Procedure for exercising the rights of data subjects

UAB AUTOCOM LT

PROCEDURE FOR IMPLEMENTATION OF THE RIGHTS OF DATA SUBJECTS

1. GENERAL PROVISIONS

1. UAB Autocom LT for the Implementation of the Rights of Data Subjects, legal entity code 302482395, registered office at Savanorių pr. 129, Vilnius Republic of Lithuania (hereinafter – the Company) procedure (hereinafter – the Procedure) the purpose of which – to determine the principle of the procedure for the implementation of the rights of data subjects in the Company.

2. In implementing the data subject’s rights based on the Regulation (EU) 2016/679 of 27 April 2016 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter – the Regulation (EU) 2016/679) and the Law on Legal Protection of Personal Data of the Republic of Lithuania.

3. The terms used in the procedure correspond to the terms used in Regulation (EU) 2016/679.

4. The rules are prepared in accordance with Regulation (EU) 2016/679.

2. RIGHT TO RECEIVE INFORMATION ABOUT DATA PROCESSING

1. Information on the Company’s processing of the data subject’s personal data, referred to in Articles 13 and 14 of Regulation (EU) 2016/679, is provided orally at the time of receiving personal data, or in writing at the time of receiving personal data, or on the Company’s website www.autocom.lt, www.autocomcarrental.com in the Privacy Policy published in the mobile application “Autocom Go”.
   

2. Information on the processing of personal data of data subjects is provided at the time of receiving personal data.

3. When the personal data of the data subject is not collected directly from the data subject, the processing of personal data of this data subject is informed:

1. within a reasonable period of time from the receipt of personal data, but no later than within 1 (one) month, taking into account the specific circumstances of personal data processing;

1. if personal data will be used to maintain contact with the data subject - no later than the first contact with that data subject; or

2. if it is planned to disclose personal data to another data recipient - no later than when the data is disclosed for the first time.

3. RIGHT OF ACCESS TO DATA

1. The data subject must be given the right to get acquainted with the personal data collected about them and the opportunity to use that right easily and at reasonable intervals, so that the data subject knows about the processing of personal data and can verify its legality. Each data subject has the right to know and be informed, first of all, about the purposes for which personal data is processed and, if possible, during which period it is processed, who are the recipients of the data.

2. At the request of the data subject, the Company must provide:

1. information on whether the personal data of the data subject is processed or not;

2. information related to the processing of personal data provided for in paragraphs 1 and 2 of Article 15 of Regulation (EU) 2016/679, if the personal data of the data subject is processed;

3. a copy of the processed personal data.

3. The data subject has the right to request that a copy of the processed personal data be provided to them in a form other than the one provided by the Company, but a fee calculated according to administrative costs is charged for this.

3. RIGHT TO DEMAND CORRECTION OF DATA

1. Pursuant to Article 16 of Regulation (EU) 2016/679, the data subject has the right to demand that any of their processed inaccurate personal data to be rectified and incomplete data to be supplemented.

2. In order to make sure that the processed data subject’s personal data is inaccurate or incomplete, the Company may ask the data subject to provide evidence confirming this.

3. If the personal data of the data subject (corrected at the request of the data subject) has been transferred to the data recipients, the Company informs these data recipients about this, unless it is impossible or requires disproportionate efforts. The data subject has the right to request information about such data recipients.

3. RIGHT TO REQUEST THE DELETION OF DATA (“RIGHT TO BE FORGOTTEN”)

1. The data subject’s right to delete their personal data (“right to be forgotten”) is implemented in the cases provided for in Article 17 of Regulation (EU) 2016/679.

2. The data subject’s right to delete their personal data (“right to be forgotten”) may not be implemented in the cases provided for in paragraph 3 of Article 17 of Regulation (EU) 2016/679.

3. If the personal data of the data subject (deleted at the request of the data subject) has been transferred to the data recipients, the Company informs these data recipients about this, unless it is impossible or requires disproportionate efforts. The data subject has the right to request information about such data recipients.

3. RIGHT TO LIMIT DATA PROCESSING

1. In the cases provided for in paragraph 1 of Article 18 of Regulation (EU) 2016/679, the Company must implement the data subject’s right to restrict the processing of their personal data.

2. Personal data, the processing of which is restricted, is stored, and before such restriction is lifted, the data subject is informed by means of electronic communications.

