1. What Does This Privacy Policy Mean?

In this Privacy Policy (hereinafter referred to as the “Privacy Policy”), we provide you with information on how Kamida Group Ltd. (hereinafter referred to as the “Company”) processes your personal data obtained through: the recruitment process; ensuring the protection of confidential information and business continuity; asset and personnel protection (video surveillance); fulfilling contracts between the Company and contractors (legal entities); handling requests, complaints, and dispute resolutions (judicial and extrajudicial); when you visit the Company’s website or social media accounts, or contact the Company. All persons whose data is processed by the Company are referred to as Data Subjects in this Privacy Policy.

2. About the Company

The Company refers to Kamida Group Ltd., legal entity code 304195013, with its registered office at Vėjo g. 1, Didvyrių k., Raudondvaris District, Kaunas region, Lithuania. The Company’s data is collected and stored in the Register of Legal Entities of the Republic of Lithuania. For inquiries related to data protection, please contact: info@kamidagroup.lt.

3. What is Personal Data?

Personal data is any information collected by the Company about a Data Subject that can be used to identify the individual and is stored electronically or otherwise.

Personal data includes any information such as the Data Subject’s name, surname, address, and any other data collected by the Company for the purposes outlined in this Privacy Policy or in separate consents or agreements with the Data Subject.

4. Execution of Contracts with Legal Entity Contractor

When executing contracts with legal entity contractors, the Company necessarily processes personal data of employees or other individuals involved in fulfilling the contract. Details regarding the processing of personal data are provided in the following table:

Purpose of Data Processing	Processed Personal Data	Legal Basis	Data Retention Period
Execution of contracts with legal entity contractors	Name, surname, email address, phone number, correspondence content, order processing status, date	GDPR Article 6(1)(f) (legitimate interest)	4 years of communication, 10 years after contract termination, or information related to contract execution
Accounting management	Name, surname, information on services received/provided and goods sold, other personal data specified in invoices and other accounting documents	GDPR Article 6(1)(c) (legal obligation)	The data is stored according to the terms established by the legal acts governing the management of accounting, as well as in accordance with the General Document Storage Terms Index

5. Candidate Selection

We collect and process your personal data (name, surname, desired position, work experience, education, and other details from your CV or cover letter) during the recruitment process, based on your consent, which is expressed by sending us your CV and/or cover letter. If you do not provide this information, we will not be able to assess your suitability for the position.

If you agree, we may contact your current employer, and your previous employer based on our legitimate interest in selecting the right candidate. You can withdraw your consent at any time by notifying us via the email provided in Section 2 of this Privacy Policy. 

In the event that you do not express your separate consent to process your personal data, after the end of this job selection, we undertake to delete and/or destroy your personal data within 3 days after signing the contract with the selected candidate or taking the decision to end the selection, except when separate consent is given regarding the candidate’s person for the period specified in the data storage consent.

Based on your consent, we will store the data for the period specified in the consent.

On the basis of our legitimate interest, we will process the data about the person specified by the candidate (name, surname, e-mail, telephone, information provided by the person) – former or current employer or the person providing the recommendation, the information provided by him – for the purpose of selecting the candidate. In this case, our legitimate interest is to select the right candidate for the position we are looking for. We will destroy this data at the end of the selection process.

6. Confidential Information Protection and Business Continuity

To ensure the protection of confidential information and business continuity, the Company may review employees’ correspondence with contractors. This includes processing personal data such as email addresses, sender/recipient names, dates, and content. Such data is stored for 4 years.

7. Asset and Personnel Protection

The Company implements video surveillance to ensure the safety of clients, visitors, employees, and other individuals entering the surveillance area, to protect property, collect evidence of violations, and defend the Company’s rights. The Company processes video surveillance data (image, movement trajectory, objects carried by individuals) based on its legitimate interest. The data is stored for 1 month from recording.

8. Handling of Requests, Complaints, and Dispute Resolution (Judicial and Extrajudicial)

For the purpose of handling requests, complaints, and resolving disputes (to exercise our legitimate interest in protecting our rights and legitimate interests), the Company processes the following personal data:

Categories of Data Subjects

• Individuals submitting requests, complaints, or otherwise initiating disputes, as well as individuals related to disputes initiated by the data controller (in the case of a legal entity – employees and other representatives);
• Representatives, employees, etc., of state and local government institutions, pre-trial investigation bodies, and other law enforcement authorities.

