SOCIAL MEDIA PRIVACY POLICY
With this document, we would like to inform you about the processing of your data on our social media accounts in accordance with Article 13 of the General Data Protection Regulation (GDPR) of the European Union.
Data Controller
In some cases, we are responsible for the data collection and processing described below, i.e.
UAB "Avitelos Prekyba"
Company code: 142054984
Registered office: Taikos pr. 15, Klaipėda
and, in certain cases, the respective social media platform operators (hereinafter referred to as "platforms").
Additionally, in some data processing scenarios, we act as joint data controllers together with the platform operators in accordance with Article 26 of the GDPR (see section 4 for joint processing).
Additionally, in some data processing scenarios, we act as joint data controllers together with the platform operators in accordance with Article 26 of the GDPR (see section 4 for joint processing).
Responsibility of platform operators
We have only limited influence over the data processing carried out by the platform operators (e.g., managing members and publishing information). Where we can exert influence, we monitor—within the scope of our capabilities—that the platform operator handles the data in a privacy-friendly manner. However, in many cases, we have no influence on the data processing carried out by the platform operator and do not know exactly which data they process.
The platform operator manages the entire IT infrastructure of the channel, defines its own data protection policies, and maintains the direct relationship with you as the user (when you are a registered user of the social media platform). Additionally, the platform operator is solely responsible for all matters related to your user account data, which we as a company do not have access to.
MORE information about how each platform provider processes data and your options to object can be found in the respective privacy policy:
The platform operator manages the entire IT infrastructure of the channel, defines its own data protection policies, and maintains the direct relationship with you as the user (when you are a registered user of the social media platform). Additionally, the platform operator is solely responsible for all matters related to your user account data, which we as a company do not have access to.
MORE information about how each platform provider processes data and your options to object can be found in the respective privacy policy:
- Facebook: https://www.facebook.com/privacy/explanation
- Instagram: https://help.instagram.com/519522125107875
- YouTube: https://policies.google.com/privacy?hl=en
- LinkedIn: https://www.linkedin.com/legal/privacy-policy
Our actions on social media accounts
Purpose and legal basis of our data processing:
The purpose of our data processing on our social media accounts is to inform customers about offers, products, services, promotions, contests, business topics, and news, to engage with people browsing our accounts, and to respond to their questions, positive feedback, and criticism.
We reserve the right to delete content if necessary. This applies, for example, in cases where posts violate the law, include hate speech, obscene comments (explicitly sexual in nature), or attachments (such as photos or videos) that infringe copyrights, personal rights, criminal law, or the ethical principles of "Elesen".
Where applicable, we may share your content on our own account (if the platform allows it) and may contact you through the platform. The legal basis for this is Article 6(1)(f) of the GDPR. The data is processed for the purposes of publishing and communication.
Platform operators do not have the ability to influence the data processing carried out by "Elesen" for customer communication or contest organization purposes.
As mentioned, where the platform provider enables us to do so, we strive to ensure our accounts are as compliant with data protection requirements as possible.
The data you share on our accounts – such as comments, videos, photos, likes, public messages, etc. – are published on the platform for that purpose only, and we never use or process this data for any other purposes.
Data recipients and categories of data recipients: In certain cases, we may share the content you provide on our account if such a function exists on the platform, and we may contact you via social media channels. If you submit a request to us on the platform, we may, depending on the nature of the requested response, direct you to other secure communication channels that ensure confidentiality. You can always send confidential inquiries to us at the address specified in point 1 of this privacy policy.
Data you transmit to us via confidential channels (for example, private messages, letters, or emails) is generally not shared with third parties unrelated to "Elesen". In exceptional cases, data may be processed on our behalf by data processors. These processors are carefully selected and verified by us. Additionally, in order to respond to your request, specific parts of it may need to be confidentially forwarded to contract partners (for example, suppliers, if your request concerns a specific product). In such cases, your request is anonymized before being forwarded so that the third party cannot associate it with you. If, in an individual case, it is necessary to share your personal information, we will inform you in advance and ask for your consent.
Retention period and criteria for determining retention: All personal information you send to us via secure messages in inquiries (such as suggestions, positive feedback, or criticism) is deleted or fully anonymized no later than 90 days after we provide a final response. The 90-day retention period is based on the fact that in some cases, you as a customer may contact us again about the same matter, and we may refer to previous correspondence. In practice, we rarely receive further questions about our responses after 90 days.
