« Back

Privacy policy

AB "Lietuvos Gelezinkeliai" privacy and website www.litrail.lt cookie usage policy



  1. Joint-stock company "Lietuvos gelezinkeliai" (hereinafter – Company) privacy and website www.litrail.lt (hereinafter – website) cookie usage policy (hereinafter – Privacy policy) is intended for people, who are using the services offered by the website or any other services, provided by the Company. The Privacy policy provides information regarding the Company's clients or other natural person's personal data management, while concluding and executing agreements, providing services or while persons are communicating with the Company or the Company communicates with persons, it also determines personal data management basis and order.

  2. The Company manages the personal data according to the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter – Regulation (EU) 2016/679) and the Law on the legal protection of personal data of the Republic of Lithuania (hereinafter – Personal data legal protection law).

  1. Personal data - any information regarding the natural person, whose identity is determined or whose identity can be determined (data subject), firstly, according to an identifier, for example, name and surname, person's identification number, location data and internet identifier, or according to one or several of that person's physical, physiological, genetic, psychic, economic, cultural or social identification features.

  2. Data recipient – natural or legal person, state institution, agency or other institution, who is revealed personal data whether it is a third party or not.

  3. Data subject – a natural person, whose personal data is processed.

  4. Data processing – any operation or operation sequence executed with automated or non-automated measures with personal data or personal data sets, i.e. collecting, recording, sorting, systemizing, keeping, adaptation or changing, export, familiarization, usage, revealing while sending, distributing or providing a possibility to use them in any other way, as well as collation or association with other data, restriction, deletion or termination.

  5. Data processor – a natural or legal person, state institution, agency or other institution, who manages the personal data on behalf of the Company.

  6. Data controller – joint-stock company "Lietuvos gelezinkeliai", legal person's code 110053842, Mindaugo str. 12, Vilnius, tel. (8 5) 269 2038, e-mail: info@litrail.lt.

  7. Cookie – a small text information particle, which is automatically created while browsing the website and is stored at the computer or any other end-device.

  8. Direct marketing – an activity, aimed at offering persons goods or services and (or) ask their opinion via mail, telephone or any other direct contact.

  9. Other terms used in this Privacy policy are understood as they are described in the Regulation (EU) 2016/679 and the Law on legal protection of personal data.

  1. The Company processes personal data in order to:

    12.1. Conclude and execute agreements (real estate rent, sale, utility service provision, container loading, cargo transportation, warehouse storage, customs intermediary, etc.);
    12.2. Provide passenger and cargo transportation and other services, related to it;
    12.3. Execute the search and selection of new employees;
    12.4. Ensure the protection of persons and Company assets, prevent criminal activities, control that there would be no such activities and reveal them in time (with the use of video surveillance, entry control systems, automatic gates with state number recognition system);
    12.5. Know how people are using the services, provided by the Company, so that they could improve present and create new ones;
    12.6. Accept, register and transport shipments by local connection trains;
    12.7. Provide information regarding its services, consult clients, examine complaints, ensure the proper quality of provided services, examine data subjects' right implementation requests;
    12.8. Examine provided information regarding planned, currently executed or completed criminal activities and violations;
    12.9. Research railway transport catastrophes, accidents or incidents;
    12.10. Returning client's objects, which were left or found in electronic storage facilities;
    12.11. Implement client loyalty program (including direct marketing);
    12.12. Prepare formal (licensed) and informal trainings for employees of legal persons;
    12.13. Protect its interests in court or other institution;

  2. Objectives, which are sought to be completed by the Company with the processing of personal data and the legal basis to do so:

 

Objective

Legal basis

Personal data

13.1. Conclude and execute agreements

Agreements (data should be processed in order to execute the agreement, a part of which is a data subject, or take actions according to the request of the data subject prior to concluding the agreement).

Name, surname, personal code, contact phone number, residence address, billing account number, Email address (data may be processed for the person, representing or authorized by a legal person or a contact person (name, surname, position, contact phone number, email address and other data by type of agreement).

