and LinkedIn social media platforms.
We process information contained in the Social Accounts for the purpose of account administration on the basis of your consent. We do not retain the information contained in the Social Accounts separately when it is processed for the purpose of administering those accounts; however, data may be retained if it needs to be processed for another purpose, such as the defence of legal rights.
When you visit the Social Accounts, the social network operators place cookies on your device that collect personal data. Cookies are placed both when you are a registered user of a social network and when you do not have an account on the relevant social network. We do not have access to the personal data collected and may receive from the social network operators only statistical information about visits to the Social Accounts.
We recommend that you read third-party privacy notices and contact the service providers directly if you have any questions about how they use your personal data.
18. Transfers of data to third countries
The Company uses Microsoft 365 products. When these products are used, the processor is Microsoft Ireland Operations Limited, established in Ireland. Although data used in connection with Microsoft 365 products is stored in the European Union/European Economic Area, under Microsoft's personal data processing terms, available here: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA, personal data stored in the EU/EEA may in certain cases be accessed from the United States and other countries in which Microsoft or its subprocessors operate. In such cases, Microsoft has undertaken to ensure that the standard data protection clauses adopted by the European Commission are applied (Article 46(2)(c) of the GDPR).
When entering into and performing distribution agreements, the Company also receives personal data of distributors' customers from distributors and returns the personal data received, to the same extent, to the distributor that provided it. The distributors are also established and operate outside the EU/EEA.
19. Receipt and disclosure of data
We obtain your data from you, your devices, job applicants, our employees, service providers, contractual counterparties, and distributors.
We disclose information about you to processors engaged by us (providers of IT services, systems/programmes used by the Company, etc.).
In addition, we may disclose information about you:
- where we are required to do so by law or other legislation;
- to companies providing audit and related services to the Company and to providers of legal and financial advisory services.
Except as provided in this Privacy Policy, we do not disclose your personal data to any third parties.
The list or categories of recipients specified in the Privacy Policy may change. If you would like to be informed of changes in the recipients of your personal data, please notify us at the email address specified in this Privacy Policy and write in the body of the email: I would like to receive information about changes in the recipients of my personal data, first name, surname.
20. Security of your personal data
Your personal data will be processed in accordance with the requirements of the General Data Protection Regulation, the Law of the Republic of Lithuania on Legal Protection of Personal Data, and other legislation. When processing your personal data, we implement organisational and technical measures to protect personal data against accidental or unlawful destruction, alteration or disclosure and against any other unlawful processing.
21. Complaints
If you believe that your rights as a Data Subject have been or may be infringed, please contact us immediately at the email address specified in this Privacy Policy. Upon receiving your complaint, we will contact you within a reasonable period and inform you about the progress of the investigation and subsequently its outcome.
If you are dissatisfied with the outcome of the investigation, you may lodge a complaint with the supervisory authority, the State Data Protection Inspectorate: https://vdai.lrv.lt/.
If you live or work in another Member State of the European Union (other than Lithuania), you have the right to lodge a complaint with the State Data Protection Inspectorate through the GDPR supervisory authority in the Member State where you live or work.
22. Responsibility
You are responsible for maintaining the confidentiality of the data you provide and for ensuring that the data you provide to us is accurate, correct and complete. If the data you have provided changes, you must notify us immediately by email. Under no circumstances will we be liable for any damage you incur because you provided incorrect or incomplete personal data or failed to notify us of changes to it.
23. Changes to the Privacy Policy
We may update or amend this Privacy Policy at any time if we consider it necessary, including when information about personal data processing changes (for example, the scope of personal data collected changes or new processing purposes arise), and in other circumstances where doing so is appropriate and necessary to ensure the transparency of our processing of personal data. We will also update the Privacy Policy when required to do so by the supervisory authority. We will take steps to inform you of material changes to the Privacy Policy by publishing a notice on the Company's website; however, we recommend that you review the Privacy Policy from time to time, as minor changes may also be made. If you would like to receive an updated Privacy Policy, please notify us at the email address specified in Section 2 of the Privacy Policy.