All your public posts on these accounts are stored in our message timeline for a limited time unless we delete them due to an update of the main topic, a legal violation, a breach of our guidelines, or you delete the posts yourself.
We have no control over cases where your data is deleted by the platform operator. In such cases, the data protection rules of the respective platform operator apply.
We reserve the right to delete content if necessary. This applies, for example, in cases where posts violate the law, include hate speech, obscene comments (explicitly sexual in nature), or attachments (such as photos or videos) that infringe copyrights, personal rights, criminal law, or the ethical principles of "Elesen".
Where applicable, we may share your content on our own account (if the platform allows it) and may contact you through the platform. The legal basis for this is Article 6(1)(f) of the GDPR. The data is processed for the purposes of publishing and communication.
Platform operators do not have the ability to influence the data processing carried out by "Elesen" for customer communication or contest organization purposes.
As mentioned, where the platform provider enables us to do so, we strive to ensure our accounts are as compliant with data protection requirements as possible.
The data you share on our accounts – such as comments, videos, photos, likes, public messages, etc. – are published on the platform for that purpose only, and we never use or process this data for any other purposes.
Data recipients and categories of data recipients: In certain cases, we may share the content you provide on our account if such a function exists on the platform, and we may contact you via social media channels. If you submit a request to us on the platform, we may, depending on the nature of the requested response, direct you to other secure communication channels that ensure confidentiality. You can always send confidential inquiries to us at the address specified in point 1 of this privacy policy.
Data you transmit to us via confidential channels (for example, private messages, letters, or emails) is generally not shared with third parties unrelated to "Elesen". In exceptional cases, data may be processed on our behalf by data processors. These processors are carefully selected and verified by us. Additionally, in order to respond to your request, specific parts of it may need to be confidentially forwarded to contract partners (for example, suppliers, if your request concerns a specific product). In such cases, your request is anonymized before being forwarded so that the third party cannot associate it with you. If, in an individual case, it is necessary to share your personal information, we will inform you in advance and ask for your consent.
Retention period and criteria for determining retention: All personal information you send to us via secure messages in inquiries (such as suggestions, positive feedback, or criticism) is deleted or fully anonymized no later than 90 days after we provide a final response. The 90-day retention period is based on the fact that in some cases, you as a customer may contact us again about the same matter, and we may refer to previous correspondence. In practice, we rarely receive further questions about our responses after 90 days.
All your public posts on these accounts are stored in our message timeline for a limited time unless we delete them due to an update of the main topic, a legal violation, a breach of our guidelines, or you delete the posts yourself.
We have no control over cases where your data is deleted by the platform operator. In such cases, the data protection rules of the respective platform operator apply.
Contests
Purposes and legal bases of data processing:
When browsing our website, reading our newsletters, or viewing our social media accounts, you may participate in various contests. The personal data you provide for participation in contests is used solely for organizing the contest (e.g., to select the winner, send the prize, or anonymously announce the winner, where applicable), unless otherwise specified in the specific contest rules or you have given us your explicit broader consent. If you have registered on the relevant social network using your real name or can be recognized from photos in your account, it cannot be ruled out that you may be identified by other visitors of our account.
When organizing contests, the usual legal basis for data processing is Article 6(1)(b) of the GDPR. If you provide consent for the purpose of participating in a contest, the legal basis for data processing is Article 6(1)(a) of the GDPR. If you have given consent for participation purposes, you may withdraw this consent at any time. The withdrawal will take effect from the moment it is submitted.
Data recipients and categories of data recipients: Data is transferred to third parties only when necessary to organize the contest or send the prize (e.g., when the prize is sent by the contest sponsor or data is passed on to a logistics company), or if you have given us your explicit consent for this purpose. Please note that content from certain social media channels may also be shared directly on publicly accessible websites (for example, in a post or comment), so other users may also see your participation through your interaction with us. In such cases, information about your win may also be visible on the respective account. If you are registered on the respective social network under your real name or can be recognized from photos in your account, it cannot be ruled out that you may be identified by other visitors of our account.
