This Privacy Policy describes how UAB ARLINSA processes personal data submitted through this website, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation — GDPR), with the Republic of Lithuania Law on the Legal Protection of Personal Data (Nº I-1374, as last amended on 16 July 2018 to implement the GDPR), and with the related Lithuanian sectoral legislation.
The data controller within the meaning of Article 4(7) GDPR is:
UAB ARLINSA
Architektų g. 56-101, LT-04111 Vilnius, Lithuania
Company code: 306736720
Email: contact@arlinsa.eu
Electronic delivery box: 306736720
UAB ARLINSA has assessed its activities against Article 37 GDPR and the guidance of the State Data Protection Inspectorate (VDAI) and has concluded that it is not required to designate a data protection officer, on the basis that its core activities do not involve regular and systematic monitoring of data subjects on a large scale or large-scale processing of special categories of data. Notwithstanding the foregoing, any matter relating to personal data may be addressed in writing to contact@arlinsa.eu, with the subject line "GDPR".
Through the contact form on this website, we collect: full name, email address, organisation (where provided), relevant jurisdiction, indicated nature of the matter, and the text of the message. Through standard server operation, we collect, for security and statistical purposes, the IP address, browser identification string and the date and time of the request, in accordance with the principles of Article 5 GDPR.
We do not request and we do not intentionally collect special categories of personal data within the meaning of Article 9 GDPR. We do not request the Lithuanian personal identification code (asmens kodas) through this website. In accordance with Lithuanian data protection law and the guidance of the VDAI, the personal identification code shall not be made public and shall not be processed for direct marketing purposes.
Personal data submitted through this website is processed for the following purposes: (i) to qualify approaches addressed to UAB ARLINSA and to assess whether the matter falls within our perimeter; (ii) to conduct conflict-of-interest screening before any substantive exchange; (iii) to maintain the documentary record required for AML and counterparty diligence purposes where the matter advances; (iv) to operate, secure and improve the website itself.
Personal data is processed on the following legal bases, in accordance with Article 6(1) GDPR:
(a) the consent of the data subject, where given, in particular with respect to the use of non-essential cookies (Article 6(1)(a) GDPR);
(b) the legitimate interest of UAB ARLINSA in assessing approaches, screening for conflicts of interest, conducting preliminary counterparty, sanctions and reputational checks, securing the website and preventing fraud (Article 6(1)(f) GDPR);
(c) the performance of pre-contractual measures taken at the data subject's request (Article 6(1)(b) GDPR);
(d) compliance with legal obligations applicable to UAB ARLINSA or, where relevant, to regulated third parties involved in the mandate, including obligations under anti-money laundering legislation (Article 6(1)(c) GDPR).
Personal data is processed internally by UAB ARLINSA. Where a matter advances, personal data may be communicated to the licensed professionals, intermediaries and institutions coordinated for the matter (legal counsel, notaries, tax advisers, regulated providers), subject to appropriate confidentiality undertakings and, where required, written data-processing arrangements under Article 28 GDPR.
Form submissions are transmitted through Formspree, operated by Formspree Inc., acting as a processor under Article 28 GDPR. Hosting services are provided by Hostinger International Ltd. (Cyprus). UAB ARLINSA does not sell personal data, does not transfer personal data to third parties for direct-marketing purposes, and does not engage in automated decision-making that produces legal effects on data subjects within the meaning of Article 22 GDPR.
Where personal data is transferred outside the European Economic Area, such transfers are made on the basis of an adequacy decision of the European Commission within the meaning of Article 45 GDPR, or, in the absence of such a decision, on the basis of appropriate safeguards under Article 46 GDPR, in particular the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021. A copy of the safeguards in place can be requested at contact@arlinsa.eu.
Personal data submitted through the contact form is retained for as long as necessary to qualify the approach and respond to it. Where the matter does not advance, personal data is retained for a maximum period of twelve (12) months from the last contact, unless a longer retention period is required by law (in particular Lithuanian anti-money laundering legislation, which sets a five-year retention requirement for documentation collected in the context of AML obligations). Server log data is retained for a period not exceeding six (6) months unless required longer for security investigations.
Under Articles 15 to 22 GDPR, data subjects have the right:
(a) to access their personal data and to obtain a copy thereof (Article 15);
(b) to rectify inaccurate data (Article 16);
(c) to erasure of personal data (the "right to be forgotten") in the cases listed in Article 17;
(d) to restrict processing in the cases listed in Article 18;
(e) to data portability in respect of data processed by automated means on the basis of consent or contract (Article 20);
(f) to object to processing based on the legitimate interest of the controller (Article 21);
(g) to withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
Requests may be addressed in writing to contact@arlinsa.eu. UAB ARLINSA will respond within one (1) month from receipt of the request, in accordance with Article 12(3) GDPR. This period may be extended by two additional months where necessary, taking into account the complexity and number of requests, with prior information to the data subject.
Data subjects have the right to lodge a complaint with the competent supervisory authority. In the Republic of Lithuania, the competent authority is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija — VDAI):
VDAI · L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania
Website: https://vdai.lrv.lt
Email: ada@ada.lt
Data subjects also retain the right to lodge a complaint with the supervisory authority of their habitual residence or the place of the alleged infringement (Article 77 GDPR).
UAB ARLINSA implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR. The website operates over HTTPS with current TLS encryption. Personal data submitted through the contact form is processed under access controls limited to the senior coordination team.
UAB ARLINSA may amend this Privacy Policy. The version in force is the version published on this website at the time of access. Material amendments will be notified by a prominent notice on the website for a reasonable period.