This privacy notice provides information about how Ignitis Renewables companies (hereinafter referred to as “we“, “the Company“) collect and process personal data of natural persons (hereinafter referred to as “you”, “the Data Subjects“) in the course of the development of renewable energy projects.
We confirm that we will process your personal data in accordance with the requirements of the the GDPR and other applicable data protection legislation, as well as the instructions of competent authorities.
The Company processes personal data of the following natural persons for the purposes and on the legal grounds set out in this Privacy Notice:
the Company’s shareholders and/or their representatives;
Candidates applying to become employees of the Company;
Members of the management, supervisory bodies, committees of the Company;
the Company’s contractual counterparties and their representatives;
Owners and users of the land or other other real estate;
Representatives of communities;
Persons (applicants) who contact the Company directly or by means of remote communication (including by telephone, e-mail) with requests, complaints, etc.;
The participants who register for and attend the Company’s events;
Persons who visit the Company’s website.
In this Privacy Notice, we provide you with information about what personal data we collect about you, for what purposes and on what legal grounds we process it, how long we keep it, who we share it with, the rights you have and how to exercise them. The Company has the right to unilaterally amend and/or supplement this Notice. The updated Notice shall come into effect from its publication on the Company’s website: ignitisrenewables.lt. Please visit our website from time to time at for the most up-to-date version of our Privacy Policy.
DEFINITIONS
Personal data means any information relating to an identified or identifiable natural person (data subject). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, a personal identification number, location data and an online identifier, or to one or more factors specific to that natural person’s physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation (GDPR) 2016/679).
Company – UAB “Ignitis renewables”, legal entity code 304988904, address Laisvės pr. 10, LT-04215 Vilnius and its subsidiaries or successor subsidiaries.
Notice – this Company Privacy Notice, which provides information on how the Company processes personal data.
Other definitions used in the Notice shall be understood as defined in the legal acts regulating the protection of personal data (GDPR and the Law on Legal Protection of Personal Data of the Republic of Lithuania).
LEGAL BASIS FOR PROCESSING PERSONAL DATA
The Company shall process your data only for specific purposes on the following legal grounds:
where the processing is necessary for the conclusion and/or performance of a contract with you;
where you have given your consent to the processing of your data for one or more specific purposes;
where the Company is required to process your data in order to comply with legal requirements (compliance with a legal obligation);
where processing is necessary for the purposes of the Company’s legitimate interests, such as maintaining relations with third parties, defending the Company’s interests; responding to your requests, enquiries and claims etc.
PURPOSES OF DATA PROCESSING, SCOPE OF PROCESSED PERSONAL DATA (CATEGORIES), RETENTION PERIODS
The Company collects and processes the following personal data for the purposes and on the legal grounds specified below:
Identification, communication, and engagement with owners and users of land plots or other real estate properties for the purpose of developing renewable energy projects.
The legal basis for processing is the legitimate interest in the development of renewable energy projects (Article 6(1)(f) of the GDPR) and the fulfilment of a legal obligation (Article 6(1)(c) of the GDPR)
Categories of personal data – identification data such as name, surname, date of birth, etc.; contact data such as telephone number, email address, address, etc.; details of real estate such as address, unique number, cadastral number of the land plot, area, average market value, and other data specified in the extract from the Real Estate Register.
The conclusion and execution of land lease or other agreements with landowners (users) and other real estate property owners for the purpose of implementing renewable energy projects.
The legal basis for processing is the conclusion and/or performance of a contract (Article 6(1)(b) of the GDPR, where the party to the contract is a natural person), the legitimate interest in the development of renewable energy projects (Article 6(1)(f) of the GDPR, where the party to the contact is a legal person).
Categories of personal data – identification data such as name, surname, personal identification number, etc.; contact data such as telephone number, email address, residential address, etc.; data on real estate such as address, unique number, cadastral number of the land plot, area, average market value, other data specified in the extract of the Real Estate Register; financial data such as bank account number, date, amount, purpose of payments, etc.
Informing land plot owners and obtaining permits, approvals, authorizations, and consents for planned and/or developing renewable energy projects.
The legal basis for the processing is the performance of a legal obligation (Article 6(1)(c) GDPR) and the legitimate interest to develop renewable energy projects (Article 6(1)(f) GDPR).
Categories of personal data – identification data, suchas name, surname, personal identification number, etc.; contact data, such as telephone number, email address, residential address, etc.; data on real estate, such as address, unique number, cadastral number of the land plot, area, average market value, other data specified in the extract from the Real Estate Register.
Maintaining relations with third parties (e.g. partners) and their representatives.
The legal basis for processing is the legitimate interest in maintaining relations with third parties through their representatives (Article 6(1)(f) GDPR).
Personal data categories – identification data of the representatives of legal entities, such as name, surname, etc.; contact data, such as email address, address, telephone number, etc.; as well as other data such as Personal data proving the right of representation, title of position, signature.
