Privacy Policy

Rules for processing personal data

Protecting your privacy is important to us. Below you will find details of how we use your data.

Name and contact details of the controller (as defined in data protection legislation)

Name: UAB Agro Parts Baltija company code: 303014079, VAT code: LT100007567014

Address. 81, Kaunas LT-46292

E-mail: info@perlitas.lt

Phone number: +370 610 94692

• GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).
• Personal Data (Data) - means any information relating to a natural person, the Data Subject, whose identity is known or can be established, directly or indirectly, by reference to data such as a personal identification number, one or more physical, physiological, psychological, economic, cultural, or social attributes specific to the individual.
• Recipient of the data means the natural or legal person or public authority or other body to which the Personal Data is disclosed, whether or not to a third party.
• Data Subject - a Client or employee of the Data Controller or any other person whose Personal Data is processed by the Data Controller.
• Processing meansany operation or sequence of operations which is performed upon personal data, whether or not by automated means, such as collection, recording, organisation, filing, storage, adaptation or alteration, retrieval, access, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination with other data, restriction, erasure or destruction.
• Data Processor - a natural or legal person, public authority or other body that processes Personal Data on behalf of the Data Controller.
• Third party means a natural or legal person, public authority or other body other than the data subject, controller, processor or persons authorised to process personal data under the direct authority of the controller or processor.
• Customer - a person who uses or has previously used the services provided by the Data Controller.
• Consent of the data subject - any freely given, specific and unambiguous indication of the data subject's wishes, given by a duly informed person, by means of a statement or an unambiguous action, by which he or she consents to the processing of personal data concerning him or her.

 GENERAL PROVISIONS

• The Data Controller collects certain Personal Data for the purposes of administration and direct marketing, to conduct its business and to comply with its legal obligations. The Data Controller is responsible for the processing of your Personal Data under the terms and conditions set out in these Terms.
• In these Terms, we explain what Personal Data we collect, how we process and store it in the course of providing the goods and services we offer. This includes information collected offline in physical stores or obtained through the provision of services to Customers and online through the website www.agropartsbaltija.lt (the "Website").
• These Terms also apply to our targeted content, including online offers and advertisements for products and services that you may see on third party websites, platforms and applications ("Third Party Sites") while browsing the internet. Please note that these Third Party Sites may have their own separate privacy policies and terms and conditions, so please read them before using these Third Party Sites
• We recommend that you read and familiarize yourself with these Terms carefully before using our Sites. By using the services provided by the Data Controller, you confirm that you agree to be bound by these Terms.
• The Data Subject shall not be entitled to use the Websites unless he/she has read and/or accepted the Terms and Conditions. In cases where the Data Subject disagrees with the Terms or a part thereof, he/she must not use the Websites Otherwise, the Customer shall be deemed to have read and unconditionally accepted the Terms.
• When using third-party services, such as Facebook, third-party terms and conditions may apply. For example, Facebook applies a Data Policy to all its users and visitors. Therefore, when using such third-party services, it is recommended that you familiarize yourself with their terms and conditions.
• The controller shall ensure that it complies with the following essential data protection principles:

1. Personal data must be processed in a lawful, fair and transparent manner in relation to the Data Subject (principle of lawfulness, fairness and transparency);
2. Personal data must be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes; further processing for archiving purposes, in the public interest, for scientific or historical research purposes, or for statistical purposes shall not be considered incompatible with the original purposes (purpose limitation principle);
3. Personal data must be adequate, relevant and only necessary for the purposes for which they are processed (principle of data minimisation);
4. Personal data must be accurate and, where necessary, kept up-to-date; all reasonable steps must be taken to ensure that Personal Data which are not accurate in relation to the purposes for which they are processed are erased or rectified without delay (principle of accuracy);
5. Personal data must be kept in a form which permits identification of Data Subjects for no longer than is necessary for the purposes for which the Personal data are processed; Personal data may be kept for longer periods if the Personal data will be processed solely for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes in accordance with Article 89(1) of the GDPR, after the implementation of the appropriate technical and organisational measures required by the present Regulation to protect the rights and freedoms of the Data Subject (the retention time limitation principle);
6. Personal Data must be processed in such a way as to ensure, by appropriate technical or organisational measures, adequate security of the Personal Data, including protection against unauthorised or unlawful processing of the Data and against accidental loss, destruction or damage (integrity and confidentiality principle).
7. The controller is responsible for ensuring compliance with the above principles and must be able to demonstrate compliance with them (accountability principle).
8. The processing is carried out with due notice to Data Subjects.
9. Data shall be retained for the periods specified in these Rules for each type of Personal Data. Retention shall be carried out in accordance with the prescribed Rules.
10. The Data Processor's access rights to the Data shall be extinguished upon termination or expiry of the Personal Data Processing Agreement concluded with the Data Controller.
11. Data shall be transferred to Data Processors and Data Recipients where the right and/or obligation to do so is conferred by law on the relevant grounds.
12. Personal data may be provided by the Data Controller to a pre-trial investigation body, a prosecutor or a court in connection with administrative, civil, criminal proceedings, as evidence or in other cases established by law.

