Privacy policy

Updated and approved

by order No. V-5 of the Director of VšĮ Vilniaus inžinerijos ir technologijų licėjus

of 5 February 2024

1. GENERAL PROVISIONS

1.1. This Privacy and Personal Data Protection Policy of VšĮ Vilniaus inžinerijos ir technologijų licėjus sets out the main principles, procedures and technical and organisational measures we apply to keep your personal data secure. It follows Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter – GDPR), the Law on the Legal Protection of Personal Data of the Republic of Lithuania (hereinafter – LLPPD) and other legal acts of the European Union and the Republic of Lithuania governing personal data protection.

1.2. The Privacy and Personal Data Protection Policy (hereinafter – the Policy) of VšĮ Vilniaus inžinerijos ir technologijų licėjus (hereinafter – the Lyceum) applies to natural and legal persons who use the Lyceum’s services or provide services to the Lyceum, and to cases where the Lyceum acts as an employer.

1.3. We aim for close and open communication and mutual trust. We respect and protect the privacy of every client, employee, pupil and their parents or other legal guardians, and every visitor to the Lyceum’s websites https://vitliolicejus.lt and www.facebook.com/vitliolicejus.lt, and we undertake to process and store the personal data you provide to the Lyceum fairly and lawfully.

1.4. The purpose of the Policy is to inform you publicly how we collect, use, share and process the personal data you provide to the Lyceum, whether you communicate with us orally, in writing, including by electronic means, or in any other way you choose.

1.5. The Lyceum collects and processes your personal data in accordance with the GDPR, the LLPPD, the Law on Electronic Communications of the Republic of Lithuania (hereinafter – LEC) and other legal acts of the European Union and the Republic of Lithuania governing the processing and protection of personal data.

1.6. In this Policy we inform you about the main principles of collecting, using, processing and storing your personal data, the purposes and means of processing, and who may access your personal data, when, for what purposes and under what procedure. The Policy also sets out your rights as a data subject and the procedure for submitting and handling your requests to exercise them. Further information on the processing of your personal data may be provided in the Lyceum’s service and/or other agreements, resolutions of the Government of the Republic of Lithuania, legal acts of the Ministry of Education and Science and of the founder, and the Lyceum’s internal rules.

1.7. By using the Lyceum’s services, continuing to browse the Lyceum’s website, providing your personal data to the Lyceum’s administration, sending a CV or filling in an enquiry form, you, as a data subject, confirm that you have read this Policy, understand its provisions and agree to comply with them. The Policy is available at any time on the Lyceum’s website https://vitliolicejus.lt in the “Privacy policy” section.

1.8. Visitors to the Lyceum’s website, pupils, parents and guardians of school-age children and other clients of the Lyceum are deemed to have read and become familiar with this Policy when they freely give the Lyceum their consent to the processing of personal data.

1.9. The Lyceum’s administration may update or amend this Policy from time to time by publishing a new version on the Lyceum’s website https://vitliolicejus.lt in the “Privacy policy” section. We recommend that you review the Policy on the website periodically to make sure you are aware of any changes.

1.10. The terms of this Policy apply to you each time you visit the Lyceum’s office at Žemuogių g. 10, LT-08418 Vilnius, or the Lyceum’s website, regardless of the device you use (computer, mobile phone, tablet, etc.).

1.11. If you do not agree with the terms of this Policy, you have the right not to visit the Lyceum’s website or office and not to use the content of the Lyceum’s website or the Lyceum’s services.

1.12. By providing their personal data to the Lyceum’s administration (including data provided directly or indirectly when visiting the Lyceum’s website and/or using the Lyceum’s services), visitors to the Lyceum’s website, parents of school-age children and other data subjects agree and do not object that the Lyceum controls and processes such data for the purposes and under the procedure set out in this Policy, in the data subject’s consent and in the Lyceum’s internal rules or agreements.

1.13. Natural persons (data subjects) under the age of 16 may not provide any personal data to the Lyceum’s administration through the Lyceum’s website without the consent of their parents or other legal guardians.

2. KEY DEFINITIONS

2.1. The terms used in this Policy have the meanings given to them in the GDPR, the LLPPD and other legal acts of the European Union and the Republic of Lithuania.

Privacy and Personal Data Protection Policy – the personal data protection provisions that the Lyceum follows as a data controller or data processor.

Data controller – VšĮ Vilniaus inžinerijos ir technologijų licėjus, legal entity code 302562877, registered address Žemuogių g. 10, LT-08418 Vilnius. Tel. +370 67244370. Email: info@vitliolicejus.lt. The data controller determines the purposes of processing, the categories of personal data and data subjects, and the means of processing.

