Allow

General provisions 

Joint stock company Lietuvos Airports, legal entity code 120864074, registered office address: Rodūnios kelias 10A, Vilnius, Lithuania, tel. No.: +37061244442, e-mail: (hereinafter - Lithuanian Airports) understands that the protection of personal data is important for our customers, suppliers, partners and other persons (hereinafter - data subjects) who cooperate or use the services of Vilnius, Kaunas or Palanga branches of Lithuanian Airports. For this reason, we take all necessary measures to ensure the privacy of each data subject and the exercise of personal data protection rights. 

You can contact our appointed Personal Data Protection Officer on all data protection issues by e-mail.

This Privacy Notice provides all information about how we, as Data Controllers, process personal data, including information about the purposes of the processing of personal data and the legal basis, what data is collected and further processed, how long it is stored, to whom it is provided, what rights you have and where you can ask about their implementation or any other issues related to the processing of personal data. 

The Privacy Notice applies to natural persons who cooperate with or use the services of any of all three branches of Lithuanian Airports (Vilnius, Kaunas and Palanga), visit our websites, social network accounts, or provide data to us for other purposes.

Our employees and members of the management body are informed about the processing of their personal data in accordance with the procedure established in the internal legal acts of Lithuanian Airports.

The Privacy Notice is prepared in accordance with the following legislation:  

  • Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as GDPR or Regulation)
  • Law of the Republic of Lithuania on the Legal Protection of Personal Data of 30 June 2018 no. XIII-1426 (hereinafter - ADTAĮ); 
  • Law of the Republic of Lithuania on Electronic Communications of 15 April 2004 No. IX-2135; 
  • Guidelines of the State Data Protection Inspectorate.  

This Privacy Notice is an integral part of the data protection policy approved by Lithuanian Airports. 

How do we collect your data? 

Depending on the nature of our cooperation, we process personal data as follows: 

  • Received directly from the data subject (you), for example when you send us inquiries, share your experience with the specified contacts, use our parking services, participate in our privilege programs or send us your CV in order to apply for vacancies;
  • which are generated when you use our services or enter our territory, for example when you visit our website or enter our video surveillance field;
  • obtained from other sources, such as insurance companies, airlines, other third parties.

For what purposes and what personal data do we process?  

Purpose of data processing 

Legal basis for processing 

Data categories 

Duration of data storage 

Execution of contracts with suppliers, (sub)contractors

Article 6(1) clause b of GDPR - performance of the contract

Name, surname, personal identification number, date of birth, contact telephone, e-mail, address of representatives of suppliers, (sub)contractors. Name, surname, position, e-mail address, telephone number of the person signing the contract

10 years after the end of the specific contract 

Administration of invoices from suppliers and (sub)contractors 

Article 6(1) clause c of GDPR - legal obligation 

Name, surname, position, address, e-mail address, telephone number

10 years 

Training and information for natural persons, non-airport staff working on airport premises

Article 6(1) clause c of GDPR - legal obligation 

Company, name, surname, e-mail, telephone number

3 years

Issuing permanent permits

Legal obligation Article 6(1) clause c of GDPR

Name, surname, personal identification number, nationality, telephone number, e-mail address, information on place of residence registered for the last 5 (five) years, place of work, reasons for unemployment, statements, confirmations, information on the functions for which the permit is required, name of the company, position, and confirmation of the accuracy of the personal data, criminal record, criminal convictions, date, certificates from third countries concerning good reputation, name of regime zone, reasons for permanent permit, name of training, date of completion of training, information on who carried out the training, make, model, registration number of the vehicle, owner of vehicle

5 years

Issuing temporary permits

Legal obligation Article 6(1) clause c of GDPR

Name, surname, information contained in the identity document (number, expiry date), e-mail, date of birth, telephone number, name of the company where the person is employed, period of time for which the temporary permit is issued, name of the area where the temporary permit is to be issued, the name of the employee of the company/establishment responsible for the person to whom the temporary permit is applied for and the name of the company, the name of the person accompanying the temporary permit holder, the make, model and registration number of the vehicle, and the name of the driver.

