PRIVACY POLICY OF THE WEBSITE www.bokstoskveras.lt

Date of update: 9 June 2026

I. GENERAL PROVISIONS

1.1.In this Privacy Policy (hereinafter referred to as Privacy Policy) of UAB “BALTISCHES HAUS”, legal entity code 111543781, registered office address Bokšto g. 6, Vilnius, (hereinafter referred to as the Company, we, us), we hereby provide you with information on how we process your personal data when you use our services and visit our website.

1.2. Visitors who are under the age of 16 are kindly requested not to register on the website and not to provide any personal data.

1.3.In this Privacy Policy, we provide the following information:

1)The definitions used in this Privacy Policy;
2) Purposes, types of personal data we process, legal basis for such processing, and storage period of such data;
3) Transfer of personal data to third parties;
4) Social media;
5) Your rights;
6) Changes of Privacy Policy.

1.4. If you have any questions or wish to exercise any of your rights set out in this Privacy Policy, you may contact us at: duomenuapsauga@balthaus.eu

II. DEFINITIONS

2.1. Bokšto Skveras means the Bokšto Skveras complex, including venue rental, event organisation and other related activities, located at Bokšto str. 6, Vilnius.

2.2. Website means the website available at www.bokstoskveras.lt.

2.3. Data Controller means UAB “BALTISCHES HAUS”, legal entity code 111543781, registered office address Bokšto str. 6, Vilnius, email: info@balthaus.eu, telephone No. +370 5 269 1995

2.4. Client means a person who submits an enquiry, enters into an agreement or uses the services of Bokšto Skveras.

2.5. Parties means the Client and the Data Controller.

2.6. Personal Data means any information relating to a natural person, the data subject, who is identified or who can be identified directly or indirectly by reference to such data as a personal identification number or one or more factors specific to his physical, physiological, mental, economic, cultural or social identity.

2.7. Data Recipient means a legal or natural person to whom the Company provides personal data and who independently determines the purposes and means of the processing of personal data received.

2.8. Data Processor means a legal or natural person who processes personal data for the purposes and in accordance with the procedure specified by the Data Controller.

2.9. Data Subject means a natural person whose personal data is controlled and/or processed by the Company.

2.10. Provision of Personal Data means disclosure of personal data by transmitting or otherwise making available personal data (except for the disclosure of such data to the media).

2.11. Processing of Personal Data means any operation (set of operations) which is performed on personal data (sets of data), whether or not by automatic means in structured files, including collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure or destruction.

2.12. Direct Marketing means the practice of offering goods or services to persons by mail, phone or other direct means and / or seeking their opinion on the goods or services offered.

III. PURPOSES, CATEGORIES OF PERSONAL DATA, LEGAL BASIS AND RETENTION PERIODS

3.1. For the purposes of contractual obligations to order and provide services:

1. The data for ordering and providing services may include: name, surname, email address, phone number, information about the services ordered, payment information and any information related to the provision of services that you provide yourself.
2. The legal basis for processing this data: performance of a contract between you and us (or, at your request, taking steps to conclude such a contract).
3. We will retain your data for this purpose for 10 years from the end of the service contract.

3.2. For the purpose of submitting and administering enquiries regarding Bokšto Skveras services (such as venue rental, event organisation, etc.):

1. We process the following data: your name, email address, telephone number, and the content of your enquiry (e.g. preferred date, type of event, etc.). All personal data provided when submitting an enquiry through the Website is mandatory in order for us to process your request. If you do not provide this data, we will not be able to assess whether we can provide the requested service.
2. The legal basis for processing this data is taking steps at your request prior to entering into a contract (reviewing the enquiry and providing a service offer), as well as our legitimate interest in ensuring communication with prospective customers.
3. We will retain your data for this purpose for no longer than 2 years from the date of our last communication with you, unless the data is required for the establishment, exercise, or defense of legal claim.

