PRIVACY POLICY OF UAB ERUDITO LICĖJUS
This Privacy Policy (the “Privacy Policy”) explains how UAB Erudito Licėjus, legal entity code 304228673, registration address and address and contact details of the Vilnius unit: Aguonų g. 26, LT-03212 Vilnius, Lithuania; phone: +37065788830, e-mail: vilnius@erudito.lt; address and contact details of the Kaunas unit: J. Gruodžio g. 9, Kaunas; phone: +37065788820, e-mail: info@erudito.lt (the “Lyceum”), as your personal data controller, processes your and/or your children’s/foster children’s (the “Child”) personal data when you and your Child visit and use the Lyceum website www.erudito.lt (the “Website”) and services provided therein.
In processing personal data, the Lyceum shall follow and comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (the “GDPR”), the Law of the Republic of Lithuania on Legal Protection of Personal Data and other effective legal acts applicable to personal data protection.
You are using the Website, which means that you have read and are familiar with this Privacy Policy and the purposes, methods and procedures for processing your and/or your Child’s personal data specified herein.
Please note that we process certain your and/or your Child’s personal data, as indicated in this Privacy Policy, on the basis of your consent to personal data processing and/or a lawful interest of the Lyceum, therefore, you have the right to withdraw such consent at any time, without any effect on the lawfulness of the data processing based on consent before the withdrawal of such consent, and/or you have the right to object to such use of your personal data.
I. WHAT PERSONAL DATA PROCESSING PRINCIPLES ARE COMPLIED WITH BY THE LYCEUM?
In processing your and/or your Child’s personal data, we:
- shall comply with the requirements of effective and applicable legal acts, including the GDPR;
- shall process your and/or your Child’s personal data in a lawful, honest and transparent manner;
- shall collect your and/or your Child’s personal data for determined, clearly defined and lawful purposes and shall not further process them in a manner incompatible with those purposes, except to the extent permitted by legal acts;
- shall take all reasonable measures to make sure that personal data that are not accurate or complete, with regard to their processing purposes, are immediately rectified, supplemented, their processing is suspended or they are destroyed;
- shall store them in a form enabling establishing your identity and/or the identity of your Child for no longer than necessary for the purposes for which the personal data are processed;
- shall not give personal data to third parties and shall not make them public, save for cases indicated in the Privacy Policy or applicable legal acts;
- shall make sure that your and/or your Child’s personal data are processed in a way as to ensure proper security of personal data by use of relevant technical or organisational measures, including protection against unauthorized or unlawful processing of data and against their accidental loss, destruction or damage.
II. YOUR AND/OR YOUR CHILD’S PERSONAL DATA PROCESSING
We hereby inform that the Lyceum processes your and/or your Child’s personal data indicated below for the following purposes:
- Assessment of the Lyceum admission form:
| Data categories | Child’s first name, surname, gender, year of birth, photo, e-mail address, a copy of the Child’s passport or birth certificate, health certificate, achievements and process assessment from former schools (if relevant).
Parents’/guardians’ gender, first name, surname, e-mail address, telephone number. |
| Legal basis for data processing | It is necessary to process data in order to take actions at the request of the data subject before entry into an agreement (Article 6(1)(b) of the GDPR). |
| Period of data processing | If an agreement is entered into, data are stored during the effective term of the agreement and for 10 years after the end of the agreement; if no agreement is entered into, data are destroyed within 6 months. |
| Data source | You. |
| We provide or transfer data to | Data are transferred to providers of IT services for the Lyceum (Openapply, ManageBac). |
- Entry into and performance of the agreement on provision of education (early education, pre-school, school and informal education) services by the Lyceum:
| Data categories | Child’s first name, surname, personal ID number, image, a copy of the birth certificate or passport/personal identity card or a permit for temporary residence in Lithuania.
Parents’/guardians’ first name, surname, personal ID number, e-mail address, telephone number, signature. |
| Legal basis for data processing | It is necessary to process data in order to enter into and perform an agreement (Article 6(1)(b) of the GDPR). |
| Period of data processing | Data are stored during the effective term of the agreement and for 10 years after the end of the agreement.
A copy of the Child’s birth certificate or passport/personal identity card or a copy of the permit for temporary residence in Lithuania are stored until September of the current year (until data are entered into the Register of Pupils). |
| Data source | You. |
| We give or transfer data to | Data are transferred to the Ministry of Education, Science and Sport of the Republic of Lithuania (the Register of Pupils, NEMIS information system), municipalities of the cities of Vilnius or Kaunas and providers of IT services for the Lyceum (ManageBac). |
- Organising and performing the education process:
| Data categories | Child’s first name, surname, date of birth, personal ID number, address, telephone number, gender, languages, citizenship, timetables, attendance, education results (grades), selected tests/exams, information from the health certificate, other information about the Child’s health, diseases.
