AB “Ignitis grupė” Privacy statement

This privacy statement applies to natural persons (hereinafter referred to as "You", "Data Subject") whose personal data is processed by AB “Ignitis grupė” (hereinafter referred to as "We", "Company") for the purposes and on the legal grounds set out in this privacy statement.

The Company processes personal data of the following natural persons:

Shareholders of the Company’s securities (stockholders, bond holders);
Candidates applying to become employees of the Company or members of its management, supervisory bodies, committees;
Members of the Company’s management, supervisory bodies, and committees;
Contract counterparties of the Company, their representatives;
Persons (applicants) who directly contact the Company or use remote communication means (including by phone, email) with requests or complaints;
Participants of events organised by the Company who register and take part in such events;
Persons who subscribe to or otherwise wish to receive news from the Company;
Persons visiting the Company’s website.

We respect your privacy and are committed to protecting your personal data. The Company processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ("General Data Protection Regulation") (hereinafter referred to as the "GDPR"), Republic of Lithuania Law on the Legal Protection of Personal Data, and the requirements of other legal acts regulating the protection of personal data, as well as in accordance with the provisions of this privacy statement.

Your personal data shall be processed in such a way as to ensure, by means of appropriate technical or organisational measures, adequate security of the personal data, including protection against unauthorised processing, accidental or unlawful destruction, loss, alteration, disclosure, use or other unauthorised processing of the data.

The Company reserves the right to unilaterally amend and/or supplement this Privacy statement. The amended or updated Privacy statement comes into effect on the day of its publication on the Company’s website.

Terms used in this Privacy statement:

Personal data – any information relating to an identified or identifiable natural person (Data Subject), whose identity is known or can be directly or indirectly identified by using such data as an identification number, or one or more factors specific to the physical, physiological, psychological, economic, cultural, or social characteristics of that person.

Person means the natural person (Data Subject) whose personal data are processed (e.g. shareholder, candidate, contractor, subscriber, etc.).

Data processing means any operation performed on personal data (e.g. collection, recording, storage, classification, alteration, transmission, destruction, erasure, etc.).

Other terms used in the Privacy statement shall be understood as defined in the legal acts regulating the protection of personal data (GDPR, Law on Legal Protection of Personal Data of the Republic of Lithuania and others).

1. Data Controller and Data Protection Officer

The controller of your personal data is AB “Ignitis grupė”, number of legal entity 301844044, registered office address Laisvės pr. 10, LT-04215 Vilnius.

If you have any questions regarding the processing of your personal data, you may contact the Data Protection Officer via email: [email protected]

2. Legal grounds for processing personal data

Your personal data is processed solely for specific purposes and in accordance with the following legal bases:

If you have given consent for the processing of your personal data for one or more specific purposes (Article 6(1)(a) of the GDPR);
If the processing of your personal data is necessary for the conclusion and/or performance of a contract with you (Article 6(1)(b) of the GDPR);
If the processing of your personal data is mandatory to fulfill a legal obligation establishes by law (Article 6(1)(c) of the GDPR);
If the processing of your personal data is necessary for the purposes of the Company’s legitimate interests,(Article 6(1)(f) of the GDPR);

3. Purpose and scope of personal data processing

The Company collects and processes the following personal data (data categories) for the purposes and legal bases outlined below:

For the purpose of fulfilling obligations to shareholders

For the purpose of candidate selection, verification of their impeccable reputation

For the purpose of reconciling public and private interests of the members of the Company's management, supervisory bodies, committees

For the purpose of concluding and executing contracts with members of the Company's management, supervisory bodies, committees

For the purpose of handling complaints, requests, claims

For the purpose of concluding and performing contracts with contractors (contracting parties) or their representatives

For the purpose of subscribing to news about the Company's activities, financial results, etc.

For the purpose of event organization

For the purpose of ensuring the safety of individuals and property (video surveillance)

For the purpose of protecting legitimate interests of the company in dispute resolution

For the purpose to improve the functionality of the Company’s website, ensuring its efficient and smooth operation

For the purpose of fulfilling obligations to shareholders

For the purpose of fulfilling obligations to shareholders (e. g. obligations defined in the Civil Code of the Republic of Lithuania, the Republic of Lithuania Law on Stock Companies and other applicable laws, ensuring the exercise of shareholders’ rights and obligations, shareholders accounting, organising and conducting general meetings of shareholders; formalising and implementing resolution s of general meetings of shareholders; calculating dividends; communicating with shareholders, and more) the following personal data are processed:

identity data (such as name, surname, personal ID number); contact details (such as email address, residential address); other data related to shareholders (such as the number of shares held, information about dividends paid, information related to the acquisition/ holding/ disposal of shares, bank account number, account number in the Nasdaq depository, representation data, resolutions of general meetings of shareholders and their protocols, related annexes, advance voting ballots, notes on protocols, and other documents where shareholders express their will in exercising shareholder rights, as well as the data recorded therein, etc.).

Legal basis for personal data processing: performance of legal obligation, legitimate interest of the Company.

