This Blue Bridge Group of Companies (“BB”, “We”, “Us”, “Our”) Privacy Policy (the “Policy”) governs the processing of data about you (including personal data): collection, use, sharing, storage, etc. As before the General Data Protection Regulation (EU) 2016/679 (hereinafter referred to as “GDPR”) and after its entry into force, we process your data fairly and lawfully. We understand the importance of data security when providing advanced IT solutions and services. Therefore, we ensure the protection and privacy of your data through technical and organisational security measures and in accordance with the GDPR, the Personal Data Protection Act and other legislation.

Our group consists of the following companies (also known as the Blue Bridge group) companies):

UAB “Blue Bridge Baltic” | Company code 302457673| VAT payer code LT100005741113;

UAB “Blue Bridge Code” | Company code 302253877| VAT payer code LT100004460912;

Blue Bridge MSP, UAB| Company code 301489547| VAT payer code LT100003708514;

whose address is J. Jasinskio g. 16A, Vilnius, e-mailinfo@www.bluebridge.lt , tel. No (8 5) 252 6060, website: www.bluebridge.lt.

In most of the cases described in this Policy, each of our companies act as separate data controllers (depending on which of our companies you have a business relationship with, which of our companies you consent to, etc.). However, in certain cases, where we specify separately, all of our Blue Bridge Group companies act as joint data controllers. In such cases, we have an agreement between us setting out our responsibilities for compliance with our obligations under the GDPR (we will make the material provisions of this agreement available to you on written request). You may nevertheless exercise your rights under the GDPR in respect of each of our companies.

We may process your personal data – any data about you (the natural person) whose identity we know or can identify, directly or indirectly.

Our Policy applies to the processing of all personal data that we have received from you or from other persons on lawful grounds. For example, in cases where:

you have a business relationship with us; or

you are applying for a vacancy we have advertised; or

contacting us with enquiries, subscribing to our newsletters, etc.

We may also process your personal data in other cases and for other purposes not covered by this Policy, but in any case you will be informed about the processing of your personal data in accordance with the procedure established by law.

Please note that the provision of your personal data is usually voluntary, but is necessary in order for us to be able to fulfil our obligations, respond to your enquiries, enable you to apply for vacancies offered by us, etc., as described in this Policy.

Please make the information contained in this Policy known to your current or future representatives (persons who represent you in your relationship with us if you are, for example, our customer or supplier), as well as to other persons who may be affected by this notice as a result of you providing us with their personal data.

We process your personal data to the extent necessary for the purposes set out by us.

We have categorised all the personal data we process into different categories, taking into account the stated purposes of the processing and the categories of data subjects. Specific information on the purposes of the processing, the specific personal data processed, the legal basis for the processing, and the data retention periods are set out in the relevant tables below.

1. Processing of personal data of clients (including prospects) and partners’ employees (or representatives) for the purposes of internal administration, the conclusion of contracts and the proper performance of BB contracts/obligations.

Personal data	The following personal data is processed for clients and partners’ employees (or representatives): name, surname, workplace, work email address and work telephone number, and information about the competence of partners’ employees.
Legal basis for the treatment	We process the data on the basis of Our legitimate interest to conclude and properly perform contracts with customers or partners (Article 6(1)(f) GDPR).
Storage period	We retain personal data for a period of 10 (ten) years, but in any case not less than (1) the end of the relevant contract with the client or partner; or (2) the end of the period of time required by the relevant legislation applicable to the storage/archiving of documents.
Data source	The personal data of an employee (or representative) of a Client or Partner is obtained from his/her employer or another person (Client, Partner) on whose behalf the representative is acting.

