Privacy policy

UAB “KITOKS MIESTAS”
PRIVACY AND PERSONAL DATA PROCESSING POLICY

1. GENERAL PROVISIONS

1.1. UAB “Kitoks miestas”, legal entity code 303118462, registered office address – Mėnulio g. 7, Vilnius, tel. +370 (610) 22229. Email: info@citypro.lt, website: www.citypro.lt The Privacy and Personal Data Processing Policy (hereinafter – the Policy) sets out the principles, procedures and technical and organisational measures of the personal data processing carried out by UAB “Kitoks miestas”, intended to ensure the security of personal data, in accordance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter – the GDPR), the Law on Legal Protection of Personal Data of the Republic of Lithuania (hereinafter – the LLPPD), the Law on Electronic Communications of the Republic of Lithuania (hereinafter – the LEC) and other legal acts of the European Union and the Republic of Lithuania regulating the protection of personal data.

1.2. The Policy must be followed by employees of UAB “Kitoks miestas” working under employment contracts (hereinafter – Employees) who, in performing the functions set out in their job descriptions, become aware of personal data where this is provided for in contracts concluded by UAB “Kitoks miestas”, as well as by data recipients and the data processors of UAB “Kitoks miestas”.

1.3. UAB “Kitoks miestas” (hereinafter – the Company) ensures that personal data in the Company are processed in compliance with the personal data protection requirements applicable to data controllers and undertakes to process and store the personal data provided fairly and lawfully.

1.4. This Policy may be consulted and printed at any time on the website of UAB “Kitoks miestas” www.citypro.lt in the section “Personal Data Protection”. Visitors to the Company’s website, customers and employees (hereinafter – the Data Subject) are deemed to have familiarised themselves with and read this Policy when they express their consent to the processing of personal data on the website.

1.5. UAB “Kitoks miestas” may periodically update or amend this Policy by publishing a new version of the Policy on its website at www.citypro.lt in the section “Personal Data Protection”, and recommends that website visitors, customers and employees periodically review the Company’s website.

1.6. The terms of the Policy apply to Data Subjects each time they visit the office, premises or website of UAB “Kitoks miestas”, regardless of the device (computer, mobile phone, tablet, etc.) used. Each time the Data Subject visits the website, he or she agrees to the terms described in this Policy. If the Data Subject does not agree to these terms, he or she has the right not to visit the website of UAB “Kitoks miestas” and not to use its content or the Company’s services.

1.7. By providing his or her personal data, a visitor to the website of UAB “Kitoks miestas”, a customer and/or an employee of the company (the Data Subject) agrees and does not object to the Company controlling and processing such data for the purposes and in the manner set out in this Policy, in the Data Subject’s consent and in other internal regulations of UAB “Kitoks miestas” or in the contract.

1.8. UAB “Kitoks miestas” obtains the personal data of Data Subjects from:

1. the data subject or the data subject’s representative;
2. natural or legal persons contacting the Company with notifications, requests, demands, complaints or on other grounds;
3. information systems managed by data processors and data providers;
4. registers and information systems;
5. legal and natural persons with whom UAB “Kitoks miestas” has signed contracts for the provision of services, the supply of goods, cooperation or contracts of another nature;
6. legal and natural persons whom UAB “Kitoks miestas” asks to provide personal data necessary for the performance of the Company’s functions and of obligations established by legal acts.

1.9. Natural persons (Data Subjects) under the age of 16 may not provide any personal data through the website of UAB “Kitoks miestas” (the Data Controller). A natural person (Data Subject) under the age of 16 must obtain the consent of his or her parents or other legal guardians before providing personal information.

2. KEY TERMS USED IN THE POLICY

2.1. The terms used in this Policy shall be understood as defined in the GDPR, the LLPPD, the LEC and other legal acts of the European Union and the Republic of Lithuania.

2.2. Company – a legal person of any legal form engaged in economic activity, including partnerships or associations regularly engaged in economic activity.

2.3. Privacy and Personal Data Processing Policy – the provisions of the personal data protection policy which the Company, as a data controller or data processor, complies with.

2.4. Website – the website of UAB “Kitoks miestas” at www.citypro.lt on which a website visitor, customer or employee may place an order, submit an enquiry, or give consent to the processing of personal data for the purposes of e-commerce and direct marketing, contract performance, or the administration of enquiries, purchases and the loyalty programme.

2.5. Personal data – any information relating to a living natural person whose identity is known or can be identified, directly or indirectly, by reference to such Data Subject data as name, surname, date of birth, personal identification number, residential address, identity card or passport number, bank card number, diploma and certificate details, data on property held, health data, facial image, telephone number, email address, internet protocol (IP) address, vehicle registration number or other features specific only to the natural person.

2.6. Data Subject – a living natural person, customer, visitor to the office, premises or website, whose personal data the Company (the Data Controller) processes for the purposes of contract performance, e-commerce, the administration of enquiries, purchases and the loyalty programme, or for direct marketing purposes.

2.7. Data Controller – UAB “Kitoks miestas”, legal entity code 303118462, registered office address – Mėnulio g. 7, Vilnius, tel. +370 (610) 22229. Email: info@citypro.lt , website: www.citypro.lt.

2.8. Employee of the Data Controller – a natural person who has concluded an employment contract with the Data Controller.

2.9. Responsible employee of the Data Controller – an employee of the Data Controller who, by virtue of his or her position and the nature of his or her work, is entitled to perform specific functions related to Data processing on behalf of the Data Controller.

2.10. Candidate – a natural person participating or seeking to participate in a staff selection procedure carried out by the Data Controller.

2.11. Data Processor – a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Data Controller and assists the Data Controller, in accordance with the authorisation granted by it, in achieving the purposes set by the Data Controller.

2.12. Data processing – any operation performed on personal data: collection, recording, accumulation, storage, alteration (supplementation or rectification), provision, use, destruction or any other operation or set of operations.

2.13. Direct marketing – activities of the Data Controller aimed at offering goods or services to persons by post, telephone or other direct means, offering occasional discounts and/or asking for their opinion on the goods or services offered.

