PRIVACY POLICY

1. PERSONAL DATA CONTROLLER

UAB “Baltic Tours Group” (hereinafter referred to as the “Company”) is the controller of the personal data processed by the Company, which ensures that personal data are processed by the Company in accordance with the requirements for the protection of personal data applicable to data controllers.

Information about the Company: UAB “Baltic Tours Group”, legal entity of the Republic of Lithuania, legal entity code 111518422, registered office address Vašingtono a. 1-66, LT-01108, Vilnius, Republic of Lithuania, website www.baltictours.com, e-mail [email protected], telephone +370 5 266 1616.

The rules on the processing of personal data have been drawn up in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation, hereinafter referred to as the GDPR). The personal data processing rules contain information on the purposes of personal data processing in the Company, the conditions of lawfulness, the personal data processed by the Company, their origin, storage periods, the purposes of their provision, the procedure for the exercise of the rights of the data subjects, and the recipients of data.

2. THE PURPOSES OF THE PROCESSING OF PERSONAL DATA BY THE COMPANY AND THE CONDITIONS FOR LAWFUL PROCESSING

The Company, acting as data controller, processes your personal data as a data subject for the following purposes:

• Sale and administration of tourist trips, package holidays and/or individual tourist services organised by the company (Legal basis for processing of personal data – Article 6(1)(b) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC) :

1. contracting and booking in reservation and other information systems;
2. handling and administering complaints and other claims from data subjects;
3. promptly informing the data subject of changes to the conditions or procedures for the provision of tourism or other services;
4. the provision of personal data to tourism or other service providers in order to fulfil the personal data subject’s requests;
5. meeting other obligations.

• The sale of airline tickets and the administration of the provision of this service (The legal basis for the processing of personal data is Article 6(1)(b) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC): 

1. contracting and booking in reservation and other information systems;
2. handling and administering complaints and other claims by the Data Subject;
3. promptly informing the data subject of changes to the conditions or procedures for the provision of the service;
4. the provision of personal data to service providers in the course of carrying out an order from a data subject;
5. meeting other obligations.

• Compliance with the requirements of public administration authorities and legal acts (The legal basis for the processing of personal data is Article 6(1)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC):

1. enforcement of border crossing requirements;
2. protecting customs controls;
3. compliance with visa requirements;
4. enforcing other border crossing requirements;
5. meeting the requirements of public administrations;
6. compliance with legislation requiring information on tourists and travellers;
7. pursuing other objectives to prevent offences.

• Conducting direct marketing to new clients (Legal basis for processing personal data – Article 6(1)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC):

1. providing marketing messages/newsletters on the sale of package tours, package holidays and/or individual tourism services, including airline tickets;
2. analysing performance to improve the quality of services. 

• Conducting direct marketing to existing clients (Legal basis for processing personal data – Article 6(1)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC):

1. for the purpose of providing suggestions about similar services offered by the Company.

• Conclusion and performance of other contracts (The legal basis for the processing of personal data is Article 6(1)(b) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC).

The Company, acting as a data processor, processes your personal data as a data subject for the following purposes:

• the sale and administration of the provision of organised tourist trips and/or individual tourist services by other tour operators (The legal basis for the processing of personal data is Article 6(1)(b) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC):

1. concluding contracts on behalf of a tour operator or service provider and making bookings in the tour operator’s or service provider’s booking and other information systems;
2. promptly informing the data subject of any changes to the terms or conditions of the service;
3. fulfilment of other obligations under the contract with the tour operator.

1. THE PERSONAL DATA PROCESSED BY THE COMPANY AND THEIR RETENTION PERIOD

The Company, acting as a data controller, processes the following personal data for the purpose of the sale and administration of the tourist trips organised by the Company, a package of tourist services and/or individual tourist services and the provision of these services:

• name, surname, date of birth, place of residence (address), e-mail address, telephone number, details of the identity document, – date of issue and validity, place, number, date of birth, gender, nationality, country of issue, payment details, information on special needs (only applicable in the case of, and only for, the data subjects concerned).