Website – the website of VšĮ Vilniaus inžinerijos ir technologijų licėjus at https://vitliolicejus.lt, where visitors may freely give consent to the processing of their personal data for the purposes of performing a contract and other purposes.

Personal data – any information relating to a living natural person who is identified or can be identified, directly or indirectly, by reference to data such as name, surname, date of birth, personal identification number, home address, identity card or passport number, bank card number, diploma and certificate details, data on assets, health data, facial image, phone number, email address, internet protocol (IP) address or vehicle registration number.

Data subject – a living natural person whose identity is established and whose personal data the Lyceum (the data controller) controls and processes for defined purposes.

Candidate for employment with the data controller – a natural person who takes part, or seeks to take part, in a recruitment procedure carried out by the Lyceum.

Employee of the data controller – a natural person who has concluded an employment contract with the Lyceum’s administration.

Employee of the data controller responsible for personal data processing – a Lyceum employee who, by virtue of their position and duties, is entitled to perform specific functions related to the processing of the personal data of natural persons (data subjects) on behalf of the Lyceum.

Data processor – a natural or legal person, public authority, agency or other body that processes the personal data of natural persons (data subjects) on behalf of the Lyceum under a contract.

Processing of personal data – any operation performed on the personal data of natural persons (data subjects): collection, recording, accumulation, storage, alteration (supplementing or correcting), disclosure, use, destruction or any other operation or set of operations.

Direct marketing – the Lyceum’s activities aimed at offering services or special discounts to natural persons (data subjects) by post, telephone or other direct means and/or asking their opinion about the services provided or offered.

Filing system – any structured set of personal data held by the Lyceum that is accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis.

Computer equipment – the Lyceum’s computers, terminals, servers, storage media and other computer equipment owned, leased or otherwise lawfully held by the Lyceum, and the software installed on it, including email accounts, online communication applications, cloud computing services and internet access.

Consent of the data subject – any freely given, specific, informed and unambiguous indication of the data subject’s wishes, given to the Lyceum’s administration by a statement or by a clear affirmative action, by which they agree to the processing of personal data relating to them at the Lyceum.

Recipient – a natural or legal person, public authority, agency or other body to which the personal data of a data subject are disclosed, whether a third party or not.

Public authorities and bodies – state and municipal institutions and bodies, enterprises and public institutions of the Republic of Lithuania that are funded from state or municipal budgets and state monetary funds and that, under the procedure laid down in the Law on Public Administration of the Republic of Lithuania, are authorised to carry out public administration, provide public or administrative services or perform other public functions.

Third party – a natural or legal person, public authority, agency or other body that is authorised by direct mandate of the Director of the Lyceum to process the personal data of natural persons (data subjects) on behalf of the Lyceum.

Enquirer – a natural or legal person who is interested in the Lyceum’s services or wishes to contact the Lyceum’s administration on other matters.

Client – a natural or legal person who has concluded a contract with the Lyceum’s administration for the provision of services.

Supervisory authority – the State Data Protection Inspectorate of the Republic of Lithuania (hereinafter – SDPI). Contact details: L. Sapiegos g. 17, 10312 Vilnius (entrance on the left). Tel. (8 5) 271 28 04, (8 5) 279 14 45. Fax (8 5) 261 94 94. Email: ada@ada.lt, e-delivery box: 188607912.

3. WHAT PRINCIPLES OF PERSONAL DATA PROCESSING AND PROTECTION DO WE FOLLOW?

3.1. When processing the personal data you entrust to the Lyceum’s administration, we follow these principles:

  • your personal data are processed lawfully, fairly and in a transparent manner (lawfulness, fairness and transparency);
  • your personal data are collected for specified, explicit and legitimate purposes and are not further processed in a manner incompatible with those purposes (purpose limitation);
  • your personal data are adequate, relevant and limited to what is necessary for the purposes for which they are processed (data minimisation);
  • your personal data are accurate and, where necessary, kept up to date (accuracy);
  • your personal data are kept in a form which permits identification for no longer than is necessary for the purposes for which they are processed (storage limitation);
  • your personal data are processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (integrity and confidentiality);
  • your personal data are processed and stored in such a form and for such periods that they can be used no longer than required by the legal acts of the Republic of Lithuania and the European Union and than necessary for the purposes for which they were collected and processed.

