PRIVACY POLICY OF KLAIPEDA TECHNOLOGY TRAINING CENTER
This Privacy Policy of Klaipeda Technology Training Center regulates how Klaipeda Technology Training Center (hereinafter – the Center) processes personal data of its employees, students and other data subjects (hereinafter referred to as Data Subjects or You) and ensures the security of personal data.
WHO ARE WE?
When processing personal data, the Center, legal entity code 190974424, the address of the registered office: Puodžių str. 10, LT-92127 Klaipėda, Lithuania, tel. +370 46 313 682, e-mail address info@ktmc.lt, website https://ktmc.lt (hereinafter – the Website), is the data controller.
When processing personal data of Data Subjects, the Center undertakes to comply with the principles and requirements for the processing of personal data established in the European General Data Protection Regulation (hereinafter referred to as the GDPR) and other applicable legal acts. This Privacy Policy is applied in conjunction with other documents regulating the protection of personal data of the Center, which are published in the Section of the Website Asmens duomenų apsauga (Personal Data Protection). If You have any questions regarding the processing of personal data or would like to obtain more detailed information about the processing of personal data, please contact the Center’s Data Protection Officer by e-mail info@ktmc.lt or gdpr@privacypartners.lt.
WHEN DO WE PROCESS YOUR PERSONAL DATA?
The Center collects and processes Your personal data only when it is necessary to achieve the Center’s legitimate purposes and when we have a legal basis to do so. The Center shall process personal data:
- when You have expressed Your consent to the processing of personal data for the specified purpose or purposes, e.g. You have agreed to the provision of data collected during the browsing of the Website;
- when it is necessary in order to conclude and perform a contract with You in the provision of training services to You or in the performance of an employment contract concluded with You;
- when it is required by law, e.g. when we have to calculate and pay taxes that are mandatory for employers or provide information to the Registers of Educators or Students;
- where the processing of personal data is necessary for the legitimate interests of the Center, e.g. for the purpose of protecting assets, we carry out video surveillance of territories and premises.
WHAT PRINCIPLES DO WE FOLLOW WHEN PROCESSING PERSONAL DATA?
The Center processes only such personal data as is necessary to achieve the following purposes, i.e. The Center shall not collect or process personal data which are not relevant to the performance of the Center’s activities.
When processing Your personal data, the Center shall:
- comply with the requirements of applicable legislation, including the GDPR;
- process Your personal data lawfully, fairly and transparently;
- process Your Personal Data for clearly defined and legitimate purposes;
- take all reasonable steps to ensure that the personal data are accurate or complete and that inaccurate data are rectified without delay to the extent possible and, if there is no possibility of rectification, their processing shall be suspended and/or the data destroyed;
- personal data shall be processed in such a way that Your identity can be established for no longer than is necessary for the purposes of processing set by the Center;
- not transfer or make public Your personal data to third parties, except where this is provided for in the contracts or in the applicable legislation;
- when processing personal data, apply technical or organisational measures to ensure an adequate level of security of personal data, including protection against unauthorised or unlawful processing of data and against accidental loss, destruction or damage, and shall impose the same requirements on the processors which they have contracted.
FOR WHAT PURPOSES DO WE PROCESS YOUR PERSONAL DATA?
Your personal data is processed by the Center in order to:
- identify and confirm the identity of the Data Subject in order to obtain employment at the Center and/or to receive training services by concluding contracts with the Center and connecting to the Center’s information systems, where such access is necessary for the performance of work functions and/or for the provision of training services;
- conclude, execute, supplement and /or terminate the contract with the Data Subjects;
- establish schedules for the provision of training services;
- provide and administer dormitory accommodation services;
- keep records of learning outcomes;
- prepare certificates of completion of learning programs;
- provide training programme participants with learning materials and other information related to the provision of training services;
- process employee data in the administration of employment relationships and enabling them to provide training services;
- carry out the selection of employees for vacancies;.
- apply for participation in third-country projects related to the Center’s training programmes (expanding or supplementing them) and administer the participation of the Center’s employees and students in third-party projects;
- conclude and execute service contracts with suppliers (natural or legal persons).
WHAT PERSONAL DATA DO WE PROCESS?