3. If the personal data of the data subject (the processing of which is restricted at the request of the data subject) has been transferred to the data recipients, the Company informs these data recipients about this, unless it is impossible or requires disproportionate efforts. The data subject has the right to request information about such data recipients.

3. RIGHT TO DATA PORTABILITY

1. In exercising their right to personal data portability, the data subject has the right to have personal data directly transferred by one data controller to another, when technically possible.

2. The data subject has the right to receive the personal data related to them that they have provided to the Company in a structured, commonly used and computer-readable format, and has the right to forward that data to another data controller, and the data controller to whom the personal data has been provided must not create obstacles when:

1. data processing is based on consent or contract;

1. data is processed by automated means.

3. The data subject does not have the right to data portability in relation to personal data that is processed manually in systematised files, such as paper files.

4. Personal data may be submitted online or recorded on a CD, DVD or other data medium. The Company may provide personal data using open formats such as XML, JSON, CSV, together with appropriate meta data.

5. If the transferred personal data contains data of third parties, in order to avoid a negative impact on their interests, the Company may transfer personal data only when it is under the exclusive control of the data subject whose request is being processed and only for personal or household needs.

6. When applying for the right to data portability, the data subject must indicate whether they wish for their personal data to be forwarded to them or another data controller.

7. When fulfilling the data subject’s request, only the data related to the data subject and submitted to the data controller and only those processed by the Company are transferred. The scope of this right does not include personal data obtained after processing and analysis of information provided directly by the data subject, as well as fixed data, such as a user profile created on the basis of analysed data.

8. The data subject has the right to exercise their right to the portability of personal data without affecting any other right (this also applies to any other rights provided for in the General Data Protection Regulation). The data subject can continue to use the services provided by the Company and take advantage of its advantages even after the personal data transfer operation.

9. According to the data subject’s request for transfer, their personal data is not automatically deleted. If the data subject so wishes, they must apply to the data controller for the implementation of the right to demand deletion of data (“right to be forgotten”).

3. RIGHT TO OBJECT TO DATA PROCESSING

1. The data subject, in accordance with Article 21 of Regulation (EU) 2016/679, has the right to object to the Company processing their personal data at any time for reasons related to them in a specific case:

1. when personal data is processed for direct marketing purposes; direct marketing is considered an activity that is intended to directly offer goods or services to individuals and/or ask for their opinion on the offered goods or services;

1. when processing personal data is necessary for the legitimate interests of the data controller or a third party.

2. If the data subject expresses disagreement with the processing of personal data, such processing is carried out only if it is reasonably decided that the reasons for the processing of personal data are superior to the interests, rights and freedoms of the data subject, or if the personal data is necessary to claim, execute or defend legal claims.

8. RIGHT TO REQUEST FOR A DECISION NOT BASED ONLY ON AUTOMATED DATA PROCESSING, INCLUDING PROFILING

1. The data subject, in accordance with Article 22 of Regulation (EU) 2016/679, has the right to demand that a decision based solely on automated data processing is not applied to them and that such a decision be reviewed if it has legal consequences for the data subject or similarly has a significant impact on the data subject .

2. The data subject’s right to request for non-application of automated data processing is limited to the cases provided for in paragraph 2 of Article 22 of Regulation (EU) 2016/679.

3. The data controller, who applied to the data subject for the review of the decision based on automated data processing, must carry out a detailed evaluation of all relevant data, including the information provided by the data subject.

8. SUBMISSION OF A REQUEST TO IMPLEMENT THE RIGHTS OF THE DATA SUBJECT

1. The data subject has the right to apply for the implementation of the data subject’s rights in writing, by submitting a request in person, by mail or by electronic means to the data protection officer at info@AutocomLT.lt, or at the address of the Company’s headquarters.

2. In order to ensure the confidentiality established by paragraph 5 of Article 38, of Regulation (EU) 2016/679, when contacting the data protection officer by post, it is written on the envelope that the correspondence is addressed to the data protection officer.

3. The request to exercise the data subject’s rights must be legible, signed by the person, it must contain the name, surname, address and/or other contact details of the data subject to maintain communication or to receive an answer regarding the exercise of the data subject’s rights.

4. If the request for the exercise of the data subject’s rights is submitted in writing in person, the data subject must confirm his or her identity by submitting an identity document. If this is not done, the data subject’s rights are not enforced. This provision does not apply if the data subject applies for information about the processing of personal data in accordance with Articles 13 and 14 of Regulation (EU) 2016/679.

