PRIVACY POLICY OF UAB KALBA.LT

PRIVACY POLICY OF UAB KALBA.LT IMPORTANT INFORMATION

HOW WE COLLECT, USE AND STORE YOUR INFORMATION

Last update date: 07-08-2019

UAB Kalba.lt (or simply “Company” or “We”) keeps information about you and your privacy. In our Company, we follow the European Union’s General Data protection Regulation (GDPR)[1] and other Data protection legislation containing the requirements of the protection of your information. This notice provides more detailed information about it.

What will I find in this policy?

In this Policy you will find answers to the most frequent questions about how we collect, use and store information about you, your children or foster children. This is important to you – please read the information carefully. This policy may be subject to change. Please from time to time visit the Company’s website on www.kalba.lt and read our latest policy version.

Who is responsible for the protection of information about me?

We are: UAB Kalba.lt

Our company code: 235980580

Our address: Vytauto pr. 32, Kaunas

Our E-mail address: [email protected]

Our tel. No: +370 68 747 211

Why and what information do you collect about me?

No.	Why do you collect information about me?	When is it relevant to me?	What information do you collect about me?	Why do you have the right to collect my information?	How long do you use or keep information about me?
3.1.	Because we provide you with consultation services according to the requirements of the law, in a proper and high-quality manner	When you are interested in studying at foreign universities	full name, residential address, date of birth, email address, telephone number, name of one of the parents/guardians, telephone number of one of the parents/guardians, name of the preferred university, country name of the preferred university, title and duration of the studies programme, copy of identity document, identity document information, motivational letter, teacher’s recommendation, information about your grades, other documents which may be required for applying for admission to the university, exams to be taken, type of exam (state matriculation examination or school examination), information on your participation in the Company’s joint and individual consultations, date of submission of documents for admission to foreign universities, information on the amounts you have paid to the Company, payment information, bank account number, application for admission to university, informational application for admission to university, date of sending the application for admission to university, UCAS questionnaire and its data, UCAS code, UCAS password, information on admission/non-admission to selected foreign universities, information on additional requirements submitted by the university, information about the results of your international CAE, IELTS and/or TOEFL exams, CAE, IELTS and/or TOEFL exam certificates.	We conclude and execute a contract with you (Article 6 (1) (b) of the GDPR) We must collect information in accordance with the laws (Article 6 (1) (c) of the GDPR)	During the validity of the contract
3.2.	Because we certify transcripts of your personal documents with a notary for you	When you request the Company to certify a copy of your ID	Full name, telephone number, e-mail address, personal number, personal documents (identity card, passport), information provided in the ID documents, notarised copy of the document, other information provided in the notarised copy of the ID document, amount payable for the service, your consent, signature.	You consent with it (Article 6 (1) (a) of the GDPR)	Until you retrieve the documents after the service has been delivered
3.3.	Because we provide you or your children (foster parents) with the organisation and delivery of language teaching, language proficiency testing, and related payment obligations	When you or your child (child in the custody) participate in our organised language training or courses	For you or your child (guardian): full name, personal identification number or date of birth, residential address, telephone number, e-mail address, signature, selected training type, information on amounts you have paid to the Company, amount of discount, payment schedule, bank account number, name of the bank at which you have an account, training contract, training contract number, date of signing the training contract, other information provided in the training contract, attendance of training sessions, achievement and test scores, language level determined with diagnostic tests, information on training duration, time and place, other information, related to the execution of the training contract.	We enter into and execute the training contract with you, your employer, your children or foster children (Article 6 (1) (b) of the GDPR) We must collect information in accordance with the laws (Article 6 (1) (c) of the GDPR)	During the validity of the contract
3.4.	Because we provide the services of organising and running language camps to your children (foster children), we fulfill the related tax obligations	When your child (foster child) attends our language camps	Your full name, telephone number, signature, full name of your other child/foster parent/guardian, full name of the child/foster child, personal identification number or date of birth, home address, telephone and e-mail address, training dates, training place, information on the amounts you have paid to the Company, bank account number, training contract, training contract number, date of signing the training contract, other information provided in the training contract and its annexes, language level your children/foster children determined with diagnostic tests, knowledge test certificate and ratings of child/foster child, registration form and its information.	We conclude and execute a contract with you (Article 6 (1) (b) of the GDPR) We must collect information in accordance with the laws (Article 6 (1) (c) of the GDPR)	During the validity of the contract
