Privacy Notice

3.1.

Enter into and perform contracts with you, fulfil related tax obligations, and provide you with information relating to the performance of the contract.

Name and surname, personal identification number and/or date of birth, residential address, e-mail address, phone number, signature, payer code, copy of identity document, individual activity certificate number, billing information, billing period, arrears information, bank account number, contract, amendments, modifications and annexes thereto, handover and acceptance certificates, dates of conclusion, contract number, place of conclusion and performance of the contract, information on the performance of the contract, information on termination of the contract, extract from the central data bank of the Real Property Register and Cadastre and, as far as the performance of the contract is concerned, communication with you, other information that may be necessary for the proper performance of the contract.

Contract conclusion and performance (GDPR Article 6(1)(b));

Legal obligation to collect information under the law (GDPR Article 6(1)(c)).

During the term of the contract and for 10 years after the end of the contract.

3.2.

Conclude and perform contracts with the natural or legal person you represent through you.

Name and surname, personal identification number and/or date of birth, address, power of attorney, period of validity of the power of attorney, signature, relationship to the person represented, the person represented, position, phone number, e-mail address, any information you provide to the Company (e.g. information about the person you represent, contracts entered into, etc.) and, in relation to the performance of the contract, communications with you, other information that may be necessary for the proper performance of the contract.

Legitimate interest (GDPR Article 6(1)(f)) to conclude and perform contracts with natural or legal persons through their representatives (employees, legal representatives or agents, etc.).

During the term of the contract and for 10 years after the end of the contract.

3.3.

Allocate and manage public railway infrastructure capacity and, to this end, examine applications from users and contractors of the Lithuanian public railway infrastructure network for the ordering of capacity, traffic interruptions and railway service facilities (RSF) via the InfraGo e-self-service portal.

Personal data of InfraGo
https://infrago.ltginfra.lt/lt-LT/
users: name, surname, account name, e-mail address, phone number, name of the company represented, the fact and time of actions taken.

Legal obligation (GDPR Article 6(1)(c)) provided for in the Railway Transport Code of the Republic of Lithuania and other legal acts regulating the activities of the public railway infrastructure manager;

Legitimate interest (GDPR Article 6(1)(f)) in the exercise of the competences and functions conferred on the manager of the public railway infrastructure by law through the InfraGo portal.

5 years from the last activity in your account.

3.4.

Perform other functions of the public railway infrastructure manager (e.g. issue design conditions, coordinate design documentation, implement procedures for land acquisition for public needs, etc.).

Name, surname, contact details, other information in the information system of the State Enterprise Centre of Registers about your property.

Legal obligation (GDPR Article 6(1)(c)) to implement the statutory functions of the public railway infrastructure manager.

Depending on the function performed, for 3, 5 or 10 years.

3.5.

Ensure compliance with the Republic of Lithuania Law on International Sanctions;

Ensure compliance with sanctions or restrictions adopted by third countries, including the United States of America and the United Kingdom of Great Britain and Northern Ireland.

Persons to be checked: name, surname, nationality, place of birth, date of birth, company with which the person is associated, basis of representation, basis of association with the company, results of the sanction check;

Name, surname, position, signature or electronic signature metadata of the person completing the questionnaire/declaration and providing the data.

Legal obligation (GDPR Article 6(1)(c)) provided for in the Republic of Lithuania Law on International Sanctions;

Legitimate interest (GDPR Article 6(1)(f)) in conducting business in a transparent and socially responsible manner and in avoiding potential negative economic consequences and reputational damage by ensuring customers' compliance with sanctions or restrictions approved by third countries.

In case of a contract with a counterparty subject to verification, for 10 years from the end of the contract, together with the contract; in case no contract is concluded, for 5 years from the submission of the questionnaire/declaration.

3.6.

Analyse the behaviour of users in our social media accounts to measure the effectiveness of our publicity and public feedback about us.

Social network user's name, surname, account name, photo, actions taken in the Company's account: openings, clicks on "Follow", "Share", "Save", etc., likes and other rating clicks, comments made and the data they contain, metadata of actions taken.

For our analysis, we only use aggregated, anonymised data provided by the operators of the social networking platforms (information on visitor engagement, the reach of the content of the Company's accounts, the number of likes, shares, comments, video views, the number of types of devices used to connect to social networks (computer or mobile device), the number of approximate geographical locations from which social networks are accessed (displayed by city), the number of visitors by activity area (in LinkedIn accounts).

Consent (GDPR Article 6(1)(a)), which is expressed when a user of a social network platform visits our account.