2.14. E-commerce – the purchase and sale of the Data Controller’s goods (products) or services over the internet.

2.15. Filing system – any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis.

2.16. Computer equipment – computers, terminals, servers, storage media and other computer equipment belonging to the Data Controller on a lawful basis (by right of ownership, lease or on other grounds), and the software installed on it, including email mailboxes, internet communication applications, cloud computing services and internet access.

2.17. Consent of the Data Subject – any freely given, specific and unambiguous indication of the will of a properly informed Data Subject, by a statement or by clear affirmative action, by which he or she agrees to the processing of personal data relating to him or her.

2.18. Data recipient – a natural or legal person, public authority, agency or another body to which the personal data are disclosed, whether a third party or not.

2.19. Public authorities and bodies – state and municipal institutions and bodies, enterprises and public institutions financed from state or municipal budgets and state monetary funds and authorised, in accordance with the procedure established by the Law on Public Administration of the Republic of Lithuania, to perform public administration or providing public or administrative services to persons or performing other public functions.

2.20. Third party – a natural or legal person, public authority, agency or body other than the data subject, data controller, data processor and persons who, under the direct authority of the data controller or data processor, are authorised to process personal data.

2.21. Enquirer – a natural person interested in the goods sold and/or services provided by the Company, or wishing to contact the Company on other matters.

2.22. Customer – a natural person who has purchased goods or services from the Company or has concluded a contract with the Company for the provision of goods or services.

2.23. Supervisory authority – the State Data Protection Inspectorate (hereinafter – the SDPI). Contact details of the authority: L. Sapiegos g. 17, 10312 Vilnius (entrance on the left-hand side) Tel. (8 5) 271 28 04, (8 5) 2791445. Fax (8 5) 261 94 94. Email: ada@ada.lt , E-delivery box: 188607912

3. PRINCIPLES OF PERSONAL DATA PROCESSING AND PROTECTION

3.1. UAB “Kitoks miestas” collects, uses, stores, transfers, destroys or otherwise processes personal data only by secure, transparent and lawful means and only on a lawful basis.

3.2. The personal data of the Data Subject are processed by UAB “Kitoks miestas” lawfully, fairly and in a transparent manner (principle of lawfulness, fairness and transparency).

3.3. The personal data of the Data Subject are collected for specified, explicit and legitimate purposes and are not further processed in a manner that is incompatible with those purposes (principle of lawfulness, fairness and transparency).

3.4. Processing of the Data Subject’s personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes is not considered to be incompatible with the initial purposes (principle of purpose limitation). The personal data of the Data Subject may be processed by UAB “Kitoks miestas” for statistical and/or document management purposes.

3.5. The personal data of the Data Subject must be adequate, relevant and limited to what is necessary for the purposes of UAB “Kitoks miestas” for which they are processed. The minimum amount of personal data that is necessary and sufficient to achieve the personal data processing purposes set by UAB “Kitoks miestas” is processed. UAB “Kitoks miestas” does not process excessive personal data of the Data Subject (principle of data minimisation).

3.6. UAB “Kitoks miestas” processes accurate personal data of the Data Subject and, where necessary, keeps them up to date. Personal data of the Data Subject that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (principle of accuracy).

3.7. The personal data of the Data Subject are kept by UAB “Kitoks miestas” in a form which permits identification of Data Subjects for no longer than is necessary for the purposes for which the personal data are processed. UAB “Kitoks miestas” may store the personal data of the Data Subject for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to implementation of the appropriate technical and organisational measures required in order to safeguard the rights and freedoms of the Data Subject, and retention periods are set for all personal data processed by UAB “Kitoks miestas” (principle of storage limitation).

3.8. The personal data of the Data Subject are processed by UAB “Kitoks miestas” in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (principle of integrity and confidentiality).

3.9. UAB “Kitoks miestas” is responsible for compliance with the principles set out in the GDPR and the Policy and must be able to demonstrate compliance with them when processing personal data. UAB “Kitoks miestas” implements the legal requirements for the protection of personal data, monitors compliance with them and collects data to demonstrate compliance with the GDPR requirements. It documents changes in personal data processing and personal data breaches and responds to other actions carried out by UAB “Kitoks miestas” related to the processing of personal data (principle of accountability).

3.10. In order to properly implement the principle of accountability, UAB “Kitoks miestas” appoints an Employee responsible for properly maintaining the records of Data processing activities.

4. FOR WHAT PURPOSES DO WE COLLECT, PROCESS AND USE

THE PERSONAL DATA OF DATA SUBJECTS?

4.1. We collect, process and use personal data which You provide yourself or which we obtain from other sources in accordance with the GDPR, the LLPPD, the legal acts of the European Union and the Republic of Lithuania, as well as the internal regulations of UAB “Kitoks miestas”.

4.2. We collect, process and use the personal data You provide for the following main purposes:

4.2.1. If You or Your representative visit the website of UAB “Kitoks miestas”, we collect information about website visitors and other browsing information, including data on when and from where our website or other electronic platforms were accessed. During registration on the website of UAB “Kitoks miestas”, You will be asked to provide personal data (name, surname, telephone number, email address) and consent to the collection and processing of the personal data You provide, so that UAB “Kitoks miestas” can provide You with information about the wholesale and retail trade of UAB “Kitoks miestas” and the services it provides. You may withdraw at any time the consent You have given to UAB “Kitoks miestas” to process the personal data You provided by sending a message to the email address: info@citypro.lt .

4.2.2. If You intend to conclude or have concluded a contract with UAB “Kitoks miestas” for e-commerce or the provision of goods and/or services, for the purposes of administering Your orders and administering the loyalty programme we collect and process Your name, surname, identity document number, residential address, delivery address, telephone number and other contact details, as well as other information related to the goods and/or services being purchased which You provide to a representative of UAB “Kitoks miestas” during meetings or at the conclusion of the contract. Where a customer of UAB “Kitoks miestas” purchases goods without becoming a registered user of the UAB “Kitoks miestas” e-shop, UAB “Kitoks miestas” processes the name, surname and email address of such Customer (Payer) or the name, surname and email address of the recipient of the goods, the recipient’s address and telephone number. We process and store this information for no longer than is necessary for the fulfilment of Your order and the performance of the contract.

