The Privacy Policy (hereinafter referred to as the Policy) sets out how Public Limited Liability Company Pieno žvaigždės (hereinafter referred to as the Company) protects the personal data and privacy of its clients, website visitors and other persons (hereinafter referred to as you, Visitors).

In all cases discussed in this Policy, the controller of your personal data shall be Pieno žvaigždės AB, legal entity code 124665536, registered address Perkūnkiemio g. 3, LT-12127 Vilnius.

I. PROCESSING OF PERSONAL DATA FOR THE PURPOSE OF ADMINISTRATION OF REQUESTS AND/OR COMPLAINTS AND ENSURING OF QUALITY OF SERVICES

The Company shall process your personal data when you submit a request and/or complaint to the Company on this website, by e-mail, mail or phone.

In the cases specified above, the Company shall process your data:
• In order to administer requests and/or complaints and ensure the quality of its services.
• On the basis of your consent expressed by your actions involving the submission of a request and/or complaint.

When contacting the Company by the toll-free quality line, the Company shall have the right to register the information provided by you in the Company's internal information system in order to examine your request and/or complaint, provide information, and ensure the quality of services.

When applying to the Company, the Company requests to follow the minimum personal data protection requirements listed below:
• Not specify such personal data as personal number, date of birth, bank account number, vehicle registration plate number, real property data, data concerning health, other special category data or sensitive personal data, etc. in the heading of a request and/or complaint (e-mail letter, documents submitted in writing, on the website) or the titles of the files enclosed thereto.
• Not specify personal number, bank account number, vehicle registration plate number, real property data, data concerning health or other special category or sensitive personal data if they are not directly related to your request and/or complaint in the text of the request and/or complaint or during a phone conversation, and specify the data of other persons to the extent they are required for the purposes for which the request and/or complaint is submitted.

If the Company requires additional information to examine your request and/or complaint, it shall use your contact details in order to contact you on this matter.

The Company shall store your personal data processed for the purpose of request and/or complaint administration and for ensuring the quality of its services for as long as it is required to examine your request and/or complaint and to reply to it and in compliance with the requirements applicable for the storage of the documents of such type as laid down by legal acts, limitation periods applied for the establishment or defence of legal claims and, if such claims are established, for as long as it is required for such purposes.

II. PROCESSING OF PERSONAL DATA FOR STAFF SELECTION PURPOSES

The Company shall process your personal data if you provide your personal data on the website http://pienozvaigzdes.lt/lt/career in order to become a part of the Company's team.

The Company shall process your personal data:
• For staff selection purposes.
• On the basis of your consent expressed by your actions involving the submission of your personal data.

The Company shall store your personal data provided on this website for staff selection purposes for the period of 12 months.

Please note that the storage of your personal data submitted on this website for staff selection purposes at the Company shall not equal to the person's application for the desired positions. If you find a job offer which is of interest to you on the Company's or job search websites, you are welcome to apply for the position directly by the e-mail specified in the job offer.

However, if you submit your personal data on this website in order to participate in a specific selection procedure but the Company selects another candidate who better meets its needs, the Company shall store your data until the end of a specific selection, and if you consent to the further processing of your data for the purpose of other staff selection procedures, your data shall be stored for one year after the end of the selection unless you withdraw your consent at an earlier date.

The Company informs you that in order to evaluate your candidacy, it may apply to the former employers specified by you for references and request information on your qualification, professional skills, and business related qualities. The Company may request such information from your current employer upon receipt of your separate consent only.

The company also notes that it may receive your personal data from the third parties, for instance, from the companies managing job portals or recruitment agencies if such data have been provided to them as well as publicly available sources where you have made your personal data public.

III. PROCESSING OF PERSONAL DATA OF THE COMPANY'S SHAREHOLDERS AND BENEFICIARIES

In its activities the Company shall process the personal data of its shareholders and beneficiaries:
• For internal administration purposes.
• In order to fulfil its legal duties in relation to the registration and processing of the data of the Company's shareholders, share accounting, and fulfilment of tax and other obligations to them.

The Company shall store the personal data of its shareholders for as long as it is required to achieve the objectives for which they are processed and in compliance with the requirements for the storage of data of such type stipulated by legal acts, limitation periods applicable for establishing or defending legal claims and, if such claims are established, for as long as it is required for such purposes.

