1.1. Data controller - UAB "Nordic Idea" (hereinafter - the Company), legal entity code 302642572, registration address Vasario 16-osios st. 38, Garliava, Kaunas district. self.

1.2. Data subject – any natural person whose data is processed by the Company. The Data Controller collects only those data of the data subject that are necessary for the Company's activities and/or visiting, using, and browsing the Company's websites, Facebook social network account, etc. (hereinafter referred to as the Website). The company ensures that the collected and processed personal data will be secure and will be used only for a specific purpose.

1.3. Personal data – any information directly or indirectly related to a data subject whose identity is known or can be directly or indirectly determined using the relevant data. Processing of personal data is any operation performed with personal data (including collection, recording, storage, editing, modification, granting of access, submission of requests, transmission, archiving, etc.).

1.4. Consent any voluntary and knowingly given confirmation by which the data subject agrees to process his data for a specific purpose.

2.1. Personal data is provided by the data subject himself. The data subject applies to the Company, uses the services provided by the Company, purchases goods and/or services, leaves comments, asks questions, applies to the Company for information, etc.

2.2. Personal data is obtained when the data subject visits the Company's website. The data subject fills in the forms therein or leaves his contact details etc. for any reason.

2.3. Personal data is obtained from other sources. Data is obtained from other institutions or companies, publicly available registers, etc.

3.1. By submitting personal data to the Company, the data subject agrees that the Company will use the collected data to fulfill its obligations to the data subject, providing services that the data subject expects.

3.2. The Company processes personal data for the following purposes:

3.2.1. Provision of furniture production services and administration of company debtors. For this purpose, the following data is processed:

When providing furniture manufacturing services, personal data of customers (natural persons) may be processed: first name(s), last name(s), phone number, email address, bank details, and other data related to the sale of goods and/or the provision of services.
When administering the Company's debtors, transferring debts for collection, personal data of clients (debtors, natural persons) may be processed: first name(s), last name(s), telephone number, e-mail address, bank details, the amount owed, information about services provided and/or sold goods, other data related to indebtedness.
Contracts, VAT invoices - invoices and other related documents are stored by the terms specified in the general document storage index, approved by order of the Chief Archivist of Lithuania.
Data related to the administration of the Company's debtors are stored no longer than is necessary for the purposes for which the personal data is processed.
The legal basis for data processing is the need to fulfill a contract to which the client is a party as a data subject, or to take action at the client's request before concluding a contract with him (GDPR Article 6 d. 1 point b), when certain personal data are required to be processed by legal acts (GDPR Article 6 d.1 point c) and the need to pursue the Company's legitimate interests in improving its operations and business success indicators (GDPR Article 6 d.1 point f).

3.2.2. Ensuring and continuity of the company's activities. For this purpose, the following data is processed:

Personal data of suppliers (natural persons) may be processed to conclude and execute contracts: first name(s), last name(s), personal identification number or date of birth, place of residence (address), telephone number, e-mail address, workplace, position, signature, data in the business certificate (type of activity, group, code, name, periods of activity, date of issue, amount), individual activity certificate number, data or the data subject is a VAT payer, bank account and bank, amount of service/goods, currency and other data provided by the person himself, which the Company receives by legislation in the course of the Company's activities and/or which the Company is required to process by-laws and/or other legal acts.
Data of supplier representatives are processed to conclude and execute contracts: first name(s), last name(s), telephone number, e-mail address, company name, address, duties, and authority data (number, date, date of birth of authorized person, signature).
Contracts, VAT invoices - invoices and other related documents are stored by the terms specified in the general document storage index, approved by order of the Chief Archivist of Lithuania.
The legal basis for data processing is the need to fulfill a contract to which the client is a party as a data subject, or to take action at the client's request before concluding a contract with him (GDPR Article 6 d. 1 point b), when certain personal data are required to be processed by legal acts (GDPR Article 6 d. 1 point c).

