PRIVACY POLICY

1. GENERAL PROVISIONS

This privacy policy regulates the personal data processed by UAB “Urmo prekybos miestelis” (hereinafter – the Company) and ensures transparent, lawful, and responsible use thereof. Company details: • Name: UAB “Urmo prekybos miestelis” • Legal entity code: 305358488 • Registered office address: Laisvės pr. 60-1107, Vilnius • Correspondence address: Pramonės pr. 16, Kaunas • Phone: +37037350662 • Email: infoupm@urmas.net The Company processes personal data in accordance with: ✔ Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) ✔ Republic of Lithuania Law on Legal Protection of Personal Data ✔ Other applicable legal norms This privacy policy describes: ✔ What personal data we collect and in what cases ✔ Why and on what legal basis we process your data ✔ How long we store the data ✔ What rights you have and how you can exercise them

2. WHAT PERSONAL DATA DO WE PROCESS AND WHEN?

2.1. When concluding and executing a contract

Circumstances: When we enter into a sublease, supply services, or other agreement with you, we need to collect certain information necessary for the execution of the contract and ensuring legitimate obligations.

Data processed: ✔ Name, surname, personal identification number ✔ Residential address, contact details (email, phone) ✔ Bank account number, payment information ✔ Contract and invoice data

Legal basis: Contract performance (GDPR Art. 6(1)(b)). Storage period: 10 years from contract fulfillment.

2.2. Debt administration and recovery

Circumstances: If you are late with payments under the contract, we may process additional data to recover the debt through legal means.

Data processed: ✔ Name, surname, personal identification number ✔ Residential address, email, phone ✔ Bank account number, debt amount ✔ Court decisions regarding debt recovery

Important to know: 🔹 If you are late with payment for more than 30 days, we may transfer information about the debt to UAB “Creditinfo Lietuva”. 🔹 If the debt is recovered through court, data may be transferred to bailiffs, notaries, debt collection companies.

Legal basis: Legitimate interest (GDPR Art. 6(1)(f)). Storage period: 10 years after fulfillment of obligations.

2.3. Website visitor data and cookies

Circumstances: When you use our website, it automatically collects certain information that helps ensure its operation and analyze traffic. When you fill out a rental form, we collect information regarding sublease possibilities. When you subscribe to a newsletter, we receive your data, which we use to provide direct marketing offers.

Data processed: ✔ IP address, browser type, device information ✔ Website visit time, browsing history ✔ In case of form completion and newsletter subscription – name, surname, contact details

Types and purposes of cookies:

  • Necessary cookies: For website operation (stored until the end of session)
  • Analytical cookies: For traffic analysis (stored up to 1 year)
  • Advertising cookies: For personalized offers (require consent)

How to manage cookies? 🔹 You can disable them in your browser settings.

Legal basis: Consent (GDPR Art. 6(1)(a)). Storage period: Up to 1 year or until the user deletes cookies.

2.4. Social networks

Circumstances: When you visit our social networks and express reactions, participate in published contests/games.

Data processed: ✔ Username, profile picture, comments, reactions ✔ Posted content

Legal basis: Legitimate interest (GDPR Art. 6(1)(f)). Storage period: As long as the Company uses its social network account, unless the person deletes or asks the Company to delete the submitted data.

2.5. Video surveillance in premises and territory

Circumstances: When you visit our premises and territory, we conduct video surveillance to ensure safety of operations, persons, and property, and to monitor the flow of people and vehicles.

Data processed: ✔ Video recordings from surveillance cameras ✔ Vehicle license plate numbers

Legal basis: Legitimate interest (GDPR Art. 6(1)(f)). Storage period: 72 hours.

2.6. Administration of insured events

Circumstances: When an insured event occurs, we will process the name, surname, personal identification number, image, contact details, damage caused, and other information of the person involved in the event that must be provided to the insurance company.

Data processed: ✔ Name, surname, personal identification number, image ✔ Residential address, contact details (email, phone)

Legal basis: Legal obligation (GDPR Art. 6(1)(c)). Storage period: 10 years from the day of insurance payout.

2.7. Processing of complaints, requests, violations

Circumstances: When we receive a complaint, request, claim, etc. from clients, we process personal data to respond to the received document.

Data processed: ✔ Name, surname, personal identification number, image ✔ Residential address, contact details (email, phone)

Legal basis: Contract performance (GDPR Art. 6(1)(b)). Storage period: 5 years from the day of receiving the document.

3. DATA SECURITY AND TRANSFER

🔹 To whom may your data be transferred? ✔ National institutions (State Tax Inspectorate, courts, State Data Protection Inspectorate) ✔ Credit bureau “Creditinfo Lietuva” ✔ IT, accounting, legal, and debt collection companies

🔹 Data transfer outside the EU Some data (e.g., information posted on social networks) may be transferred outside the EU. In such cases: ✔ We use contracts approved by the EU CommissionWe ensure that the data is secure

4. YOUR RIGHTS

Right to access your dataRight to correct inaccurate dataRight to be forgotten (delete data)Right to restrict data processingRight to data portabilityRight to object to data processingRight to lodge a complaint with the State Data Protection Inspectorate

How to exercise your rights? 🔹 Write to email infoupm@urmas.net 🔹 Apply in writing to the Company’s registered office

5. PRIVACY POLICY UPDATES

🔹 This privacy policy may be changed. The latest version is published on the website: 🔗 https://www.urmas.net/lt/