Joint-stock company Lietuvos oro uostai(code of the legal entity: 120864074, legal address: Rodūnios kelias 10A, Vilnius, Lietuva; phone No.: +370 612 44442; e-mail: (hereinafter referred to as we or the Lietuvos oro uostai) understands personal data protection is important for our customers, suppliers/providers, partners, and other persons (hereinafter referred to as the data subject), who cooperate or use services of Vilnius, Kaunas and Palanga international airports. For this reason, we take all reasonable measures to ensure privacy of each data subject and enable person to exercise his personal data protection rights.
You may contact our data protection officer in respect of all matters related to data protection using general e-mail address: .
In this privacy notice we provide all of the information on how we process personal data of data subjects, while acting as data controller, including:
The privacy notice shall be applied to all natural persons, who cooperate or use the services of all three airports in Lithuania (Vilnius, Kaunas and Palanga), visit our websites and/or premises/facilities, stay active on our social network accounts and/or provide their personal data to the Lietuvos oro uostai for other purposes.
Our employees and members of the management bodies are informed about the processing of their personal data in the manner and by means established in the internal regulations of the Lietuvos oro uostai.
The privacy notice has been drawn up based on the following regulations:
This privacy notice is an integral part of a data protection policy approved by the Lietuvos oro uostai.
Depending on the nature of our cooperation, we collect/process your personal data:
| Purpose of data processing | Legal ground for data processing | Data categories | Data retention period |
|---|---|---|---|
| Conclusion and performance of contracts with suppliers/providers, subcontractors | Article 6 (1) (b) of the GDPR – performance of a contract; Article 6 (1) (f) of the GDPR – legitimate interest | Name, surname, personal ID number, date of birth, phone number, e-mail address, address of a place of residence of representatives of suppliers/providers/ subcontractors. Name, surname, position, contact details of a signatory to a contract. | 10 years after expiration of a specific contract |
| Administration of invoices of suppliers/providers/ subcontractors | Article 6 (1) (c) of the GDPR – legal obligation, Article 6 (1) (b) of the GDPR – performance of a contract | Name, surname, job position, personal ID number, number of an individual activity certificate (if applicable), VAT payer’s ID (if applicable) | 10 years from the date of preparation of an invoice |
| Organization of training for natural persons, that are not part of airport employees, who are working on the premises of the airport and subsequent communication with them | Article 6 (1) (c) of the GDPR – legal obligation; Article 6 (1) (b) of the GDPR – performance of a contract | Name, surname, personal ID number, e-mail address, phone number, name of a company/job position | 3 years from the date of organization of training activities |
| Issuing of temporary access permits for the natural persons wishing to get access to an airport premises | Article 6 (1) (c) of the GDPR – legal obligation | Name, surname, personal ID number, date of birth, phone number of an employee of a supplier/provider/customer, name of a company the person is working for, job position, period of issuance of a temporary permit, name of restricted area a temporary permit is issued to, name/ surname of a company’s/institution’s supervisor, who has initiated an issuance of the temporary permit, and a name of a company, name, surname of an accompanying person on airport premises, make, model, license plate number of a vehicle, name, surname of a driver of a vehicle | 1 year after the issuance of a temporary permit |
| Issuing of permanent permits for access for the natural persons wishing to get access to an airport premises | Article 6 (1) (c) of the GDPR – legal obligation | Name, surname, personal ID number, citizenship, phone number, e-mail address of a supplier/customer, information about a registered place of residence for the last 5 years, place of work, reasons for unemployment (extracts, confirmations etc.), information with regard to reason for the issuance of a permanent permit, job position, confirmation of accuracy of data of a natural person, prior criminal records, data about prior convictions dates, certificates of impeccable reputation from third parties, name of restricted area permit allow access to, motives for reception of a permanent permit, training certificates, date of completion of relevant training, information about person who had conducted training activities, make, model, license plate number of a vehicle, name, surname of a driver of a vehicle | 5 years from the date of issuance of a permanent permit |
| Issuing of permits that allow to operate motor vehicle | Article 6 (1) (c) of the GDPR – legal obligation; Article 6 (1) (b) of the GDPR – performance of a contract | Name, surname, mobile phone, e-mail address | 6 months from the date of issuance of a permit |
| Issuing of permits for drone flights | Article 6 (1) (c) of the GDPR – legal obligation | Name, surname, mobile phone number of a drone pilot, number of a drone pilot certificate | 5 years from the date of issuance of a permit |