3.2.3. Execution of practice contracts. For this purpose, the following data is processed:

Name(s), surname(s), personal identification number, if not available - date of birth, signature, phone number, e-mail address, address, educational institution, conviction/non-conviction data, time of practice, activity.
Personal data of interns, which are contained in the texts of relevant documents (contracts, orders, requests, etc.) (in electronic space, paper document, or other media), are stored by the terms specified in the General Document Storage Index, approved by order of the Chief Archivist of Lithuania.
The legal basis for data processing is the need to fulfill a contract to which the intern is a party as a data subject, or to take action at the request of the intern before concluding a contract with him (GDPR Article 6 d. 1 point b) and when certain personal data are required to be processed by legal acts (GDPR Article 6 d. 1 point c).

3.2.4. Administration of inquiries, comments, and complaints. For this purpose, the following data is processed:

Name(s), surname(s) and/or username, e-mail address, telephone number, address, subject of the request, comment or complaint, text of the request, comment or complaint.
The data of requests, comments, and complaints are stored for 1 year after their submission.
Legal basis for data processing – processing data is necessary for the pursuit of the legitimate interests of the data controller or a third party, except in cases where such interests of the data subject or the fundamental rights and freedoms necessary to ensure the protection of personal data override them, especially when the data subject is the child (GDPR Article 6 d.1 point f) and consent of the data subject (GDPR Article 6 d.1 point a).

3.2.5. To ensure the security of the company's employees, other data subjects, and property (video surveillance). For this purpose, the following data is processed:

Image representation. Video surveillance systems do not use facial recognition and/or analysis technologies, the video data captured by them are not grouped or profiled according to a specific data subject (person). The data subject is informed about the ongoing video surveillance using information signs with a video camera symbol and Company details, which are presented before entering the monitored territory and/or room. The surveillance field of video cameras does not include premises where the data subject expects absolute protection of personal data.
Personal data (video data) obtained by video surveillance cameras are stored for up to 14 (fourteen) days from the moment of their capture, after which they are automatically destroyed, except in cases where there is reason to believe that a misdemeanor has been recorded, a criminal act or other illegal acts have been recorded (until the end of the relevant investigation and/or trial).
Legal basis for data processing – processing data is necessary for the pursuit of the legitimate interests of the data controller or a third party, except in cases where such interests of the data subject or the fundamental rights and freedoms necessary to ensure the protection of personal data override them, especially when the data subject is a child (GDPR Article 6 d. 1 point f).

3.2.6. Administration of Whistleblowers in the Company:

Personal data of presenters: first name(s), last name(s), personal identification number, workplace (service, work, or contractual relations with the Company), position, telephone number, personal e-mail mailing address, or residential address.
Data on the violation: violation, place of violation, time, and other collected information about the violation.
Person(s) who may have committed the violation: : name(s), surname(s), employees te, responsibilities.
Witness(es) to the violation: first name(s), last name(s), position, workplace, phone number, e-mail address.
Documents and data are stored by the terms specified in the General Document Storage Index, approved by order of the Chief Archivist of Lithuania.
Legal basis for data processing – when certain personal data are required to be processed by legal acts (GDPR Article 6 d. 1 point c).

3.2.7. For other purposes for which the Company has the right to process the data subject's data when the data subject has expressed his consent, when the data needs to be processed due to the legitimate interest of the Company, or when the Company is required to process the data by relevant legal acts.

4.1. All information you submit via social media (including messages, use of the Like and Follow boxes, and other communications) is controlled by the operator of the relevant social network.

4.2. Currently, our Company has an account on the social network Facebook, whose privacy policy is available at https://www.facebook.com/privacy/explanation;

4.3. Our Company currently has an account on the social network LinkedIn, whose privacy policy is available at https://www.linkedin.com/legal/privacy-policy.

4.4. We recommend that you read the privacy notices of third parties and contact the service providers directly if you have any questions about how they use your data.