4.2.3. In order to advise You on the services provided in car parks administered by UAB “Kitoks miestas” and to provide You with services for accounting and security purposes, we collect and process Your telephone number (where it is possible to pay for parking by telephone call or where assistance needs to be provided in the event of malfunctions of the automatic video surveillance equipment), vehicle registration number, time of arrival and time of departure. Where parking is paid for by card – payment order data. The data are obtained when Data Subjects physically visit the car parks administered by UAB “Kitoks miestas”. Access to real-time video surveillance is granted, on the instructions of UAB “Kitoks miestas”, to authorised call centre staff when assistance is required for the Data Subject’s vehicle exiting/entering due to malfunctions of the automatic equipment. Anonymised data are transferred to persons providing services to UAB “Kitoks miestas” for the purposes of accounting, calculation of parking charges and processing of parking payments. We process this information and the data collected in the course of providing services for as long as You use the services of UAB “Kitoks miestas”.

4.2.4. In order to provide You with the services and products of UAB “Kitoks miestas” under the contract and properly perform contractual obligations, as well as to perform the obligations established in the legal acts of the European Union and the Republic of Lithuania, we collect and process the name, surname, identity document number, residential address, telephone number and other contact details of You or Your authorised representative. For this purpose, we also use the bank current account number You have provided, data on Your transactions concluded with UAB “Kitoks miestas” and other data and information necessary for the performance of the contract. We analyse Your use of the services of UAB “Kitoks miestas” by automated means so that we can properly inform You of service disruptions and present improvements to the services provided or new similar services. We process the data You have provided, collected while providing You with the services or goods of UAB “Kitoks miestas”, for as long as You use our services and store them for a further 10 years after You stop using them. In order to communicate with You, properly perform contractual obligations, respond to Your questions and requests regarding the provision of the services of UAB “Kitoks miestas”, as well as to receive Your feedback, send important notices regarding changes to the provision of the services of UAB “Kitoks miestas”, the rules, this Policy or other documents, and send security alerts, we process Your contact details and the content of messages received and sent. We process the data collected while providing the services of UAB “Kitoks miestas” for as long as You use our services.

4.2.5. In order to send and present to You direct marketing offers that meet Your needs and are tailored to You, we collect and use the name, surname, telephone number and email address of You or Your representative, and we also collect and use information about Your use of the e-commerce and services of UAB “Kitoks miestas”, payment transaction history and other information which You provide to us during meetings or through electronic channels. For this purpose, we analyse by automated means information about Your orders and Your purchase and service history, i.e. which goods and services You have purchased using our e-commerce services. We process the data collected while providing services for as long as You use our services. If You do not agree to Your personal data being used for direct marketing purposes, please inform us immediately by email: info@citypro.lt .

4.2.6. In order to ensure the provision of e-commerce and services, for this purpose we record and store Your telephone number, IP address and other technical data identifying You, and the time of communication. We process the data collected while providing services for as long as You use our services.

4.2.7. In order to manage Your debts for the purposes of debt management of UAB “Kitoks miestas”, we collect and process Your name, surname, personal identification number (or date of birth), identity document number, residential address, telephone number, data on the amount of the debt, Your income, Your workplace, position held, property held, Your financial obligations to other creditors, credit and payment history, and Your family’s property. If a customer-debtor of UAB “Kitoks miestas” has died, we collect and process information about the fact and date of death. We process the data for no longer than is necessary to achieve the purpose for which the data were collected, taking into account the legitimate interest of UAB “Kitoks miestas” and in compliance with the time limits established by legal acts.

4.2.8. In order to manage and protect the legitimate interests of UAB “Kitoks miestas” and in seeking to comply with the provisions of the GDPR, the LLPPD, as well as the personal data processing rules and other internal regulations of UAB “Kitoks miestas”, and with the requirements of courts and law enforcement authorities and to satisfy their requests, we may process data and information about judicial or administrative proceedings in which You are involved, as well as other information transferred to us for the above purposes. We process and store the data for no longer than is necessary to achieve the purpose for which the data were collected, taking into account the legitimate interest of UAB “Kitoks miestas” and in compliance with the time limits established by legal acts.

4.2.9. In order to advise You on employment with UAB “Kitoks miestas” and to assess Your candidacy, we collect and process Your name, surname, personal identification number or date of birth, identity document number, residential address, telephone number and other contact details, information about Your education, marital status, Your income and financial obligations to other entities, and other information which You provide to us during meetings or remote consultations. We process and store this information for no longer than is necessary to assess Your candidacy.

4.2.10. For the purposes of ensuring the protection of the staff, customers and other persons entering the field of video surveillance, and of property, UAB “Kitoks miestas” processes the image data of its staff, customers and other persons entering the field of video surveillance. Image data may be transferred only to law enforcement authorities in accordance with the procedure established by the legal acts of the Republic of Lithuania.

4.3. In performing contractual obligations or obligations established in the legal acts of the European Union and the Republic of Lithuania, we may also obtain Your personal data from other sources: from the Board of the State Social Insurance Fund, SE Centre of Registers, SE Regitra, from law enforcement authorities and other registers and state institutions of the Republic of Lithuania. From UAB Creditinfo Lietuva, insurance companies operating in Lithuania if You use insurance services, from the Ministry of Finance and other financial institutions. The use of this personal information of Yours helps us to manage, improve and develop our services, reduce disruptions in the provision of the services we offer, and allows us to keep our communication up to date, make it easier and tailor it as closely as possible to You personally.

4.4. In collecting and using the personal data You have entrusted to UAB “Kitoks miestas”, as well as personal data obtained from other sources, we undertake:

4.4.1. To process personal data only for explicitly defined and legitimate purposes.

4.4.2. Not to process or use the personal data You have provided for purposes other than those specified in this Policy, except in cases established by legal acts.

4.4.3. To process and store Your personal data lawfully, accurately, transparently, fairly and in such a manner as to ensure the accuracy, integrity and security of the personal data processed.

4.4.4. We undertake to ensure that no excessive personal data of Yours are processed and to store the personal data You have provided for no longer than is necessary for the performance of the contract and for the purposes for which the personal data are processed.

4.4.5. We undertake to be responsible for compliance with the principles laid down in this Policy, to perform the obligations provided for in the legal acts of the European Union and the Republic of Lithuania and to be able to demonstrate compliance with them.