3.3. For recruitment purposes:

1. We process candidates’ personal data, including all information provided in a curriculum vitae (CV), cover letter and/or reference.
2. The legal basis for processing this data is your consent, which you provide by submitting your CV, cover letter and/or reference to the Company. If you do not provide your CV and/or cover letter, we will not be able to assess your suitability for the position offered.
3. We delete this data as soon as an employment contract is signed with the selected candidate. At your request, we may retain this information for the purpose of contacting you regarding other job opportunities, if you have given your prior consent. In such case, your personal data will be retained for 3 years from the date on which such consent was given.

3.4. For the purpose of ensuring the safety of persons and property, we carry out video surveillance within our premises:

1. We process the following data: your image data captured by video surveillance systems.
2. The legal basis for processing this data is our legitimate interest.
3. We retain these data for 21 days from the date of recording. In exceptional cases, where video surveillance recordings are or may be used as evidence in pre-trial investigations or judicial proceedings, the retention period will be extended for as long as necessary for the investigation and use of such recordings as evidence.

3.5. We may process your personal data referred to in this Privacy Policy where it is necessary to make, exercise or defend legal claims. For this purpose, we process your personal data on the basis of legitimate interest, namely to protect and secure our rights and your rights and those of others

3.6. We may process your personal data referred to in this Privacy Policy where it is necessary for the purposes of obtaining or maintaining insurance cover, risk management or professional advice. For this purpose, we process your personal data on the basis of legitimate interest, namely, to adequately protect our activities against risks.

3.7. In addition to the specific purposes set out in this part of the notification, we may also process your personal data where such processing is necessary to comply with our legal obligations and to protect your vital interests or those of other natural people.

3.8.  Your personal data shall be stored for no longer than it is necessary to achieve the purposes of the processing of personal data set by the Company. After the expiry of the specified storage period, we will securely and irretrievably destroy or alter your personal data in such a way that they can no longer be directly or indirectly identified.

IV. DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES

4.1 The Company may transfer your personal data to the following categories of recipients:

1. personal data processors providing various services to the Company: personal data processors providing various services to the Company: providers of maintenance and hosting services for the website, email service providers, administration of social media accounts, data protection officer service providers, insurers, lawyers, consultants, auditors, bailiffs, other recipients with confidentiality obligations;
2. to the extent necessary for the provision of services or the payment for services (e.g. to make a payment for a service you have chosen), to payment service providers that you designate or that will be involved in making the payment;
3. law enforcement authorities, the courts and other public authorities, but only to the extent necessary for the proper enforcement of applicable legislation.

4.2. We only use Data Processors that use appropriate technical and organizational measures to ensure the protection of personal data in compliance with the GDPR and to ensure the exercise of your rights as the Data Subjects.

4.3 We do not transfer your personal data outside the European Economic Area unless the country to which your personal data is transferred ensures an adequate level of protection or you consent to such transfer of your personal data.

4.4 The Data Processors engaged by the Company will process your personal data only in accordance with the Company’s instructions. The Data Processor shall have the right to engage a sub-processor only with the prior written consent of the Company.

V. SOCIAL MEDIA TOOLS

6.1. We currently have the following social media accounts:

1. on Facebook — @Bokšto_skveras. You can access Facebook’s privacy policy here;
2. on Instagram — @boksto_skveras. You can access Instagram’s privacy policy here;
3. on LinkedIn — @Baltisches_Haus. You can access LinkedIn’s privacy policy here.

6.2. We encourage you to read third-party privacy notices and contact service providers directly if you have any questions about how they use your personal data. The Company is not responsible for the privacy policies of third-party platforms.

VI. YOUR RIGHTS

6.1 This Privacy Policy provides an overview of your rights under data protection legislation. Some of the rights cover many aspects, so this Privacy Policy only sets out the main ones. We recommend that you consult the relevant legislation and guidelines from the supervisory authorities so that you have full information about these rights.

6.2 You have the following rights as a Data Subject to the extent that they can be exercised, considering the particularities of the processing of data for certain purposes:

1) To be informed about the processing of your personal data. We also exercise this right by providing you with information in this Privacy Policy. You have the right to obtain confirmation from us as to whether we are processing personal data relating to you and, in the case of processing, you have the right to have access to the personal data we are processing as well as to certain additional information. Unless it violates the rights and freedoms of others, we will provide you with a copy of your personal data on your request. We will provide the first copy free of charge, but we may charge a reasonable fee for additional copies to cover administrative costs.