The retention period for personal data is until the end of the contract and for 10 years thereafter.
Protection and assurance of the Company’s legitimate interests in the event of disputes.
The legal basis for data processing is the legitimate interest in asserting legal claims and ensuring defense in legal disputes (Article 6(1)(f) GDPR).
Categories of personal data – identifying data such as name, surname, etc. ; contact data such as email address, residential address, telephone number; financial data if relevant such as financial institution account number, etc.; data contained in correspondence, signature.
The retention period of Personal Data – where the Personal Data is necessary for the protection of the legitimate interests of the Company in the event of claims under civil law, no longer than 10 (ten) years from the termination of the contract, and where the Personal Data is necessary for the protection of the legitimate interests of the Company in the event that the Company is involved in a legal proceeding or investigation, until the end of that investigation or legal proceeding.
Dealing with complaints, requests, claims.
The legal basis for processing is the legitimate interest in handling complains, requests, claims. (Article 6(1)(f) GDPR).
Categories of personal data – identification data such as name, surname, etc., contact data such as email address, telephone number, address, data relating to the request, complaint, claim such as date, content of the request/complaint/claim, signature, correspondence data, etc.
The retention period for personal data is 5 years from the date of resolution of the complaint, request or claim.
Video surveillance for the purpose of ensuring the security of individuals and property
The legal basis for the processing is the legitimate interest in ensuring the security of individuals and property (Article 6(1)(f) GDPR).
Categories of personal data – image data of individuals (e.g. employees, partners, contractors, agents and other third parties) who have entered the field of view of cameras.
Retention period for personal data – video recordings are kept for 30 days.
Events organization.
The legal basis for processing is your consent (Article 6(1)(a) of the GDPR), legitimate interest in organising the event (Article 6(1)(f) of the GDPR).
Categories of personal data – identification data such as name, surname, contact details such as email address, other data provided at the time of registration for the Company’sevents, image if the event is filmed and/or photographed.
The storage period for personal data is until the expiry or withdrawal of your consent, or for a maximum of 2 years if the personal data is processed on the basis of legitimate interest.
Recruitment of employees
The legal basis for the processing is the legitimate interest of the Company in the selection of the employee (Article 6(1)(f) GDPR).
Categories of personal data – identification data, suchas name, surname, date of birth or personal identification number if required for identification purposes, contact data, such as telephone number, email address, etc.; qualification data such as education, qualifications, work experience, professional skills, professional qualities, personal data contained in curriculum vitae (CV) and/or other documents submitted, as well as publicly available information, including public information on professional social networks; application data, data collected during the recruitment process.
Improving the functionality of the Company’s website, ensuring its efficient and smooth operation
The legal basis for processing is your consent to the use of non-essential cookies (Article 6(1)(a) of the GDPR) and Company’s legitimate interest in using of essential cookies (Article 6(1)(f) of the GDPR).
Categories of personal data – cookies do not store information that can be used to directly identify the user, but information contained in cookies can be linked to the user’s device used, browsing history and other information obtained and stored by cookies.
The Company provides more information in the Cookie Policy.
RECEIVING PERSONAL DATA
The Company, in compliance with legal requirements, may receive your data from the following sources:
Directly from you;
Public registers;
Official authorities (e.g. municipalities);
Local communities;
Other public law bodies exercising public law functions (including bailiffs, notaries, courts);
Ignitis Group companies;
From other publicly available sources.
SHARING OF YOUR PERSONAL DATA
The Company may share personal data with the following third parties in certain circumstances, for example, to provide you services, to comply with legal requirements or to protect legitimate interests, such as:
service providers providing IT software, information systems, cloud computing, information hosting services, as well as accounting, postal or courier and other services, only to the extent necessary for the proper provision of services to the Company;
the Company’s investors (to the extent necessary for the proper internal administration of the Company), contracting authorities, counterparties;
banks or other financial institutions for the purposes of making the relevant payments or other financial transactions;
police, other law enforcement and state or municipal authorities (where expressly required by the relevant legislation) or other persons with relevant public powers (e.g. notaries, etc.), supervisory authorities (e.g. State Energy Regulatory Authority), as well as courts, arbitrators, and other dispute resolution bodies;
our professional advisers, such as lawyers, auditors or accountants (if necessary to provide services or protect the Company’s legitimate interests);
other natural or legal persons where this is necessary for the organisational changes of the Company, for example, when transferring shares, assets or part of the Company, and for the purpose of carrying out a legal due diligence of the Company (auditors of potential acquirers, representatives, etc.) or transferring the relevant data to the acquirer;
Ignitis Group companies;
In accordance with the requirements provided for by legal acts to state institutions e.g. the State Tax Inspectorate, the State Enterprise Centre of Registers etc.
