Privacy Policy

1. GENERAL INFORMATION

• Investment Broker, UADBB (hereinafter referred to as the “Company” or “Data Controller”) sets forth in this Privacy Policy (hereinafter referred to as the “Privacy Policy”) sets forth the terms and conditions for the processing of personal data when using the website administered by the Company and the insurance brokerage services provided therein.
• Contact information for the data controller:
  UADBB Investment Broker
  Legal Entity Code: 300665316
  Business address: 25 Algirdo St., LT-03219 Vilnius
  Email: infodraudimopatarimai.lt
• This Privacy Policy applies every time you use the website and the services provided on it, regardless of the device you use (computer, mobile phone, etc.). Please read this Privacy Policy carefully. If you do not agree to its terms, please do not use the website or the services provided on it.
• Individuals under the age of 16 may not provide any personal data through our website. If you are under 16 years of age, you must obtain consent from your parents or other legal guardians before submitting any personal information.
• When processing personal data, the Data Controller is guided by and complies with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the GDPR), the Law on the Legal Protection of Personal Data of the Republic of Lithuania, and other applicable laws and regulations governing the protection of personal data.
• In providing its services, the Company uses a technological platform administered by a third party—an IT service provider (hereinafter referred to as the “Processor”). The Contractor acts as a data processor and processes personal data on behalf of the Company to the extent necessary to ensure the operation of the platform.
• The terms used in this Privacy Policy are to be understood as defined in the GDPR

2. DATA PROCESSING PRINCIPLES

The Company adheres to the following principles when processing personal data:

• Personal data is processed lawfully, fairly, and transparently in relation to the data subject;
• Personal data is collected for specified, explicit, and legitimate purposes and is not further processed in a manner incompatible with those purposes;
• only personal data that is adequate, relevant, and necessary for the purposes for which it is processed shall be processed;
• personal data is accurate and, where necessary, kept up to date;
• Personal data shall be stored in a form that allows the identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed;
• Personal data is processed in such a way as to ensure its security, including protection against unauthorized or accidental destruction, loss, alteration, disclosure, or access;
• The company is responsible for ensuring that these principles are implemented and must be able to demonstrate this.

3. INFORMATION COLLECTED ABOUT YOU AND THE USE OF COLLECTED INFORMATION

The company processes the data of the following individuals:

• people who use the website and are looking to receive insurance quotes;
• customers who have entered into or have previously entered into insurance contracts;
• individuals who contact the Company for information or advice;
• other individuals whose data is provided for the purposes of concluding or performing an insurance contract.

Other information collected:

• The company may also collect other information about you, your device, or your use of the content on the www.draudykle.lt website with your consent.
• The company may use automated decision-making, including profiling, to provide you with personalized insurance offers, assess insurance risk, and determine the amount of your insurance premium.

Categories of data processed:

Depending on the services provided, the Company may process the following categories of personal data:

• identification information (first name, last name, personal identification number, date of birth, and details of the identification document);
• contact information (phone number, email address, home address);
• information about the insured property (e.g., vehicle information—license plate number, VIN code, technical specifications; real estate information—address, area, intended use; data on other insured property or risks);
• data necessary for assessing insurance risk (e.g., length of driving experience, history of traffic accidents and claims, compliance indicators, nature of use of the object, and life or business circumstances that may affect the insurance risk);
• financial and payment data (bank account number, payment details, payment history);
• information about insurance contracts that have been concluded or are currently in force (insurance period, sum insured, covered risks, insurance premiums);
• communication data (content of correspondence, inquiries, complaints, call recordings, where applicable);
• technical data (IP address, browsing data, cookie information, device data);
• special categories of personal data (e.g., health data) when necessary for the provision of life, health, or other related insurance products or for the conclusion of contracts. Such data is processed only with the explicit consent of the data subject or on another legal basis established by law.
• other data that you provide when using the website, that we obtain from insurance companies or other relevant sources, or that is necessary for the provision of services.

If personal data is transferred outside the European Economic Area, the Company ensures that such transfers are carried out in accordance with the requirements of the GDPR, using appropriate safeguards, such as the standard contractual clauses approved by the European Commission or other lawful grounds for transfer.

Sources of data:

Personal data is typically obtained:

• directly from you, when you submit data on the website or contact the Company;
• from insurance companies, when necessary for the submission of insurance quotes or the performance of a contract;
• from state registries and information systems, where permitted by law;
• from other third parties involved in the provision of insurance services;
• from technical and browsing data (e.g., IP address, browser type, device information, cookie data) that is collected automatically when you use the website.

Purposes of data processing:

Personal data is processed for the following main purposes:

• submitting insurance quotes, comparing them, and selecting the most suitable one;
• for assessing insurance risk and calculating insurance premiums;
• the conclusion, performance, and administration of insurance contracts;
• for communicating with customers, reviewing inquiries, providing consultations, and sharing information;
• for the administration of payments and the processing of settlements;
• to comply with legal obligations, including requirements arising from legislation governing insurance activities;
• fraud prevention, risk management, and security;
• for the resolution of disputes, the assertion, enforcement, and defense of legal claims;
• to improve service quality, ensure system performance, and for analytics and statistics;
• for direct marketing purposes, provided we have obtained your consent.