Retention period and criteria for determining the retention period: After the contest ends and winners are announced, participants' personal data is deleted from the contest administration page within two weeks after the prize is sent. In cases where the prizes are tangible items, the winners’ data is retained for the period required by law to fulfill warranty obligations, so the item can be repaired or replaced in case of a defect. If you participate in a contest published on our account (e.g., by posting or commenting), we have no control over cases where your data is deleted by the platform operator. In such cases, the data protection rules of the respective platform operator apply.
When organizing contests, the usual legal basis for data processing is Article 6(1)(b) of the GDPR. If you provide consent for the purpose of participating in a contest, the legal basis for data processing is Article 6(1)(a) of the GDPR. If you have given consent for participation purposes, you may withdraw this consent at any time. The withdrawal will take effect from the moment it is submitted.
Data recipients and categories of data recipients: Data is transferred to third parties only when necessary to organize the contest or send the prize (e.g., when the prize is sent by the contest sponsor or data is passed on to a logistics company), or if you have given us your explicit consent for this purpose. Please note that content from certain social media channels may also be shared directly on publicly accessible websites (for example, in a post or comment), so other users may also see your participation through your interaction with us. In such cases, information about your win may also be visible on the respective account. If you are registered on the respective social network under your real name or can be recognized from photos in your account, it cannot be ruled out that you may be identified by other visitors of our account.
Retention period and criteria for determining the retention period: After the contest ends and winners are announced, participants' personal data is deleted from the contest administration page within two weeks after the prize is sent. In cases where the prizes are tangible items, the winners’ data is retained for the period required by law to fulfill warranty obligations, so the item can be repaired or replaced in case of a defect. If you participate in a contest published on our account (e.g., by posting or commenting), we have no control over cases where your data is deleted by the platform operator. In such cases, the data protection rules of the respective platform operator apply.
Social media listening and monitoring
Purposes and legal bases of data processing:
In order to understand how people perceive our products and services, evaluate our promotional activities, and identify possible improvements, in addition to the information you directly disclose to us by using the platform, we also perform so-called social media “listening” and social media monitoring. For this purpose, posts published on platforms are analyzed based on a search query (e.g., about a new product line) or certain indicators (e.g., number of views or clicks). Only those posts that are published for an unlimited number of people are monitored.
The amount of data collected for this purpose primarily depends on the nature and content of the post; for example, it may be a text-based post or an uploaded photo. In certain cases, a user ID may also be collected and used if necessary — for instance, when “Elesen” would like to offer assistance in resolving a problem. Additionally, we currently receive information from the respective platform operators about the reach of specific posts.
The legal basis for the processing of personal data for social media “listening” purposes is Article 6(1)(f) of the GDPR, as we process your personal data based on our legitimate interest in identifying potential shortcomings of our products and services through publicly available posts and responding accordingly.
Data recipients and categories of data recipients: In cases where we use external data processors for social media “listening” or monitoring, their obligations are defined by contract as stipulated in Article 28 of the GDPR.
Retention period and criteria for determining the retention period: “Elesen” does not permanently store relevant data but instead analyzes it for specific purposes to identify possible corrective actions. For the purpose of annual benchmarking analyses, your data may, if necessary, be additionally retained for up to 2 years, unless you delete your data from the platform earlier.
The amount of data collected for this purpose primarily depends on the nature and content of the post; for example, it may be a text-based post or an uploaded photo. In certain cases, a user ID may also be collected and used if necessary — for instance, when “Elesen” would like to offer assistance in resolving a problem. Additionally, we currently receive information from the respective platform operators about the reach of specific posts.
The legal basis for the processing of personal data for social media “listening” purposes is Article 6(1)(f) of the GDPR, as we process your personal data based on our legitimate interest in identifying potential shortcomings of our products and services through publicly available posts and responding accordingly.
Data recipients and categories of data recipients: In cases where we use external data processors for social media “listening” or monitoring, their obligations are defined by contract as stipulated in Article 28 of the GDPR.
Retention period and criteria for determining the retention period: “Elesen” does not permanently store relevant data but instead analyzes it for specific purposes to identify possible corrective actions. For the purpose of annual benchmarking analyses, your data may, if necessary, be additionally retained for up to 2 years, unless you delete your data from the platform earlier.