The Company, acting as a data controller, processes the following personal data for the purpose of selling airline tickets and administering the provision of this service:

• name, surname, date of birth, details of identity document, – date of issue and expiry, place, number, date of birth, gender, nationality, issuing country, gender, nationality, issuing country, telephone number, email address, payment details, flight information (date, flight number).

The Company, acting as a data controller, processes the following personal data for the purpose of public administration authorities and for the purpose of fulfilling the requirements of legislation :

• name, surname, date of birth, place of residence (address), details of identity document – date of issue and expiry, place, number, date of birth, gender, nationality, issuing country, gender, nationality, issuing country, telephone number, e-mail address, payment details, flight information (date, flight number) .

The Company, acting as a data controller, processes the following personal data for the purpose of direct marketing to new customers:

• email address;
• data relating to the confirmation and validity of consent to receive the Company’s newsletter: the fact, date and time of confirmation, the fact, date and time of revocation of consent.

The Company, acting as a data controller, processes the following personal data for the purpose of direct marketing to existing customers:

• email address.

The Company, acting as a data controller, processes the following personal data for the purpose of concluding and performing other contracts:

• the person’s name, surname, personal identification number or date of birth, residential address, e-mail address, mobile or fixed telephone number, the information/financial data to be transmitted with the payment (payment account number, amount of the transaction), the number of the certificate of individual activity or business certificate;
• the name, surname, email address, mobile or landline telephone number of the persons authorised to represent the legal entity in its relations with third parties, as well as the name, surname, email address, mobile or landline telephone number of the persons who are involved in the administration, supervision and/or monitoring of the legal entity.

The Company, acting as a data processor, processes the following personal data for the purpose of the sale and administration of the provision of organised tourist trips and/or individual tourist services by other tour operators:

• name, surname, date of birth, residential address, email address, telephone number, details of identity documents – date of issue and validity, place, number, date of birth, gender, nationality, country of issue, payment details, information on special needs (only applicable in the case of, and only for, the data subjects concerned).

The Company processes Personal Data voluntarily provided by the Data Subject by post, registered post, e-mail, fax, telephone, by direct access to the Company’s point of sale, as well as by using the Company’s website.

When the company acts as a data controller, personal data is stored for the duration of the contract and for 10 years after the end of the contract. Personal data for the purpose of claims handling and administration shall be stored for the duration of the contract and for 3 years after the end of the contract. Personal data processed for the purpose of direct marketing shall be retained for 5 years from the date of receipt, or for a shorter period if a request is received from the Data Subject to opt out of receiving direct marketing communications. Personal data of the Data Subject for the purpose of direct marketing to existing customers shall be stored for the duration of the Organised Tour, Package and/or Individual Tour Service Booking, Passenger Transport Contract or for a shorter period if the Data Subject’s request to opt out of receiving direct marketing communications is received. Upon expiry of the retention period of the document containing such data, a decision on its destruction shall be taken and the document shall be destroyed in accordance with the procedure established by the Law on Documents and Archives of the Republic of Lithuania. Permanently stored documents containing Personal Data shall be transferred to the State Archives for storage in accordance with the procedure laid down in the Law on Documents and Archives of the Republic of Lithuania .    

The Company, acting as a data processor, shall keep personal data for a period of time determined by the data controllers.

The data subject has the right to opt out of the use of Personal Data for marketing purposes by informing the Company by e-mail to [email protected], [email protected], [email protected] or [email protected].

3. TRANSFER OF PERSONAL DATA

The information we receive from you as a data subject is administered and used only for the purposes set out in the Personal Data Processing Rules.

The information obtained from you as a data subject may not be disclosed without lawful justification to third parties other than those involved in or contributing in any way to the performance or provision of the services requested by the data subject, as well as to processors or joint controllers with whom the Company has entered into Personal Data processing or other agreements that address the processing of Personal Data and their security requirements. In such a case, the legal liability for the breach or damage of the processing of Personal Data shall be borne by the processor or controller responsible for the breach or damage. In other cases, Personal Data may only be disclosed to third parties where this is provided for or required by law. Personal data may also be communicated to public administration and law enforcement authorities, where the Company is legally obliged to do so.