Parents’/guardians’ first name, surname, e-mail address, telephone number. |
| Legal basis for data processing | It is necessary to process data in order to perform the agreement (Article 6(1)(b) of the GDPR), to fulfil the requirements of legal acts applicable to the Lyceum (Article 6(1)(c) of the GDPR and Article 9(2)(b) of the GDPR) and on the basis of the lawful interest of the Lyceum to ensure the quality of its services (Article 6(1)(f) of the GDPR). |
| Period of data processing | Data are stored during the effective term of the agreement on education services and for 10 years after the end of the agreement. |
| Data source | You and/or your Children, teachers and other participants of the education process. |
| We provide or transfer data to | Data are transferred to the Ministry of Education, Science and Sport of the Republic of Lithuania (the Register of Pupils, NEMIS information system), municipalities of the cities of Vilnius or Kaunas, they may be transferred to providers of informal education services and providers of IT services for the Lyceum (ManageBac). |
- Use of data of members of the Lyceum community (Children and their parents/guardians) for internal communication:
| Data categories | Child’s first name, surname, photos, videos, achievements and other information, parents’ first name, surname, e-mail address. |
| Legal basis for data processing | Lawful interest of the Lyceum to ensure quality of education and communication within the community (Article 6(1)(f) of the GDPR) and performance of the agreement on education services (Article 6(1)(b) of the GDPR). |
| Period of data processing | Data are stored during the effective term of the agreement on education services and the Child’s image is stored indefinitely according to the terms and conditions of the agreement on education services. |
| Data source | You, persons carrying out the education process. |
| We provide or transfer data to | Data can be transferred to newsletter companies, IT service providers (ManageBac). |
- Organising and performing the Lyceum community events (festival of the start of the academic year, graduation (diploma) festivals, etc.):
| Data categories | Images, video |
| Legal basis for data processing | Consent of the data subject or his/her representative (Article 6(1)(a) of the GDPR), performance of the agreement (Article 6(1)(b) of the GDPR). |
| Period of data processing | Data are processed for 5 years, afterwards they are reviewed and irrelevant data are eliminated, whereas data having historical, artistic or self-expression value may be stored longer. |
| Data source | You, third parties. |
| We provide or transfer data to | We can make data public by posting them on the Website or the Lyceum social media accounts. |
Photos and videos can be made during the public events of the Lyceum community, where you take part as the Child’s parents or relatives. As the events are public and if you do not object to being captured in photos or videos during the event, which objection can be implied from your actions, you may be captured in photos or videos and we can post your image on the Lyceum’s Website, social media accounts, community newsletters. If you noticed your photo posted on the Lyceum’s Website or social media accounts and you object to that, please let us know about it at the contact details of the Lyceum indicated above.
- Creation of parents’/guardians’ accounts on the Lyceum’s Website and in other systems:
| Data categories | Parents’/guardians’ first name, surname, e-mail address, telephone number. |
| Legal basis for data processing | It is necessary to process data in order to perform the agreement (Article 6(1)(b) of the GDPR). |
| Period of data processing | Data are stored during the effective term of the agreement on education services. |
| Data source | You. |
| We provide or transfer data to | Data may be transferred to providers of IT services for the Lyceum (Openapply, ManageBac). |
- Staff selection:
| Data categories | Applicant’s first name, surname, address, e-mail address, telephone number, education, work experience and other information from curriculum vitae (CV). |
| Legal basis for data processing | Data are processed on the basis of the lawful interest of the Lyceum to select a proper staff member (Article 6(1)(f) of the GDPR). |
| Period of data processing | Data are stored for 4 months after signing a contract with a selected applicant, if you have given your consent, we will store data for 3 years after the consent was obtained. |
| Data source | You. |
| We provide or transfer data to | We may provide data to recruitment agencies. |
- Conclusion and performance of contracts with legal entities:
| Data categories | Counterparty’s employees’ first names, surnames, e-mail addresses, telephone numbers, personal data in communication. |
| Legal basis for data processing | Data are processed on the basis of the lawful interest of the Lyceum to carry out activities (Article 6(1)(f) of the GDPR). |
| Period of data processing | Data are processed during the effective term of the contract and for 10 years after the end of the contract. |
| Data source | Your employer or you. |
| We provide or transfer data to | We may transfer data to providers of IT or other services. |