IV. PROCESSING OF DATA OF THE COMPANY'S MANAGEMENT BODIES AND THEIR MEMBERS

In its activities the Company shall process the personal data of the Company's single-person and collegial management bodies and their members (managers, board members):
• For internal administration purposes.
• In order to fulfil its legal obligations in connection with the formation of the Company's single-person and collegial management bodies (appointment of managers, setting up of the board), the organisation of their activities, the provision of data of the Company's single-person and collegial management bodies and their members to public registers and registration, the application of the requirements stipulated by the Law on Financial Reporting by Undertakings of the Republic of Lithuania (for example, the requirement to provide the data of the board and its members in the annual report), etc.

The processing of the personal data of the Company's single-person and collegial management bodies and their members is a mandatory requirement established by legal acts.

The Company shall store the personal data of its board members for as long as it is required to achieve the objectives for which they are processed and in compliance with the requirements for the storage of data of such type stipulated by legal acts, limitation periods applicable for establishing or defending legal claims and, if such claims are established, for as long as it is required for such purposes.

V. PROCESSING OF PERSONAL DATA OF CONTRACTING PARTIES AND OTHER PERSONS

The Company shall process the personal data of the entities of different categories (for example, clients, business partners, suppliers, other counterparties, as well as their employees, representatives and agents). These data shall be collected and processed for the below purposes and on respective grounds:
• When the above mentioned persons establish, maintain and develop business, professional or other legitimate relations with the Company;
• When entering into, executing and administering transactions, contracts and agreements;
• When developing and safeguarding the lawful interests of the Company and related group companies;
• When the Company defends itself against any lawsuits, requests or claims brought against it;
• When the Company fulfils the duties which are assigned to it under the applicable legislation.

In carrying out the duties applicable to it under the valid legislation, implementing the measures designed to prevent the trade in the Company's securities by means of inside information and unlawful disclosure of inside information on its part and in ensuring the confidentiality of inside information, the Company shall process the data of the persons included on the insider list (first name and surname of the insider, professional and personal telephone number, personal home address, date of birth, national identification number, company name and address, function and reason for being the insider, etc.), compile and process information on the persons in managerial positions / persons tightly related with them, as well as process other related personal data.

The Company shall store the personal data of the above persons for the duration of the contract or for as long as it is required to achieve the objectives for which they are processed and in compliance with the requirements for the storage of data of such type stipulated by legal acts, limitation periods applicable for establishing or defending legal claims and, if such claims are established, for as long as it is required for such purposes.

VI. PROCESSING OF PERSONAL DATA IN ORGANISING GAMES AND CAMPAIGNS

The Company may process your personal data in order to administer the games, campaigns and/or competitions (if applicable) organised and operated by it or its suppliers if you expressed your intention to participate in them. In such cases, the Company shall process your personal data in order to determine and announce the winner, to present prizes and awards and to identify you.

If you intend to participate in the game and/or competition, you shall provide the Company with your personal data. If you fail to provide your data, you shall not be entitled to participate in the game and/or competition. In that case, the Company will not be able to present the prize to you if you win. When presenting the prize, your identity will be verified. In the cases established by legal acts the Company shall inform competent authorities about the prize (e.g. State Tax Inspectorate).

The personal data collected for the purpose of games and campaigns shall be stored for as long as it is required to organise and operate the game or campaign and in compliance with the requirements for the storage of data of such type stipulated by legal acts, limitation periods applicable for establishing or defending legal claims and, if such claims are established, for as long as it is required for such purposes.

Detailed conditions and rules of participation and personal data processing and related conditions and rules shall be established separately in the conditions and/or rules of the specific game, campaign and/or competition.

VII. PROCESSING OF PERSONAL DATA ON THE WEBSITE

If you visit our website, the Company may process the Visitor's IP address, network and location data when they are provided by the Visitor. The data are collected by cookies and other similar technologies on the basis of the user's consent.

Cookies are small textual files (occupying up to several KB) which your browser places on your computer, tablet or other smart device when you visit this website. By means of cookies, the Company intends to ensure effective and safe operation of the website and analyse your habits in order to ensure that the website's operation is convenient, effective and meets your needs and expectations.

Please note that the acceptance of required and analytical cookies is the condition for the use of our website. If you do not accept these cookies, the Company may not be sure how the website will operate and whether it will operate at all.