13.2. Provide passenger and cargo transportation and other related services

Agreements (data should be processed in order to execute the agreement, a part of which is a data subject, or take actions according to the request of the data subject prior to concluding the agreement).

 

Adhering to the requirements of legal acts (data should be processed in order to execute an obligation, applied to the data processor).

 

Lawful interest (data should be processed in order to implement the lawful interest of the data processor or a third party (i.e. in order to properly administrate and provide cargo transportation services, whenever a cargo transportation service agreement is not concluded, and only a cargo transportation order is provided).

Name, surname, payment method, payer's name and account number, ticket information, other information that may be required for the provision of services (e.g. phone number or email address, information about hobbies and specific needs, including personal data of special categories regarding a present disability that the Company processes to provide access to special social security rights).

 

Information regarding the use of Company services – history of travel by train (route, number of used train, arrival and departure stations, departure time, duration of travel, number of seat, provided service, ticket number).

 

Cargo delivery and retrieval information, legal person's representatives', authorized or specified contact persons' data (name, surname, duties, contact telephone number, e-mail address).

13.3 Execute the search for new employees and their selection (more information can be found in the Policy on candidates to occupy free workplaces, published at the www.litrail.lt website).

Lawful interest (data should be processed in order to implement the lawful interest of the data processor or a third party.

Adhering to the requirements of legal acts (data should be processed in order to execute an obligation, applied to the data processor, whenever health should be checked (special category personal data processing) and check information regarding convictions and criminal offenses).

Consent (the data subject has provided a consent for his personal data to be processed with one or couple of specific objectives (whenever personal data, provided by the candidate in his CV are to be kept in the Company database and inform the candidate in the future regarding the Company's implemented selection to take open positions).

Agreements (data should be processed in order to execute the agreement, a part of which is a data subject, or take actions according to the request of the data subject prior to concluding the agreement (whenever a candidate provides needed data in order to conclude an agreement).

Candidate's name, surname, payment method, payer's name and account number, ticket information, other information regarding the candidate's work experience (workplace, working period, duties, responsibilities and (or) achievements), information about the candidates education (education institution, studying period, received education and (or) qualification), information regarding the improvement of qualification (participation in trainings, received certificates), information about knowledge of languages and usage of information technologies, driving skills, information about other competences, as well as other information, which is provided in the CV, motivational letter or other candidacy documents).

Recommendations of former employers of the candidate, which he provided to the Company (name, surname, contact information of the person, providing the recommendation and its contents).

Information of the evaluation of the Candidate's suitability to take the specific position (duties), comments of the (Company's) persons executing the selection or their notes regarding the candidate. Information regarding the convictions and criminal activities.

Candidate's special category data regarding health.

 

13.4. Ensure the protection of the property owned by the persons and the Company, prevent criminal activities, providing control so that there would be no criminal activities and that the ones which took place to be revealed.

Lawful interest (data should be processed in order to implement the lawful interest of the data processor or a third party).

Adhering to the requirements of legal acts (data should be processed in order to execute an obligation, applied to the data processor).

 

Visual data (whenever a person enters the viewing field of a surveillance device):

  1. Whenever a person visits the premises of the Company with an entry control system (person's name, surname, workplace, duties, contact telephone number, object of visiting a Company object (i.e. participation in trainings, etc.), data regarding the movement in the Company objects with an installed entry control system (time, date, place), names of the object areas, which the person is allowed to  enter, entry card validity time, person's photo, whenever a limited-period entry card is issued)

  2. In case the person enters his residential territory through the gates, installed in our objects, which have state registration plate recognition system (person's name, surname, car registration plate and model, information regarding if the person has entered or left the territory).

13.5. Knowing how people are using the services, offered by the Company at its website, so that the company could improve them and create new ones.

Lawful interest (data should be processed in order to implement the lawful interest of the data processor or a third party) (supervising the quality of own provided services, improve and create new services, ensure the safety of the website).