6 months

Issuing permits for driving motor vehicles

Article 6(1) clause c of GDPR - legal obligation

Driving licence number, name, surname, medical details, e-mail address and telephone number

6 months

Issuing permits for drone flights

Article 6(1) clause c of GDPR - legal obligation

Pilot’s licence number, telephone number, name, name of the customer

5 years

Authorisations to apply for permanent residence permits and permanent vehicle permits

Article 6(1) clause c of GDPR - legal obligation

Name, surname, position, e-mail, telephone number,  specimen signature

5 years

Receipt of requests to be registered on the list of entities operating in the controlled area

Article 6(1) clause c of GDPR - legal obligation

Name, surname, position, date

5 years

Registration of media representatives for access to the Airport area

Article 6(1) clause c of GDPR - legal obligation

Company, name, surname, e-mail

5 years

Managing applications for tour groups

Article 6(1) clause a of GDPR - consent 

Name, surname, personal identification number, date of birth of excursion participants

1 year

Video surveillance, implementation of aviation security measures, protection of Lithuanian airports’ assets and crime prevention 

Article 6(1) clause f of  GDPR - legitimate interest, Article 6(1) clause c of GDPR - legal obligation

Image, voice, other data visible in the video

30 days 

Passenger screening for aviation security

Article 6(1) clause c of GDPR - legal obligation

Name, surname, flight number, flight time

24 hours

Recording telephone conversations for quality assurance purposes

Article 6(1) clause f of GDPR - legitimate interest 

Call metadata: voice, time, duration, phone number, call content

6 months

Administration of damages, insured events 

Article 6(1) clause c of GDPR - legal obligation, Article 6(1) clause f of  GDPR - legitimate interest 

Name, surname, personal identification number, information on damaged property, information provided by insurance company and aviation company

10 years

Carrying out direct marketing 

Article 6(1) clause a of GDPR - consent 

Name, surname, e-mail, telephone number, age, purpose of travel

Until consent is withdrawn

Sending newsletters

Article 6(1) clause a of GDPR - consent 

E-mail

Until consent is withdrawn

Organisation of lotteries

Article 6(1) clause f of  GDPR - legitimate interest, Article 6(1) clause a of GDPR - consent

Participants’ social account details, winner's e-mail, telephone number, address for delivery of winnings

Until the end of the lottery

Administration of Lithuanian Airports’ websites and social networks 

Article 6(1) clause f of GDPR - legitimate interest 

Opinions and comments on social networks, name, surname, nickname

Opinions and comments posted on social networks are not deleted

Information collected by cookies

Article 6(1) clause a of GDPR - consent 

The specific information collected by cookies can be found in the cookie management window

The duration of the activity of specific cookies can be found in the cookie management window

Dealing with passenger enquiries, complaints and sharing their experiences

Article 6(1) clause b of  GDPR - performance of the contract, Article 6(1) clause a of GDPR - consent 

Name, surname, e-mail, telephone number, flight details, damage suffered, bank account number and other information provided by the passenger

6 months

Provision of services to very important persons, as provided for in the internal regulations of Lithuanian airports

Article 6(1) clause b of GDPR - performance of the contract

Name, date of arrival/departure, time, flight number, airport of departure/arrival, name of the person(s) picking up/dropping off the passengers, information on the vehicle(s) picking up/dropping off the passenger(s), their model, registration number(s)

6 months

Participation in the Lithuanian Airports Privilege Programme - Privilege Card

Article 6(1) clause a of GDPR - consent 

Name, surname, date of birth, e-mail, telephone number, address, visit history

1 year after expiry of the privilege card

Business Club administration

Article 6(1) clause b of GDPR - performance of the contract

Name, surname, flight number, class, loyalty card number, flight time

3 months

Fast Track service

Article 6(1) clause b of GDPR - performance of the contract

Action records - Passenger's passage date, time, airline, name, surname

3 months

Administration of user accounts and orders for the e-shop VNO.lt/e-shop.lt

Article 6(1) clause b of GDPR - performance of the contract

Name, surname, telephone number, e-mail, address.