The processing of personal data by the Center is summarized below, indicating the purposes of the processing, the legal bases for the processing and the time limits for storage:
| Purpose of data processing | Personal data processed | Legal basis for data processing | Time limit for data processing |
| SELECTION OF EMPLOYEES FOR VACANCIES | Candidate’s details of his/her CV: name, surname, age/date of birth, telephone number, e-mail address, address of residence, education, work experience | Candidate’s consent (Art. 6 Para. 1) (a) of the GDPR); actions to conclude a contract (Art. 6 Para. 1 (b) of the GDPR) | Until the end of the selection process, plus an additional time limit for the submission of complaints about the results of the competition. |
| DECLARATION OF PRIVATE INTERESTS AND CONFIDENTIALITY OBLIGATIONS | Name, surname, personal identification number of the person | Functions are performed in the public interest or by order of public authority (Art. 6 Para. 1 (e) of the GDPR) | 3 years after submission by an employee |
| EMPLOYMENT/DISMISSAL OF EMPLOYEES | Employee’s name, surname, telephone number, e-mail address, personal identification number, date of birth, identity card or passport document data, address of residence, gender, education | Conclusion and performance of the contract (Art. 6 Para. 1 (b) of the GDPR) | 50 years after the expiry of the employment contract |
| ADMINISTRATION OF LABOR RELATIONS | Employee’s name, surname, telephone number, e-mail address, date of birth, address of residence, education, qualification data, age of minor children / wards, personal file no., bank account no., level of disability / working capacity / special needs, marital status, information on vacations and business trips, code of identification in the register of educators, etc. | Performance of the contract (Art. 6 para. 1 (b) of the GDPR) | Time periods set in the national legislation and in the Documentation Plan |
| VERIFICATION OF THE LEGAL CODE FOR WORKING WITH CHILDREN (QR CODE) FOR EMPLOYEES, SERVICE PROVIDERS, VOLUNTEERS, TRAINEES, TRAINEES AND OTHER PERSONS PERFORMING ANY ACTIVITIES RELATED TO CHILDREN ON BEHALF OF THE CENTER | The name of the person for whom the QR code is formed, the date of formation of the QR code and the date and time of scanning the QR code, information if the code valid / invalid | Legal obligation applicable to the data controller (Art. 6 Para. 1 (c) of the GDPR) | During the validity of a person’s legal relationship with the Center |
| DEVELOPMENT OF EMPLOYEE COMPETENCIES IN TRAININGS, SEMINARS, CONFERENCES, ETC. | Employee’s name, surname, telephone number, work email address, position, department | Performance of the contract (Art. 6 Para. 1 (b) of the GDPR) | 5 years |
| PREPARATION OF PROJECT APPLICATIONS AND CONCLUSION OF PROJECT CONTRACTS (processing of employee data due to the requirements for project applications established or applied by the funding institution (e.g. LMT, CPVA, LVPA, ministries, etc.) | Name, surname, telephone number of the employee (other personal data may also be processed, depending on the requirements of the institution that issued the tender and the application forms used) | Performance of the contract (Art. 6 Para. 1 (b) of the GDPR); the legal obligation applicable to the data controller (Art. 6 Para. 1 (c) of the GDPR); the legitimate interest of the data controller in obtaining financing for carrying out the activities (Art. 6 Para. 1 (f) of the GDPR) | 10 years |
| COOPERATION IN THE PROVISION OF PRACTICAL MODULES FOR TRAINING UNDER PROJECTS FUNDED BY THE EU AND OTHER INSTITUTIONS | Student’s name, surname, main educational institution | Legitimate interest in the proper performance of the cooperation agreement (Art. 6 Para. 1 (f) of the GDPR) | Until the approval of final project reports |
| LESSON SCHEDULE DATA | Teacher’s name, surname, pedagogical duties | Performance of the contract (Art. 6 Para. 1 (b) of the GDPR) | During the validity of the schedule |
| INFORMATION NOTICES OF LOW-VALUE PURCHASES CARRIED OUT | Employee’s name, surname, telephone number, e-mail address, position | Legal obligation applicable to the data controller (Art. 6 Para. 1 (c) of the GDPR) | For a period to be determined by national legislation |
| PROCESSING OF DATA OF POTENTIAL SUPPLIERS IN THE OFFERS OF PUBLIC PROCUREMENTS | Name, surname, position of representatives of legal entities; name of natural persons, address of the activity, identification number of the document proving the legality of carrying out the activity | Legal obligation applicable to the data controller (Art. 6 Para. 1 (c) of the GDPR) | For a period to be determined by national legislation |
| PROCESSING OF DATA OF SUPPLIERS AND BUYERS ON A COMMERCIAL BASIS | Name, surname, position of representatives of legal entities; name of natural persons, address of the pursuit of activities, identification number of the document proving the legality of carrying out activities, bank account number | Performance of the contract (Art. 6 Para. 1 (b) of the GDPR) | 10 years |