METHODS OF COLLECTING PERSONAL DATA

• We collect your personal data directly in different ways, such as when you provide us with your personal information, when you register as a Customer on our Websites or participate in our loyalty programmes, when you enter prize draws, games and competitions, when you subscribe to our newsletter, when you receive information or electronic communications, when you purchase products and services from us, when you complete questionnaires, when you comment, when you make requests or when you contact our customer service.
• When you provide us with your Personal Data, we process it for the purposes and in the manner set out in these Terms. If you do not want us to process your Personal Data in this way, please do not provide it to us.
• We may also receive your personal data from other sources, including data sources in the commercial sector, such as public databases and data aggregators and information from third parties. If you do not want us to obtain your personal data from other sources, please indicate your preferences to the relevant sources.
• We process your Personal Data in order to provide you with services as explained below. In specific cases, we may only process your Personal Data with your consent, e.g. usually when we process your Personal Data for marketing purposes, use cookies or location data. In other cases, we may rely on another legal basis for processing your personal data, such as the performance of a contract with you or other legitimate interests, such as the prevention of crime.
• If you become a member of one of our loyalty programmes, we may consider this as your consent that you want us to process your personal data for marketing purposes. You can opt out of this marketing relationship at any time and this will not affect your participation in the loyalty programme or the benefits it provides.
• When we process your personal data with your consent, we will ask for your consent for the specific purpose of processing. We will also ask for your consent if we need your personal data for other purposes not specified in this Policy.
• Please see the information provided under "Browsing the Websites" for more information on the different personal data we may collect, the purposes for which we collect it and the legal basis for processing it.
• Our Sites are intended for adults, but there may be occasions when some Customers under the age of 16 (sixteen) view or purchase products on our Sites If we are aware that a Customer is under the age of 16 (sixteen), we will not use that Customer's personal data for marketing purposes, unless we have the consent of their parents.
• To provide parental consent for the use of data for marketing purposes, please ask your parent or guardian to contact us as indicated in "CONTACT"
• In some cases, we will consider that you have obtained parental consent based on your actions. We then reserve the right to decide whether you will receive our marketing communications before you reach the required age.
• Please note that access to prizes, samples and other rewards may only be granted to users who are of the required age. We may process your Personal Data in order to verify your age and to enforce age restrictions.

PURPOSES OF PROCESSING PERSONAL DATA

Browsing websites

Personal Data collected:

Information about the browser you use when you visit our Sites, your IP address and device address, the links you click on, other websites you have visited prior to our Sites, and information collected by cookies and similar tracking tools. Your username, profile picture, gender, affiliations, and any other information that you agree to share when you use third-party websites (e.g., when you click "Like" on Facebook).

Purpose of processing personal data:

We (and third party service providers acting on our behalf) use cookies and similar technologies to process data about you when you visit our Websites. We want to know if you have visited our Sites before and what you prefer so that we can tailor your experience. Please also see the "COOKIES AND OTHER TECHNOLOGIES" section for more information about cookies.

Legal basis for processing personal data:

Your consent when you click "accept and continue" in the Cookie authorisation tool on our websites. In some cases, and wherever permitted by law, we will assume that you have consented to the use of cookies based on your actions. Please note that we need to process basic data about your browsing to provide you with basic features of the Sites, such as secure login, or to remember where you are in your order. You can change your cookie preferences at any time in our Cookie Enabler or by changing your browser settings.