| Registration of media outlet’s representatives in order to grant them access to the airport premises | Article 6 (1) (a) of the GDPR – consent of a subject | Name, surname, job position, e-mail address, phone number of a journalist | 1 year from the date of submission of an application |
| Administration of admission applications/requests for group tours at the airport | Article 6 (1) (a) of the GDPR – consent of a subject | Name, surname, personal ID number, date of birth of tour participant | 1 month after completion of the tour |
| Video surveillance, implementation of aviation safety measures in order to protect property of the Lietuvos oro uostai and prevent crimes at company premises | Article 6 (1) (f) of the GDPR – legitimate interest; Article 6 (1) (c) of the GDPR – legal obligation | Images of passengers, other personal data seen on a surveillance video | 7 days from the date a specific video surveillance recording was taken |
| Flight ticket validity checking control | Article 6 (1) (c) of the GDPR – legal obligation | Name, surname of an owner of a flight ticket, flight number, flight time | 24 hours from the moment the check was conducted |
| Provision of the contact center services (calls are being recording, automated response informs customers about such activities) | Article 6 (1) (f) of the GDPR – legitimate interest | Call metadata: time, duration, phone number. Content of the recorded call | 3 months from the date phone call was recorded |
| Investigation of road traffic accidents and preparation of notices for insurance companies | Article 6 (1) (c) of the GDPR – legal obligation, Article 6 (1) (f) of the GDPR – performance of a contract | Name. surname of a traffic accident perpetrator or an affected person/victim, copy of a driver’s license, copy of an identity document, road traffic accident statement | 1 year from the date of transfer of a notice about the road accident to an insurance company |
| Distribution of newsletters in order to interest customers in the services of the company or its partners (direct marketing) | Article 6 (1) (a) of the GDPR – consent of a subject | E-mail address of a customer or a potential customer | Until the moment of withdrawal of consent, termination or expiration of a contract for provision of services |
| Distribution of newsletters to partners, subcontractors | Article 6 (1) (a) of the GDPR – consent of a subject | E-mail address of subcontractor’s or partner’s representative | Until the moment of withdrawal of consent, termination or expiration of a contract for provision of services |
| Organization of lotteries | Article 6 (1) (f) of the GDPR – legitimate interest, article 6 (1) (a) of the GDPR – consent of a subject | Names, surnames, address of a place of residence, data of a personal social network account of lottery participants | Until the end of a lottery (prize distribution to a winner) or within terms established by an owner of a social network platform |
| Administration of social networks while conducting communication | Article 6 (1) (f) of the GDPR – legitimate interest, Article 6 (1) (a) of the GDPR – consent of a subject | Names, surnames, aliases, comments, information about user profile, social network account details, information from an electronic device collected by cookies | The records that remain in the accounts of other users are not destroyed after the deletion of the data subject's account. Also, the data that can be used by social network administrators to protect their legitimate interests is not deleted |
| Ensuring operation of cookies | Article 6 (1) (a) of the GDPR – consent of a subject | Specific information collected by cookies is provided in the cookies management window | The exact duration of cookies activity provided in the cookies management window |
| Processing of customers general complaints | Article 6 (1) (c) of the GDPR – legal obligation, Article 6 (1) (f) of the GDPR – legitimate interest | Name, surname, phone number, e-mail address, address of a place of residence of a customer, amount of damage incurred, photos, international bank account number | 3 years from the date complaint was filed |
| Processing of customer complaints/claims related to damage that was done to their health/life and preparation of relevant responses | Article 6 (1) (c) of the GDPR – legal obligation, article 6 (1) (f) of the GDPR – legitimate interest, Article 9 (2) (f) of the GDPR – compliance with legal actions | Name, surname of a passenger, information about injuries to his wellness/health, financial data, e-mail address, place of residence, phone number, international bank account number | 5 years from the date of reception of a specific complaint or a claim and other documents that are accompanying it |
| Ensuring the operation of the terminal, which is intended for the use by VIP customers, shoes in depth description can be found in the internal regulations of Lietuvos oro uostai | Article 6 (1) (c) of the GDPR – legal obligation | Name, surname of a passenger; date, time of arrival/departure, flight number, arrival/departure airport; name, surname of hosting/accompanying persons during arrival/departure; information about vehicles which are used to host/accompany passenger during arrival/departure, their model, state license plates | 3 years from the moment of provision of services |
| Issuance of a privilege card, administration of a privilege card | Article 6 (1) (b) of the GDPR – performance of a contract | Name, surname, e-mail address of a customer, visit history, phone number | 1 year after the end of expiration period of a privilege card |