 

IP address, operational system version, device (used to access the website) parameters, as well as the time and duration of the session of the person, search terms, which the person enters in the Company website and any information, kept with the use of cookies, applied in the person's device (you can find more information on used cookies in Section IX of the Privacy policy).

13.6. Accept, formalize and transport consignments by local connection trains.

Agreements (data should be processed in order to execute the agreement, a part of which is a data subject, or take actions according to the request of the data subject prior to concluding the agreement).

Data of the persons sending and receiving consignments (name, surname, contact telephone number, signature).

13.7. Provide information about the services, provided by the Company, consult clients, examine complaints, ensure the proper quality of provided services, examine the data subject's rights request to implement their rights.

Lawful interest (data should be processed in order to implement the lawful interest of the data processor or a third party) (providing exact information and consulting regarding own services, examine complaints and provide personal replies to the questions asked).

Adhering to the requirements of legal acts (data should be processed in order to execute an obligation, applied to the data processor) (proper execution of the requests to implement rights coming from the data subjects).

 

 

 

If the people are consulted via telephone, the voice record data is processed – person's specified identification data (name, surname, etc.), contents of provided request, as well as telephone number, used to call, the start, end and duration of the conversation.

If the people are consulted via e-mail, Company's social network accounts, then the identification and contact information, provided by the people, is processed: name, surname, telephone number, e-mail address, residential address, date of birth, content of the request and documents, which are sent with it (travel ticket copy, etc.).

If the persons provide a data subject's right implementation request, the information named by such persons (identification and contact information) is processed: name, surname, telephone number, e-mail address, residential address, date of birth, content of the request and personal identification documents, which are sent with it – personal document copy, confirmed by a notary, or the original of a person's document (showed to the Company employee).

13.8. Examine provided information regarding planned, currently executed or completed criminal activity and violations, related to corruption.

Lawful interest (data should be processed in order to implement the lawful interest of the data processor or a third party). It is important for the Company to receive and examine the information regarding the planned, currently executed or completed criminal activity, employee's possible unlawful actions or inactions, improper execution of one's duties or failure to execute them, abuse of duties or other actions of the Company employee, having corruption or criminal activity features.

Adhering to the requirements of legal acts (data should be processed in order to execute an obligation, applied to the data processor) (Company is obliged to inform the law enforcement institutions regarding criminal activities or violations).

If the person provides information via telephone, the voice record data is processed – person's specified identification data (name, surname, etc.), contents of provided message, as well as telephone number, used to call, the start, end and duration of the conversation.

If the person provides information via e-mail or the Company's website, then the identification and contact information, provided by the person, is processed: name, surname, telephone number, contents of their message.

13.9. Investigate railroad transport catastrophes, traffic accidents or incidents.

Adhering to the requirements of legal acts (data should be processed in order to execute an obligation, applied to the data processor)

Railroad transport catastrophe, traffic accident or incident witness name and surname.

Name, surname, age, sobriety and actions of a person who was a victim of a railroad transport catastrophe, traffic accident or incident.

13.10. Returning client's objects, which were left or found in electronic storage facilities.

Lawful interest (data should be processed in order to implement the lawful interest of the data processor or a third party) (the need to make sure that the objects, which are requested to be returned, really belong to the corresponding person.

Name, surname, residential address, contact telephone number, signature and circumstances at which the objects were lost (in order to return them).

13.11. Implement client's loyalty program (including direct marketing) – provide special offers regarding the discounts for local connection train tickets, provision of personally tailored advertisements or announcements about actions, which are related with both the Company and Company partners' activities, as well as assessing and analyzing the market, clients, products and services, collect information regarding the quality of provided Company services, client's opinion and organizing client surveys related to that.

Lawful interest (administrate a loyalty program, use client's e-mail for similar goods or services marketing objectives – inform about Company's services, events, news, provide other actual information).