			Copy of your child’s /foster child’s ID.	The processing of data is necessary to protect the vital interests of your child/foster child (Article 6 (1) (d) of the GDPR)
			The information contained in your letter about your child’s/foster child’s preventive health checks, information about the peculiarities of your child’s /foster child’s diet and allergies, and the information on health disorders of the person participating in the camp.	The processing of data is necessary for important reasons of public interest in accordance with the legislation of the Republic of Lithuania (GDPR Art. 9 para. 2 (g), Lithuanian Hygiene Norm HN 79:2010 Children’s Recreation Camp. General health safety requirements)
3.5.	Because we organise educational events (exhibitions) which you attend	When you participate in our organised events	Full name, e-mail address, telephone number, information about your arrival/non-arrival to the event, ticket information, information of the university of your interest.	We conclude and implement the training contract with you (Article 6 (1) (b) of the GDPR)	During the validity of the contract
3.6.	Because we maintain relationships with the natural or legal persons you represent	When you or your represented person are our customers, when you take interest in our services	Full name, personal code, address, power of attorney, term of validity of the power of attorney, signature, relation to the person represented, person represented, position title, telephone number, email address, communication with the Company, information about the person you represent, etc.	We have a legitimate interest (in maintaining relationships with your represented persons) (Article 6 (1) (f) of the GDPR)	During the contract with the person you represent
3.7.	Because we inform you about the Company’s goods and services that are relevant to you	When you are our customer, when you are interested in our services	Full name, telephone number, address, organisation represented, email address.	You agree that we will use information about you (Article 6 (1) (a) of the GDPR, Article 69 (1) of the Law on Electronic Communications) or you have purchased goods or services from us (Article 69 (2) of the Law on Electronic Communications) We have a legitimate interest (to engage in direct marketing) (Article 6 (1) (f) of the GDPR)	For 5 years after giving the consent or termination of relationship with you, unless you express your objection within this period
3.8.	Because you provide a query, review, request or complaint to us	When you are our customer, when you are interested in our services	Full name, email address, country, phone number, topic of the query/review, time of receipt of the query/review, content of the query/review, annexes to the query, response to the query.	We have your consent (Article 6 (1) (a) of the GDPR) We have a legitimate interest (to examine your requests, queries or complaints) (Article 6 (1) (f) of the GDPR)	10 years after the last referral
3.9.	Because we ensure the safety of your health, life and property of the Company – when you are filmed at the Company’s premises	When you enter our premises, you are monitored by surveillance cameras	Video material.	We have a legitimate interest (security of property and persons) (Article 6 (1) (f) of the GDPR)	14 days
3.10.	Because we can participate in legal proceedings related to you	Only if we become a party in the court proceedings or other legal processes you are related to	All of the above-mentioned information, documents and attachments sent to you, documents and attachments you have submitted, procedural documents, court orders, rulings, decisions.	We have a legitimate interest (to defend the Company’s rights in legal proceedings) (Article 6 (1) (f) of the GDPR)	10 years after the expiration of contract with you or 10 years after the end of legal proceedings
3.10.			Information on criminal offenses and judgements of conviction.	Data is required in order to claim, enforce or defend legal claims (Article 9 (2) (f) of the GDPR)

What information must I provide to you and why?

Please review the answer to question 3 above – you must provide the information about yourself which is necessary in order to:

For the purpose 1, we will enter into and execute a contract for the provision of consultation services with you, and at your request, to order and provide you with the documents required for admission to foreign universities.
For the purpose 3, we will conclude and execute a training contract with you when you or your child/foster child attend language courses organised by us;
For the purpose 4, we enter into and execute a training contract with you when your child/foster child participates in our language camps;
For the purpose 5, we conclude and execute a contract with you to participate in the exhibitions we are organising when you are interested in the events (exhibitions) we organise.

Where do you get information about me?

Most of the information is collected directly from you. However, we receive some of the information from the following parties:

Facebook Ireland Ltd. (for the purpose of Clause 3.8);
Google Ireland Ltd. (for the purpose of Clause 3.8);
LinkedIn Ireland Unlimited Company (for the purpose referred to in Clause 3.8).