| Administration of the business club | Article 6 (1) (b) of the GDPR – performance of a contract | Name, surname of a customer, flight number, personal ID number, travel class, loyalty card number, flight time | 3 months from the moment business club card is physically scanned |
| Provision of Fast Track services | Article 6 (1) (b) of the GDPR – performance of a contract | Summaries of customer’s actions, time of use of the service, flight number, costumer’s name, surname | 3 months from the last time when the customer used this service |
| Administration/Maintenance of digital store VNO.lt/ e-shop.lt | Article 6 (1) (b) of the GDPR – performance of a contract | Buyer’s name, surname, address of a place of residence, delivery address, phone number, e-mail address, IP address of an el. device, MAC address, browser data | 3 months from the date of execution of a placed order |
| Provision of car parking services | Article 6 (1) (b) of the GDPR – performance of a contract | Name, surname of a customer, e-mail address, state license plates of a vehicle, photos, time, date of vehicle parking | 3 months from the date of execution of an order |
| Organization and overall control of tenders for the purchase of land, property, and realization of activities related to leasing of real estate of joint-stock company Lietuvos oro uostai | Article 6 (1) (b) of the GDPR – performance of a contrac | Name, surname of a tender participant, address of a place of residence, phone number, e-mail address | 10 years after the end of the tender |
| Conducting of auctions for unnecessary and unsuitable movable property | Article 6 (1) (b) of the GDPR – performance of a contract, Article 6 (1) (c) of the GDPR – legal obligation | Name, surname, personal ID number, phone number, e-mail address of a participant, number of an identity document, number of an auction participant | Registration documents are stored for 5 years, data on winners of auctions for 10 years |
| Administration of invoices related to the purchase of goods/services | Article 6 (1) (c) of the GDPR – legal obligation | Name, surname of a supplier/provider, number of an individual activity certificate, personal ID number, position, VAT payer’s ID number | 10 years from the date of issuance of purchase invoice |
| Administration of invoices related to the sales of goods/services | Article 6 (1) (c) of the GDPR – legal obligation. Article 6 (1) (b) of the GDPR – performance of a contract | Name, surname of a customer, job position, personal ID number, number of an individual activity certificate, VAT payer’s ID number | 10 years from the date of issuance of sales invoice |
| Administration of debt and management of company debtors | Article 6 (1) (f) of the GDPR – legitimate interest | Name, surname, personal ID number of a debtor, amount of debt, phone number, e-mail address | 3 years from the moment of establishment of the debt |
| Recruitment and selection of candidates for open vacancies | Article 6 (1) (a) of the GDPR – consent of a subject, Article 6 (1) (f) of the GDPR – legitimate interest/td> | Name, surname of a candidate, personal ID number, expected salary, CV, data on associated persons (who are already working at the company), phone number, e-mail address, address of a place of residence, photo of candidate, job interview video record/practical task | If the consent was not given – until the end of recruitment process. If the consent was given – 6 months from the end of recruitment process |
| Representation of the Lietuvos oro uostai during litigation procedures in order to protect rights and legal interests of a legal entity that might have been violated | Article 6 (1) (c) of the GDPR – legal obligation, Article 6 (1) (f) of the GDPR – legitimate interest | Names, surnames of plaintiffs, defendants, third persons and their representatives, court officials, independent/dependent experts, contact details, address of the place of residence/ headquarters | 1 year after a final and unappealable decision in a specific case was made |
| Investigation of injuries or cases of fatality on the premises of the airport and provision of adequate reports | Article 6 (1) (c) of the GDPR – legal obligation, Article 9 (2) (f) of the GDPR – compliance with legal actions | Name, surname, personal ID number of an injured or a deceased person, information about health status, past injuries, data on long-term and short-term consequences of injuries of a person, reasons of death | 3 years from the moment of an injury or death |
| Servicing of passengers with limited capabilities by means of SITATEX system notices, documenting of airport operations related to proper servicing of the specified persons | Article 6 (1) (c) of the GDPR – legal obligation | Name, surname of a passenger with limited capabilities, description of person’s needs (without describing his ailment or health data) | 1 week from the date SITATEX notice was created |
| Implementation and technical support of the passenger registration system (CUTE) | Article 6 (1) (c) of the GDPR – legal obligation | Name, surname of a passenger, personal ID number, flight number, flight time, flight direction, flight ticket, luggage number | The data controller does not store data in his storage devices; data is transferred to data processors (airlines operating on premises of the airports) |