Joint controllers under Article 26(1) of the GDPR
The relationship with the following platform operators is subject to Article 26(1) of the GDPR (Joint Controllers):
The legal basis for applying web tracking methods is your consent in accordance with Article 6(1)(a) of the GDPR.
You can learn more about data recipients and categories of data recipients, as well as about the retention period and the criteria used to determine that period, by reading the privacy policies of the respective platform operators. We have no influence over these privacy policies. To learn about the options you have for exercising your rights to prohibit the use of web tracking methods or to withdraw your consent, please refer to the privacy policies of the platform operators provided in section 2 of this policy. Additionally, you can contact the platform operators directly using the contact details provided in the publication section.
We can only partially influence the statistical data provided to us by the platform operator and the ability to disable it. However, we strive to ensure that we do not receive additional, non-essential statistical data.
You should be aware: the platform operator uses your account and behavioral data to analyze your habits, personal connections, and interests. “Elesen” has no control over the data processing or transmission carried out by the platform operator.
- Facebook: https://en-gb.facebook.com/legal/terms/page_controller_addendum
- LinkedIn: https://legal.linkedin.com/pages-joint-controller-addendum
- YouTube: https://policies.google.com/privacy?hl=lt&gl=lt
- LinkedIn: https://www.linkedin.com/legal/privacy-policy
The legal basis for applying web tracking methods is your consent in accordance with Article 6(1)(a) of the GDPR.
You can learn more about data recipients and categories of data recipients, as well as about the retention period and the criteria used to determine that period, by reading the privacy policies of the respective platform operators. We have no influence over these privacy policies. To learn about the options you have for exercising your rights to prohibit the use of web tracking methods or to withdraw your consent, please refer to the privacy policies of the platform operators provided in section 2 of this policy. Additionally, you can contact the platform operators directly using the contact details provided in the publication section.
We can only partially influence the statistical data provided to us by the platform operator and the ability to disable it. However, we strive to ensure that we do not receive additional, non-essential statistical data.
You should be aware: the platform operator uses your account and behavioral data to analyze your habits, personal connections, and interests. “Elesen” has no control over the data processing or transmission carried out by the platform operator.
Data processing in a third country
In cases where we transfer data to recipients located in a third country (outside the European Economic Area), you can find this information in the section on data recipients or categories of recipients, as provided in the description of the relevant data processing activity. The European Commission, through so-called “adequacy decisions,” confirms that certain third countries ensure a level of data protection equivalent to that guaranteed within the European Economic Area. You can view the list of such countries at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions. If a country does not provide an equivalent level of data protection, we take other measures to ensure an adequate level of protection. For example, this may be ensured through binding corporate rules, the European Commission’s decision on standard contractual clauses,
certifications, or approved codes of conduct.
Additionally, when you use the platform, your data may be processed by the platform operator in a third country (outside the European Economic Area). For more information about such third-country data processing, which “Elesen” cannot influence, please refer to the platform operators' privacy policies provided in section 2 of this policy.
Additionally, when you use the platform, your data may be processed by the platform operator in a third country (outside the European Economic Area). For more information about such third-country data processing, which “Elesen” cannot influence, please refer to the platform operators' privacy policies provided in section 2 of this policy.
Your rights as a data subject
Overview
In addition to the right to withdraw any consent you have given us, and subject to the applicable legal conditions, you also have the following rights:
Pursuant to Article 15(1) of the GDPR, you have the right to access your personal data stored by us free of charge. This includes, in particular:
Right to rectification under Article 16 of the GDPR
You have the right to request the correction of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data, including by means of providing a supplementary statement.
Right to erasure under Article 17 of the GDPR
You have the right to request that we erase your personal data without undue delay if one of the following grounds applies:
Right to restriction of processing under Article 18 of the GDPR You have the right to request the restriction of processing when one of the following applies:
You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, and you have the right to transmit those data to another controller without hindrance from us, where:
When exercising your right to data portability, you also have the right to have the personal data transmitted directly from us to another controller, where technically feasible.
Right to object under Article 21 of the GDPR
Where the conditions set out in Article 21(1) of the GDPR are met, you may object to the processing of your data on grounds relating to your particular situation. This general right to object applies to all data processing activities described in this privacy policy that are based on Article 6(1)(f) of the GDPR. In contrast to the specific right to object to data processing for direct marketing purposes, we are only obliged to comply with such a general objection if you provide compelling legitimate grounds, such as a possible risk to life or health. In addition, you may contact the competent supervisory authority or the data protection officer at “Elesen”.