4.5. UAB “Kitoks miestas” does not collect special categories of personal data revealing Your racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, or data concerning sex life or sexual orientation.

5. WHAT DO WE DO TO PROTECT YOUR PERSONAL DATA AND INFORMATION?

5.1. UAB “Kitoks miestas” uses a variety of technologies and procedures ensuring the security of personal data in order to protect Your personal information, which we collect for the purposes of providing our services, from unauthorised access, use or disclosure.

5.2. We require suppliers providing services to UAB “Kitoks miestas” to use appropriate measures capable of protecting Your confidentiality and ensuring the security of Your personal information.

5.3. Please note that, although we take appropriate steps to protect Your information, no website, online transaction, computer system or wireless connection is completely secure. The security of the transmission of information, via the internet or by email, may sometimes not be ensured for reasons beyond the control of UAB “Kitoks miestas”; You should therefore be careful when providing us with information by means of Your choice other than through the electronic systems used by UAB “Kitoks miestas”.

5.4. We store Your personal data in printed documents and information systems for no longer than is necessary for the purposes provided for in the service contract of UAB “Kitoks miestas” and in the legal acts of the European Union and the Republic of Lithuania, and they are stored for as long as it is necessary to store the data for the purposes of contract performance or document archiving, in compliance with the requirements and time limits established in the legal acts of the European Union and the Republic of Lithuania.

5.5. UAB “Kitoks miestas” applies different personal data retention periods, in accordance with the requirements of the legal acts of the European Union and the Republic of Lithuania and taking into account the purposes of personal data processing.

5.6. Exceptions to the retention periods may be established insofar as they do not infringe Your (Data Subjects’) rights and comply with the requirements of the legal acts of the European Union and the Republic of Lithuania.

5.7. Your personal data may be stored for a longer period where:

5.7.1. It is necessary for UAB “Kitoks miestas” to be able to defend itself against claims or actions brought by You and to exercise its rights.

5.7.2. There are reasonable suspicions of unlawful activity on Your part which is being investigated.

5.7.3. Your data are necessary for UAB “Kitoks miestas” to properly resolve a dispute, complaint or claim.

5.7.4. On other grounds provided for in the legal acts of the European Union and the Republic of Lithuania.

5.8. Upon expiry of the personal data retention periods provided for in the contract and in the legal acts of the European Union and the Republic of Lithuania, unless they have been extended, the personal data will be destroyed in such a way that they cannot be restored.

6. RIGHTS OF THE DATA SUBJECT

6.1. You have the right, at any time, by submitting a written request to the head of UAB “Kitoks miestas” at Mėnulio g. 7, Vilnius or by sending a written request to the email address: info@citypro.lt, to access Your personal data being processed and to know how they are processed.

6.2. You have the following rights:

1. the right of access to Your personal data;
2. the right to request rectification of incorrect, inaccurate or incomplete data;
3. the right to restriction of the processing of Your personal data until the lawfulness of their processing has been verified at Your request;
4. the right to request erasure of personal data;
5. the right to object to the processing of personal data for direct marketing purposes, including profiling, and where personal data are processed for the purposes of legitimate interests;
6. the right to request that the personal data You have provided be transmitted to another data controller or provided directly to You in a convenient form (applicable to personal data which You have provided yourself and which are processed by automated means on the basis of consent or on the basis of the submission of a request or the conclusion and performance of a contract);
7. the right to withdraw the consent You have given to UAB “Kitoks miestas” to the processing of personal data, without affecting the use of Your personal data carried out before the withdrawal of consent;
8. the right to lodge a complaint with the State Data Protection Inspectorate.

6.3. We will reply to Your request no later than within 30 (thirty) calendar days from the date of receipt of the request. In exceptional cases, where we are entitled to extend the time limit for providing the data You have requested or for examining other demands set out in Your request to up to 60 (sixty) calendar days from the date of Your application, we will inform You of this separately in writing or by the email address You have specified.

6.4. If UAB “Kitoks miestas” refuses to satisfy Your request where the circumstances set out in the GDPR and other legal acts of the European Union and the Republic of Lithuania are established, we will additionally inform You of this in writing or by the email address You have specified, providing a reasoned reply.

7. TO WHOM MAY WE TRANSFER YOUR PERSONAL DATA?

7.1. UAB “Kitoks miestas” ensures the protection of personal data in accordance with both the directly applicable legal acts of the European Union and the Republic of Lithuania and the internal regulations of UAB “Kitoks miestas”; therefore, we may transfer Your personal data to third parties only in compliance with the requirements of legal acts and only on the basis of one-off lawful requests from such persons or under concluded data provision agreements.

7.2. Image data may be transferred only to persons authorised by the owners of car parks and to law enforcement authorities in accordance with the procedure established by the legal acts of the Republic of Lithuania, except for the data processors engaged by UAB “Kitoks miestas”.

7.3. UAB “Kitoks miestas” may engage data processors for the processing of the personal data specified in this Policy and provided by You to UAB “Kitoks miestas”. (For example, companies providing data centre, website administration and related services, companies providing document archiving and destruction services, companies developing, providing, maintaining and further developing software, companies providing information technology infrastructure services, companies providing communication services, companies providing accounting services, etc.)

7.4. Data Processors engaged by UAB “Kitoks miestas” have the right to process Your personal data only in accordance with the instructions of UAB “Kitoks miestas” (the Data Controller) and only to the extent necessary for the proper performance of the obligations set for the Data Processors in the data processing agreement. Data Processors have the right to process personal data only in accordance with the instructions of UAB “Kitoks miestas” (the Data Controller) and only to the extent necessary for the proper performance of the obligations set out in the agreement.

7.5. When engaging data processors, UAB “Kitoks miestas” takes all necessary measures to ensure that the data processors have implemented appropriate organisational and technical security measures and maintain the confidentiality of personal data.