| Identification of users visiting the company’s website in order to achieve better customer experience | Article 6 (1) (a) of the GDPR – consent of a subject | Website user’s IP address, MAC address, browser version | Data is stored for up to 13 months after the end of the website browsing/search session, depending on the types of cookies used |
| Maintenance of electronic mailboxes of the Lietuvos oro uostai, and administration of communications therein | Article 6 (1) (f) of the GDPR – legitimate interest | Name, surname of a person concerned, e-mail address, content of e-mails (related to activities performed by the enterprise) | Digital correspondence is stored for 2 years |
| Implementation of higher standards of aviation safety and improvement of experience of passengers in aforementioned field | Article 6 (1) (c) of the GDPR – legal obligation | Name, surname of passenger, flight number | Until boarding to a plane ends |
| Provision of conference center leasing services and implementation of assurance control for access to restricted area | Article 6 (1) (b) of the GDPR – performance of a contract | Name, surname of a participant, purpose for participation in a conference | 3 months from the date, on which event has ended |
| Provision of information about available advertising spaces | Article 6 (1) (c) of the GDPR – legal obligation | Name, surname, e-mail address of the person interested in advertising opportunities | 1 month from the date of reception of notification about advertising vacancies |
| Issuing of loyalty card and its subsequent support | Article 6(1)(b) GDPR - performance of a contract | Loyalty card holder's name, surname, telephone number, e-mail address | 3 months from the reception of application for a loyalty card |
| Reservation of temporary parking spaces for company guests | Article 6(1)(a) GDPR - consent of the subject; Article 6(1)(f) GDPR - legitimate interest | Name of company guest, vehicle license plate number | 1 month from the date of the meeting taking place |
| Control of illegal/prohibited items before the flight | Article 6(1)(c) GDPR - legal obligation | Passenger's name, boarding pass, explanation for the possession of illegal/prohibited items | 1 month from the discovery of the illegal/prohibited item at passenger's possession |
| Maintenance of customer communication system of joint-stock company Lietuvos oro uostai | Article 6(1)(b) GDPR - performance of a contract; Article 6(1)(c) GDPR - legal obligation | Customer's name, surname, e-mail address | 5 years from the date of the last operation/interaction (10 years from the date of the last transaction if accounting documents are kept) |
| Resolution of tenant complaints and enforcement of those resolutions, management of emergency situations | Article 6(1)(b) GDPR - performance of a contract | Name, surname, e-mail address, telephone number of the tenant's representative, personal data contained in the complaint | 5 years from the date tenant's complaint was filed |
| Taking care of requests using "e-mail us" form | Article 6(1)(a) GDPR - subject consent; Article 6(1)(f) GDPR - legitimate interest | Name, surname, telephone number, e-mail address of the request sender | 6 months from the date of lodging the complaint/request |
| Administration of the digital contact form for media outlets | Article 6(1)(a) GDPR - consent of the subject | Name, surname, title and e-mail address of the journalist or a person equated to journalist | 1 month from the date of submission of the form |
| Conducting of public hearings | Article 6(1)(c) GDPR - legal obligation | Name, surname of the person interested in the project, name, telephone number, e-mail address | 3 months from the date of minutes of the hearing were concluded |
| Conducting of internal investigations based on information received through the whistleblower channel | Article 6(1)(c) GDPR - legal obligation | Name, surname, title, personal ID number, place of work, e-mail or home address, telephone number of the person providing information | 5 years from the date of receipt of the notification of possible infringement |
| Maintenance of the register of unlawful remuneration | Article 6(1)(c) GDPR - legal obligation | Name, surname, job position of the person giving the gift/unlawful remuneration | 3 years from the date unlawful remuneration was made |
| Assurance of the short- and long-term archiving of static documents managed by the company | Article 6 (1) (f) GDPR - legitimate interest | Personal data in the other parts of the table | The retention periods set out in the other parts of the table shall apply |
| Management of images of our clients/passengers for professional and commercial purposes to promote the company's activities in the public domain | Article 6 (1) (a) GDPR - consent of the subject | Customer/passenger name, surname, e-mail address, image | Data is stored up to a point the data subject opt-outs |
| Conducting public procurement tenders | Article 6 (1) (c) GDPR - legal obligation | Name, surname, e-mail address, certificates, attestation documents, curriculum vitae, special permits of the supplier/worker of the supplier | 10 years from the end of the procurement procedures |
| Support of the Customer Experience Management (CRM) system | Article 6 (1) (b) GDPR - performance of a contract | Customer name, surname, e-mail address, comments left in the system about the customer experience | 5 years from the date of the last interaction/operation (10 years from the date of the last interaction/operation if accounting documents are kept) |
