DATA SUBJECTS RIGHTS
INFORMATION PREPARED AND PROVIDED BASED ON THE GENERAL DATA PROTECTION REGULATION EU 2016/679
We inform you that Amsterdam LAB UAB (data controller), company code 306711293, registered office address J. Jasinskio g. 4-15, Vilnius, collects, processes, and stores data subjects’ data. This data is collected for the following purposes:
- To perform company functions, services, obligations, and contracts, or to take steps prior to entering into a contract;
- To comply with a legal obligation to which the data controller is subject;
- To pursue the legitimate interests of the data controller or a third party;
- To protect the vital interests of the data subject or another natural person;
- To perform a task carried out in the public interest or in the exercise of official authority vested in the data controller.
All personal data provided by the Client (including special categories of personal data) is processed and stored in accordance with the provisions of the Law on Legal Protection of Personal Data of the Republic of Lithuania, Regulation EU 2016/679, and the Service Provider’s local legal acts regulating personal data processing and protection. The Service Provider undertakes to ensure the security of processed personal data by implementing appropriate technical and organizational measures to protect personal data against unlawful destruction, accidental alteration, disclosure, and any unlawful processing.
According to the requirements of EU Regulation 2016/679, before providing you with services, we must obtain your consent for data processing and storage. This consent is given by signing a separate consent form, which provides accurate information about the types of data processed, the purposes of data processing, data retention periods, and potential data recipients and processors who may process the data while providing or assisting in providing services, or collaborating with our company.
DATA SUBJECTS’ RIGHTS
- RIGHT OF THE DATA SUBJECT TO ACCESS DATA AND HOW IT IS PROCESSED (ARTICLE 15 OF THE REGULATION)
The data subject, upon presenting an identity document to the data controller or processor, or confirming their identity in accordance with legal procedures or by electronic means that allow proper identification, has the right to obtain from the data controller confirmation as to whether personal data concerning them are being processed, and if so, has the right to access their personal data, from which sources and what personal data has been collected, for what purpose it is processed, to which data recipients it is provided and has been provided for at least the last 1 year. When personal data is transferred to a third country, the data subject has the right to be informed about appropriate safeguards relating to the transfer. The data controller shall provide a copy of the personal data being processed free of charge once per calendar year upon request. For any additional copies requested by the data subject, the data controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form. - RIGHT OF THE DATA SUBJECT TO REQUEST RECTIFICATION OF INACCURATE DATA (ARTICLE 16 OF THE REGULATION)
The data subject has the right to obtain from the data controller without undue delay the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement. - RIGHT TO REQUEST ERASURE OF DATA (RIGHT TO BE FORGOTTEN) (ARTICLE 17 OF THE REGULATION)
The data subject has the right to obtain from the data controller the erasure of personal data concerning them without undue delay, and the data controller has the obligation to erase personal data without undue delay where one of the following grounds applies:
a) The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
b) The data subject withdraws consent and there is no other legal ground for the processing;
c) The data subject objects to the processing pursuant to Article 21;
d) The personal data have been unlawfully processed;
f) The personal data have been collected in relation to the offer of information society services to a child under the age of 16 and the data of the minor was collected without parental or guardian consent.
However, these rights do not apply if the processing is necessary:
a) For exercising the right of freedom of expression and information;
b) For compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
c) For reasons of public interest in the area of public health;
d) For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes;
e) For the establishment, exercise or defense of legal claims. - RIGHT TO RESTRICT DATA PROCESSING (ARTICLE 18 OF THE REGULATION)
The data subject has the right to obtain from the controller restriction of processing where one of the following applies:
a) The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
b) The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
c) The controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims;
d) The data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject. - RIGHT TO DATA PORTABILITY (ARTICLE 20 OF THE REGULATION)
The data subject has the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:
a) The processing is based on consent;
b) The processing is carried out by automated means.
This right shall not adversely affect the rights and freedoms of others.
In exercising their right to data portability, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
This right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. - RIGHT TO OBJECT AND WITHDRAW CONSENT TO DATA PROCESSING (ARTICLE 21 OF THE REGULATION)
The data subject has the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.
Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning them for such marketing, which includes profiling to the extent that it is related to such direct marketing.
Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to their particular situation, shall have the right to object to processing of personal data concerning them, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
Note: Data subjects’ rights have various limitations, about which you can learn more by contacting us using the details provided below. We inform you that your refusal to consent to data processing may limit or completely terminate your ability to use our services if we cannot provide services or fulfill obligations without your data. However, if your data processing is suspended for direct marketing purposes, you can continue to use our services, but you will no longer be able to receive messages related to direct marketing about discounts, etc. - RIGHT TO LODGE A COMPLAINT WITH A DATA PROTECTION SUPERVISORY AUTHORITY
Data processing and protection in the Republic of Lithuania is supervised and controlled by the State Data Protection Inspectorate (SDPI). If you have decided that the company has violated your rights to data processing, you have the right to contact SDPI by phone or email. - FINAL PROVISIONS
If you want to exercise your rights, our employee will provide you with a document form where you can indicate your preferences regarding data processing in the company. We will provide a response about the decision within 30 calendar days. For more information about data subject rights, you can contact:
Company’s responsible person for data processing email: ask@mieless.com