4. WHAT INFORMATION DO WE COLLECT, AND FOR WHAT PURPOSES DO WE PROCESS AND USE THE PERSONAL DATA YOU PROVIDE?

4.1. We collect, process and use the personal data you provide to the Lyceum’s administration in accordance with the GDPR, the LLPPD, the legal acts of the Republic of Lithuania and the European Union, and the Lyceum’s internal rules.

4.2. We collect, process and use the personal data you provide to the Lyceum’s administration for the following main purposes:

  1. If you visit the Lyceum’s website, we collect information about website visitors and other browsing information, including when and from where the website was accessed. When registering on the Lyceum’s website, you will be asked to provide personal data and your consent to their collection and processing so that the Lyceum’s administration can send you the news, publications and information about the Lyceum’s activities and services you have subscribed to. You may withdraw your consent at any time by writing to info@vitliolicejus.lt;
  2. If you intend to conclude or have concluded a contract for the Lyceum’s services, for the purposes of performing the contract, administering your orders and administering the loyalty programme, we collect and process your name, surname, personal identification number or date of birth, identity document number, home address, phone number and other contact details, and information you provide to us during meetings or remote consultations. We process and store this information no longer than required by the legal acts of the Republic of Lithuania and than necessary for the purposes for which it was collected and processed;
  3. To advise you on vacancies at the Lyceum and assess your application, we collect and process your name, surname, personal identification number or date of birth, identity document number, home address, phone number and other contact details, information about your education, family status, income and financial obligations to other parties, and other information you provide to us during meetings or remote consultations. We process and store this information and the personal data you provide no longer than required by the legal acts of the Republic of Lithuania and than necessary for the purposes for which they were collected and processed;
  4. To advise you, provide information about the Lyceum’s services and contact you, we collect and process your name, surname, phone number and other contact details. We keep this information no longer than necessary to respond to your enquiry;
  5. To provide the Lyceum’s services under a contract, properly perform our contractual obligations and fulfil the obligations laid down in the legal acts of the European Union and the Republic of Lithuania, we collect and process the name, surname, date of birth, personal identification number, identity document number, home address, phone number and other contact details of you or your representative. For this purpose we use the bank account number you provide, data on your transactions with the Lyceum’s administration and other data and information necessary to perform the contract. We analyse how you use the Lyceum’s services so that we can inform you about service disruptions and present improvements or new similar services. We process the data collected while providing the Lyceum’s services for as long as you use the services and store them no longer than required by the legal acts of the Republic of Lithuania and than necessary for the purposes for which they were collected and processed;
  6. To communicate with you, properly perform our contractual obligations, answer your questions and requests regarding the Lyceum’s services, receive your feedback, send important notices about services, rules, this Policy or other documents, and send security alerts, we process your contact details and the content of messages received and sent. We process the data collected while providing the Lyceum’s services for as long as you use them and store them no longer than required by the legal acts of the Republic of Lithuania and than necessary for the purposes for which they were collected and processed;
  7. To manage debts owed to the Lyceum by its clients, we collect and process the debtor’s name, surname, personal identification number (or date of birth), identity document number, home address, phone number, data on the amount of the debt, the debtor’s income, workplace, assets, financial obligations to other creditors, and debt and payment history. If a debtor of the Lyceum has died, we collect and process information on the fact and date of death. We process and store these data no longer than required by the legal acts of the Republic of Lithuania and than necessary to achieve the purpose of debt management, taking into account the Lyceum’s legitimate interest and the time limits set by the legal acts of the Republic of Lithuania;
  8. To manage and protect the Lyceum’s legitimate interests and to comply with the GDPR, the LLPPD, the Lyceum’s personal data processing rules and the legal acts of the Republic of Lithuania, as well as the requirements and requests of the courts and law enforcement authorities of the Republic of Lithuania, we may process personal data and information about court or administrative proceedings in which you are involved, and other information provided to us for the above purposes. We process and store these data no longer than necessary to achieve this purpose, taking into account the Lyceum’s legitimate interest and the time limits set by the legal acts of the Republic of Lithuania.

4.3. In fulfilling the obligations laid down for the Lyceum in the legal acts of the European Union and the Republic of Lithuania, we may also obtain your personal data from other sources: the State Social Insurance Fund Board, the State Enterprise Centre of Registers, the State Enterprise Regitra, law enforcement authorities and other registers and state institutions of the Republic of Lithuania, UAB Creditinfo Lietuva, insurance companies operating in Lithuania and other institutions of the Republic of Lithuania. Using this information helps the Lyceum’s administration manage, improve and develop the Lyceum’s activities, and makes our communication more relevant, easier and better suited to you personally.