Certain technical data of your visit to the website (IP address, cookies, technical information of your browser, other information related to your browser and your browsing on the website) may be transferred or made available to the entities operating in the European Economic Area and outside it for the purposes of website browsing statistics, analysis and related purposes (e.g. when we use Google Analytics, the company operating in the United States of America is such an entity). Less protection may apply to personal data in non-EEA states compared to EEA member states, but the Company shall carefully evaluate the terms and conditions under which such data will be further processed and stored after they are transferred to the above entities.

VIII. USE OF COOKIES

We wish to give you the information and functions that best suit your needs when you visit our website. Cookies are required for this purpose. They are small pieces of information saved on your browser. They help us to recognise you as a previous Visitor of our website, save the history of your visit to the website and adjust our content to your interests. Cookies also help to ensure smooth operation of the website, enable us to monitor the duration and frequency of your visits on our website and collect statistical information on the number of website visitors. By analysing the above data, we can improve our website and make it more convenient for you. When you visit our website, you may choose whether you want to use cookies. If you disagree to the placement of cookies on your computer or a different device, you may withdraw your consent at any time by changing the settings and deleting the cookies already placed on your device.

Data on the cookies used on our website

CMSSESSIDX is a standard cookie used to manage the user's session. It is created after opening the website and expires when the user closes the website.

cookiesAgree is a cookie which records whether you consented to the use of cookies on our website. It is created from the moment of consent and expires when it is deleted.

cookiesLevelX is a cookie identifying the types of cookies you have accepted on our website. It is created from the moment of consent and expires when it is deleted.

_ga is a cookie used by Google Analytics to assess the purpose of the user's visit, generate reports on the website activity to website operators and improve the client's experience when browsing on the website. It is created from the moment of consent and is valid for 2 years.

_gat is a cookie used by Google Analytics to collect statistical information about the website traffic. It is created upon the first visit to the website and expires after the end of the session.

_gid is a cookie used by Google Analytics to distinguish the person from other users. It is created on the first visit to the website and expires after 2 days.

Types of cookies

Cookies include session cookies and persistent cookies as well as first-party or third-party cookies. The definitions of these terms are provided below so that you can get a better understanding of our cookies and the purposes of their use. Session cookies allow you to be recognised for the duration of a single session so that any page changes or selections are remembered when you move from page to page. These cookies make navigating across numerous website pages faster and easier to prevent repeated processing of the information when a new page is opened. Session cookies are temporary and disappear once you close your browser or log off from the website.

Persistent cookies

Persistent cookies are the cookies which are saved on your computer for a fixed period of time after the end of your session and they may record specific user preferences or actions when the user returns to the website.

Third-party cookies

These are the cookies operated by other organisations via our website. Google Analytics cookies are used on our website to analyse the website traffic. Google Analytics collects anonymous information about the number of users, the location from which our website has been accessed, and the parts of the website browsed by the visitors. These cookies are created by Google Analytics. To learn more about Google Analytics, visit http://www.google.com/analytics. Any information collected through cookies is stored until these cookies expire and is not used for any purpose other than those listed in this policy.

First-party cookies

These cookies are essential for the proper operation of our website.

Management and deletion of cookies

You can manage and/or delete cookies. For more information, visit http://www.youronlinechoices.com/. You can delete the cookies which are already stored on your device or you can prevent cookies from being installed by adjusting your browser settings; however, this may disable certain functions of the website.

IX. DATA PROCESSORS AND OTHER DATA RECIPIENTS

The Company uses certain service providers (data processors) for the processing of your personal data. Such data processors include: a company providing the services of data centres, companies performing the analysis of browsing or online activity and providing services, companies engaged in software creation, supply, support and development, companies providing the services of IT infrastructure, companies providing communications, protection, recruitment and call handling services and other service providers to which your personal data are disclosed to the extent it is required to provide their services.

If there are legitimate grounds (for example, when it is required for conclusion or fulfilment of the contract with you and when you were duly notified of such transfer of personal data) data can be transferred to our business partners and contracting parties.

We are obliged to transfer your personal data to state supervisory authorities on the grounds and in the cases stipulated by legal acts.