| Administration of the content management system, publication of safety documentation | Article 6 (1) (f) GDPR - legitimate interest | System user’s name, e-mail, user action reports, familiarization with data status | 6 months from the moment the safety documentation was made public |
| Investigation of non-hazardous aviation incidents within the airport's area of responsibility | Article 6 (1) (c) GDPR - legal obligation | Name, surname, age, nationality, license of pilot-in-command or crew member; name, surname, job position of ground service personnel | 5 years from the date aviation incident investigation report/act was concluded |
| Organization of partner surveys in order to improve the quality of cooperation and services provided | Article 6 (1) (f) GDPR – legitimate interest | E-mail adress of the employee of services provider/goods supplier | 3 months from day of receiption of the partner survey |
| Assessment of contractors' and subcontractors' employees' compliance with the requirements set out in the in the Law on protection of objects of importance to ensuring national security of the Republic of Lithuania and the Law on the prevention of corruption of the Republic of Lithuania | Article 6 (1) (c) GDPR – legal obligation | Name, surname, information about a person's criminal record/conviction/capacity, information about cooperation with foreign intelligence/security services, information about participation in terrorist organizations, information about a person's addiction to alcohol/narcotics, psychotropic/other psychoactive substances, information about mental disorders | 5 years from the last evaluation |
| Administration of registry of flammable activities and issuing of permits for flammable activities, ensuring compliance with Law on fire safety of the Republic of Lithuania | Article 6 (1) (c) GDPR – legal obligation | Name, surname, position, signature of the contractor; name, surname, signature of the person conducting the briefing; signature of the person who performed the air analysis; name, surname, signature of the person who prepared the place of work for flammable activities; name, surname and signature of the person who issued a permit for flammable activities | 3 business days from the end of the flammable activities |
| Inspection of investors, partners, participants of legal entities and beneficiaries of legal entities that have a connection with Lietuvos oro uostai in order to enforce national/international sanctions and control implementation of the Law on protection of objects of importance to ensuring national security of the Republic of Lithuania | Article 6 (1) (c) GDPR – legal obligation | Person's name, surname, circumstances of participation in the legal entity, number of overall shares/shares held, amount/part of voting rights, date of birth, personal identification number, place of residence, country that has issued the document confirming the identity of the person in question, citizenship, country of residence | 3 years form the reception of inspection form from the service provider that is responsible for the management of the JADIS/JANGIS (Beneficial ownership registry/legal entity participant registry) state registries |
| Provision of the information for the owners/users/trustees of real estate properties that fall within noise protection zones (TAZ) about special land usage conditions and possible compensations for infringement of their property rights | Article 6 (1) (c) GDPR – legal obligation | Real estate roperty owner‘s, user‘s, trustee‘s name, surname, title, declared place of residence or place of residency | 1 year form the moment provision of information was conducted |
| Issuance of PPR (prior permission request) permit for the use of Vilnius, Kaunas and Palanga international airport aerodromes | Article 6 (1) (c) GDPR – legal obligation | PPR applicant name and surname, PPR applicant e-mail address, aircraft operator‘s name and surname (natural person), copy of the certificate of the aircraft operator (natural person), name/surname of the air carrier (natural person), air carrier‘s e-mail adress, name/surname of the owner of the airfracft/person who ordered the aircraft (natural person), flight details of the planned arrival/departure, contents of the general declaration of aircraft passengers/aircraft personnel or crew | 3 years from the provision of the PPR from by applicant |
| Administration and overview of mall value/insignificant State aid requests/applications | Article 6 (1) (e) GDPR – processing for the public interest or exercise of public authority | Name, surname of the person who is providing request/application; name, surname of the CEO of the air carrier who is asking for State aid assistance; information related to the position held by the person making the request/application or the manager of the air carrier receiving assistance | 3 years from the date of reception of request/application for the State aid |
In order to ensure a level of security appropriate to the risks involved in the processing of personal data, Lietuvos oro uostai shall implement appropriate technical and organizational security measures. In selecting and implementing appropriate technical and organizational security measures, to ensure the appropriate level of security for the processing of data, we shall be guided by:
Lietuvos oro uostai only use data processors that ensure compliance with the GDPR and the same level of personal data security as set out in our privacy policy.