Offering products and services

Personal Data collected:

Name, surname, postal address, email address Email address, mobile phone number, loyalty card number, order history/wish list (including your purchases on our Site, in our store), payment history, age, date of birth, gender, products you view on our Sites, favorite brands, favorite store, your actions on our Sites and in reading our emails, your responses to surveys or contests, your purchasing habits and preferences, and information about your lifestyle, hobbies, and interests.

Purpose of processing personal data:

To offer you tailored products or services (including from affiliated third parties) that may be of interest to you, based on your shopping history and behaviour, your preferences and our marketing segmentation strategies. We may do this by sending you information by post, email, newsletters, SMS or telephone about products, services, promotions etc. We may also contact you to offer to participate in customer surveys, promotions, prize draws and competitions. You may also receive offers for promotions (e.g. vouchers) from stores when you have created an account on our Sites or participate in a loyalty programme.

Duration of storage of personal data:

As long as you buy from us. If you have a loyalty card and no transactions have taken place within 3 (three) years, we delete your personal data, unless the law provides for a longer retention period for such data. If you shop online as a guest, we will keep your data for 1 (one) year after the purchase. If you have subscribed to our newsletter, we will retain your Data until you unsubscribe.

Legal basis for processing personal data:

You authorise us to process your personal data if you become a member with a loyalty card and agree to the terms and conditions of our customer loyalty programme (contract performance).

If you do not participate in the loyalty programme, you give us permission to process your Personal Data by subscribing to our newsletters.

If you are purchasing online as a guest, we will contact you about related offers to the extent permitted by law, including spamming.

You can unsubscribe from our marketing communications at any time, either in your profile (if you have one) using the Privacy Preferences panel or by clicking on the unsubscribe button in our marketing emails sent to you.

Customer service

Personal Data collected:

Name, surname, postal address, home telephone number, mobile telephone number, loyalty card number, passwords, order history, payment history, payment information (i.e., bank or credit card information), order history/wish list, age, gender, request fulfillment information, postings and other content that you provide on our Sites, as well as other information that you have provided in the course of a purchase or order of a service, or in the course of a request.

Purpose of processing personal data:

We process your Personal Data when you contact us and when we respond to your requests and comments.

Duration of storage of personal data:

General enquiries and comments relating to service problems, store standards, availability of goods, etc. are kept for a period of 3 (three) years from the date of the last contact with you. Correspondence relating to personal injury, accidents and other health and safety issues may be retained for a longer period in the event of litigation or settlement.

Legal basis for processing personal data:

Processing your queries, comments and complaints at your request (performance of a contractual or other legal obligation).

Purchase from

Personal Data collected:

Name, surname, postal address, email address, home telephone number, mobile telephone number, loyalty card number, passwords, order history, payment history, payment information (i.e. bank or credit card details), order history/wish list, age, gender, your order fulfillment information, and any other personal data you voluntarily provide to us.

Purpose of processing personal data:

We process personal data in order to provide the products and services you have ordered, including sending you the products or samples you have ordered.

Duration of storage of personal data:

As long as you buy from us. If no transactions have taken place within 3 (three) years, we delete your personal data, unless the law provides for a longer retention period for such data.

Legal basis for processing personal data:

We use this information to fulfil your order or any other service you have requested (contract).

Lotteries and competitions

Personal Data collected:

Name, surname, postal address, email address, home or mobile phone number, age, date of birth, gender, user-generated content, or any other personal data you provide, according to the needs of the contest or game.

Purpose of processing personal data:

To run prize draws, games and competitions in which you choose to participate and to determine the winner or to pass on the prize if you win.

Duration of storage of personal data:

3 (three) months after the end of the game or competition, unless a longer retention period is prescribed by law.

Legal basis for processing personal data:

We need this data to identify the participants/winner of the competition or game and to transfer the prize to you (contract performance). If we intend to use your Personal Data for marketing purposes, we will explicitly notify you prior to processing and ask for your consent.

Buying online

Personal Data collected:

Name, surname, postal address, email address, home phone or mobile phone number, information about products ordered, order history, IP address, details of your purchases, payment information, payment history.

Purpose of processing personal data:

To process your online order and deliver the products you ordered. Your Personal Data related to the execution of the payment may be forwarded to payment intermediaries (Paysera LT, SB lizingas UAB and PayPal) for the purpose of payment execution.