The Company informs you that certain data of your visit to the website (IP address, cookies, technical information of your browser, other information related to your browser and your browsing on the website) may be transferred or made available to the entities operating in the European Economic Area and outside it for the purposes of website browsing statistics, analysis and related purposes (for example, when we use Google Analytics, the company operating in the United States of America is such an entity). Please bear in mind that less protection may apply to personal data in the states outside the European Economic Area compared to the member states of the European Economic Area, but the Company shall carefully evaluate the terms and conditions under which such data will be further processed and stored after they are transferred to the above entities.

Your personal data may be disclosed to other data recipients on the grounds stipulated in legal acts only.

X. PERIOD OF DATA STORAGE

Your personal data may be stored for a period longer than specified above in the following cases:
• It is required for the Company to defend itself against the requests, claims or lawsuits and to exercise its rights.
• There are reasonable suspicions regarding illegal activity which is the subject of an investigation.
• Your data are required for the proper settlement of a dispute or complaint.
• To make backup copies and for other or similar purposes relating to the operation and support of information systems.
• On other grounds laid down in legal acts.

XI. YOUR RIGHTS IN THE AREA OF PERSONAL DATA PROTECTION

You are entitled to exercise the following rights to the extent and under the conditions established by the legal acts which apply with respect to your personal data:
• To have access to your personal data and the procedure of their processing.
• To request correction of incorrect, inaccurate or incomplete data.
• To request erasure of your personal data or restrict their processing when the personal data are not processed in compliance with the requirements of legal acts or on other legal grounds.
• To request the transfer of your personal data to another data controller or to provide directly in the form convenient to you (concerns those personal data which were provided by you and which are processed on the grounds of agreement or consent by automated means).
• The right to disagree to the processing of your personal data where they are processed on the grounds of legitimate interest, unless there are legitimate grounds for such processing or it is necessary for the establishment, exercise or defence of legal claims.
• The right to withdraw the consent at any time if your personal data are processed on the grounds of consent.

If you believe that your personal data are processed unlawfully or your rights relating to data processing are being violated, you have the right to apply to the State Data Protection Inspectorate (for more information, visit www.ada.lt) and submit a complaint in relation thereto.

Before filing an official complaint, the Company recommends you to contact the Company by e-mail duomenuapsauga@pienozvaigzdes.lt in order to find an appropriate solution to the problem.

In order to protect personal data against unlawful disclosure, the Company shall, after receipt of your request for the implementation of your rights, verify your identity. To that end, the Company may request you to specify your name, surname, e-mail or phone number or ask you to arrive at the Company's head office at the address Perkūnkiemio 3, Vilnius in order to verify your identity properly. In the context of this verification, the Company may also send a control message using the specified contact details (SMS or e-mail) asking to perform authorisation. If the verification procedure is unsuccessful (your specified data do not match the data held by the Company or your authorisation request under the SMS or e-mail message fails), the Company shall conclude that you are not the subject of the requested data and reject your request.

After your request is received and the above verification is successfully completed, the Company shall within one month of the receipt of your request and the completion of the verification procedure submit the information on the actions taken under your request. Taking into account the complexity and number of requests, the Company shall be entitled to extend the period of one month by two more months by notifying you thereof at least one month after the receipt of your request and the completion of the verification procedure and specifying the reasons of such extension.

If your request is submitted by electronic means and the Company may verify your identity properly, the Company shall also send its reply by electronic means unless it is not possible (e.g. due to extensive scope of information, other objective circumstances and reasons) or when you prefer to receive the reply by other means.

If the Company refuses to satisfy your request on the grounds and/or under the circumstances established by legal acts, the Company shall notify you thereof in writing by specifying the motives of such refusal.

XII. HOW TO CONTACT US?

If you have any questions regarding our Policy or you have any requests in relation to the processing of your personal data, please contact us by e-mail duomenuapsauga@pienozvaigzdes.lt.

Details of the Company acting in the capacity of the data controller: Pieno žvaigždės AB, legal entity code: 124665536, address: Perkūnkiemio g. 3, LT-12127 Vilnius, Republic of Lithuania.

XIII. OTHER PROVISIONS

The Company may update the Policy at any time. The Company shall inform its Visitors about any updates by posting the new version of the Policy on its website together with the date of the latest changes. The Visitors are aware that their further use of the website after the updates of the Policy shall constitute their agreement to the changes made.

If any provision of the Policy is declared invalid or unenforceable, it shall not affect the legality and validity of the remaining provisions.

The Policy applies from 25 May 2018.