In order for the Company to provide services to you, data may be provided:

• “Amadeus IT Group” S.A.;
• UAB “Waavo”;
• the relevant airlines whose tickets are purchased by the data subject;
• for travel agents;
• for actual tourism service providers;
• “Mailerlite” (newsletter service provider). 

1. PROCESSING OF TELEPHONE CALL DATA

Incoming and outgoing calls on the phones assigned to the company’s advice line are recorded.

Purposes of data processing:

• to ensure a high quality telephone service;
• to ensure the objectivity of the examination of enquirers’ requests/complaints regarding services not provided or improperly provided, if the information provided by the enquirer and/or consultant during the interview has an impact on the proper provision of the Company’s services (sale of airline tickets, organised tourist trips, package tourism services and/or other tourism services) and/or relates to the fulfilment of the contract.

The legal basis for the processing of personal data is Article 6(1)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (Article 6(1)(a) of Regulation (EU) 2016/679), which provides for the actual consent of the data subject (continued the conversation)).

The following data shall be recorded and processed:

• an audio recording of the interview, which captures the information provided by the enquirer and the person giving the advice during the interview;
• the metadata of the call recording: the name of the consultant, the telephone number of the enquirer, the date and time of the start and end of the call (hereinafter referred to as ‘the Data’).

Recipients of the data: pre-trial investigation body, prosecutor or court for administrative, civil, criminal cases at their disposal, as evidence or in other cases provided for by law. For the purpose of recording conversations, we use the services of the data processor TENESYS UAB, Inc. 302361251, Žirmūnų str. 139, Vilnius.

Data retention period: 1 year.

4. PROCESSING OF IMAGE DATA

The Company carries out video data monitoring for the purpose of protection of persons and property (the legal basis for the processing of personal data is Article 6(1)(f) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC).

Video surveillance is ongoing:

• in this area: Vašingtono a. 1-66, Vilnius (outside the entrance to the premises);
• at the following premises: premises Washingtono a. 1-66, Vilnius: in the sales hall at the entrance to the premises (on the inside).

Recipients of the data: pre-trial investigation body, prosecutor or court for administrative, civil, criminal cases at their disposal, as evidence or in other cases provided for by law.

Data retention period: 72 hours

5. IMPLEMENTATION OF DATA SUBJECTS’ RIGHTS

As a data subject, you have the right to contact the Company regarding issues related to the processing of your personal data, i.e. you have the following rights:

• the right to receive information about the processing of data;
• the right of access to data;
• the right to request rectification;
• the right to have your data erased (‘right to be forgotten’);
• the right to restrict processing;
• the right to data portability (where data are processed by automated means);
• the right to request that a decision based solely on automated processing, including profiling, is not applied.

The data subject shall have the right to apply to the Company for the exercise of the data subject’s rights orally or in writing, in person, by post or by e-mail to info@baltictours.lt. If the application for the exercise of the data subject’s rights is made orally or in writing in person, the data subject shall be required to confirm his or her identity by providing a document proving his or her identity. Failure to do so will result in the data subject’s rights not being enforced.

When writing to exercise the rights of the data subject, it is recommended that you submit a request in the following form in accordance with the Personal Data Processing Rules.

Upon receipt of a request from a data subject, the Company shall provide the data subject with information on the action taken in response to the request, no later than within 1 (one) month of receipt of the request. If there is a delay in providing the information, the data subject shall be informed within the specified period of time, indicating the reasons for the delay and the possibility of lodging a complaint with the State Data Protection Inspectorate (L. Sapiegos g. 17, Vilnius, tel. (8 5) 271 2804, 279 1445, e-mail: [email protected]);.

6. FINAL PROVISIONS

The Company reserves the right to change this Privacy Policy, therefore we kindly ask the visitors of the website to check whether the Privacy Policy has changed and to familiarize themselves with the amended and/or new provisions of the Privacy Policy.

Updated 30 May 2023.