You can withdraw your consent by deleting your actions on the platform.

The data will be retained for as long as our account is active on the relevant social networking platform, or for as long as the settings and functionalities of the specific platform and the data subject's own actions make such data available to us.

Dedicated Rail Baltica project accounts on social media platforms are designed to publicise the use of international investment and will therefore be active for 10 years after the final implementation of the project.

3.7.

Receive feedback from business customers and their representatives on the services provided by the Company in order to evaluate their experience and improve the quality of services.

Name, surname, email, name of the company represented, work email address, name of the service provided, date of contact for participation in the feedback survey, answers provided during the survey (opinion on the services provided).

Legitimate interest (GDPR Article 6(1)(f)) to evaluate the experience of business customers with regard to the services provided and to improve the quality of services in the future.

Personal data is stored for 2 years after the invitation is sent.

3.8.

Conduct direct marketing to business customer and partner (B2B) representatives (employees) by e-mail and phone, sending newsletters with relevant information about the Company's services, news and events being organised (Newsletters), inviting to provide opinions on the quality of services and customer care, participate in customer satisfaction and needs surveys (Surveys), providing commercial offers or other commercial information where this is not necessary for the performance of an existing contract (Commercial offers).

Name, surname, position, name of the company represented, business phone number and e-mail address, the subscriber or registered recipient of the public electronic communications service of which is the company represented, the fact, date and time of confirmation of the consent, the fact, date and time of withdrawal of the consent or of the refusal of direct marketing, and the personal data provided in the opinion or survey form.

Consent given by an authorised representative of the registered recipient or subscriber of public electronic communications services (GDPR Article 6(1)(a), Article 81(1) of the Republic of Lithuania Law on Electronic Communications).

Consent is valid for 5 years unless withdrawn earlier. Recipients of direct marketing may also opt out of receiving direct marketing separately for themselves only.

Personal data is retained for the duration of the consent and for 2 years after the consent expires. If a company's representative/employee refuses direct marketing without the company's own consent being withdrawn, his/her personal data will be retained for 2 years after refusal.

3.9.

Deal with requests for proposals, complaints or other enquiries received by post, by general e-mail, in a form on the website or through other channels, where it is not a function of the Company as the manager of the public railway infrastructure.

Personally identifiable data provided by the requester, such as name and surname, e-mail address, phone number, subject of the request, time of receipt of the request, content of the request, attachments to the request, history of correspondence, other information relating to the request, response to the request, metadata of correspondence.

Legitimate interest (GDPR Article 6(1)(f) GDPR). to process incoming requests, proposals, complaints or other enquiries, to ensure the quality of the service provided to applicants and to provide them with accurate information.

1 year after the request is answered.

3.10.

Record telephone conversations with people who call the company's general customer service line to ensure the quality of the customer service provided over the phone, i.e. to ensure that they are provided with accurate information, that enquiries, requests and complaints are dealt with appropriately, that disputed situations are dealt with objectively, and that the company's standard of customer service is maintained.

Phone number, recordings of telephone conversations and data from the conversations.

Consent (GDPR Article 6(1)(a)), provided by your action, i.e. by continuing the conversation;

Legitimate interest (GDPR Article 6(1)(f)) to record telephone conversations for the specified purpose, in relation to employees of the Company and employees of the Company's affiliates.

1 year after the conversation with you.

3.11.

Record GSM-R, shunting radio, analogue train, technological telephone, general telephone, station public address, public service mobile and fixed systems to ensure rail traffic safety and to investigate rail transport accidents and incidents.

GSM-R radio system: call records, call origination date and time, call answering date and time, call termination date and time, call duration, caller number, caller's function number, addressee number, addressee's function number;
Shunting radio: call record, date, time and duration;
Analogue train radio: call record, date, time and duration;
Technological telephone communication: call record, date and time of call, duration, recipient number, caller number;
Station audio: call record, date, time and duration;
Public operator mobile and landline telephones: call record, caller number, recipient number, date and time of call, duration of call.

Legitimate interest (GDPR Article 6(1)(f)), to ensure rail traffic safety, to investigate accidents and incidents in rail transport;

Legal obligation (GDPR Article 6(1)(c) to record radio conversations between trains and stations with automatic call recording systems (Regulations on the Technical Use of Railways, approved by the Minister of Transport and Communications of the Republic of Lithuania), and to record the operational conversations of employees who manage the power system, the network or carry out its operational maintenance with recording equipment (Regulations on the Dispatch Control of the Power System approved by the Minister of Energy of the Republic of Lithuania).