2. Processing of personal data of candidates for vacancies advertised by BB for the purpose of selecting the most suitable candidates for recruitment, and subsequently, with your consent, for the purpose of compiling BB’s database of

Personal data	The following personal data of candidates shall be processed: name, surname, telephone number, e-mail address, employment data, work experience, former employment data and position, education, qualifications, skills, information on the possession of a driver’s licence, hobbies, additional information voluntarily provided in the candidate’s curriculum vitae, data obtained during the selection process of the candidate (assessment of candidate).
Legal basis for the treatment	Your consent, which may be expressed by submitting your CV to us or otherwise applying for a vacancy, or by giving separate consent to be included in our database of candidates (Article 6(1)(a) GDPR). Data from your former employer is obtained on the basis of a legitimate interest in receiving information about the candidate from his/her former employer (Article 6(1)(f) GDPR).
Storage period	For the purpose of maintaining a database of candidates, we keep personal data for 5 (five) years. Where a candidate does not consent to the processing of his/her personal data after the selection for the position applied for, we will process his/her data until the end of the selection for the position applied for.
Data source	The personal data of a potential candidate are obtained from the candidate himself or herself, as well as from third parties, such as the candidate’s former employer’s representative.

When applying for a vacancy, you are informed that we have the right to contact the former employer you have indicated in order to obtain information from him/her regarding your qualifications, professional skills and personal qualities. By providing your former employer’s contact details, you should inform him/her that you are providing such details to us and that we may contact him/her for the purposes of your selection.

3. Processing of data of persons who have given their consent to direct marketing for the purposes of direct marketing (including sending newsletters).

BB’s direct marketing includes sending newsletters, offering BB services over the phone, offering to participate in our events and other direct marketing activities.

Personal data	Personal data processed (depending on the data provided and the data consented to): name and surname, telephone number, email address, workplace data including workplace address, date of birth.
Legal basis for the treatment	We process the data on the basis of your consent (Article 6(1)(a)) or, under the conditions provided for by law, our legitimate interest in offering similar goods and services (Article 6(1)(f)). You always have the opportunity to withdraw your consent or object to the use of your data for direct marketing purposes as described later in this Policy.
Storage period	We store personal data for 2 (two) years.
Data source	Personal data comes from the data subjects themselves.

4. Processing of personal data of persons who make enquiries to us using the functionalities available on the website (or by email) for the purpose of administering and responding to enquiries.

Personal data	The following personal data of the persons who send us enquiries are processed: name, surname (if indicated by the data subject), name of the company, e-mail address, telephone number, content of the message submitted.
Legal basis for the treatment	We process your data on the basis of your consent (Article 6(1)(a)). The person making the enquiry consents to the processing of his or her personal data processing in accordance with this Policy.
Storage period	We store personal data for 3 (three) years.
Data Source	Personal data comes from the data subjects themselves.

5. Processing of data of persons visiting our data centre and office (only with a designated employee) for the purpose of protecting our clients’ assets (including sensitive information).

Personal Data	The following data is processed for persons visiting our data centre and certain premises of our office: image data of persons entering the surveillance area of security cameras.
Legal basis for the treatment	We process data on the basis of a legitimate interest to protect our clients’ assets (including sensitive information) (Article 6(1)(f)).
Storage period	We keep the data for 7 (seven) days.
Data source	Personal data is obtained from the data subjects themselves (when they enter the surveillance field of security cameras).

6. Processing of personal data of persons calling the Blue Bridge MSP, UAB Helpdesk in order to control the quality of the telephone service and to ensure the provision and quality of contractual services.

Personal data	Personal data provided during a telephone conversation is processed.
Legal basis for the treatment	We process the data on the basis of our legitimate interest in the proper performance of our contracts with our customers and to ensure the quality of our service (Article 6(1)(f) GDPR).
Storage period	We store data for 3 (three) months.
Data source	Personal data is obtained from the data subjects themselves (by providing it to them during the call).

7. Processing of personal data of customers (or their representatives) who have provided feedback on our services for the purposes of quality assurance and service quality improvement.