4.4. When collecting and using the personal data you provide to the Lyceum’s administration, as well as personal data lawfully obtained from other sources, we undertake:

  1. to process your personal data only for specified and legitimate purposes;
  2. not to process or use your personal data for purposes other than those set out in this Policy, except in cases provided for by the legal acts of the Republic of Lithuania;
  3. to process and store your personal data lawfully, accurately, transparently, fairly and in a way that ensures the accuracy, integrity and security of the personal data processed;
  4. to ensure that the Lyceum does not process excessive personal data about you;
  5. to process and store your personal data no longer than necessary for the purposes for which they are or were processed;
  6. to be responsible for compliance with the principles set out in this Policy, to fulfil the obligations laid down in the legal acts of the European Union and the Republic of Lithuania and to be able to demonstrate compliance.

4.5. The Lyceum’s administration does not collect or process special categories of your personal data revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, or data concerning your sex life or sexual orientation.

ADVERTISING MEASUREMENT AND AUDIENCES

When you fill in the registration form, we may use your email address and phone number for two more purposes.

1. To see whether our ads work. If you accepted advertising cookies, the website encodes your email address and phone number and passes them to Google. This shows us whether the registration came from our ad. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time on our Cookie Policy page.

2. For advertising audiences. We may upload your encoded email address and phone number to the advertising systems of Meta (Facebook, Instagram) and Google. They compare this data with their users and:

  • show our ads to people with interests similar to families who are already interested;
  • stop showing our ads to people who have already registered.

Meta and Google use the encoded data only for matching and delete it afterwards. They do not learn who registered and receive no information about your child. Legal basis: our legitimate interest in introducing the school to families who may find it relevant (Art. 6(1)(f) GDPR).

You can object at any time: write to info@vitliolicejus.lt and we will stop uploading your data and update existing audiences within 30 days.

We keep your data in audiences for no longer than 12 months after registration.

Google LLC and Meta Platforms, Inc. are US companies, so data may be transferred to the USA. Both participate in the EU-U.S. Data Privacy Framework, which the European Commission has recognised as providing adequate protection.

5. WHAT DO WE DO TO PROTECT YOUR PERSONAL DATA AND INFORMATION?

5.1. The Lyceum’s administration uses various technologies and procedures to protect your personal information and personal data against unauthorised access, use or disclosure.

5.2. We require the data processors (suppliers) that provide personal data processing services to the Lyceum to use appropriate data protection measures capable of protecting your confidentiality and ensuring the security of your personal data and information.

5.3. Please note that, although we take appropriate steps to protect your information, no website, online transaction, computer system or wireless connection is completely secure. The security of information transmitted over the internet or by email may sometimes be compromised for reasons beyond the control of the Lyceum’s administration. We therefore advise you to be careful when providing information or personal data to the Lyceum’s administration by electronic means of your choice rather than through the electronic systems used by the Lyceum.

5.4. We store the personal data you provide to the Lyceum’s administration in printed documents and in the Lyceum’s information systems no longer than necessary for the purposes set out in the service agreement and in the legal acts of the European Union and the Republic of Lithuania, and only for as long as storage is necessary for the performance of the contract or for archiving purposes, in compliance with the requirements and time limits set by those legal acts.

5.5. The Lyceum’s administration applies different retention periods for your personal data in accordance with the requirements of the legal acts of the European Union and the Republic of Lithuania, taking into account the purposes of processing and the Lyceum’s legitimate interest.

5.6. Exceptions to the retention periods may be made insofar as they do not infringe your rights as a data subject and comply with the requirements of the legal acts of the European Union and the Republic of Lithuania.

5.7. The Lyceum may process and store your personal data for longer when:

  • this is necessary to defend ourselves against claims or lawsuits brought by you and to exercise the Lyceum’s rights;
  • there are reasonable grounds to suspect unlawful activity on your part that is under investigation;
  • your data are needed to properly resolve a dispute, complaint or claim brought by the Lyceum;
  • there are other grounds provided for in the legal acts of the European Union and the Republic of Lithuania.

5.8. When the periods for processing and storing personal data set out in the contract and in the legal acts of the European Union and the Republic of Lithuania expire and have not been extended, your personal data will be destroyed in such a way that they cannot be restored.