Processed Personal Data

• Name, surname, position, employer, email address, phone number, content of claims, complaints, or other dispute documents, personal data specified therein, as well as other personal data obtained during the review of the claim, complaint, or other statement.

Legal Basis for Data Processing

• GDPR Article 6(1)(f) (legitimate interest).

Data Retention Period

• 1 year after the final court decision or the conclusion of extrajudicial dispute resolution.

9. Internal Company Administration (Shareholder Rights)

For internal administration purposes, if a shareholder requests the implementation of their rights, the Company may disclose personal data recorded in documents provided to the shareholder. This is done to fulfill a legal obligation (GDPR Article 6(1)(c)), and the data is processed only until it is provided to the shareholder.

10. Contact Us

You can contact the Company by phone or email. We accept, review, and respond to all messages ourselves. If you contact us, we may process the data you provide us, namely your email address, phone number, name, surname (if provided), workplace (if mentioned in the email signature), as well as the dates, times, and content of sent and received messages.

Such data will be processed to respond to your inquiries and review your suggestions. If you do not provide your contact details, we will not be able to reach you.

Correspondence is stored for 1 year from the date of receipt, except for information for which other retention periods are specified in this Privacy Policy or by law.

All personal data you provide when communicating with us is used solely for the purposes mentioned above, as well as for reviewing communications and managing communication flows. We commit to not using your personal data in any publications without your explicit consent in a manner that would allow your identity to be determined.

Please note that we may need to contact you by mail, email, or phone. Please inform us of any changes to your personal data.

11. Website

Cookies are used on our website. The website allows you to upload your data in electronic form. We draw your attention to the fact that the uploaded data must not violate the rights or interests of any third parties. The person who uploads such data is responsible for any violations.

A cookie is a small file made up of letters and numbers that we record in your browser or on your computer’s hard drive with your consent. We use different cookies for various purposes. Cookies also help us distinguish you from other users of the website, thus ensuring a more pleasant browsing experience and allowing us to improve the website.

Most browsers allow you to refuse all cookies, and some browsers provide the option to refuse only third-party cookies. Therefore, you can take advantage of these options. However, please note that blocking all cookies will have a negative impact on your use of the website, and without cookies, you will not be able to use all the services provided on the website. More detailed information is available at AllAboutCookies.org or www.google.com/privacy_ads.html.

We may use the types of cookies described below, but a detailed and current list of the cookies used can be found in the Cookie Policy (www.kamidagroup.lt).

Absolutely necessary cookies.

These cookies are essential for our website to function. The basis for processing data handled by such cookies is the proper performance of the contract when you visit the website, while ensuring the quality and security of the visit. These may include cookies that allow you to log in and access secure areas of our website, use the shopping cart function, or electronic billing services.

Analytical and/or performance cookies.

These cookies allow us to recognize and count visitors to the site and see how visitors navigate through our site. This helps us improve the website’s performance, for example, ensuring that users can easily find what they are looking for. The basis for processing data collected by these cookies is your consent.

Functional cookies.

These cookies are used to recognize you when you return to our website so that we can tailor the content presented to your needs and remember relevant information for you. The basis for processing data collected by these cookies is your consent.

Commercial cookies.

We use our own and third-party cookies to display personalized advertisements on our site and others. This is called “remarketing,” which is based on browsing actions, such as products you have searched for or viewed.

12. Data Sharing and Disclosure

We collect your data from you, your devices, our employees, and from our contractual partners.

We may disclose information about you to our employees, intermediaries, service providers, such as companies conducting debt administration or recovery, marketing service providers, IT service providers, or subcontractors, if reasonably necessary for the purposes outlined in this Privacy Policy.

Additionally, we may disclose information about you:

• if we are required to do so by law;
• to defend our rights or interests (including providing your data to third parties to recover any debts you owe us);
• with the intent to sell a portion of the Company’s operations or assets, disclosing your personal data to a potential buyer of such operations or assets;
• upon selling the Company’s operations or a significant part of its assets to third parties.

Except as provided in this Privacy Policy, we do not provide your personal data to any third parties.