For the purpose of candidate selection, verification of their impeccable reputation

For the purpose of candidate selection, verification of their impeccable reputation, the following personal data are processed:

identity data (such as name, surname, date of birth or personal ID number, if required for identification), contact data (such as telephone number, e-mail address, etc.), qualification data (such as education, qualifications, work experience, professional skills, business qualities, personal data contained in curriculum vitae (CV) and/or other submitted documents, etc), personal data required by law

Legal basis for personal data processing: performance of legal obligation, legitimate interest of the Company.

Detailed information on the processing of candidates' personal data is provided in the Privacy Notice for candidates

For the purpose of reconciling public and private interests of the members of the Company's management, supervisory bodies, committees

For the purpose of reconciling the public and private interests of members of the company's management, supervisory bodies, committees the following personal data are processed:

identity data (such as name, surname, date of birth or personal ID number, if required for identification); data related to potential conflicts of interest, private interests (such as specific private interests, their nature, e.g., information about all professional activities, related persons, if any, whose activities and nature could lead to conflicts of interest, etc.); other data specified in the declaration of private interests, as well as data processed in accordance with the Law on the Alignment of Public and Private Interests of the Republic of Lithuania.

Legal basis for data processing: performance of legal obligation, legitimate interest of the Company.

For the purpose of concluding and executing contracts with members of the Company's management, supervisory bodies, committees

For the purpose of concluding and performing contracts with members of the Company's management, supervisory bodies, committees the following personal data are processed:

identity data (such as name, surname, personal ID number), contact data (such as residential address, e-mail address), other data (such as bank account details for payment of remuneration, personal signature, other personal data specified in the contract).

Legal basis for data processing: conclusion and performance of the contract, performance of a legal obligation, legitimate interest of the Company.

For the purpose of handling complaints, requests, claims

For the purpose of handling complaints, requests, claims, the following personal data are processed:

identity data (such as name, surname, etc.), contact data (such as e-mail address, telephone number, address), data relating to the request/complaint or other written communication (such as date, content of the request/complaint/writing, signature, etc.).

Legal basis for data processing: legitimate interest of the Company.

For the purpose of concluding and performing contracts with contractors (contracting parties) or their representatives

For the purpose of concluding and performing contracts with contractors (counterparty) or their representatives the following personal data are processed:

identity data (such as name, surname, personal ID number), contact data (such as e-mail address, telephone number), other data (such as signature, basis of representation, duties, billing information, other information related to the contract).

Legal basis for data processing: conclusion and performance of the contract, legitimate interest of the Company.

For the purpose of subscribing to news about the Company's activities, financial results, etc.

For the purpose of subscribing to news about the Company's activities, financial results, etc. the following personal data are processed:

identity data (such as name, surname); contact details (such as email address); other data provided at the individual's choice (e.g., country, company, etc.).

Legal basis for data processing: consent of the natural person (Data subject).

For the purpose of event organization

For the purpose of event organization the following personal data are processed:

identity data (such as name, surname); contact details (such as email address); other data provided upon registration for the Company's events; images (if the event is filmed or photographed).

Legal basis for data processing: consent of the person, legitimate interest of the Company.

For the purpose of ensuring the safety of individuals and property (video surveillance)

For the purpose of ensuring the safety of persons and property, the Company may perform video surveillance, during which video data is processed. The Company informs data subjects about the video surveillance using informational signs warning of the surveillance, in cases where video surveillance is conducted.

Legal basis for data processing: legitimate interest of the Company.

For the purpose of protecting legitimate interests of the company in dispute resolution

For the purpose of protecting the legitimate interests of the Company in dispute resolution the following personal data are processes:

identity data (such as name, surname, etc.); contact details (such as email address, etc.); other data (e.g., data provided in contracts, other documents, etc.).

Legal basis for data processing: legitimate interest of the Company.

For the purpose to improve the functionality of the Company’s website, ensuring its efficient and smooth operation

For the purpose to improve the functionality of the Company's website and ensure its efficient and smooth operation:

essential cookies are used.
non-essential cookies are employed to track website navigation statistics, perform effective marketing, recognise users as previous visitors, store the user's browsing history on the site, and collect statistical information on website page views.

Cookies do not store information that directly identifies a user, but the information contained in cookies may be linked to the user's device, browsing history, and other data obtained and stored by cookies.

Legal basis for data processing: essential cookies are used based on the Company's legitimate interest, non-essential cookies are used with your consent.

The Company provides more information in the Cookie Policy.

4. Receipt of personal data

The Company collects your personal data from the following sources:

Directly from you.
From law enforcement authorities, Official/State authorities which provide personal data as required by legal obligations.
From other third parties (e.g., financial institutions responsible for securities accounting, depositories, etc.).
Ignitis Group companies;
From publicly accessible sources and career social networks (e.g., LinkedIn) during recruitment processes and background checks for candidates.