7.6. In compliance with the requirements of the legal acts of the European Union and the Republic of Lithuania, the personal data of the Data Subject may be transferred to:

1. the courts of the Republic of Lithuania and other law enforcement and dispute resolution authorities in the exercise of their lawful powers, on the basis of their written request;
2. companies operating in the Republic of Lithuania that provide debt collection, auditing, training organisation, video surveillance and other services;
3. the Department of Statistics of the Republic of Lithuania, the Board of the State Social Insurance Fund, SE Centre of Registers, SE Regitra, notaries, bailiffs, law enforcement and state institutions;
4. representatives of audit firms;
5. other third parties, insofar as this relates to the provision of services by UAB “Kitoks miestas” (the Data Controller), sales, purchases, reorganisation of the services provided or similar changes in the company.

7.7. Data obtained directly from Customers (Data Subjects) or their representatives, with their consent or in the performance of a contract with the Customer, may, as necessary, be transferred to the following recipients:

1. A company providing accounting services, for the purpose of keeping the internal accounts of UAB “Kitoks miestas” (the Data Controller);
2. Lietuvos paštas and/or parcel delivery (courier) services, for the purpose of transferring or forwarding goods or providing services to the Customer (Data Subject);
3. When providing services – to partners of UAB “Kitoks miestas” (the Data Controller), in order to fulfil the Customer’s (Data Subject’s) order or the services ordered. UAB “Kitoks miestas” (the Data Controller) will provide these service providers with only as much of the Customer’s (Data Subject’s) personal information as is necessary to perform the specific service.

7.8. In all cases, UAB “Kitoks miestas” (the Data Controller) will require a legal basis from the Data recipient. In the absence of a legal basis, UAB “Kitoks miestas” (the Data Controller) will not provide Your personal data to third parties.

Thank You for choosing UAB “Kitoks miestas” as Your partner; we strive to ensure that the services we provide meet Your expectations. It is important to us that You provide us with information about changes in circumstances and in Your personal data, so that we can inform You about changes to our services, products, prices and other important terms.

8. COOKIES

8.1. Cookies are small text files stored on Your device when You visit www.citypro.lt.

8.2. Necessary cookies are required for the website to work and are always used. Other categories (functional, analytics, performance, advertising) are used only with Your consent.

8.3. You can change Your choice at any time via the “Cookie settings” link at the bottom of the website or by deleting cookies in Your browser settings.

8.4. Cookies used on the website:

Necessary

Functional

RULES FOR THE EXERCISE OF DATA SUBJECT RIGHTS

1. GENERAL PROVISIONS

1.1. The controller and processor of the personal data referred to in these Rules is UAB “Kitoks miestas”, company code 303118462. Registered office address: Mėnulio g. 7, LT-04326 Vilnius, tel. +370 (610) 22229. Email: info@citypro.lt . Website www.citypro.lt, which ensures that the data of a natural person (hereinafter – the Data Subject) are processed in the Company in compliance with the personal data processing requirements established in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter – the GDPR), the Law on Legal Protection of Personal Data of the Republic of Lithuania (hereinafter – the LLPPD) and other legal acts of the European Union and the Republic of Lithuania, and creates more favourable conditions for Data Subjects to exercise the rights established in Articles 15–22 of the GDPR.

1.2. The purpose of the Rules for the Exercise of Data Subject Rights (hereinafter – the Rules) is to establish the procedure for the exercise of Data Subjects’ rights at UAB “Kitoks miestas” (hereinafter – the Company), in order to ensure compliance with the GDPR, the LLPPD and other legal acts of the European Union and the Republic of Lithuania regulating the processing and protection of personal data, and to implement the principle of accountability.

1.3. The Rules form part of the Company’s Privacy and Data Processing Policy, which is published on the website www.citypro.lt in the section “Personal Data Protection”.

1.4. In the section “Personal Data Protection” of the Company’s website, the Data Subject may consult the Privacy and Data Processing Policy and other internal regulations of the Company governing the processing and protection of personal data, and exercise the Data Subject’s rights established in Articles 15–22 of the GDPR.

1.5. The Rules have been drawn up in accordance with the personal data processing requirements established in the GDPR, the LLPPD and other legal acts of the European Union and the Republic of Lithuania.

1.6. The Rules are binding on all employees of the Company and other personal data processors who, in the cases established in these Rules, the GDPR and the LLPPD, process or may process the personal data of Data Subjects on behalf of the Company.

1.7. The terms used in these Rules shall be understood as defined in the GDPR, the LLPPD and other legal acts of the European Union and the Republic of Lithuania.

2. KEY TERMS USED IN THE RULES

2.1. Company – a legal person of any legal form engaged in economic activity, including partnerships or associations regularly engaged in economic activity.

2.2. Privacy Policy – the provisions of the personal data protection policy which the Company (as data controller or data processor) complies with.

2.3. Website – the Company’s website at www.citypro.lt on which a website visitor or customer may place an order, submit an enquiry, or give consent to the processing of personal data for the purposes of e-commerce and direct marketing, or for the administration of enquiries, purchases and the loyalty programme.

2.4. Personal data – any information relating to a living natural person whose identity is known or can be identified, directly or indirectly, by reference to such data subject data as name, surname, date of birth, personal identification number, residential address, identity card or passport number, bank card number, diploma and certificate details, data on property held, health data, biometric data, facial image, telephone number, email address, internet protocol (IP) address, vehicle registration number or other physical, physiological, psychological, economic, cultural or social features specific only to the natural person.

2.5. Data Subject – a living natural person, customer or website visitor whose personal data the Data Controller processes for the purposes of e-commerce, the administration of enquiries, purchases and the loyalty programme, and for direct marketing purposes.

2.6. Data Controller – UAB “Kitoks miestas” company code 303118462. Registered office address: Mėnulio g. 7, Vilnius, tel. +370 (610) 22229. Email: info@citypro.lt . Website www.citypro.lt

2.7. Data Processor – a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Data Controller and assists the Data Controller, in accordance with the authorisation granted by it, in achieving the purposes set by the Data Controller.

2.8. Data processing – any operation performed on personal data: collection, recording, accumulation, storage, alteration (supplementation or rectification), provision, use, destruction or any other operation or set of operations.

2.9. Direct marketing – activities of the Data Controller aimed at offering goods or services to persons by post, telephone or other direct means, offering occasional discounts and/or asking for their opinion on the goods or services offered.

2.10.E-commerce – the purchase and sale of the Data Controller’s goods (products) or services over the internet.