GSM-R radio systems: records are stored according to their type, railway alert call records are stored for 6 months, and all others for 2 months.
Shunting radios: records are kept for 2 months.
Analogue train radio: records are kept for 2 months.
Technological telephone communication: records are kept for 6 months.
Station audio: records of messages are kept for 2 months.
Public operator mobile and landline telephones: records are kept for 6 months.

3.12.

Carry out video surveillance of the Company's premises, their accesses, level crossings, stations and their approach areas in order to ensure railway traffic safety, the protection of public railway infrastructure, as well as the security of other property and persons.

Video footage, image of a person captured

Legal obligation (GDPR Article 6(1)(c)) to ensure the protection of public railway infrastructure;

Legitimate interest (GDPR Article 6(1)(f)) to ensure the protection of property and persons, rail traffic safety, and to investigate accidents or incidents.

Up to 30 days.

3.13.

Control access to the Company's offices and other secure facilities.

Name, surname, place of work, job title, contact phone number, purpose of the visit to the company's site (training, etc.), movement at premises with an access control system, the details (time, date, location), the validity period of the access card, and the person's photo where a time-limited access card is issued.

An identity document may be required at the time of access control.

Legal obligation (GDPR Article 6(1)(c)) to ensure the protection of public railway infrastructure;

Legitimate interest (GDPR Article 6(1)(f)) to protect property and persons.

12 months.

3.14.

Carry out mandatory monitoring of employees of contractors and sub-contractors working on sites critical to national security.

Name, surname, date of birth, nationality, copy of identity document, place of work, position, document constituting the basis of representation, role in the project, work schedule at the site, data on the person's actions in the performance of the contract, including, but not limited to, data on the location and timing of the person's access to the controller's resources (railway infrastructure, premises, other objects), as recorded by CCTV, access control system, unscheduled checks at the site, etc., and other technical and organisational measures.

Public interest (GDPR Article 6(1)(e)) to ensure the protection of sites important to national security.

3 months after completion of the contract.

3.15.

Investigate rail transport accidents and incidents.

Name, surname, contact details of the injured party, guilty party and witness, circumstances of the incident, other personal data necessary to achieve the purpose of the processing.

Legitimate interest (GDPR Article 6(1)(f)) to investigate rail transport accidents or incidents.

10 years after a rail accident or incident.

3.16.

Ensure the functioning of the website by using essential cookies;

Improve the browsing experience of visitors to the website, improve the website and the services offered on the website, and carry out direct and indirect marketing, by using non-essential convenience, analytics, marketing or other cookies without which the website may still function (non-essential Cookies).

IP address, the operating system version of the device you are using, the settings of the device you are using, the time and duration of your session, the search query words you have entered, the language of the website you have chosen, your cookie acceptance, other statistical data and any information stored using cookies on your device (see section 11 of the Privacy Notice for more information on the use of cookies).

Legitimate interest (GDPR Article 6(1)(f)) to ensure the functioning of the website by means of essential cookies;

Consent (GDPR Article 6(1)(a)) on the use of non-essential cookies

Up to 2 years; see the description of cookies in section 11 of the Privacy Notice).

3.17.

Examine a request to exercise the rights of data subjects under the GDPR and ensure the implementation of the request.

Depending on the personal data you provide: name, surname, phone number, address, date of birth, e-mail address, copy of the identity document, request for the exercise of the data subject's rights, date of the request, place of the request, the specified method of responding to the request, the content of the request and other information contained in the data subject's request, the response to the data subject, other information relating to the exercise of the data subject's rights.

Legal obligation (GDPR Article 6(1)(c)) provided for in Chapter III of the GDPR.

5 years from the date of the reply to the request.

3.18.

Investigate reports of possible corruption and other legal violations related to the Company's activities submitted through the LTG Group's whistleblowing platform Transparency Line.

For more, please read in the Privacy Notice published on the notification platform https://pasitikejimas.ltgpranesimai.lt/whisper

Read more there.

Read more there.

3.19.

Assert, enforce and defend the Company's rights and legitimate interests in legal proceedings.

All of the above information relating to other purposes, documents sent to you and their attachments, documents and their attachments submitted by you, procedural documents, court orders, rulings or decisions.

We have a legitimate interest (GDPR Article 6(1)(f)) to assert, exercise or defend the Company's rights and legal claims in legal proceedings.

If it becomes necessary to process personal data for the purpose stated, 10 years after the end of legal proceedings.