 

Personal data processing after receiving the person's consent:

  1. Whenever a person is sent information regarding services, special offers, discounts, as well as surveys and news, unrelated to the services used by the person;

  2. Whenever the person is sent information regarding the Company's partners' (which are established in Lithuania) services, special offers to clients, discounts, as well as news.

In case the client is a legal person, then legal person's representative, authorized person's or specified contact person's personal data is managed: name, surname, duties, contact telephone number, e-mail address.

13.12 Prepare formal (licensed) and informal trainings for legal person employees.

Lawful interest (special trainings, providing services according to concluded written or oral agreements for the employees of legal persons, working at a territory where railroads are present).

Name, surname, date of birth, personal code, information about education, health checks, qualification certificate number (used in organizing formal and informal trainings, issuing qualification certificates and diplomas).

13.13. Protect its interests in court or other institution.

Adhering to the requirements of legal acts.

Lawful interest to defend against issued court lawsuits and claims.

Taking in account which lawsuit or claim is issued, various data category personal data, specified in the Privacy policy, which is owned by the Company can be processed.

 

 

14. Personal data, i.e. any information about the person, which allows to recognize such a person, is received in the ways, described below:
14.1. A person can provide them by himself, when he/she:
14.1.1. Sends consignments by local connection trains;
14.1.2. Positions himself in corresponding video surveillance device field of view;
14.1.3. Candidates to received announced free positions;
14.1.4. Concludes various agreements with the company;
14.1.5. Visits buildings, where an entry control system is installed;
14.1.6. Participates in conversations in the Company's administrated social network accounts, provides requests, questions, complaints, information via e-mail, telephone (which are specified on the website);
14.1.7. Becomes a victim or the causer of a railroad transport catastrophe, traffic accident or incident;
14.1.8. Participates in Company's surveys;
14.1.9. Uses passenger or cargo transportation and related services;
14.1.10. Seeks to become a participant of the loyalty program;
14.1.11. Requests to return his lost objects, which were left or found at the electronic storage facilities;
14.1.12. Participates in trainings, organized by the Company;
14.2. Information about a person can be collected automatically when he/she:

14.2.1. Provides requests regarding the social network accounts administrated by the Company;

14.2.2. Browses the webpage, where cookies and similar technologies are used (more information about the company's used cookies is provided in section IX of the Privacy policy);

14.2.3. Leaves public records on the social network platforms, which are monitored by the Company;

14.3. In specific cases data can be obtained from third parties and collected from publicly available sources (i.e. the "Linkedin" social network);

15. Information regarding the person can be collected in other cases, unspecified in this Policy. In case this happens, the Company additionally informs the person.

 

16. Personal data is stored for a period, needed to achieve the determined objective. After that, the data is deleted, except for cases when storing such personal data is obligatory according to the legal acts, e.g. for taxation purposes, or they can be needed for the execution of pre-trial investigation. After the personal data storing term expires, the data is deleted in a way that it could not be restored.

17. Usually personal data is stored for the following period:

Personal data

Storing period

17.1. Data collected while concluding and executing agreements

10 years after the end of agreement validity

17.2 Data needed for the provision of passenger transportation services

1 year after the purchase of the ticket

17.3. Data of candidates to take free positions in the Company

Data of a candidate, who was not selected, is kept for 3 years (if the person has provided his consent).

Data of a candidate, who was selected and with whom an employment agreement has been signed, are stored for the period of the selection process. It is held, that after the end of the test period of the candidate, with whom an employment agreement has been concluded (maximum of 3 months), the selection ends. After that, the personal data is stored for the duration of the employment agreement, and after its end, the data is terminated according to the order, provided for by laws.

17.4 Video camera data

5-30 days

17.5. IT system logs

Up to 1 year

17.6. Analytics data

Usually collected automatically, with the use of the website and are then anonymized / generalized immediately after being collected.

17.7. Data collected during the transportation of consignments by local connection trains

2 years

17.8. Data collected during the provision of information about Company services, consulting clients, examining complaints and requests

1 year

17.9. Data collected during the examination of information about a planned, currently executed or completed criminal activity and violations, related to corruption.