- Conclusion of tripartite agreements with the Vilnius City Municipality (regarding compensation of some of the pre-school education costs):
| Data categories | Parents’ first names, surnames, date of birth, e-mail address, telephone number, address, Child’s first name, surname, date of birth. |
| Legal basis for data processing | It is necessary to process data in order to perform the agreement (Article 6(1)(b) of the GDPR). |
| Period of data processing | Data are stored during the effective term of the tripartite agreement and for 10 years after the end of the agreement. |
| Data source | You. |
| We provide or transfer data to | Vilnius City Municipality. |
- Conclusion and performance of services contracts with natural persons:
| Data categories | First name, surname, date of birth, address, e-mail address, self-employment certificate No. |
| Legal basis for data processing | It is necessary to process data in order to perform the agreement (Article 6(1)(b) of the GDPR). |
| Period of data processing | Data are stored for 10 years after the end of the contract. |
| Data source | You. |
| We provide or transfer data to | We may transfer data to providers of IT or other services. |
- Video surveillance:
| Data categories | Images, movement data of data subjects captured by video cameras. |
| Legal basis for data processing | The lawful interest of the Lyceum to ensure public order, to protect tangible assets controlled by the Lyceum, to protect personal assets and property interests of the staff, pupils and their parents/guardians, visitors, partners, guests, event participants (Article 6(1)(f) of the GDPR). |
| Period of data processing | Data are stored for 30 days after the recording date. |
| Data source | You. |
| We provide or transfer data to | Data may be transferred to law enforcement authorities. |
- Administration of social media accounts of the Lyceum:
| Data categories | Your social media account handle, photos, feedback on the Lyceum-generated content (likes, comments, shares, etc.). |
| Legal basis for data processing | Your consent (Article 6(1)(a) of the GDPR). |
| Period of data processing | Personal data are stored as long as the Lyceum’s or your social media account are active and you are a follower of the Lyceum’s accounts. |
| Data source | You, third parties. |
| We provide or transfer data to | We are co-processors of your personal data along with administrators of the relevant social media. |
- For the purpose of ensuring the Website functionality, collection of statistical information, analysis of information flows, improving the Website and browsing in it, customisation of the Website:
| Data categories | IP address, your actions on the Website. |
| Legal basis for data processing | Your consent (Article 6(1)(a) of the GDPR). |
| Period of data processing | Personal data are stored as long as a specific cookie is valid, unless you cancel your freely given consent to the use of cookies at any time earlier. More information about this can be found in Chapter VI of this Privacy Policy. |
| Data source | You, third parties. |
| We provide or transfer data to | Data processors (providers of IT services, servers, virtual cloud storages, direct marketing services, etc.). |
III.TO WHOM CAN WE TRANSFER YOUR PERSONAL DATA?
We hereby inform you that we do not transfer or otherwise disclose your and/or your Children’s personal data to any third parties, except in the cases specified below:
- We have your request and/or consent;
- To data processors who process your and/or your Child’s personal data by our order for the purposes established by us and specified in this Privacy Policy (e.g., providers of IT, server services, marketing services);
- To law enforcement and/or law and order authorities, institutions and/or other data recipients to whom the data must be transferred according to requirements of legal acts.
In those cases when the Lyceum transfers data to data processors, the Lyceum demands that data processors process the transferred data only in accordance with the instructions of the Lyceum, for the purposes set by the Lyceum and based on this Privacy Policy, laws on legal protection of personal data and the data processing agreements concluded between the Lyceum and data processors.
Referring to the lawful basis and purpose, the Lyceum may transfer your or your Children’s personal data to entities outside the European Economic Area (EEA) (e.g., if the Lyceum data processors or recipients of personal data are established outside the EEA). In case personal data are transferred from the EEA to countries that are not recognized by the European Commission as ensuring an adequate personal data protection level, the Lyceum shall take all appropriate measures to protect your Children’s personal data (e.g., shall transfer personal data based on the standard contractual clauses for data transfer approved by the European Commission).
IV. WHAT RIGHTS DO YOU AND/OR YOUR CHILD HAVE AS DATA SUBJECTS?
You and/or your Child as data subjects have the following rights:
- Right to be informed about the processing of personal data by the Lyceum. You have the right to receive information about your and/or your Child’s personal data being processed, personal data sources, processing purposes, legal bases, storage period and persons, data recipients or data processors, data subject’s rights, etc.