To whom do you transfer information about me?

We transfer the information related to you to the following entities and only when this is necessary and permitted under applicable laws and for the reasons listed in Clause 3:

To the foreign universities of your choice, to which we submit the application documents on your behalf (data are transferred for the purpose specified in Clause 3.1);
For a UK company that administers the UCAS (Universities and Colleges Admissions Service) system (data are transferred for the purpose specified in Clause 3.1);
for training facilitators and camp leaders who work under self-employment certificate (the data are transferred for the purposes set out in points 3.3 and 3.4);
UAB EGOperfectus (the data are transferred for the purposes set out in points 3.1 and 3.5);
For foreign educational institutions from which you would like to find out more about opportunities for higher and secondary education abroad (data are transferred for the purpose specified in Clause 3.5);
Facebook Ireland Ltd. (data are transferred for the purpose specified in Clause 3.8);
Google Ireland Ltd. (the data are transferred for the purposes set out in points 3.7 and 3.8);
LinkedIn Ireland Unlimited Company (data are transferred for the purpose specified in Clause 3.8);
for courts, supervisory, law enforcement and other public authorities (the data may be transferred for any of the purposes specified in the answer to question 3);
For your employers (data are transferred for the purpose specified in Clause 3.3);
lawyers, notary, bailiffs, auditors, consultants, IT maintenance service providers, providers of electronic communications services, insurance companies, companies providing archiving and other services to the Company (the data may be transferred for any of the purposes specified in the answer to question 3);
If necessary, – to companies that intend to buy or buy the Company’s business.

How do you protect my data transferred outside the European Economic Area[2]?

In most cases, Personal Data are processed and transferred within the territory of the European Union and the European Economic Area, but in the case of the provision of certain services, the data may be transferred and processed outside the above-mentioned areas when the protection of Personal Data is ensured at an adequate level. When permitted by law and is required for the reasons given in this policy to the answer to question 6, we disclose the information about you to:

Facebook, Inc. (USA) (data are stored in accordance with the Privacy Shield program);
Google LLC (USA) (data are stored in accordance with the Privacy Shield program);
LinkedIn Corporation (USA) (data are protected according to the Privacy Shield Programme).
Multiple Natures International (USA) (data are protected according Standart Contractual Clauses)
Foreign universities (USA) (data are protected according Standart Contractual Clauses)

What rights do I have?

GDPR and other laws give you the rights, provide the cases when you can exercise his right, the procedures you have to follow, and the exceptions when you will not be able to exercise his rights. When permitted by law, you can:

Submit a request to us for receiving a confirmation as to whether the Company’s processes the Data related to you and to request access to the data processed and related information;
Provide us with a request to correct inaccurate, incorrect information, or to supplement it when it is incomplete;
Provide us with a request to delete the information we have about you if we use it illegally;
Provide us with a request to limit the processing of information about you – when you dispute the accuracy of the data or object to the processing of the data, you object to the unlawful processing of your data or you need the data in order to claim, execute or defend the legal requirements;
Express objection on the use of data – when we do so on the basis of the Company’s legitimate interests and/or third party interests;
Provide us with a request for the transfer (receipt) of the data you have provided to us under the contract or with the consent/express consent and which we process using automated means in the generally used electronic form;
To object to the application of a completely automated solution, including profiling, in respect of you, if the adoption of such solution has legal effects or a similar significant effect to you;
To revoke the consent given to us regarding the use of your information – when we use the data based on your consent;
File a complaint to the supervisory authority, in particular in the Member State of your habitual residence or the place where the alleged breach of the GDPR was committed and to seek legal remedies.

Are you profiling me and making automated decisions?

The Company may profile you for statistical purposes, as well as to prevent the sending of unsolicited marketing offers, by categorising you by the contract date, contract expiration/termination term, contract status, your age, type of language courses of your interest.

How to contact us?

For requests or complaints, please use the contacts listed in question 2 above. Please note that there are exceptions to the law when you are unable to exercise your rights and the procedures we will follow to assist you.

[1] Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of Personal data and on the free movement of such data, and repealing Directive 95/46/EC

[2] The European Economic Area comprises all the Member States of the European Union as well as Iceland, Liechtenstein and Norway.