5.1. The company undertakes to observe the duty of confidentiality towards the data subjects. Personal data may be disclosed to third parties only if it is necessary to conclude and execute a contract for the benefit of the data subject, or other legitimate reasons.

5.2. The Company may provide personal data to its data processors who provide services to the Company and process personal data on behalf of the Company. Data processors have the right to process personal data only by the Company's instructions and only to the extent that it is necessary to properly fulfill the obligations set out in the contract. The company uses only those data processors who sufficiently ensure that appropriate technical and organizational measures will be implemented in such a way that the data processing meets the requirements of the Regulation and ensures the protection of the data subject's rights.

5.3. The company may also provide personal data in response to court or state authority requests to the extent necessary to properly comply with applicable legislation and state authority orders.

5.4. The company guarantees that personal data will not be sold or rented to third parties.

6.1. Persons under the age of 14 may not provide any personal data through the Company's website. If a person is younger than 14 years old, to use the Company's services, before submitting personal information, it is mandatory to submit the written consent of one of the representatives (father, mother, guardian) regarding the processing of personal data.

7.1. Personal data collected by the Company are stored in printed documents and/or in the Company's information systems. Personal data is processed no longer than is necessary to achieve the purposes of data processing or no longer than is required by the data subjects and/or provided for by legal acts.

7.2. Although the data subject may terminate the contract and refuse the Company's services, the Company must continue to store the data subject's data due to possible future demands or legal claims until the data storage terms expire.

8.1. The right to receive information about data processing.

8.2. The right to access the processed data.

8.3. The right to demand rectification of data

8.4.The right to request deletion of data ("Right to be forgotten"). This right does not apply if the personal data that is requested to be deleted is also processed on another legal basis, such as if the processing is necessary for the performance of a contract or is the fulfillment of an obligation according to applicable legislation.

8.5. The right to restrict data processing.

8.6. The right to object to data processing.

8.7.Right to data portability. The right to data portability cannot adversely affect the rights and freedoms of others. The data subject does not have the right to data portability about personal data that is processed manually in systematized files, such as paper files.

8.8.The right to request that a decision based solely on automated data processing, including profiling, not be applied.

8.9. The right to submit a complaint regarding the processing of personal data to the State Data Protection Inspectorate.

10.1. The data subject, to exercise his rights, can contact the Company:

10.1.1. by submitting a written request in person, by post, through a representative, or using electronic communication - e-mail by mail: info@nordicidea.eu;

10.1.2. orally - by phone: +370 618 00609;

10.1.3. in writing - to the address: Vasario 16-osios g. 38, Garliava, Kaunas district. self.

10.2. To protect data from illegal disclosure, the Company, upon receiving a data subject's request to submit data or exercise other rights, must verify the identity of the data subject.

10.3. The company's response to the data subject is given no later than one month from the date of receipt of the data subject's request, taking into account the specific circumstances of personal data processing. This period may be extended by another two months if necessary, depending on the complexity and number of requests.

11.1. The data subject has:

11.1.1. inform the Company about changes in the provided information and data. The company needs to have correct and valid data subject information;

11.1.2. to provide the necessary information so that, at the request of the data subject, the Company can identify the data subject and make sure that it is communicating or cooperating with a specific data subject (provide a document confirming the identity of the person or by the procedure established by legal acts or electronic means of communication that would allow the proper identification of the data subject). This is necessary for the data protection of the data subject and other persons so that the disclosed information about the data subject is provided only to the data subject, without violating the rights of other persons.

12.1. By transferring personal data to the Company, the data subject accepts this Privacy Policy, understands its provisions, and agrees to comply with it.

12.2. During the development and improvement of the Company's activities, the Company has the right to unilaterally change this Privacy Policy at any time. The company has the right to unilaterally, partially, or completely change the Privacy Policy by announcing it on the website www.nordicidea.eu.

12.3. Additions or changes to the privacy policy take effect from the date of their publication, i.e. i.e. from the day they are placed on the website www.nordicidea.eu.

PRIVACY POLICY

COOKIES POLICY