5. Sharing of your personal data

The Company may share personal data with the following third parties in certain circumstances, for example, to provide services, to comply with legal requirements or to protect legitimate interests. The following categories of recipients are such as:

Service providers (data processors engaged by the Company), who process personal data on behalf of the Company (the data controller). These service providers assist with tasks such as recruitment, IT development and maintenance, and other services necessary to ensure proper service delivery.
State/Official authorities, law enforcement, and regulatory bodies, including national registries, when required by law or necessary to protect the legitimate interest of the Company, its employees, or third parties, in accordance with legal obligations.
For other third parties (e.g., when concluding civil liability insurance contracts), based on legal grounds and legitimate purposes defined in applicable laws.
Ignitis Group companies.

6. Transfer of personal data

Personal Data is processed by the Company in the European Union and the European Economic Area (“EU/EEA”), but in certain cases, for example, if the Personal Data Processor/sub-processor engaged by the Company is located outside of the EU/EEA, it may be necessary to transfer certain Personal Data outside of the EU/EEA, or to provide access to it to Data Processor outside of the EU/EEA, and the transfer of such Personal Data is necessary for the provision of the services. Personal Data may only be transferred outside the EU/EEA if the Company ensures adequate safeguards as required under the GDPR and there is a legal basis for such transfer.

7. Personal data storage

The storage period for personal data processed by the Company is determined based on specific purposes for which the personal data was collected and processed, or by the duration specified in applicable laws. Additionally, storage periods are set in accordance with the Company’s legitimate interest, such as for the purpose of asserting, enforcing, or defending legal claims in accordance with general limitation periods under applicable laws.

Retention periods such as:

When the Company fulfils its legal obligations, personal data is kept for the duration specified in this privacy statement and other applicable laws (e.g., in accordance with the Order No. V-100 issued by the Lithuanian Chief Archivist on 9 March 2011, regarding the approval of the internal administrative document retention schedule, and the retention periods defined in the Company’s documentation plan – for example, shareholder lists for 10 years from the date of amendment, minutes of general shareholders’ meetings, supervisory board, committee meetings, and related documents for 25 years, etc.).
Requests, complaints, claims and documents relating to the handling of such requests, complaints and claims shall be kept for 5 years from the date of the resolution of the complaint, request or claim.
Personal data processed for the purpose of contract conclusion and performance is stored for 10 years after the termination of contractual relations.
For subscribing to newsletters, personal data is stored until subscription withdrawal (until the consent is revoked).
When organising events, personal data is stored until the consent’s validity expires or is revoked, or for no longer than 2 years if personal data is processed based on a legitimate interest.
Video recordings captured during surveillance are stored for 30 days.
Retention periods may be reasonably extended in accordance with legal requirements or where Personal Data is necessary for the protection of the legitimate interests of the Company, for the establishment, exercise or defence of legal claims, for the purpose of evidence (e.g. until the end of the relevant legal proceedings or legal proceedings and for as long as necessary thereafter, in accordance with the specific legal proceedings or legal proceedings, or for the purposes of the time limits laid down by law (e.g. in accordance with the applicable legal limitation periods).

8. Your rights as a data subject and their exercise:

As a data subject, you have the following rights:

The right to be informed about the processing of your personal data (Articles 13-14 of the GDPR);
The right to access your personal data being processed (Article 15 of the GDPR);
The right to rectify inaccurate, incomplete, or outdated your personal data (Article 16 of the GDPR);
The right to request the erasure of your personal Data ("right to be forgotten") (Article 17 of the BDAR). Remark: This right can be exercised if at least one of the conditions specified in Article 17(1) of the GDPR applies.
The right to restrict the processing of your personal data (Article 18 of the BDAR). Remark: this right can be exercised when at least one of the conditions referred to in Article 18(1) of the GDPR exists;
The right to receive your personal data that you have provided to the Company in a structured, commonly used and computer-readable format, and the right to transfer that data to another controller if: the data are processed on the basis of consent or a contract; and the data are processed by automated means. You also have the right to request that the Company transfers your personal data directly to another controller if this is technically possible. (Article 20 of the GDPR);
The right to object to the processing of your personal data when the legal basis for such processing is legitimate interest (Article 21(1) of the GDPR).
The right to withdraw your consent at any time when personal data is processed based on consent; however, such withdrawal will not affect the legality of processing that occurred before the consent was withdrawn (Articles 7(3) and 21(3) of the GDPR).
The right to lodge a complaint with the supervisory authority – the State Data Protection Inspectorate (L. Sapiegos g. 17, Vilnius, [email protected]) – if you believe your rights as of a data subject have been improperly exercised or your personal data has been processed inappropriately. Before filing a complaint with the supervisory authority, we recommend contacting the data protection officer at [email protected] to resolve any concerns you may have.

You can exercise your rights as a data subject by: submitting a written request Laisvės pr. 10, LT-04215 Vilnius or by email: [email protected].

The Company is obliged to fulfil your requests within one month from the date of receiving your request and inform you accordingly, or to refuse the request, stating the reasons for such refusal. This period may be extended by another two months, depending on the complexity and number of requests. In such cases, within one month of receiving your request, we will inform you about the extension, along with the reasons for it. To ensure data protection and enable you to exercise your rights, we have the right to request additional information necessary to verify your identity.