6. YOUR RIGHTS AND HOW TO EXERCISE THEM

6.1. As a data subject, you have the right at any time, by submitting a written request to the Lyceum’s administration at Žemuogių g. 10, LT-08418 Vilnius, or by writing to info@vitliolicejus.lt, to read this Policy, to access the personal data the Lyceum processes about you, and to know how and for what purposes they are processed.

6.2. You have the following rights:

  • the right to access your personal data;
  • the right to have incorrect, inaccurate or incomplete data rectified;
  • the right to restrict the processing of your personal data while the lawfulness of the processing is being checked at your request;
  • the right to have your personal data erased;
  • the right to object to the processing of your personal data for direct marketing purposes, including profiling, or where your personal data are processed for the purposes of the Lyceum’s legitimate interests;
  • the right to have the personal data you provided to the Lyceum’s administration transferred to another data controller or processor, or provided directly to you in a convenient format (this applies to personal data you provided yourself that are processed by automated means on the basis of your consent or for the conclusion and performance of a contract);
  • the right to withdraw your consent to the processing of your personal data, without affecting the lawfulness of processing carried out before the withdrawal;
  • the right to lodge a complaint with the State Data Protection Inspectorate.

6.3. We will respond to your request no later than 30 (thirty) calendar days from the day it is received. In exceptional cases, where we are entitled to extend the time limit for providing the requested data or handling other requirements in your request to up to 60 (sixty) calendar days from the day you contacted us, we will inform you separately in writing or by the email address you provided.

6.4. If we refuse to grant your request in the circumstances set out in the GDPR, the LLPPD and other legal acts of the European Union and the Republic of Lithuania, we will inform you in writing or by the email address you provided, giving the reasons for the refusal.

7. TO WHOM MAY WE TRANSFER YOUR PERSONAL DATA?

7.1. The Lyceum’s administration protects your personal data in accordance with the GDPR, the LLPPD, directly applicable legal acts of the European Union and the Republic of Lithuania and the Lyceum’s internal rules. We may therefore transfer your personal data to third parties only in compliance with these legal acts and only upon a one-off lawful request from such parties or under a data provision agreement, except for data processors engaged by the Lyceum.

7.2. To process the personal data referred to in this Policy and provided by you, we may engage the following data processors:

  • companies providing data centre, website administration and related services;
  • companies providing document archiving and destruction services;
  • companies that develop, supply, maintain and improve software;
  • companies providing information technology infrastructure services;
  • companies providing communication and legal services;
  • companies that analyse internet browsing or online activity and provide related services.

7.3. Data processors may process your personal data on behalf of the Lyceum only on the instructions of the Lyceum (the data controller) and only to the extent necessary to properly perform the obligations set for them in the data processing agreement.

7.4. The Lyceum’s administration undertakes to take all necessary measures to ensure that the data processors it engages under contract have implemented appropriate organisational and technical measures to keep your personal data secure.

7.5. In compliance with the requirements of the legal acts of the European Union and the Republic of Lithuania, your personal data may be transferred to:

  • the Ministry of Education, Science and Sport of the Republic of Lithuania, the Vilnius County State Tax Inspectorate, the State Social Insurance Fund Board, the State Enterprise Centre of Registers and the State Enterprise Regitra;
  • courts, notaries, bailiffs and other law enforcement and dispute resolution bodies of the Republic of Lithuania exercising their lawful powers, upon their written request;
  • companies operating in the Republic of Lithuania that provide the Lyceum with debt collection, audit, training, video surveillance and security services;
  • other third parties, insofar as this relates to the provision of the Lyceum’s services, procurement, reorganisation of activities and services, or similar changes.

7.6. In all cases, the Lyceum’s administration will require the recipient to have a legal basis for receiving personal data. Without a legal basis, the Lyceum’s administration will not provide your personal data to third parties.

7.7. The Lyceum’s administration does not transfer any of your personal data to third parties unless you have consented to the disclosure or the transfer is required by the legal acts of the Republic of Lithuania and the European Union.

8. FINAL PROVISIONS

8.1. The Lyceum’s Privacy and Personal Data Protection Policy is reviewed at least once every two years or when the legal acts of the European Union and the Republic of Lithuania governing personal data processing change.

8.2. The Lyceum’s Privacy and Personal Data Protection Policy and personal data processing rules are published on the Lyceum’s website https://vitliolicejus.lt in the “Privacy policy” section.

8.3. Thank you for choosing and using the services of VšĮ Vilniaus inžinerijos ir technologijų licėjus. We do our best to make sure the Lyceum’s services meet your expectations.

__________________________________

E-Journal
E-Journal
Join Vitlis
Join Vitlis
Scroll to Top