In case a person provides information via e-mail or by filling out the form at www.litrail.lt its data is stored in the e-mail box for 1 year.

 

If a person provides information via telephone, the data is kept for 6 months.

17.10 Data collected during the investigation of a railroad transport catastrophe, traffic accident or incident.

10 years

17.11. Data collected during the return of personal objects

1 year from the provision of the request to return objects

17.12. Loyalty program participant data (including data, used for the purposes of direct marketing)

2 years after the last active action

17.13. Data collected during the preparation of formal (licensed) and informal trainings for legal person employees.

50 years (according to the order, specified by laws).

 

 

18. The Company, while implementing the objectives of personal data collection, specified in point 13 of the Privacy policy, can provide collected data subjects' personal data to the following third parties:

18.1. Data processors (communication, advertising and marketing service, as well as information technology service providers, companies analyzing web browsing or activities on the internet, etc.);

18.2. Subjects, providing services at the request of the Company, i.e. provider of post services;

18.3. Legal persons, helping the Company to execute candidate selections or providing services related to selections or their assessment (personnel selection and (or) assessment service providers, database software providers, etc.);

18.4. Banks, executing settlement operations;

18.5. Courts, pre-trial investigation institutions, state or municipal institutions, having the right t or receive personal data according to effective legal acts or in cases, when the Company provides these subjects with personal data in order to protect its lawful interests;

18.6. Other responsibly selected business partners (i.e. Company's subsidiary companies, data processors);

18.7. Other parties, whenever it is required according to laws (i.e. during the investigation of railroad transport catastrophes, traffic accidents or incidents, the Company is obliged to provide information to the Lithuanian transport safety administration) or it is obligatory in order to protect the lawful interest of the Company;

18.8. To third parties, who act in the European Economic Area (hereinafter – EEA) territory (websites users' personal data);

18.9. Third parties or international organizations located outside of EEA territory limits (website users' personal data). In case such a need arises, the Company takes all possible measures, to ensure the safety of transferred personal data and provides the data according to:

18.9.1. European Commission ruling on suitability, meaning, that the European Commission has accepted the state, where the third party is established and (or) executes its activities, as providing proper personal data protection level; or

18.9.2. By signing an agreement with the third party, prepared according to the standard agreement conditions, approved by the European Commission; or

18.9.3. After receiving a permit from State data protection inspectorate;

18.9.4. Using, if it is possible, other possible data protection measures and applying provisions allowing derogations.

 

19. The Company, while seeking to protect the data subject's personal data, implements and constantly updates various technical and organizational measures:

19.1. Ensures that:

19.1.1. Management and protection of access to personal data;

19.1.2. Control of access to personal data;

19.1.3. Safety control of personal data, kept at the electronic mailbox, and its termination after use;

19.1.4. The possibility of an employee using the personal data to execute only specific actions, which are allowed to that employee;

19.1.5. That whenever the Privacy policy specified personal data storing period is expired, the data would be terminated;

19.2. Records logs of connections to personal data;

19.3. Provides access to personal data only to those employees, who need personal data for the implementation of their functions;

19.4. Limits the possibility of access to premises where personal data is kept to unauthorized persons;

19.5. Encodes personal data kept in the active database;

19.6. Uses personal data safety measures, which help to control the actions of the persons administrating the database.

20. According to the Regulation (EU) 2016/679, data subjects are granted the following rights:

20.1. Familiarize with personal data, i.e. receive a message, confirming if the Company is processing the website user's (data subject's) personal data, and if it does, familiarize with the processed personal data, receive information regarding the categories of processed personal data, objectives, processing period, data recipient's categories, etc.;

20.2. Correct personal data and (or) stop processing actions of such personal data, with the exception of storing, when the website user's (data subject's), familiarized with the Company processed personal data, determine, that the data is incorrect, incomplete or inaccurate;