5 years since the last active actions on your account

Provision of parking services

Article 6(1) clause b of GDPR - performance of the contract

Name, surname, e-mail, vehicle registration number, photo, traffic accident information, parking time, date

10 years

Conducting public property auctions

Article 6(1) clause b of GDPR - performance of the contract

Name, surname, personal identification number, address, telephone number, e-mail, name, surname, telephone number, e-mail of the authorised person, payment order details

10 years

Keeping records of services provided

Article 6(1) clause c of GDPR - legal obligation 

Name, surname, position, address, e-mail address, telephone number

10 years

Debt administration

Article 6(1) clause f of GDPR - legitimate interest

Name, surname, personal identification number, amount of debt

5 years, from the date of repayment of the debt

Selection of candidates for vacant positions

Article 6(1) clause a of GDPR - consent, Article 6(1) clause f of  GDPR - legitimate interest

Name, surname, telephone number, e-mail, CV data, motivational letter

If no consent has been obtained, until the end of the selection process

If consent is given - 6 months.

Selection of candidates for vacant positions

Article 6(1) clause f of GDPR - legitimate interest

Content of the recording of the job interview (oral test)

1 year

Purpose of recruitment of candidates
(on the basis of an approved list of duties)

Article 6(1)(C) of the GDPR - legitimate interest for the purpose of compliance with a legal obligation to which the controller is subject, and Article 6(1)(A) of the GDPR - consent (in the case of a check pursuant to the Law on the Protection of Objects of Importance to Ensuring National Security), and in accordance with Appendix 11.1 of the EC Regulation 1998/2015

Name, surname, personal number, date of birth, residence history for the last 5 years, employment history for the last 5 years, phone number, e-mail, ID document information (type, number, validity, copy), photograph, nationality, education, information on whether the person has been recognised as incapacitated or as having limited capacity in any field or is subject to compulsory medical measures, whether the person has been registered in a health care institution for alcoholism or drug addiction in the last 3 years, whether the person has a history of mental disorders and any other information provided by the competent authorities

3 years from the end of employment

Authorisation of unescorted access to the aerodrome for employees of contractors/subcontractors/suppliers
(on the basis of an approved list of duties)

Article 6(1)(C) of the GDPR - legitimate interest for the purpose of compliance with a legal obligation to which the controller is subject, and Article 6(1)(A) of the GDPR - consent (in the case of a check pursuant to the Law on the Protection of Objects of Importance to Ensuring National Security)

Name, surname, personal number, date of birth, information on whether the person has been recognised as incapacitated or as having limited capacity in any field or is subject to compulsory medical measures, whether the person has been registered in a health care institution for alcoholism or drug addiction in the last 3 years, whether the person has a history of mental disorders and any other information provided by the competent authorities

1 year

Managing the working relationship between the members of the audit committee and the members of management

Article 6(1) clause a of GDPR - consent, Article 6(1) clause f of  GDPR - legitimate interest

Name, surname, telephone number, e-mail, salary, length of service, list of related persons (board members and audit committee). Contract, personal identification number, address, bank account, hours worked, total hours

10 years

Event organisation

Article 6(1) clause a of GDPR - consent

Company name, position, name, surname, e-mail address, telephone number

6 months

Keeping records of authorisation of the airports’ users‘ committee

Article 6(1) clause c of GDPR - legal obligation

Name, surname, enterprise/company, position, personal identification number, duration of authorisation

10 years

How do we protect your data? 

Lithuanian Airports have implemented proper technical and organizational measures to ensure an appropriate level of security in data processing. We guide the selection and implementation of the technical and organizational measures to ensure the security of data processing: 

To whom do we provide your data? 

Lithuanian Airports uses only those data processors that ensure compliance with the GDPR and the same level of personal data security as set out in our personal data protection policy. 

Here is a list of categories of data recipients at Lithuanian Airports

  • state institutions in accordance with the procedure provided by law;
  • Data Centre, Hosting, Cloud, Website Administration and Related Services, Software Development, Provisioning, Supporting and Development Companies, IT Infrastructure Services Companies, Communication Services Companies; 
  • subcontractors; 
  • law enforcement authorities at their request or on our own initiative if there is a suspicion that a criminal offense has been committed, as well as courts and other dispute resolution bodies.

Do we provide your data outside the European Union and the European Economic Area?