| ARCHIVE MANAGEMENT | Data stored in the paper files of employees, students and other Data Subjects: name, surname, personal identification number, residence address, telephone No. Other personal data stored in employment contracts, copies of orders, resolutions on competitions / attestations in various characteristics, resumes, testimonials, etc. are also possible. | Legal obligation applicable to the data controller (Art. 6 Para. 1 (c) of the GDPR) | 50 years or other terms set out in the national legislation |
| DOCUMENT MANAGEMENT AND STORAGE | Correspondence, contracts, invoices, legal acts (orders, decrees, resolutions), meeting materials were received, sent in paper and electronic format. | The data controller is subject to a legal obligation (Art. 6 Para. 1 (c) of the GDPR); the legitimate interest of the data controller in providing the proper management of his resources (Art. 6 Para. 1 (f) of the GDPR) | Received and sent correspondence – 5 years; employee requests – 3 years; copyright contracts – 50 years; cooperation agreements – protected on a permanent basis; for other contracts, until the expiry date or for 10 years; accounts – 10 years; orders, resolutions – stored constantly; ordinances – 10 years; minutes of meetings for 10 years or kept on a permanent basis |
| CONCLUSION AND ADMINISTRATION OF TRAINING CONTRACTS | Name, surname, personal identification number, personal identification document number of the student and/or student representative (if the student is a minor); name, surname, personal identification number, date of birth, gender of the student under the age of 18, code of identification of the object in the Student Register, address of residence, e-mail address, telephone number, data on fees for the dormitory (bank account number). | Performance of the contract (Art. 6 Para. 1 (b) of the GDPR) | 50 years after the end of studies (archival documents and data for long-term storage); electronic data – 10 years |
| REPORTING OF TRAINING RESULTS AND PRACTICE WORK | Student’s name, surname, personal identification number, telephone number, e-mail address, results and assessments of the subjects of the curriculum, sessions and modules, semester average, number of academic debts held, study credits, level of study basic subjects, data of the graduation certificate / diploma, year of graduation, name of the training program and registration / identification data | Performance of the contract (Art. 6 Para. 1 (b) of the GDPR) | 50 years after the end of studies (archival documents and data for long-term storage); electronic data – 10 years |
| ADMINISTRATION OF FINANCIAL SUPPORT AND OTHER BENEFITS FOR STUDENTS | Student’ s name, surname, e-mail address, training program information, student’s certificate details, personal identification number, documents justifying the financial / social situation (e.g. family composition (with personal identification numbers), declared place, medical documents, allowances, birth / death certificate, extract from the police, family income, etc.) | Performance of the contract (Art. 6 Para. 1 (b) of the GDPR); the legal obligation applicable to the data controller (Art. 6 Para. 1 (c) of the GDPR) | 10 years |
| ADMINISTRATION OF THE ACCOMMODATION OF STUDENTS IN THE DORMITORY | Student’s name, surname, personal identification number, telephone number, e-mail address, address of residence | Conclusion and performance of the contract (Art. 6 Para. 1 (b) of the GDPR) | 5 years |
| ADMINISTRATION OF PARTICIPANTS IN NON-FORMAL EDUCATION PROGRAMMES | Name, surname, date of birth or personal identification number of student or the student’s representative, address of residence, telephone number, e-mail address; name, surname, date of birth or personal identification number of the student under the age of 18, address of residence, telephone number, e-mail address | Performance of the contract (Art. 6 Para. 1 (b) of the GDPR) | 5 years |
| DATA PROCESSING IN THE CENTER’S INFORMATION SYSTEMS AND ON THE WEBSITE | Employee’s name, surname, position, department, e-mail address | Legitimate interest of the data controller in the proper provision of services (Art. 6 para. 1 (f) of the GDPR) | For employees – until the end of the term of the employment contract; for students – until the expiry of the student’s certificate. |
| PROCESSING OF VIDEO DATA | Images of employees, students and other persons visiting the premises and territories of the Center shall be captured by CCTV cameras | The legitimate interest of the data controller in protecting his property and ensuring the safety of persons (Art. 6 Para. 1 (f) of the GDPR) | 14 days |
| VOICE DATA MANAGEMENT | Recordings of the voice of employees made during some internal meetings, meetings, contests | The legitimate interest of the data controller in having reliably recorded information about the resolutions taken for transfer to the meeting minutes (Art. 6 Para. 1 (f) of the GDPR) | Until the drawing up and approval of the meeting minutes and protocols of contests by the signatures of the responsible persons |
PROCESSING PERSONAL DATA ON THE WEBSITE USING COOKIES
Information about the processing of personal data on the Website using cookies is provided in the Center’s Cookie Policy.
WHERE DO WE PROCESS YOUR PERSONAL DATA?
The Center processes Your personal data in the data repositories of the Center used by the Center or in the repositories of the service providers contracted by the Center in the territory of the European Union/European Economic Area (EU/EEA).