4. LEGAL BASIS FOR DATA PROCESSING

The company processes personal data on the following legal grounds:

• Sutarties vykdymas ir veiksmai prieš sudarant sutartį (Article 6(1)(b) of Regulation (EU) 2016/679 (GDPR)). Personal data is processed for the purposes of taking steps prior to entering into an insurance contract, providing insurance quotes, assessing insurance risk, calculating the insurance premium, as well as concluding and performing insurance contracts.
• Teisinės prievolės vykdymas (Article 6(1)(c) of the GDPR). Personal data is processed for the purpose of complying with legal obligations, including the requirements of laws governing insurance activities, financial accounting, taxation, anti-money laundering and counter-terrorist financing, and other applicable requirements.
• Teisėti Bendrovės interesai (Article 6(1)(f) of the GDPR). Personal data may be processed for the purposes of the Company’s legitimate interests, including improving and developing the quality of services, ensuring system security, and preventing fraud, resolving disputes, asserting, exercising, and defending legal claims, as well as for internal analysis, statistics, and operational improvement. When processing data on this basis, we ensure that the rights and interests of the data subject are not infringed.
• Duomenų subjekto sutikimas (Article 6(1)(a) of the GDPR). In some cases, personal data is processed based on the data subject’s consent, for example, for direct marketing purposes or in other cases where consent is required by law. The data subject has the right to withdraw their consent at any time.
• Specialių kategorijų duomenys (Article 9(2)(a) of the GDPR and other applicable legal bases). Special categories of personal data (e.g., health data) are processed only where necessary for the provision of insurance services, and only with the explicit consent of the data subject or on another lawful basis provided for in Article 9 of the GDPR, including where the processing is necessary for the establishment, exercise, or defense of legal claims.

5. DATA RECIPIENTS

The company may transfer personal data to the following recipients:

• Draudimo bendrovėms. Personal data is transferred to insurance companies for the purpose of providing insurance quotes, assessing insurance risks, and concluding and executing insurance contracts.
• Paslaugų teikėjams (duomenų tvarkytojams). The Company may transfer personal data to service providers that provide IT, system maintenance, hosting, data storage, or other services related to the provision of our services. Such service providers process personal data on behalf of the Company and only to the extent necessary to perform the services they provide.
• Valstybės institucijoms ir kitiems subjektams. Personal data may be disclosed to government agencies, regulatory authorities, or law enforcement agencies when required by law or when necessary to comply with legal obligations.
• Kitiems gavėjams. Personal data may be disclosed to other parties when necessary for the performance of a contract, the assertion or defense of legal claims, or with the data subject’s consent.

6. RETENTION PERIODS FOR PERSONAL DATA

• Personal data is retained for no longer than is necessary to fulfill the purposes for which it was collected and processed, and in accordance with the retention periods established by law. When determining retention periods, we take into account the purposes of data processing, applicable legal requirements, and the need to assert, exercise, or defend legal claims. Upon expiration of the retention period, personal data is destroyed or irreversibly anonymized.

7. DIRECT MARKETING

• The company may process your personal data for direct marketing purposes in order to provide you with offers for insurance products, reminders about expiring insurance policies, personalized offers, and other information related to the services provided.
• Personal data is processed for direct marketing purposes only with your consent (Article 6(1)(a) of the GDPR) or on other grounds provided for by law.
• You have the right to object at any time to the processing of your personal data for direct marketing purposes, including profiling related to such marketing. You can opt out by clicking the opt-out link in the message you received or by contacting the Company using the contact information provided in this Privacy Policy.
• If you opt out of direct marketing, your data will no longer be processed for this purpose; however, this will not affect other processing of your personal data based on other legal grounds.

8. YOUR RIGHTS

A data subject whose data is being processed has the following rights:

• the right to know (be informed) about the processing of your personal data;
• the right to access your personal data;
• the right to request the correction of inaccurate data or the completion of incomplete data;
• the right to request the erasure of data (“the right to be forgotten”);
• the right to restrict the processing of data;
• the right to data portability;
• the right to object to the processing of your data, including for direct marketing purposes;
• the right to lodge a complaint with the State Data Protection Inspectorate or another supervisory authority.

If you wish to exercise your rights, you may contact UAB Draudykle by email infodraudykle.ltThe operator undertakes to respond to your request no later than one month from the date of receipt, except in cases where the law permits an extension of this deadline.

9. COMPLAINTS AND INQUIRIES

• If you have any questions, comments, or complaints regarding the processing of your personal data, you can contact us using the contact information provided in this Privacy Policy.
• The Company strives to resolve all issues and disputes promptly and amicably; therefore, we encourage you to contact the Company directly first.
• If you believe that your personal data is being processed in violation of legal requirements, you have the right to file a complaint with the State Data Protection Inspectorate (www.ada.lt) or to another supervisory authority in the European Union member state where you have your permanent residence or place of work.

10. FINAL PROVISIONS

• Personal data is protected against loss, unauthorized use, and alteration. We have implemented physical and technical measures to protect all information we collect for the purpose of providing our services. Please note that, although we take appropriate measures to protect your information, no website, online transaction, computer system, or wireless connection is completely secure, and therefore you assume the risks associated with data transmission.
• The Company reserves the right to update or amend this Privacy Policy at any time to ensure its compliance with applicable laws, changes in business operations, or technological developments. The updated Privacy Policy is published on the Company’s website and takes effect upon publication, unless otherwise specified.
• We recommend that you review this Privacy Policy periodically to stay up to date with the latest version.