We ensure that your data is processed in accordance with the requirements and standards established by the legal acts of the European Union and we inform you that your data is processed only within the European Union and the European Economic Area.

Consequences of non-submission 

You have the right to refuse to provide your personal data, but the provision of your personal data is necessary and mandatory for the purposes set out in this Privacy Notice, so if you do not provide your personal data, we will not be able to achieve the purposes listed. 

What rights do you have and how can you exercise them?  

In accordance with the provisions of the GDPR, you, as a data subject, can exercise these rights:  

1The right of access to personal data. I.e. to submit a request for information on whether your personal data is processed, and if personal data is processed, you have the right to access your processed personal data. 

2. The right to correct personal data. I.e. to submit a request to correct your personal data if you find that the personal data we process is incorrect, incomplete or inaccurate. 

3The right to delete data (a right “to be forgotten”). I.e. to request the deletion of your personal data if you believe that your data has been processed illegally or fraudulently. 

4. The right to restrict data processing. I.e. to make a request to restrict (suspend) the processing of your personal data, except for storage - in case, for example, you request the rectification of your personal data (while the accuracy of personal data is checked and / or corrected), if it is established that personal data is processed unlawfully and you do not consent to the deletion of the data and you have expressed your consent to the processing of your personal data, etc. 

5. The right to data transfer. I.e. to submit a request to transfer your personal data, which is processed by automated means, to you and / or another data controller in a systematic, commonly used and computer-readable format. 

6. The right to object to data processing. I.e. to object to the processing of personal data where the processing is carried out on a legal basis or on a legal basis in the public interest.  

7The right to request that you are not subject only to a decision based on automated data processing, including profiling, which has legal consequences for you or which has a significant effect on you in a similar way;  

8. The right to withdraw a consent given to us at any time, with regard to the processing of personal data, for example for direct marketing.  

 

You can exercise your rights: 

  1. By sending us a free-form request by e-mail: The application must be electronically signed or accompanied by a notarized copy of an identity document in order for us to verify your identity. 
  1. By sending the application by registered mail to the address Rodūnios kelias 10A, Vilnius, Lithuania. The application must be signed and accompanied by a notarized copy of your identity document. 
  2. You can also exercise your rights through a representative. In this case, your representative must provide your name, contact details, a copy of an identity document certified by a notary, information about you, namely: name, surname, other data on the basis of which we could identify you as a data subject, as well as a notarized copy of the document supporting your representation.

 

The request must be legible, signed, state the name, address and other details of the data subject in the desired form of communication, information on which of the data subject's rights and to what extent the data subject wishes to exercise.  

We will provide a response to your request no later than within 30 (thirty) calendar days from the date of receipt of the request. In exceptional cases requiring additional time, we will, after notifying you, have the right to extend the deadline for submission of the requested data or examination of other requirements specified in your request to 60 (sixty) calendar days from the date of your request.  

Where can you submit questions regarding personal data? 

If you have any questions regarding the information provided in this Privacy Notice or the protection of your personal data and the exercise of your rights at Lithuanian Airports, please contact our data protection representative in any way convenient for you: 

  • by e-mail: 
  • in writing to the address: Rodūnios kelias 10A, Vilnius, Lietuva.

If a solution that is suitable for both parties cannot be found, you have the right to contact the State Data Protection Inspectorate at the address: L. Sapiegos str. 17, Vilnius.

 

Cookies 

A cookie is a small text file that a website saves in the browser of your computer or mobile device when you visit the website. It allows your website to "remember" your actions and options (such as registration name, language, font size, and other display options) for a period of time so that you don't have to re-enter them each time you visit the site or browse its various pages. 

The information collected by cookies allows us to ensure that you can browse more conveniently, as well as learn more about the behavior of website users, analyze trends and improve the website. 

You can find out what cookies are used on this page and how to manage them in the cookie control panel of each page. 

 

Final provisions of the Privacy Notice

The Privacy Notice is adjusted at the discretion of the Data Controller or in the event of a change in the requirements of applicable legislation.

The current version of the Privacy Notice is published on the website, so it is recommended that you read the latest version.

Latest version: 07-04-2022.

Last updated: 2023 09 05
Back