Data recipients of Lietuvos oro uostai can be divided into the following categories:
We ensure that your data is processed in accordance with the requirements and standards established by European Union legislation and inform you that the majority of your personal data is processed within the European Union or the European Economic Area.
In the event that Lietuvos oro uostai are unable to adequately perform their functions and/or provide the services you require without the use of processors located outside the European Economic Area, we take responsibility to ensure that your personal data will be transferred to third countries or international organizations in accordance with the data transfer requirements set out in Articles 45 to 50 of the GDPR.
Personal data may be transferred to third countries and international organizations on the following grounds:
You have the right to refuse to provide your personal data, however, the provision of your personal data is necessary and required for the purposes set out in this privacy notice, and if you do not provide your personal data, we will not be able to carry out our duties, fulfil the purposes set out in the privacy notice, and to provide you with the services you require.
In accordance with the GDPR, you, as a data subject, may exercise the following rights:
You can exercise your rights:
In cases where there has been previous communication between you and Lietuvos oro uostai and we are able to establish your identity on the basis of that communication, it is not necessary to provide copies of documents confirming your identity.
Your request must be clear and legible if made in writing. If possible, it should include the name of the data subject, contact information for the preferred form of communication, details of the right, including its scope, that the data subject wishes to exercise and/or enforce under the GDPR.
We will respond to your request no later than one calendar month from the date your request was received. In exceptional cases, requiring additional time, we will have the right, upon noticing you, to extend the time limit for the provision of the requested data or for the processing of other requirements set out in your request by up to 3 calendar months from the reception of your request.
If you have any questions regarding the information contained in this privacy notice or the protection of your personal data and the exercise of your rights at Lietuvos oro uostai, please contact our data protection officer in any way that is convenient for you:
Lietuvos oro uostai does not restrict your right to contact the State Data Protection Inspectorate if you believe that we are processing/have processed your personal data unlawfully, or if you have reasonable grounds to suspect that we have violated your rights as a data subject under the GDPR. Complaints to the State Data Protection Inspectorate can be sent to:
Cookies are small text files that a website places on your computer or mobile device's browser, hard drive or other storage medium when you visit our websites. It allows the website to "remember" your actions and preferences (e.g. login name, language, font size and other display options) for a certain period of time based on the identification number you have been provided, so that you do not have to re-enter them each time you visit the websites or browse through their different sections. The information collected by cookies enables us to provide a more user-friendly browsing experience, as well as appropriate suggestions to users and allows us to learn more about the behavior of our websites’ visitors, which grants us ability to improve both the website and the services that are provided by Lietuvos oro uostai.
The cookies used by Lietuvos oro uostai can be divided into the following main groups:
You can find out which specific cookies are used by Lietuvos oro uostai and our websites and how to manage them in the cookie control panel of the individual website.
The Privacy Notice shall be amended at the discretion of the data controller or in the event of a change in the requirements of applicable legislation.
Only the current version of the privacy notice with current data processing operations is published on the website.