Duration of storage of personal data:

As long as you buy from us. If no transactions have taken place within 3 (three) years, we delete your Personal Data, unless the law provides for a longer retention period for such data. If you check out as a guest, we will keep your data for 1 (one) year after the purchase.

Legal basis for processing personal data:

We need this Personal Data in order to be able to fulfil the order you have placed online (contract performance).

Loyalty services

Personal Data collected:

Name, surname, postal address, email address, home telephone number or mobile phone number, information about products you have ordered through the loyalty programme, loyalty programme related transactions, account status, payment information (e.g. bank details) and payment history.

Purpose of processing personal data:

Providing you with all the services of a loyalty scheme, including exclusive offers.

Duration of storage of personal data:

As long as you participate in one of our loyalty programmes. If no transactions have taken place within 3 (three) years, we delete your Personal Data, unless the law provides for a longer retention period for such data.

Legal basis for processing personal data:

By signing up for one of our loyalty programmes, you authorise us to process your Personal Data in order to provide you with the full range of services under the loyalty programme (contract performance).

Service and crime prevention

Personal Data collected:

Name, surname, postal address, email address, home phone or mobile phone number, payment information (e.g. bank details) and payment history.

Purpose of processing personal data:

To provide our support services, including processing service requests made by you, preventing fraud and other crimes, verifying your identity and credit/payment status and executing payment instructions. Your Personal Data relating to the execution of a payment may be forwarded to payment intermediaries (Paysera LT, SB lizingas UAB and PayPal) for the purpose of executing payments or to the police for the purpose of fraud prevention.

Duration of storage of personal data:

As long as you buy from us. If no transactions have taken place within 3 (three) years, we delete your Personal Data, unless the law provides for a longer retention period for such data.

Legal basis for processing personal data:

For the detection and prevention of fraud, to ensure that your identity and transactions are secure (balancing our interests with our interest in preventing fraud and protecting our customers). We provide other support services to provide you with relevant additional services (contract performance).

COOKIES AND SIMILAR TECHNOLOGIES

• We use cookies and similar technologies ("cookies") to improve our products and your experience on our Sites by collecting information about your use of our Sites. Some of the cookies we use are necessary for the basic functionality of the Sites, such as determining where you are in your order; however, we also use cookies to analyse your use of the Sites (so that we can evaluate and improve its performance); and advertising cookies are used by advertising companies to deliver advertising relevant to your interests. You can see which cookies we use and how long they are valid for HERE.
• Cookies can be temporary or permanent: a) temporary cookies are valid and not removed until you browse in your browser; b) permanent cookies are not removed after you close your browser and contain information that facilitates subsequent access to your Account (password, username). Such Cookies speed up and facilitate the use of the Website
• You can block the use of cookies and remove persistent cookies at any time using your browser software. For more information on how to manage Cookies in your browser, please see the Cookie Enabler.

Web analytics with Google Analytics

• The websites use Google Analytics, a web analytics service from Google Inc. ("Google"). Google Analytics uses "cookies", which are text files that are stored on your computer and allow us to analyse the use of the website. The information generated by the cookie about your use of our website is usually sent to a Google server in the United States where it is stored. However, if you have enabled IP anonymisation for this website, your IP address will first be truncated by Google in the Member States of the European Union or in other countries of the European Economic Area. Acting at the request of the website operator, Google will use this information to analyse your use of the website, to provide us, the website operator, with reports on the website's performance, and to provide us with other services relating to website and internet usage. The IP address that Google Analytics sends via your browser will not be associated by Google with any other data held by Google. If you wish to prevent the collection of data generated by cookies and the collection of data about your use of the website by Google (including your IP address), and if you wish to opt-out of the processing of such data by Google, you can download and install the browser plug-in from the following link: https://tools.google.com/dlpage/gaoptout?hl=de.
• "The data collected by Google Analytics is stored for 26 months. Please note that without cookies, you may not be able to use all of the services of our Websites.