- Right of access to your and/or your Child’s personal data processed by the Lyceum. You have the right of access to your and/or your Child’s personal data being processed and the right to receive their copy.
- Right to request rectification of your personal data processed by the Lyceum. You have the right to request rectification of inaccurate your and/or your Child’s personal data processed by the Lyceum.
- Right to withdraw consent. You have the right to withdraw your consent at any time, without any effect on lawfulness of data processing based on the consent before the withdrawal of the consent.
- Right to request deletion of data. You have the right to request deletion of your and/or your Child’s personal data if they (i) are no longer necessary for the purpose for which they were collected; (ii) you have withdrawn your consent to the processing of your and/or your Child’s personal data if data processing was based on your consent; (iii) we process your and/or your Child’s personal data based on a lawful interest but you object to such processing and there are no overriding legitimate grounds for the processing; (iv) we must delete your and/or your Child’s personal data in the performance of legal obligations imposed on us, or (v) your and/or your Child’s personal data were processed unlawfully.
- Right to restriction of data processing. You have the right to request restriction of the processing of your and/or your Child’s personal data carried out by the Lyceum: (i) if you contest the accuracy of the data and the Lyceum is carrying out a related verification; (ii) if your personal data were processed unlawfully but you oppose to their erasure; (iii) if your and/or your Child’s personal data are no longer necessary for the purpose for which they were collected but they are required for the establishment, exercise or defence of legal claims by you; (iv) if you objected to processing, as described below, pending the verification whether the legitimate grounds of the Lyceum override your grounds.
- Right to object to data processing. You have the right to object to the processing of your and/or your Child’s personal data by the Lyceum for direct marketing purposes, the right to object to the processing of your and/or your Child’s personal data for public interests or lawful interests of the Lyceum, unless these interests override the reasons for your and/or your Child’s objection.
- Right to portability of your personal data. You have the right to receive your and/or your Child’s personal data provided by you to us or the right to request to transmit those data to another data controller in a structured, commonly used and machine-readable format if the processing of your and/or your Child’s personal data is based on your consent or our mutual agreement and your and/or your Child’s personal data are processed by automated means.
- Right to lodge a complaint. If you believe that your and/or your Child’s rights have been infringed, you can write to the Lyceum by e-mail vilnius@erudito.lt (Vilnius unit) and/or info@erudito.lt (Kaunas unit) and/or lodge a complaint with the State Data Protection Inspectorate (L. Sapiegos g. 17, LT-10312 Vilnius, by e-mail ada@ada.lt).
For exercise of your rights, you can write to the Lyceum by e-mail vilnius@erudito.lt (Vilnius unit) and/or info@erudito.lt (Kaunas unit). Before the implementation of your right(s), the Lyceum can request you to present a proof of identity.
The Lyceum hereby informs that the implementation of the above rights can depend on the conditions for the implementation of a specific right provided for in legal acts, therefore, in the presence of specific grounds set in legal acts, the Lyceum has the right to give a reasoned written refusal to fulfil your request for exercise of a specific right.
The Lyceum, having received your request, undertakes, as soon as possible but, in any case, no later than within one month as of the receipt of your request, to implement your right or give a reasoned written refusal to implement it. The Lyceum has the right to charge a reasonable fee if your requests are obviously unreasonable, repetitive or excessive.
V. ENSURING YOUR PERSONAL DATA SECURITY
You undertake to give the Lyceum only correct data and to protect and not disclose to anyone your login data for the Website.
The Lyceum processes your and/or your Child’s personal data responsibly and safely, with regard to personal data security requirements set in legal acts. When determining personal data processing measures, also during the processing, the Lyceum shall implement the data protection technical and organisational measures set in legal acts, meant for protection of processed personal data from accidental or unauthorised destruction, damage, alteration, loss, disclosure, as well as from any other unauthorised processing. The personal data security measures and their levels shall be determined with regard to risks arising in the processing of personal data.
Among other things, employees of the Lyceum who have access to personal data shall be made aware of the personal data protection requirements and shall ensure full confidentiality of the personal data processed.
VI. COOKIES
The Lyceum hereby informs about the use of cookies on the Website. More information about cookies can be found in the Cookie Policy (link) of the Lyceum, which is an integral part of this Privacy Policy.
VII. CHANGES IN THE PRIVACY POLICY
The Lyceum has the right to amend provisions of this Privacy Policy. Upon change of the terms of this Privacy Policy, we shall publish an updated version of the Privacy Policy on the Website and shall inform pupils of the Lyceum and parents/guardians by e-mail.
Changes to the Privacy Policy were made and are valid from 3 March 2023.