2.11. Filing system – any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis.

2.12. Consent of the Data Subject – any freely given, specific and unambiguous indication of the will of a properly informed Data Subject, by a statement or by clear affirmative action, by which he or she agrees to the processing of personal data relating to him or her.

2.13. Data recipient – a natural or legal person, public authority, agency or another body to which the personal data are disclosed, whether a third party or not.

2.14. Public authorities and bodies – state and municipal institutions and bodies, enterprises and public institutions financed from state or municipal budgets and state monetary funds and authorised, in accordance with the procedure established by the Law on Public Administration of the Republic of Lithuania, to perform public administration or providing public or administrative services to persons or performing other public functions.

2.15. Third party – a natural or legal person, public authority, agency or body other than the data subject, data controller, data processor and persons who, under the direct authority of the data controller or data processor, are authorised to process personal data.

2.16. Supervisory authority – the State Data Protection Inspectorate (hereinafter – the SDPI). Contact details of the authority: L. Sapiegos g. 17, 10312 Vilnius (entrance on the left-hand side) Tel. (8 5) 271 28 04, (8 5) 2791445. Fax (8 5) 261 94 94. Email: ada@ada.lt , E-delivery box: 188607912.

3. THE DATA SUBJECT’S RIGHT TO RECEIVE INFORMATION ABOUT DATA PROCESSING

3.1. The information referred to in Articles 13 and 14 of the GDPR about the processing of the Data Subject’s personal data carried out in the Company is provided in the Company’s Privacy and Data Processing Policy published on the website www.citypro.lt in the section “Personal Data Protection”, in the rules on the processing of customers’ and employees’ personal data and on the exercise of data subject rights, and in other internal regulations of the Company.

3.2. Information about the processing of personal data is provided to Data Subjects in writing, by telephone or by electronic means of communication at the time the data are obtained.

3.3. Where the Data Subject’s personal data are not collected directly from the Data Subject, the Data Subject is informed about the processing of personal data:

3.3.1. Within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed.

3.3.2. If the personal data are to be used in the Company solely for communication with the Data Subject – at the latest at the time of the first communication with that Data Subject.

3.3.3. If the Company envisages disclosing the personal data obtained to another data recipient – at the latest when the data are first disclosed.

4. THE DATA SUBJECT’S RIGHT OF ACCESS TO DATA

4.1. The Data Subject has the right to submit a request to the Company for access to his or her personal data and to obtain from the Company confirmation as to whether or not personal data concerning him or her are being processed in the Company. Document template.

4.2. Where personal data are processed in the Company, the Data Subject has the right to request access to his or her personal data and to obtain from the Company the information provided for in Article 15(1) and (2) of the GDPR about the purposes of the processing of personal data, the categories of personal data processed, the categories of data recipients to whom his or her personal data have been or will be disclosed, and the envisaged period for which the personal data will be stored.

4.3. The Data Subject also has the right to submit a request to the Company for rectification or erasure of his or her personal data, for restriction of the processing of personal data concerning the Data Subject, or to object to such processing of personal data.

4.4. Where personal data are or have been collected not from the Data Subject, the Data Subject has the right to request the Company to provide him or her with information about the sources from which his or her personal data are or have been collected.

4.5. Where the Company transfers or intends to transfer the Data Subject’s personal data to a third country or to an international organisation, the Data Subject has the right to be informed of the appropriate safeguards relating to the transfer of personal data pursuant to Article 46 of the GDPR.

4.6. The Data Subject has the right to request the Company to provide him or her with a copy of his or her personal data processed in the Company; however, a fee may be charged for this, calculated on the basis of the Company’s administrative costs.

4.7. The Data Subject has the right to submit a request to the Company for access to his or her personal data also by electronic means. In responding to the Data Subject’s request, the Company provides him or her with the information in writing, by telephone or by electronic means of communication and separately from any other information.

5. THE DATA SUBJECT’S RIGHT TO REQUEST RECTIFICATION OF DATA

5.1. Pursuant to Article 16 of the GDPR, the Data Subject has the right to require that any inaccurate personal data concerning him or her processed in the Company be rectified without delay and that incomplete personal data be completed.

5.2. Taking into account the Company’s purposes for which his or her personal data are or have been processed in the Company, the Data Subject has the right to require the Company to rectify and complete his or her incomplete personal data by submitting a supplementary request to the Company.

5.3. In order to verify that inaccurate or incomplete personal data of the Data Subject are being processed in the Company, the Company may ask the Data Subject to provide evidence confirming this.

5.4. If the Data Subject’s personal data have been rectified in the Company at the Data Subject’s request and have been transferred to other data processors or recipients, the Company shall inform those data recipients thereof without delay, unless this proves impossible or would involve disproportionate effort on the part of the Company.

5.5. The Data Subject also has the right to request the Company to provide him or her with information about such data processors and recipients. Such a request of the Data Subject should not adversely affect the rights or freedoms of other persons (Data Subjects).

5.6. Upon receipt of the Data Subject’s request, the Company carries out a thorough assessment of the information provided in the Data Subject’s request and informs the Data Subject of the decision taken. This information is provided to the Data Subject in writing, by telephone or by electronic means of communication and separately from any other information.

6. THE DATA SUBJECT’S RIGHT TO REQUEST ERASURE OF DATA

(“RIGHT TO BE FORGOTTEN”)

6.1. In the cases provided for in Article 17 of the GDPR, the Data Subject has the right to submit a request to the Company and to require the Company to erase personal data concerning him or her without undue delay where one of the following grounds applies:

6.1.1. The Data Subject’s personal data are no longer necessary for the Company in relation to the purposes for which they were collected or otherwise processed.

6.1.2. The Data Subject withdraws the consent on which the processing is based according to point (a) of Article 6(1) or point (a) of Article 9(2) of the GDPR, and there is no other legal ground for the Company to process the Data Subject’s personal data.

6.1.3. The Data Subject objects to the processing pursuant to Article 21(1) of the GDPR and the Company has no compelling legitimate grounds which override the interests, rights and freedoms of the Data Subject, or there are no overriding legitimate grounds for the Company to process the Data Subject’s personal data, and the Data Subject objects to his or her personal data being processed for direct marketing purposes. Where the Data Subject objects to processing for direct marketing purposes, his or her personal data are no longer processed in the Company for such purposes.