"Google Inc." use of remarketing or similar targeting features

• We use Google Inc. on our websites. ("Google") remarketing or similar focus groups. With this feature, providers can direct visitors to targeted advertising on the website, in other words, interest-based ads tailored to the visitors to the website - ads that are displayed when you visit other websites in Google's display advertising network. In order to carry out this analysis of the use of the website, which forms the basis for the creation of interest-based advertising (remarketing), Google uses so-called cookies. Google therefore stores a small file containing a sequence of numbers in the browsers of website visitors. The file records the number of visitors to the website as well as anonymous data about the use of the website. No personal data of website users will be stored. Subsequent visits to other sites in Google's display advertising network will result in the display of advertisements that take into account the products and information that the visitor has viewed on the sites previously visited. If you wish to prevent the collection of data generated by cookies in connection with your use of the website (including your IP address), and if you wish to opt-out of the processing of such data by Google, you can download and install a browser plug-in from the following link: https://tools.google.com/dlpage/gaoptout?hl=de. If you wish to permanently deactivate the use of cookies by Google, please click on the following link to download and install the plug-in provided: https://www.google.com/settings/ads/plugin. You can disable the use of third-party cookies by visiting the website at: https://www.networkadvertising.org/choices/bei and adapting the disabling information provided there.

"Using Google AdWords to track conversions

• As a Google AdWords customer, we use Google Conversion Tracking, a service of Google Inc. an analytics service provided by Google. "Google AdWords places a cookie ("conversion cookie") on your computer if you have accessed our Sites using a Google ad. These cookies expire after 300 days and are not used for personal identification. If you visit certain of our pages and the cookie has not yet expired, we and Google may be able to recognise that someone has clicked on an advert and been directed to our website. Each advertiser receives a different cookie. Cookies cannot be tracked through advertisers' websites. The information collected by the conversion cookie is used to generate conversion statistics for AdWords advertisers who have opted in to conversion tracking. Advertisers will see the total number of users who clicked on an advert and were redirected to a conversion tracking bookmark page. However, they do not receive information that personally identifies users. If you do not wish to participate in tracking, you can object to this use by preventing the installation of cookies through an appropriate setting in your browser software (disable option). You will not be included in the conversion tracking statistics.

DATA RETENTION PERIODS

• We only process your Personal Data for as long as we are fulfilling the above purposes for which we collected or received your Personal Data and the expiration of our record retention obligations as set out in the "PURPOSES OF PROCESSING PERSONAL DATA"

RIGHTS OF DATA SUBJECTS

• The data subject may exercise these rights in accordance with the procedures set out in the GDPR and the ADA:
• The right to obtain confirmation as to whether or not we process your Personal Data;
• The right to access and read your Personal Data;
• The right to have inaccurate Personal Data corrected;
• The right to have your Personal Data erased ("right to be forgotten");
• Right to object to the processing of Personal Data;
• Right to restrict processing;
• The right to data portability - to receive your Personal Data held by us in a structured, commonly used and automatically readable form and to transmit it to another Data Controller;
• In cases where the Customer's consent forms a legal basis for us to process your Personal Data, you may withdraw your consent in the following ways:
• For direct marketing purposes: by logging in to your account in the "Privacy Preferences" area or by using the unsubscribe link in any marketing communication we send you;
• For administration and other purposes: send us an email at info@perlitas.lt or call our customer service at +37060601003.
• Please note that the withdrawal of your consent does not affect the lawfulness of the processing of your Personal Data prior to the withdrawal.
• The rights referred to in the "DATA SUBJECT RIGHTS" clauses of the Rules shall be exercised within the time limits set out in the GDPR. The periods set out above and in the GDPR are as follows:

• The Data Controller shall have the right to refuse, on reasonable grounds, to allow the Data Subject to exercise his/her rights or to charge a reasonable fee in the circumstances provided for in Article 12(5)(b) of GDPR

TO WHOM CAN WE TRANSFER (SHARE) YOUR PERSONAL DATA?

