Privacy Policy

PRIVACY POLICY

1. What is the purpose of this privacy policy?

This privacy policy (hereinafter referred to as the “Policy”) provides information about how we collect and use data related to you or your company (hereinafter referred to as “Data”), access or otherwise process it, and to what extent we process or will process such Data, as well as information about your rights and how to exercise your rights in relation to such Data processing.

2. Who is the controller of my Data?

Name: UAB “BTL Group”

Legal entity code: 303389111

Email address: [email protected]

Address: R. Kalantos g. 49, LT-52303, Kaunas, Lithuania

And other companies in the Group that you have a relationship with, a list of which can be found here.

3. Purposes of data processing and legal basis, relevant data categories
   3.1. Provision of transport, logistics, vehicle rental and sales services

In cases where your organization or you use our services, we will process your Data as specified below in order to provide our services properly.

Legal basis for data processing	Relevant data categories	Is the provision of Data mandatory?
Legitimate interest to provide services to entities you represent (Article 6(1)(f) of GDPR)   Contract (Article 6(1)(b) of GDPR)	Company representative’s first name, last name, position, individual activity certificate number (if applicable), represented organization, e-mail address, telephone number, address, city, cargo identification data (e.g., shipment number, contents, weight, delivery address, recipient’s name, surname and signature, vehicle identification data, route information)	Yes, data processing is necessary in order to establish, maintain, and administer business relations with your organization and to ensure the proper provision of our services.

 

3.2. Transportation of cargo requiring enhanced security

In cases where our company transports cargo subject to special security or access procedures (e.g., when cargo is related to strategic projects, government institutions, military facilities, or other restricted access areas), we will process your Data as specified below in order to ensure compliance with the established security, verification, and access control requirements.

Legal basis for data processing	Relevant data categories	Is the provision of Data mandatory?
Legitimate interest in ensuring that only authorized persons enter the premises (Article 6(1)(f) of GDPR)   Legal obligation (Article 6(1)(c) of GDPR)	Driver’s first name, last name, organization represented, date of birth or personal identification number, personal document details (e.g., passport or ID card number), vehicle registration number	Yes, the provision of this data is necessary for us to provide services properly and ensure that the cargo is transported safely and smoothly.

 

3.3. Debt management

If your organization or you are late in fulfilling your contractual obligations to our company, we may process the data of a natural person or the manager or shareholder of a legal entity as specified below.

Legal basis for data processing	Relevant data categories	Is the provision of data mandatory?
Legitimate interest in receiving timely payment for our services (Article 6(1)(f) of GDPR)	Represented organization, first name, last name, personal identification number, address, date of birth, email address, telephone number, payment account number, payment account statements, credit history, and other data if related to the circumstances of the debt or the management of outstanding debts	No

 

3.4. Marketing & social media

When you register on our website or mobile app, give us your consent, or when we have a legitimate interest, we may process your data for marketing purposes. This may include sending you offers related to our or our partners’ services and goods, providing news, and feedback on our services. In addition, when you interact with us on our social media accounts, we process the data generated during these interactions so that we can administer and improve our social media accounts and communicate with you effectively.

Legal basis for data processing	Relevant data categories	Is the provision of data mandatory?
Consent (Article 6(1)(a) of GDPR)   Legitimate interest to inform you about our services and goods (Article 6(1)(f) of GDPR)   Customer relationship (Article 81(2) of the Electronic Communications Act)	Represented organization, first name, last name, e-mail address, telephone number, demographic information (age, gender, place of residence, language preferences), communication settings and consents, social network identifiers and user names, profile information (profile photo, description, public interests), comments, reactions, messages sent to us and our responses to them, participation in surveys, promotions, contests, reviews, recommendations, and events, browsing behavior on our websites and apps, interactions with marketing communications, device and technical data (IP address, device type, operating system, browser type, advertising identifiers, cookies, pixel tags, and similar technologies), geographic location data (if enabled), social media engagement statistics and ratings	No

 

3.5. Handling your inquiries, requests and complaints

When you submit an inquiry, request, or complaint to us, we process your Data as described below.

Legal basis for data processing	Relevant data categories	Is the provision of Data mandatory?
Consent (Article 6(1)(a) of GDPR)	Represented organization, first name, last name, email address, telephone number, address, inquiry, request or complaint, information related to the inquiry, request or complaint, other information provided, conversation recording	No

 

3.6. Security, functionality, and improvement of our services and products

In order to ensure the security, stability, and proper functioning of our website, as well as protection against fraud, abuse, and unauthorized access, we automatically collect and process certain technical and usage data. This information also helps us monitor performance, detect errors, implement product updates, develop new features, and improve the overall user experience.