6.2. If the Data Subject’s personal data have been erased in the Company or their processing has been restricted at the Data Subject’s request, the Data Subject is informed thereof at the latest at the time of the first communication with the Data Subject, and this information is provided to him or her in writing, by telephone or by electronic means of communication and separately from any other information.

7. THE DATA SUBJECT’S RIGHT TO RESTRICTION OF DATA PROCESSING

7.1. In the cases provided for in Article 18(1) of the GDPR, the Data Subject has the right to submit a request to the Company and to require the Company to restrict the processing of personal data concerning him or her without undue delay where one of the following applies:

1. the accuracy of the personal data is contested by the Data Subject, for a period enabling the Company to verify the accuracy of the personal data;
2. following a verification, it has been established that the processing of personal data in the Company is unlawful and the Data Subject opposes the erasure of his or her personal data in the Company and requests the Company to restrict the use of his or her personal data instead;
3. the Company no longer needs the Data Subject’s personal data for the purposes of the processing, but they are required by the Data Subject for the establishment, exercise or defence of legal claims;
4. the Data Subject has objected, pursuant to Article 21(1) of the GDPR, to the processing of personal data concerning him or her in the Company, pending verification of whether the legitimate grounds of the Company override those of the Data Subject.

7.2. The personal data of the Data Subject, the processing of which in the Company has been restricted at the Data Subject’s request, are stored in the Company. Before such a restriction is lifted, the Company informs the Data Subject thereof in writing, by telephone or by electronic means of communication.

7.3. If the processing of the Data Subject’s personal data in the Company has been restricted at the Data Subject’s request and his or her personal data have been transferred to other data recipients, the Company shall inform those data recipients thereof without delay, unless this proves impossible or would involve disproportionate effort on the part of the Company. In this case, the Data Subject has the right to request the Company to provide him or her with information about such data recipients. That right should not adversely affect the rights or freedoms of other persons.

7.4. Upon receipt of the Data Subject’s request, the Company carries out a thorough assessment of the information provided in the Data Subject’s request and informs the Data Subject of the decision taken. This information is provided to the Data Subject in writing, by telephone or by electronic means of communication and separately from any other information.

8. THE DATA SUBJECT’S RIGHT TO DATA PORTABILITY

8.1. In the cases provided for in Article 20(1) and (2) of the GDPR, the Data Subject has the right to submit a request to the Company and to require the Company to transmit the Data Subject’s personal data, which he or she has provided to the Company for processing, in a structured, commonly used or machine-readable format to another data controller, or to provide them to the Data Subject himself or herself, where:

1. the processing of data in the Company is based on the Data Subject’s consent pursuant to point (a) of Article 6(1) of the GDPR and point (a) of Article 9(2) of the GDPR, or on a contract pursuant to point (b) of Article 6(1) of the GDPR, where processing of his or her personal data is necessary for the performance of a contract;
2. the Data Subject’s personal data are processed in the Company by automated means.

8.2. In exercising his or her right to data portability in the cases provided for in Article 20(1) of the GDPR, the Data Subject may request the Company to transmit the personal data concerning him or her directly to another data controller, and shall clearly specify the personal data which, at his or her request, the Company must transmit to the other data controller, where technically feasible.

8.3. Upon receipt of the Data Subject’s request to transmit the personal data concerning him or her directly to another data controller, the Company shall not hinder this where the Data Subject’s personal data are processed in the Company by automated means and where it is technically feasible to do so.

8.4. The Data Subject also has the right to request the Company to erase personal data which have been transmitted to another data controller at his or her request. That right shall not apply where the processing of the Data Subject’s personal data in the Company is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Company.

8.5. The Data Subject does not have the right to data portability in respect of those of his or her personal data which are processed in the Company by non-automated means in structured files or paper files.

8.6. In exercising his or her right to data portability, the Data Subject may not adversely affect the rights and freedoms of other persons.

8.7. Upon receipt of the Data Subject’s request, the Company carries out a thorough assessment of the information provided in the Data Subject’s request and informs the Data Subject of the decision taken. This information is provided to the Data Subject in writing, by telephone or by electronic means of communication and separately from any other information.

9. THE DATA SUBJECT’S RIGHT TO OBJECT TO DATA PROCESSING

9.1. Pursuant to Article 21 of the GDPR, the Data Subject has the right to object, on grounds relating to his or her particular situation, at any time to the processing of his or her personal data by the Company where:

1. pursuant to point (e) of Article 6(1) of the GDPR the processing of the Data Subject’s personal data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Company, including profiling;
2. pursuant to point (f) of Article 6(1) of the GDPR the processing of the Data Subject’s personal data is necessary for the purposes of the legitimate interests pursued by the Company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the Data Subject which require protection of personal data, in particular where the data subject is a child, including profiling.

9.2. The Data Subject does not have the right to object to the Company processing his or her personal data where the Company demonstrates to the Data Subject that his or her personal data are processed in the Company on compelling legitimate grounds which override the interests, rights and freedoms of the Data Subject, or for the establishment, exercise or defence of legal claims applicable to the Company. The Data Subject is informed thereof at the latest at the time of the first communication with him or her. This information is provided to the Data Subject clearly and separately from any other information, in writing, by telephone or by email.

9.3. Where the Data Subject’s personal data are processed in the Company for direct marketing purposes, the Data Subject has the right at any time to submit a request to the Company and to object to the processing of personal data concerning him or her for such marketing purposes, including profiling to the extent that it is related to such direct marketing. Where the Data Subject objects to processing for direct marketing purposes, the personal data are no longer processed in the Company for such purposes and the Data Subject is informed thereof at the latest at the time of the first communication with him or her. This information is provided to the Data Subject clearly and separately from any other information, in writing, by telephone or by email.

9.4. Where the Company processes or intends to process the Data Subject’s personal data for statistical purposes or for scientific or historical research purposes pursuant to Article 89(1) of the GDPR, the Data Subject has the right at any time to submit a request to the Company and to object to the processing of personal data concerning him or her in the Company, unless the processing of the Data Subject’s personal data by the Company is necessary for the performance of a task carried out for reasons of public interest. The Data Subject is informed thereof at the latest at the time of the first communication with him or her. This information is provided to the Data Subject clearly and separately from any other information, in writing, by telephone or by email.