• We share your Personal Data with the following data processors (i.e. service providers who assist us in performing the above tasks):
• To affiliated companies of Hymen UAB and trusted third parties that directly support our loyalty program and the administration of the Websites (specifically ES4B UAB) for the management, support, maintenance and testing of IT systems (specifically ES4B UAB).
• We emphasise that we impose strict requirements on these Data Processors under applicable data protection laws to process your personal data only in accordance with our stated purposes and scope, and to meet high IT security standards.
• We share your Personal Data with the following third parties who process your Personal Data for their own purposes (i.e. these third parties are not authorised Data Processors by us and they use your Personal Data for their own interests or because you have consented to this):
• Interested third parties (who are not affiliated with Hymen UAB) who will send you marketing material, but only if you have consented to receive it from them.
• To law enforcement and other authorities where disclosure of your personal data is required by law, a lawful order of public authorities/officials or a court decision.
• Please note that we never aggregate your Personal Data on social networks. When we expand our customer base or refer customers via social networks such as Facebook or Google, we anonymise your Personal Data before it is transferred. If there are changes in the future and we need to share your personal data on social networks, we will ask for your consent in advance.
• With your consent, we will share information about your use of the Sites with trusted third parties (i.e. advertisers, advertising agencies, advertising networks, data exchangers, etc.) in order to provide you with tailored content that may be of interest to you based on your past activity on our Sites. These trusted third parties may set and use their own cookies, web beacons and similar tracking technologies on your device to help us provide you with tailored content and advertising when you visit our respective Sites.

DATA PROTECTION OFFICER

• Under the GDPR, it is mandatory to have a Data Protection Officer where the controller's main activity consists of processing operations which require regular and systematic monitoring of data subjects on a large scale, or where the controller's or processor's main activity consists of large-scale processing of special categories of data.
• The rights and obligations of the Data Protection Officer shall be detailed in the GDPR, the Annexes to the Policy, the Terms of Reference if the position is held by an employee of the Data Controller, or in the service contract if the person holding the position of the Data Protection Officer is an external provider of that service
• Taking into account the above criteria and the activities carried out by the Data Controller, the Data Controller is not obliged to appoint a Data Protection Officer.

MANAGING AND RESPONDING TO PERSONAL DATA BREACHES

PROCEDURE FOR INFRINGEMENTS

• The Data Controller's employees with access rights to the Data shall inform the responsible employee and/or their line manager if they notice a breach of the security of the Data (omissions or actions of individuals that may cause or threaten the security of the Data).
• After assessing the risk factors, the degree of impact, the damage and the consequences of a Data Breach, the Data Controller shall, in accordance with the relevant internal procedures, decide on the measures necessary to remedy the Data Breach and its consequences and to inform the relevant actors.
• If you believe that we are violating data protection laws in processing your Personal Data, you may lodge a complaint with the competent supervisory authority in the Republic of Lithuania or in any other country where you reside, work or where a breach of the GDPR occurred.

TECHNICAL AND ORGANISATIONAL MEASURES FOR THE SECURITY OF PERSONAL DATA

• The organisational and technical data security measures implemented by the Data Controller shall ensure a level of security appropriate to the nature of the Data processed by the Data Controller and the risks associated with their processing, including, but not limited to, the measures referred to in this Section.
• Personal data security measures:

Administrative (secure management of documents and computer data and their archives, establishing procedures for organising the work of the various activities, briefing staff on entry and exit/termination, etc.);
Protection of hardware and software (administration of service stations, information systems and databases, maintenance of workstations, protection of operating systems, monitoring of user access, protection against computer viruses, etc.);
Administration of information systems and databases, maintenance of workstations, protection of operating systems, protection against computer viruses, etc.;
Protection of communications and computer networks (technical and software measures for the encryption and transmission of shared data, applications, personal data, filtering of unwanted data packets, etc.).

• The above measures for the protection of personal data shall ensure: 1) the installation of a storage facility for copies of operating systems and databases, and control of the storage of copying equipment; 2) the technology of continuous processing of data; 3) a strategy for updating the operation of the systems in case of unexpected events (contingency management); 4) a system of unique identification and passwords for unique users; 5) the physical (logical) separation of the environment for the testing of applications from the processes of the operating mode; 6) the registered use of data, and the invulnerability of data.
• The Data Controller shall ensure procedures for the recovery of Personal Data in the event of their accidental loss. The Data Controller shall back up the data in the system at a frequency determined by the Data Controller and shall store them under the conditions specified. Data shall be restored in accordance with an approved internal procedure using SQL database tools from the libraries of backup facilities. Backup copies of Data shall in all cases be kept within the retention periods set out in the Rules.
• The Data Controller also applies other measures to ensure the security of Personal Data:

1. VPN technology is used for remote access to the Data Controller's internal network, and a digital certificate is used for user identification;
2. Access to Personal Data is controlled by organisational and technical data security measures that record and control the logging and authorisation efforts;
3. The following records of access to the database by persons authorised to process Personal Data shall be recorded: login identifier, date, time, duration, result of the connection