2) To request the rectification of inaccurate personal data or the completion of incomplete data. You can also exercise this right by logging into your Customer’s Account, if you have one.

3) To request deletion of your personal data if:

the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;

you withdraw your prior consent and there is no other lawful basis for the processing of your personal data;

the data are processed for direct marketing purposes;

the personal data have been processed unlawfully;

other cases set out in the GDPR exist.

However, please note that in some cases you may not be able to exercise this right due to exceptions. These exceptions include cases where the data are necessary for: exercising freedom of expression and information; bringing, exercising or defending legal claims.

4) To request restriction of the processing of your personal data when:

you contest the accuracy of the data for a period within which we can verify the accuracy of the personal data;

we no longer need the personal data but require it for the assertion, exercise or defense of legal claims;

your personal data is no longer required by the Company but is necessary for you to exercise your right to lodge a complaint or defend your rights;

You have objected to the data processing on grounds of public interest or legitimate interest, until the validity of your objection is assessed.

In the event of a restriction on the processing of your data, we will continue to retain your data but we will not further process it except: (i) with your consent; (ii) for the assertion, exercise or defense of legal claims; (iii) for the protection of the rights of others; (iv) for the purposes of important public interest.

5) To request the transfer of your personal data. Where the legal basis for the processing of personal data is your consent or the performance of a contract, or actions carried out at your request prior to the conclusion of a contract, you have the right to receive your personal data in a structured, commonly used and computer readable format. You will not be able to exercise this right where it may adversely affect the rights and freedoms of others.

6) To object to the processing of your personal data based on your particular situation, where we process your personal data for public interest purposes or based on our legitimate interest or the legitimate interest of third parties. If you object to such processing of your personal data, we will no longer process your relevant personal data unless we can demonstrate that such processing is carried out for compelling legitimate reasons which override your interests, rights and freedoms. We may also continue to process such data to assert, exercise or defend legal claims.

7) In cases where the legal basis for processing is your consent, you have the right to withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of the processing of your data prior to withdrawal.

8) If you believe that we are violating data protection legislation by processing your personal data, you have the right to file a complaint with the State Data Protection Inspectorate, ada.lt.

6.3 You may exercise the Data Subject rights set out in this Privacy Policy by submitting a request and indicating the specific right you wish to exercise. To exercise your rights, we will need to verify your identity. Therefore, when applying to exercise your rights (other than your right to know about the processing of your personal data, which is already implemented in this Privacy Policy), you may submit a request by:

E-mail to info@balthaus.eu by submitting a request signed with a qualified e-signature;

By submitting a written request directly to Bokšto Skveras (UAB Baltisches Haus) and providing a document proving your identity;

By any other means if we can identify you.

6.4 You will receive a reply on the action taken to implement the request, or the reasons for not implementing the request, no later than 1 month after receipt of the request. The time period for implementing the rights may be extended by two further months taking into account the complexity and number of the requests.

6.5 If you submit your request by electronic means, you will receive a reply in the same way, if possible, unless you request otherwise.

VII. ABOUT COOKIES

7.1. In order to ensure your ability to navigate the website more easily and efficiently and to ensure the provision of high-quality services that meet your needs, the following cookies are used (cookies are files, which are storing information on your computer’s hard drive or search “engine”)

7.2. When visiting the website, you have the option to accept or reject functional and analytics cookies: when you access the website, you may see a notice informing you about the use of cookies and requesting your consent to their use. If you do not provide your consent to the use of cookies (by selecting the relevant checkbox), such cookies will not be used, except for essential cookies, which enable the core functionality of the website. Without these essential cookies, the website would not function properly. Cookie retention periods may change depending on the settings and policies of third parties.

VIII. AMENDMENTS TO THE PRIVACY POLICY

8.1. Any changes to this Privacy Policy will be posted on the website and, in the event of material changes, we will notify you by email.