20.3. Limit personal data processing, until the legality of data processing will be inspected according to the website user's (data subject's) request;

20.4. Disagree with the processing of personal data, when the Company processes the website user's (data subject's) personal data for direct marketing purposes or seeking lawful interests of the Company or third party;

20.5. Delete personal data ("the right to be forgotten"), when the website user (data subject) does not agree that personal data should be processed for direct marketing purposes or seeking lawful interests of the Company or third party, when the website revokes his consent to process personal data or determines that personal data is not needed to achieve the objectives, which were the reason for their processing;

20.6. Receive personal data, which the website user (data subject) provided the Company in a systemized, usually used, computer readable format and send this data to another data processor (if it is technically possible);

20.7. Disagree with the application of a fully automatically made decision, including profiling, in case making such a decision has legal consequences or similar significant effect on the website user (data subject);

20.8. Revoke issued consent to process personal data.

20.9. Provide a complaint to the State data protection inspectorate.

21. The data subject can implement his/her rights, specified in point 23 of the Privacy policy:

21.1. By personally delivering the request to implement his rights (hereinafter – request) to the Company headquarters, Passenger information center or Company data protection officer according to addresses, specified in points 27 and 28 of the Privacy policy. The data subject should provide his personal identification document (passport, personal identification card or a driver's license) together with the request; or

21.2. By providing the request to the Company or Company data protection officer according to addresses, specified in points 30.1 and 30.2 of the Privacy policy. The data subject should attach a copy of a personal identification document (passport, personal identification card or driver's license), together with the request to implement his rights, such a copy should be confirmed by a notary or in any other way, provided for in laws.

22. The Company recommends using the request to implement data subject's rights form, which can be found at the www.litrail.lt website.

 

23. The Company uses the following cookies in order to ensure the effective and safe operation of the website, and adapt it to more convenient usage:

Name

Period

Objective

COOKIE_SUPPORT

Until the end of session

Used to save the browser cookies

GUEST_LANGUAGE_ID

Until the end of session

Saves the website visitor's language selection.

JSESSIONID

Until the end of session

Is obligatory to ensure the functionality of the website (saves session data).

__cfduid

1 year

Identifies the user at the cloudflare.com platform.

__utma

2 years

Saves the number of user's visits to the website (cookie used for statistical purposes)

__utmb

Until the end of session

Determines the time, when the user has opened the website (cookie used for statistical purposes)

__utmc

30 minutes after closing the website

Determines the time, when the user has closed the website (cookie used for statistical purposes)

__utmt

10 minutes

Determines website content download time (cookie used for statistical purposes)

__utmz

12 hours

Determines if the website visitor has visited the website through the search function or after gaining knowledge from other sources (cookie used for statistical purposes)

 

24. Website user can refuse to save the cookies to his computer or other device. It can be achieved by changing the web browser's ("Internet explorer", "Safari", "Firefox", etc.) settings – turning off the cookies (selected ones or altogether) or by correspondingly turning them on.

25. Turning off cookies can affect the speed of web browsing or the functionality of the website.

26. Any website user can read more about the use of cookies here: http://www.allaboutcookies.org/manage-cookies/

27. In cases, when the Data subject has questions regarding personal data processing, Privacy policy provisions or wants to implement his data subject's rights, he/she can address:

27.1. Company's data protection officer – Pelesos str. 10, Vilnius, Tel. (8 5) 269 3085, e-mail: dap@litrail.lt;

27.2. Company – Mindaugo str. 12, Vilnius, tel. (8 5) 269 2038, e-mail: info@litrail.lt

28. Requests regarding the implementation of the data subject's rights can also be delivered to the Passenger information center located at Gelezinkelio str. 16, Vilnius.

 

29. The Privacy policy is reviewed at least once per 2 years. The Company, having updated the Privacy policy, informs of its essential changes by publishing an announcement at its website.

30. The Company recommends website users to review the Privacy policy for changes, prior to the use of the website.