TRANSFER OF PERSONAL DATA
Personal Data is processed by the Company in the European Union and the European Economic Area (“EU/EEA”), but in certain cases, for example, if the Personal Data Processor/sub-processor engaged by the Company is located outside of the EU/EEA, it may be necessary to transfer certain Personal Data outside of the EU/EEA, or to provide access to it to Data Processor outside of the EU/EEA, and the transfer of such Personal Data is necessary for the provision of the services. Personal Data may only be transferred outside the EU/EEA if the Company ensures adequate safeguards as required under the GDPR and there is a legal basis for such transfer.
PERSONAL DATA SECURITY MEASURES
The Company ensures the security and confidentiality of your Personal Data in accordance with the requirements of the applicable legislation and the implementation of appropriate technical and organisational measures to protect your data against unauthorised access, disclosure (except where the data must be provided in accordance with the requirements of the legislation), accidental loss, alteration, or destruction, or any other unlawful processing. These measures include the selection and configuration of appropriate computer systems, the protection of the information system, as well as organisational measures such as restricting access to systems, documents and premises, careful selection of service providers, and continuous training of employees.
YOUR RIGHTS RELATED TO PERSONAL DATA PROCESSING
Right to be informed and right of access to personal data
You have the right to receive information about the processing of your personal data in a transparent, comprehensible and easily accessible form, in clear and plain language. If you are unclear about any part of this Notice, you are welcome to contact us using the contact details provided in this Privacy Notice. You also have the right to obtain confirmation from the Company if your personal data is being processed and, in such case, to be provided with information about how we process your personal data, including the right to obtain a copy of such data.
Right to have personal data rectified
You have the right to request that the Company rectify or supplement inaccurate or incomplete personal data.
The right to have personal data erased (“right to be forgotten“)
You have the right to ask us to erase your personal data if the following circumstances exist: the personal data is no longer necessary for the purposes for which it was collected or otherwise processed; oryou withdraw the consent and there is no other legal basis for processing your personal data; orFor the other reasons set out in Article 17 of the GDPR. Please note that Article 17(3) of the GDPR provides for exceptions to the above cases where processing of personal data is necessary. If such exceptions apply in your case, we will inform you accordingly.
Right to request restriction of processing of personal data
You have the right to request that the Company restrict the processing of your personal data if: you contest the accuracy of the personal data – until such time as it is verified; the processing is unlawful and you do not consent to erase the personal data and instead request the restriction of its use;we no longer need the personal data for the purposes of processing it, but you need it to assert, exercise or defend legal claims;you object to the processing of your personal data – as long as it is verified that our legitimate grounds override yours. Where the processing of personal data is restricted, such personal data may be processed (other than stored) only with your consent or for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person or for an important public interest.
Right to data portability
You have the right to receive your personal data that you have provided to the Company in a structured, commonly used and computer-readable format, and the right to transfer that data to another controller if: the data are processed on the basis of consent or a contract; andthe data are processed by automated means. You also have the right to request that the Company transfers your personal data directly to another controller if this is technically possible.
Right to object
You have the right to object at any time to the processing of your personal data which is processed for the performance of a task carried out in the public interest or in the legitimate interest of the Company. In this case, the Company will no longer process your personal data unless we can demonstrate legitimate grounds for processing your personal data which override your interests, rights and freedoms or are necessary for the establishment, exercise or defence of legal claims.
Right to withdraw consent
If your personal data is processed on the basis of your consent, you have the right to withdraw your consent at any time. Withdrawal of consent shall not affect the lawfulness of processing based on consent carried out prior to the withdrawal of consent.
Right to lodge a complaint with a supervisory authority
If you believe that our processing of your personal data violates the provisions of the GDPR, you have the right to lodge a complaint with the supervisory authority (e.g. in Lithuania – the State Data Protection Inspectorate (address L. Sapiegos g. 17, 10312 Vilnius, Lithuania, e-mail:[email protected], website: https://vdai.lrv.lt/). Before submitting a complaint to the relevant supervisory authority, we would be grateful if you would contact us with your concerns. We will make every effort to resolve your issue promptly and carefully.
THE EXERCISE OF YOUR RIGHTS IN RELATION TO THE PROCESSING OF PERSONAL DATA
To exercise these rights, you may contact us regarding this Notice or the Company’s processing of your personal data in writing at Laisvės pr. 10, LT-04215 Vilnius or by e-mail: [email protected].
The Company must fulfill your rights within 1 month from the date of receiving your request, or refuse to fulfill the request, stating the reasons for such refusal. This period may be extended by an additional 2 months, considering the complexity and number of requests. In such a case, we will inform you of the extension within 1 month of receiving the request, along with the reasons for the delay. To ensure data protection and provide you with the opportunity to exercise your rights, we have the right to request additional information necessary to verify your identity.