Legal basis for data processing	Categories of data processed	Is the provision of data mandatory?
Legitimate interest in ensuring the security, proper functioning, and continuous improvement of the website, mobile app, and products (Article 6(1)(f) of GDPR)	IP address, device identifiers, device type and model, operating system and version, browser type and version, screen resolution, language settings, time zone, login details, session identifiers, cookies and similar tracking technologies, browsing and interaction data with the website, mobile application and product features, referring URL, geographic location data (if this feature is enabled), network and connection information, log files, system error data, authentication and access records, user account activity data (including login attempts), order history (to identify suspicious or unusual activity), user feedback and behavior within the app related to product usage	No

 

3.7. Video surveillance (CCTV) & access control

We use video surveillance systems on our premises and grounds to ensure the safety of people, property, and our infrastructure. We also use access control measures such as entry cards and electronic logs to help manage and record access to the premises and restricted access areas.

Legal basis for data processing	Relevant data categories	Is the provision of data mandatory?
Legitimate interest in ensuring the safety of persons and property (Article 6(1)(f) of GDPR)	Video recordings (including time and location of recording), visual image of the individual, behavior and activities captured in monitored areas, incident-related information, access badge identifiers, badge usage logs (entry/exit times, doors or zones accessed), and system-generated access control records	No

 

3.8. Recruitment

When you apply for a vacancy at one of our group companies or we contact you about possible job offers, we process your personal data related to the selection and recruitment process.

Legal basis for data processing	Categories of data concerned	Is the provision of data mandatory?
Consent (Article 6(1)(a) of GDPR)   Legitimate interest to contact you regarding job opportunities at our company (Article 6(1)(f) of GDPR)	First name, last name, place of residence or residential address, email address, telephone number, information about the candidate’s work experience (place of work, period of employment, duties, responsibilities, achievements), information about the candidate’s education (educational institution, period of study, education and/or qualifications obtained), information about professional development (training courses attended, certificates obtained), information about language skills, information technology skills, other competencies, other information provided in your CV, cover letter, or other application documents, the person recommending the candidate or providing feedback, the content of the recommendation or feedback, a summary of the interview with the candidate, the comments and opinions of the person conducting the selection, the results of the candidate’s test	No

 

3.9. Compliance with legal requirements and defence of our legal interests

In accordance with the limitation periods established by law, we will store the Data so that we can defend our rights and legal interests if necessary. We must store certain Data in order to comply with legal requirements in the areas of payment, accounting, archiving, and others. In rare cases, if you become involved in legal proceedings to which we are a party, we will use this Data for the purposes of those legal proceedings.

Legal basis for data processing	Relevant data categories	Is the provision of Data mandatory?
Legal obligation (Article 6(1)(c) of GDPR)   Legitimate interest in protecting our rights and legal interests (Article 6(1)(f) of GDPR)	Represented organization, first name, last name, email address, contracts, documents and data of legal significance, communication, legal documents, procedural documents, attachments, court documents, investigation information, information about convictions and criminal offenses, information about IT and communication tools provided by us, username, password, correspondence, information about the use of IT and communication tools, log entries, possible violations and incidents, individual activity report number, represented organization, contact details, bank account number, payment details, services provided, and other information if required by accounting rules, other data submitted and collected	No

 

4. How long do you keep my Data?

We retain Data in a form that allows your identity to be determined for no longer than is necessary for the purposes for which the Data is processed and in accordance with legal requirements:

• We store information related to the provision of transport, logistics, vehicle rental, and sales services for 10 years after the end of the business relationship with your organization or you.
• Data specified in the General Document Storage Terms Index approved by the Chief Archivist of Lithuania is stored for the periods specified in this legal act;
• Video recordings Data is stored for 30 days from the date of recording, except in cases where there is reason to believe that illegal activities have been recorded – until the end of the relevant investigation and/or court proceedings.
• We store data that is necessary for the defense of our legal interests for 10 years in accordance with the general statute of limitations (Article 1.125(1) of the Civil Code of the Republic of Lithuania), calculated in accordance with the rules set out in the aforementioned legal act.

5. Where do you collect my Data from?

We collect most of the Data from you. If necessary for the purposes specified below, we collect Data from other sources.

Source of Data	Purpose of data processing
The company/organization you represent	Cooperation with our partners in business processes (e.g., signing contracts, communication)
Entities providing job search, selection, and intermediation services, e.g. the Employment Service of the Republic of Lithuania, employment agencies, online job search portals, professional social networks (e.g. LinkedIn), persons recommending you, current or former employers	For the purpose of selecting potential employees
Social media networks	Administration of our social media accounts
Courts, supervisory authorities, police, prosecutors, or other state and municipal institutions, participants in legal proceedings and their representatives	Compliance with legal requirements and protection of our legal interests

 

6. Who do you transfer my Data to?

When necessary for the purposes listed above and in accordance with applicable laws, we share data with the following recipients.