Currently, when processing Your personal data, the Center does not transfer them to third countries. If there is a need to transfer Your personal data to a third country, we will inform You about it before performing the transfer and ensure the lawfulness and security of the transfer (application of the necessary transfer mechanisms and security measures).
TO WHOM DO WE TRANSFER AND FROM WHOM DO WE RECEIVE YOUR PERSONAL DATA?
We process Your personal data, which You provide to us directly, for example, when concluding employment contracts, or indirectly, for example, when concluding training contracts, when we receive Your data from LAMA BPO. We also receive Your data from Yourself or from Your employer when we conclude service or cooperation agreements. We also receive certain data that in some cases may be treated as personal data when You visit our Website.
When providing training services, fulfilling the obligations imposed on the Center by legal acts, the Center shall transfer Your personal data to the Student Register and the Register of Educators, as well as to the Register of Non-Formal Education, when obliged by legal acts.
When You pay for accommodation in a dormitory for the purpose of making payments, the Center uses third parties who transfer to us the personal data You provide to them, which we process as joint data controllers, in accordance with applicable legislation, personal data protection rules and privacy policies approved by each party in accordance with our obligations to ensure an adequate level of data protection and confidentiality.
WHAT RIGHTS DO YOU HAVE?
As a Data Subject, You have all the below rights established by the General Data Protection Regulation, which You can exercise by contacting the Center at its registered office at Puodžių Str. 10, LT-92127 Klaipėda, Lithuania, or by contacting the Center’s Data Protection Officer by e-mail: info@ktmc.lt or gdpr@privacypartners.lt:
- to know about the processing of Your personal data – to receive information about whether we process Your personal data and, if such personal data are processed, the right to access Your personal data;
- to request the correction of Your personal data if You determine that Your personal data being processed is inaccurate;
- to request the suspension of the processing of Your personal data, except for storage – in the event that, after familiarising Yourself with the personal data, You establish that the data are incorrect, incomplete or inaccurate, or are being processed unlawfully;
- to request the erasure of Your personal data (right to be forgotten), except when Your data must be stored on the basis of legal obligations applicable to the Center or for the establishment, execution and defense of legal requirements;
- to object to the processing of Your personal data when these data are processed or intended to be processed for the legitimate interest pursued by the Center;
- to receive personal data relating to You, which You have provided to the Center Yourself, processed by automated means, the processing of which is based on consent or a contract, in a commonly used machine-readable format, and to transfer them to another data controller (right to data portability), where technically possible;
- to withdraw Your consent to the processing of personal data at any time, if the data is processed on the basis of Your consent.
You can exercise Your rights Yourself or through representatives. When fulfilling Your request, the Center has the right and duty to verify Your identity, which will always be tried to be established in the simplest and most convenient way for You. By submitting a request, You can confirm Your identity in one of the following ways:
- if the application is submitted directly upon arrival at the Center – upon presentation of an identity document to our employee;
- if the application is submitted by post or through an authorized person, You must provide with him/her a notarized copy of the identity document;
- if the request is submitted by electronic means of communication, it must be signed with an electronic signature or it must be submitted from Your e-mail address that You have already used for communication with the Center prior to the submitting this Data Subject request.
Your request must be clear, contain Your name, information about what rights You want to exercise and to what extent, as well as information on how You would like to receive a response. If You submit Your application by electronic means, the information shall also be provided by electronic means, unless You request otherwise in advance.
The Center will examine Your requests and provide You with the information as soon as possible, but no later than within 30 calendar days from the date of receipt of the request. If, due to certain circumstances, such as the complexity of the application submitted (if it is necessary to seek assistance from the data processors involved) or the number of requests processed by the Center at the time, the Center may not have time to deal with the request in a timely manner, the response term may be extended for a maximum of two months, by informing You in advance.
Requests are processed and information and data are provided free of charge, but the Center has the right in certain cases either to refuse to exercise Your rights (when the request is unreasonable or disproportionate or repetitive), or the provision of information and data may be charged depending on the administrative costs of providing information or reports or actions requested, in accordance with the provisions of the legislation and the fees set by the Director of the Center (if an obvious abuse of the rights of the Data Subject is detected, repeated requests for information, data, extracts, documents, etc.) are unreasonably made.
If You believe that the actions of or failure to act by the Center violate Your rights or the provisions of legal acts, You have the right to submit a complaint to the supervisory authority – the State Data Protection Inspectorate (https://vdai.lrv.lt).
VALIDITY OF THE PRIVACY POLICY
This Privacy Policy is approved by the order of the Director of the Center and is valid from the date of approval. The Center has the right to review and update this Privacy Policy on a regular basis or if necessary, and to publish it on the Website. The Center will not inform You additionally about the update of the Privacy Policy in any other way.
______________________________