Right to lodge a complaint with a supervisory authority under Article 77 of the GDPR
You also have the right to lodge a complaint at any time with the competent data protection supervisory authority. In Lithuania, you can contact the national supervisory authority – the State Data Protection Inspectorate.
In addition to the right to withdraw any consent you have given us, and subject to the applicable legal conditions, you also have the following rights:
- the right to access your personal data processed by us, in accordance with Article 15 of the GDPR;
- the right to request the rectification of inaccurate or incomplete data, in accordance with Article 16 of the GDPR;
Pursuant to Article 15(1) of the GDPR, you have the right to access your personal data stored by us free of charge. This includes, in particular:
- the purposes for which the personal data is processed;
- the categories of personal data being processed;
- the recipients or categories of recipients to whom your personal data has been or will be disclosed;
- the envisaged period for which your personal data will be stored, or, if precise information is not possible, the criteria used to determine that period;
- the right to request from the controller rectification or erasure of personal data concerning you, or restriction of processing, or to object to such processing;
- the right to lodge a complaint with a supervisory authority;
- where the personal data is not collected from the data subject, any available information as to its source;
- the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the GDPR, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
Right to rectification under Article 16 of the GDPR
You have the right to request the correction of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data, including by means of providing a supplementary statement.
Right to erasure under Article 17 of the GDPR
You have the right to request that we erase your personal data without undue delay if one of the following grounds applies:
- the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
- you withdraw your consent on which the processing is based in accordance with Article 6(1)(a) or Article 9(2)(a) of the GDPR, and there is no other legal ground for the processing;
- you object to the processing pursuant to Article 21(1) or (2) of the GDPR and, in the case of Article 21(1), there are no overriding legitimate grounds for the processing;
- the personal data has been unlawfully processed;
- the erasure of the personal data is required to comply with a legal obligation to which the controller is subject;
- the personal data has been collected in relation to the offer of information society services as referred to in Article 8(1) of the GDPR.
Right to restriction of processing under Article 18 of the GDPR You have the right to request the restriction of processing when one of the following applies:
- you contest the accuracy of the personal data;
- the processing is unlawful and you oppose the erasure of the data and request the restriction of its use instead;
- the controller no longer needs the personal data for processing purposes, but you require it for the establishment, exercise, or defense of legal claims; or
- you have objected to processing pursuant to Article 21(1) of the GDPR, pending the verification of whether the controller’s legitimate grounds override yours.
You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, and you have the right to transmit those data to another controller without hindrance from us, where:
- the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR or on a contract pursuant to Article 6(1)(b) of the GDPR; and
- the processing is carried out by automated means.
When exercising your right to data portability, you also have the right to have the personal data transmitted directly from us to another controller, where technically feasible.
Right to object under Article 21 of the GDPR
Where the conditions set out in Article 21(1) of the GDPR are met, you may object to the processing of your data on grounds relating to your particular situation. This general right to object applies to all data processing activities described in this privacy policy that are based on Article 6(1)(f) of the GDPR. In contrast to the specific right to object to data processing for direct marketing purposes, we are only obliged to comply with such a general objection if you provide compelling legitimate grounds, such as a possible risk to life or health. In addition, you may contact the competent supervisory authority or the data protection officer at “Elesen”.
Right to lodge a complaint with a supervisory authority under Article 77 of the GDPR
You also have the right to lodge a complaint at any time with the competent data protection supervisory authority. In Lithuania, you can contact the national supervisory authority – the State Data Protection Inspectorate.
Contact information
Contact persons for questions or to exercise your data protection rights
If you have questions regarding our social media accounts or wish to exercise your rights related to the processing of your data, you can contact our GDPR department:
Email: info@elesen.lt
Contact persons for data protection inquiries
If you have additional questions about the processing of your data, you can contact our GDPR department: Email: info@elesen.lt
If you have questions regarding our social media accounts or wish to exercise your rights related to the processing of your data, you can contact our GDPR department:
Email: info@elesen.lt
Contact persons for data protection inquiries
If you have additional questions about the processing of your data, you can contact our GDPR department: Email: info@elesen.lt