9.5. Where the Data Subject has submitted a request to the Company and objected to the processing of personal data for clearly specified purposes of personal data processing, such processing may be carried out in the Company only if the head of the Company decides, with reasons, that the grounds for the processing of the Data Subject’s personal data override the interests, rights and freedoms of the Data Subject, or that the Data Subject’s personal data are necessary for the Company for the establishment, exercise or defence of its rights and legal interest.

9.6. Upon receipt of the Data Subject’s request, the Company carries out a thorough assessment of the information provided in the Data Subject’s request and informs the Data Subject of the decision taken. This information is provided to the Data Subject in writing, by telephone or by electronic means of communication and separately from any other information.

10. THE DATA SUBJECT’S RIGHT TO REQUEST NOT TO BE SUBJECT TO

A DECISION BASED SOLELY ON AUTOMATED DATA PROCESSING

10.1. In the cases provided for in Article 22(1) of the GDPR, the Data Subject has the right to submit a request to the Company and to require that he or she not be subject to a decision of the Company based solely on automated processing of personal data, including profiling, which produces legal effects concerning the Data Subject or similarly significantly affects him or her, and that such a decision of the Company be reviewed.

10.2. Upon receipt of the Data Subject’s request, the Company carries out a thorough assessment of the information provided in the Data Subject’s request and informs the Data Subject of the decision taken. This information is provided to the Data Subject in writing, by telephone or by electronic means of communication and separately from any other information.

11. SUBMISSION OF A REQUEST TO EXERCISE DATA SUBJECT RIGHTS

11.1. The Data Subject has the right to submit a request to the Company regarding the exercise of his or her rights orally, in writing, by telephone +370 (610) 22229 or by electronic means of communication to the email address: info@citypro.lt or by submitting the request in person at the Company’s office at Mėnulio g. 7, LT-04326 Vilnius.

11.2. If the Data Subject applies orally regarding the exercise of the Data Subject’s rights, or submits the request to the Company in writing in person at the Company’s office, the Data Subject must confirm his or her identity by presenting an identity document to the Company’s administration. Failing this, the Data Subject’s request will not be examined and his or her rights will not be exercised. This provision does not apply where the Data Subject applies to the Company’s administration for information about the processing of his or her personal data pursuant to Articles 13 and 14 of the GDPR.

11.3. If the Data Subject has submitted a request to the Company by post regarding the exercise of the Data Subject’s rights, a notarised copy of the Data Subject’s identity document must be submitted together with the request. When submitting a request by electronic means, the Data Subject’s request must be signed with a qualified electronic signature or be generated by electronic means which ensure the integrity and immutability of the text. This provision does not apply where the Data Subject applies to the Company’s administration for information about the processing of his or her personal data pursuant to Articles 13 and 14 of the GDPR.

11.4. A request submitted by the Data Subject to the Company to exercise the Data Subject’s rights must be legible and signed by the Data Subject, and must state the Data Subject’s name, surname, address and other contact details for communication or by which the Data Subject wishes to receive the Company’s reply regarding the examination of the Data Subject’s request and the exercise of his or her rights.

11.5. The Data Subject may exercise his or her rights personally or through a representative. In the request, the Data Subject’s representative must state his or her name, surname, address and other contact details for communication by which the Data Subject’s representative wishes to receive the Company’s reply, as well as the name and surname of the represented Data Subject, and must specify other data necessary for the identification of the Data Subject and provide a document certifying the representation or a copy thereof.

11.6. Where there are doubts as to the identity of the Data Subject, the Company (the Company’s representative) may ask the Data Subject to provide additional information necessary to establish or confirm the identity of the Data Subject.

11.7. On all matters relating to the processing of the Data Subject’s personal data and the exercise of his or her rights, the Data Subject has the right to apply to the head of the Company in person, by post or by email info@citypro.lt. In order to ensure the confidentiality laid down in Article 38(5) of the GDPR, when the Data Subject or his or her representative applies to the head of the Company by post, he or she shall mark on the envelope that the correspondence is intended only for the head of the Company or for the Company’s data protection officer, if one has been appointed.

12. EXAMINATION OF A REQUEST TO EXERCISE DATA SUBJECT RIGHTS

12.1. Upon receipt of the Data Subject’s request, the Company shall, no later than within one month from the date of receipt of the request, provide the Data Subject with information on the action taken on the Data Subject’s request. This information is provided to the Data Subject in writing, by telephone or by electronic means of communication and separately from any other information.

12.2. If the Company is late in providing information to the Data Subject within the time limit specified in point 12.1., the Data Subject is additionally informed thereof, stating the reasons for the delay and the possibility of lodging a complaint with the State Data Protection Inspectorate.

12.3. If a request of the Data Subject or his or her representative has been submitted to the Company without complying with the procedure and requirements established in point 11 of these Rules, it is not examined, and the Data Subject is informed thereof, with the reasons stated, without delay but no later than within five working days.

12.4. If, during the examination of the Data Subject’s request, it is established that the Data Subject’s rights are restricted on the grounds provided for in Article 23(1) of the GDPR, the Data Subject is informed thereof in writing, by telephone or by electronic means of communication and separately from any other information.

12.5. Information in response to the Data Subject’s request concerning the exercise of his or her rights is provided to the Data Subject or his or her representative in the state language in writing, by telephone or by electronic means of communication and separately from any other information.

12.6. All actions of the Company in response to the Data Subject’s requests to exercise the Data Subject’s rights are carried out, and information is provided to the Data Subject or his or her representative, free of charge once per calendar year.

12.7. The Data Subject or his or her representative has the right to lodge a complaint about the Company’s actions or omissions in the exercise of the Data Subject’s rights with the State Data Protection Inspectorate at: L. Sapiegos g. 17, 10312 Vilnius, email: ada@ada.lt, website www.vdai.lrv.lt, or with a court of the Republic of Lithuania in accordance with the procedure established by law.

12.8. Where the Data Subject has suffered material or non-material damage as a result of an infringement of the Data Subject’s rights, the Data Subject has the right to apply to a court of the Republic of Lithuania for an award of compensation in accordance with the procedure established by law.