Personal data	Customer (or customer representative) data is processed: name, surname, company name, and comments left freely by the customer.
Legal basis for the treatment	We process data on the basis of consent (Article 6(1)(a)), which may be expressed, for example, by completing various questionnaires or surveys.
Storage period	We store personal data for 2 (two) years.
Data source	Personal data comes from the data subjects themselves.

We do not process special categories of your personal data, i.e. data relating to your racial or ethnic origin, political, religious, philosophical or other beliefs, trade union membership, health, sex life, or criminal record.

We may only disclose your personal data on a lawful basis (e.g. where required to do so by law, by contract, or where we have your individual consent). Such disclosures will be made in accordance with applicable laws and regulations.

Your Personal Data may be provided to:

our responsibly selected service providers who provide IT maintenance and administration services, provide and administer the applications and systems we use (e.g. financial accounting software), provide customer survey (feedback) services, and provide other necessary services (data processors who process personal data on our instructions);

For Group BB companies;

in cases provided for by law, by law enforcement and supervisory authorities, as well as by other state and municipal authorities, in compliance with legal requirements;

bailiffs, courts and other dispute resolution bodies;

to other third parties where you have made an appropriate request for your personal data, or to third parties of which you are otherwise explicitly notified and/or consent is obtained and the provision of information is agreed in the context of a particular service;

audit and related services companies, legal and financial advisory services providers;

other business entities, mergers of BB companies with another legal entity or in the case of an acquisition, including the rights of the persons carrying out the inspection.

Please note that BB may use data processors who operate and may process your data in third countries.

Where we transfer personal data outside t h e European Economic Area, we will ensure that the personal data is adequately protected and that the transfer complies with the GDPR. In such cases, we will transfer personal data to countries for which the European Commission has issued an adequacy decision, or we will ensure and implement an adequate level of protection of personal data through the use of standard contractual clauses, other documents or measures in accordance with GDPR.

We take appropriate technical and organisational measures to ensure the protection of your personal data against accidental or unlawful destruction, alteration or disclosure.

We do not keep your personal data for longer than the purposes of processing the personal data require (for specific retention periods of personal data, please refer to the section above in this Policy entitled “What personal data do we process, for what purposes and on what grounds?“).

Please note that in certain cases, a longer retention period or the right to retain personal data longer may be provided for by law, e.g. where processing is necessary in order to comply with the legal requirements applicable to us that require us to process the data, or where processing is necessary for the establishment, exercise or defence of legal claims.

In this case, we may process your personal data for a longer period of time, but only to the extent necessary for these purposes. Such personal data will be deleted as soon as it is no longer necessary.

As a data subject, you have all the rights provided for in the applicable law, including the following:

• the right to withdraw consent to the processing of personal data at any time, without prejudice to the lawfulness of the processing of personal data based on consent carried out before the withdrawal of consent. You may do so by contacting us using the contacts set out in this Policy or by using other functionalities provided by us (e.g. the unsubscribe functionality in the emails we send);
• the right to request access to their personal data. You can have access to your personal data that we process. You can get information about how it is collected, how long your data is stored and who receives data about you and to what extent. However, your right of access may be limited by law;
• the right to have personal data rectified. You can request that we rectify personal data we process about you if it is incorrect, inaccurate or incomplete;
• the right to disagree. You have the right to object to the processing of your personal data in certain circumstances, including where the processing of your data is based on legitimate interest. You also have the right to object to our use of your data for direct marketing purposes (only when and if we process your data for these purposes);
• the right to request the restriction of the processing of personal data. If you believe that the processing of your personal data is incorrect or if you object to the use of the data, you can request that we restrict the use of the data to storage only. The use will be limited to storage until the correctness of the data has been established or it has been verified that our legitimate interests outweigh your interests;
• the right to have personal data erased. If your personal data is processed unlawfully, if you object to such processing of your personal data, or if there are other grounds provided for by law, you have the right to have the data erased, subject to the restrictions provided for by law;
• the right to data portability. You have the right to receive the personal data relating to you that you have provided to us in a structured, commonly used and computer-readable format and to request the transfer of (transfer) that data to another controller, in accordance with the procedure provided for by law.