The list of recipients or categories of recipients specified in the Privacy Policy may change, so if you wish to be informed about changes to the recipients of your personal data, please notify us at the email address specified in this Privacy Policy, stating in the body of the message: “I wish to receive information about changes to the recipients of my personal data, Name, Surname”.

13. Data Security

Your personal data will be processed in accordance with the General Data Protection Regulation, the Law on the Legal Protection of Personal Data of the Republic of Lithuania, and the requirements established by other legal acts. When processing your personal data, we implement organizational and technical measures to ensure the protection of personal data against accidental or unlawful destruction, alteration, disclosure, as well as any other unlawful processing.

14. Your Rights

This section provides information about your rights related to our processing of your personal data and the circumstances under which you can exercise these rights. If you would like more information about your rights or wish to exercise them, please contact us via the email address provided in this Privacy Policy.

The company will provide information about the actions taken upon receiving your request regarding the exercise of your rights without undue delay, but no later than 1 (one) month after receiving the request. Considering the complexity of the request and the number of received requests, this period may be extended by an additional 2 (two) months. In such a case, we will inform you about the extension and the reasons for it within 1 (one) month from the receipt of the request. The company will only refuse to exercise your rights in cases stipulated by law.

14.1. Right to Access Your Personal Data

We aim to ensure that you fully understand how we use your personal data and that you do not experience any inconvenience. You can contact us at any time to inquire whether we process any of your personal data. If we store or in any way use your personal data, you have the right to access it. To do so, please submit a written request to the email address provided in this Privacy Policy, confirm your identity, and follow the principles of fairness and reasonableness when submitting such a request.

14.2. Right to Withdraw Consent

If you have given us explicit consent to process your data, you can withdraw it at any time.

14.3. Additional Rights

Below is information about additional rights you may have, which you can exercise according to the procedures described here:

(a) You have the right to ask us to correct any inaccuracies in the data we hold. In such a case, we may ask you to confirm the corrected information.

(b) You have the right to ask us to delete your personal data. This right is implemented under the conditions stipulated in Article 17 of the General Data Protection Regulation (EU) 2016/679.

(c) You have the right to request that we restrict the processing of your personal data or not process it:

• for a period necessary to verify the accuracy of your personal data, if you challenge its accuracy;
• when the collection, storage, or use of your personal data by us is unlawful, but you choose not to request the deletion of the data;
• when your personal data is no longer needed by us, but you require it to establish, exercise, or defend a legal claim;
• for a period necessary to determine whether we have a more important legal basis to continue processing your personal data, if you have exercised your right to object to its processing.

(d) You have the right to data portability for data processed by automated means, which we have obtained from you based on your consent or for contractual purposes. Upon exercising this right, we will transfer a copy of the data you provided upon your request.

(e) You have the right to object to the processing of your personal data in accordance with Article 21 of the GDPR. You have the right to object when your personal data is processed based on legitimate interest (the legal basis for data processing is indicated for each of the purposes mentioned above) or for direct marketing purposes.

14.4. Right to Request More Information

We hope you understand that discussing all possible ways of collecting and using personal data is very difficult. We strive to provide the clearest and most comprehensive information and are committed to updating this Privacy Policy when personal data usage processes change. However, if you have any questions about the use of your personal data, we would be happy to answer them or provide any additional information we are permitted to disclose. If you have any specific questions or did not understand the provided information, please contact us.

15. Complaints
    If you believe that your rights as a Data Subject have been or may be violated, please contact us immediately using the email address provided in this Privacy Policy. We ensure that upon receiving your complaint, we will contact you within a reasonable time and inform you about the progress of the investigation and, later, the outcome.

If you are not satisfied with the results of the investigation, you may file a complaint with the supervisory authority – the State Data Protection Inspectorate (www.vdai.lrv.lt).

16. Responsibility
    You are responsible for maintaining the confidentiality of the data you provide and ensuring that the data you submit to us is accurate, truthful, and complete. If any of the data you provide changes, you must inform us immediately via email. We will not be liable for any damage caused to you as a result of providing inaccurate or incomplete personal data or failing to inform us of changes.

17. Changes to the Privacy Policy

We may update or change this Privacy Policy at any time. If you would like to receive an updated version of the Privacy Policy, please notify us at the email address provided in Section