Data recipients or categories of data recipients	If the Data is to be transferred to a third country or international organization:
	Third country	Safeguard measure or exemption allowing the transfer
Lawyers, notaries, bailiffs, debt management and/or collection agencies, leasing, credit and insurance companies, auditors, tax, business, personnel management and other consultants	—
IT tools and services, electronic communications service providers, travel agencies, insurance companies, archiving and other service providers	—
State labor, social security, tax, and supervisory authorities, police, prosecutor’s office, courts, law enforcement, and other state and municipal institutions	—
Other companies in our Group	—
Communication service providers: UAB Tele2, AB Telia Lietuva, UAB Bitė Lietuva	—
IT, infrastructure, and system development service providers: UAB Athera Technologies, MB Vytjana Group, UAB Itoma, UAB The Infotrust,   UAB Data Bank Group, UAB NFQ Technologies, UAB TeraSky Baltic
UAB Creditinfo Lietuva (credit rating and risk management service provider)	—
UAB Asseco Lietuva (document management system service provider)	—
UAB Paysera LT (payment administration service provider)	—
UAB Finansų valdymo sistemos (accounting and financial management system service provider)	—
UAB Dokobit (provider of electronic document signing and identity verification services)	—
UAB Konica Minolta Baltia (provider of document scanning (OCR), printing, and digitization services)	—
UAB TeamBit (provider of project and task management system administration services)	—
N-able Technologies Ltd. (IT, infrastructure and systems development service provider)	UK	EC decision on the adequate protection
Atlassian Corporation Plc (team collaboration and productivity software provider, Jira)	USA	EU Standard Contractual Clauses
Google Inc. (IT infrastructure and cloud services provider)	USA	EU Standard Contractual Clauses
Facebook (Meta) (social networking service provider)	USA	EU Standard Contractual Clauses
LinkedIn (social networking service provider)	USA	EU Standard Contractual Clauses
Microsoft Corporation (IT infrastructure and service provider)	USA	EU Standard Contractual Clauses
Potential or actual buyers of the business or part thereof and their authorized advisors or representatives	Various	EU Standard Contractual Clauses

 

7. What rights do I have in relation to the processing of my Data?

Right	Summary of rights
Right of access	Right to obtain confirmation from us as to whether Data relating to you is being processed and, if such Data is being processed, you have the right to access the Data and information about the processing.
Right to request correction of data	Right to request that we correct inaccurate Data relating to you.
Right to request deletion of data (“right to be forgotten”)	– when the Data is no longer necessary to achieve the purposes for which it was collected or otherwise processed; – when you withdraw your consent on which the processing of Data is based and there is no other legal basis for processing the Data; – when you object to the processing of the Data and there are no overriding legitimate grounds for processing the Data, or when you object to the processing of the Data for direct marketing purposes; – when the Data has been processed unlawfully; – when the Data must be deleted in order to comply with a legal obligation; – when the Data was collected for the direct offering of information society services directly and based on consent.
Right to restrict data processing	– when you contest the accuracy of the Data; – when the processing of the Data is unlawful and you do not agree to have it deleted and instead request that its use be restricted; – when we no longer need the Data for the purposes for which it was collected, but you need it to establish, exercise, or defend legal claims; – when you have objected to the processing of the Data and pending verification whether our legitimate interests override yours.
Right to data portability	when you seek to obtain your submitted Data or transfer this Data to another Data controller, and the processing of the Data is based on consent or a contract and is carried out by automated means.
Right to object	when we collect and use Data based on a task carried out in the public interest, public authority, or our legitimate interests, or for direct marketing purposes.
Right to withdraw consent	where the processing of Data is based on consent and you wish to withdraw it at any time, without affecting the lawfulness of the processing based on consent before its withdrawal.
Right to lodge a complaint	Right to lodge a complaint with a supervisory authority.

 

8. Automated decision-making, including profiling

We do not make decisions based solely on automated processing of Data, including profiling, which would produce legal effects concerning you or similarly significantly affects you.

9. Do we use cookies and other similar technologies?

Yes, our website stores the following cookies on your device:

Purpose of processing	Cookie	Category	Do third parties have access to the information	Duration
Helps the website recognize the user during browsing and maintain the login or session status between pages	CMSSESSIDX	Essential	No	Session
Remembers the user’s choices regarding cookie settings (e.g., which cookie categories the user has consented to)	cookieControl	Functional	No	3 months
Used by Google Analytics to limit the frequency of requests in order to optimize system performance.	_gat	Analytical	Yes, Google. More information can be found here	1 minute
Used to identify users and analyze their activity on the website in order to improve the content and user experience	_ga	Analytical	Yes, Google. More information can be found here	2 years
Used to distinguish users by session and track their browsing behavior for analytical purposes.	_gid	Analytical	Yes, Google. More information can be found here	24 hours

 

10. Can this Policy be amended?

We may amend this Policy unilaterally from time to time. Any such amendments will take effect immediately upon publication. Therefore, please visit our website regularly to review the latest version of this Policy.

Last updated: October 29, 2025