In all of the above cases, if you wish to exercise your rights, you should submit your request toinfo@bluebridge.lt (for candidates – cv@bluebridge.lt) or to J. Jasinskio 16A, Vilnius. We undertake that a reply will be provided no later than 1 (one) month from the date of receipt of the request, except for the exceptions provided for in the legislation, where an extension of the time limit for the reply is possible.

You will need to provide proof of your identity when requesting rights relating to the processing of personal data (e.g. you must sign your request by electronic means, sign it with an electronic signature if you apply to us in person or by post if you send your request by post, or provide an identity document or a copy certified in accordance with the procedure provided for by law).

Please note that we may not allow you to exercise your rights in cases provided for by law, where it is necessary to ensure national security or defence, public order, prevention, investigation, detection or prosecution of criminal offences, important economic or financial interests of the State, prevention, investigation and detection of breaches of professional or professional ethics, protection of your rights and freedoms or the rights and freedoms of other persons.

Please also note that the above rights are not absolute and their exercise may be subject to the conditions set out in the applicable data protection legislation.

If you believe that the processing of the personal data you have provided does not comply with applicable law, you have the right to contact the State Data Protection Inspectorate (www.ada.lt), but please always contact us first.

We would like to inform you that www.bluebridge.lt uses cookies on its website. We use cookies for the purposes of website traffic statistics, marketing and functionality.

1. What is a cookie?

A cookie is a small text file or piece of software sent to y o u r device that stores information related to your browsing history and a collection of data about your device’s internet usage. It is controlled by your web browser and sometimes has a unique random number. You can read it, delete it or change it.

2. Why do we use cookies?

We are always looking for new ways to improve our website and offer better services. That’s why we use the section “6. What type of cookies are used?” the different types of cookies described below.

For the use of functional cookies and the provision of services. Cookies are essential for the functioning of the website and electronic services and ensure a smooth user experience. For example, if the user so requests, he/she does not need to enter his/her name, password or any other data each time he/she logs in.

For service development. By monitoring the use of cookies, we can improve the performance of the website and electronic services. We receive information such as which parts of the website are most popular, which websites you access from our website, from which websites you access our website and how much time you spend on our website.

For use in analysis. Cookies are used to collect statistical data on the number of visitors to the website and the use of electronic services and to evaluate the effectiveness of advertising. Information may be collected, for example, from emails and newsletters sent for marketing purposes, in order to find out whether the emails have been opened and whether they have prompted users to take any action, for example, whether the user has clicked on a link to our website contained in the email.

For targeted marketing. We may also use cookies to collect information in order to provide browser-specific advertising or content by creating different target groups.

3. How do we inform you about the use of cookies?

The first time you access the website, you will receive a message containing a link “Find out more”, which links to the part of the website where all the information about the cookies installed and used on this website. In any case, cookies are controlled by you. You can therefore refuse them or delete (delete, disable) them at any time.

1. What type of cookies are used?

Our websites are periodically scanned with special scanners and, depending on the results, the cookie list is updated. There are the following categories of cookies:

• Mandatory cookies;
• Provision cookies
• Analytics;
• Marketing.

You can opt out of each category of cookies (except essential cookies) by clicking on “Cookie settings” on the website.

This Policy (v.2) is effective from 22 September 2023. We also have the right to update this Policy at any time. The updated Policy will be published on our website and will be effective from its publication.

This Policy shall be governed by the law of the Republic of Lithuania. Any disagreements regarding the implementation of this Policy shall be settled by negotiation. In the event of failure to reach an agreement, disagreements shall be settled in accordance with the procedure established by the laws of the Republic of Lithuania.

If you have any questions, complaints or require our assistance in interpreting or applying the Policy, please contact us at the contact details set out in this Policy.