5. If a request is made in writing regarding the implementation of the data subject’s rights, a copy of the personal identity document must be submitted together with the request by mail. This provision does not apply if the data subject applies for information about the processing of personal data in accordance with Articles 13 and 14 of Regulation (EU) 2016/679.

6. The data subject can exercise their rights themselves or through a representative. If the request is submitted through a representative – depending on the method of submission of the request, in addition to the above-mentioned documents, the representative must indicate their name, surname, address and/or other contact details for communication, via which the person’s representative wishes to receive an answer and submit a document confirming the representation (or a copy of the power of attorney approved in accordance with the procedure established by the legal acts).

7. In case of doubt about the identity of the data subject, the data controller requests additional information necessary to be sure of it. The Company must make reasonable efforts to determine the identity of the person who submitted the request for access to personal data, as sanctions may be applied for unauthorised disclosure of personal data to third parties.

8. When applying in writing for the implementation of the data subject’ rights, it is recommended to submit a request in the form specified in Annex 1 of the Procedure.

8. EXAMINATION OF THE REQUEST TO IMPLEMENT THE RIGHTS OF THE DATA SUBJECT

1. Upon receipt of the data subject’ request, no later than within 1 (one) month from the receipt of the request, they are provided with information on what actions were taken based on the received request. If there will be a delay in providing information, the data subject is informed about it within the specified deadline, indicating the reasons for the delay and the possibility of filing a complaint with the State Data Protection Inspectorate.

2. If the request is submitted without complying with the procedure and requirements set out in Chapter 10 of the Procedure, it will not be processed, and the data subject shall be informed of this immediately, but no later than within 5 (five) working days, stating the reasons.

3. The data controller should be obliged to respond to the requests of the data subject without undue delay and no later than within 1 (one) month and to indicate the reasons when they do not intend to satisfy any such requests.

4. This period can be extended by another 2 (two) months if necessary, depending on the complexity and number of requests. In such a case, it is mandatory to inform the Data Subject in writing about such an extension and indicate the reasons for the delay within 1 (one) month from the receipt of the request.

5. If it is decided not to take action based on the data subject’s request, it is mandatory to inform the data subject in writing about the reasons for inaction (e.g., the person making the request did not specify their identity) and about the possibility of filing a complaint with the supervisory authority immediately, but no later than within 1 (one) month after receiving the request. It is mandatory to properly inform the data subject about the refusal to comply with their request.

6. If, during the examination of the request, it is determined that the data subject’s rights are limited on the grounds provided for in paragraph 1 of Article 23 of Regulation (EU) 2016/679, the data subject shall be informed thereof.

7. The information requested by the data subject about the processing of personal data is provided in the same form as the data subject’s request was received (unless the data subject themselves requested it to be provided in a different way), i.e., if the request is submitted by electronic means (e.g., e-mail), the information is submitted in a commonly used electronic form. Information according to the data subject’s request regarding the exercise of their rights is provided in the national language.

8. The provision of information and notifications and other actions related to the exercise of the rights of data subjects are carried out free of charge, except in cases where the data subject’s requests are clearly unreasonable or disproportionate, primarily due to their repetitive nature, in which case the Company may charge a reasonable fee for the provision of information or notification or the performance of the requested actions (in this case, the data subject is informed about the determined amount of remuneration and the payment procedure for the provision of data) or refuse to take actions according to the request. The amount of the fee must not exceed the cost of providing information or notification or performing actions. The amount of the fee is determined and approved by the Company taking into account the labour and material costs required to provide the information or notification or to perform the actions.

9. Whether a request is obviously unreasonable or disproportionate must be assessed on a case-by-case basis. If the data subject’s request is clearly unfounded or disproportionate, the obligation to prove it rests with the Company.

10. In cases where the Company processes a very large amount of personal data, a request to provide information on all processed personal data for the entire period of processing may be considered disproportionate. However, even after receiving a disproportionate request, first of all, it is recommended to ask the data subject to clarify it, indicating the reason why it is necessary for the data subject to receive such a large amount of information, and if there is no such reason - to narrow the scope of the requested personal data.

11. The data subject has the right to complain about the company’s actions or inaction in implementing the data subject’s rights themselves or the data subject’s representative, as well as their authorised non-profit institution, organisation or association that meets the requirements of Article 80 of Regulation (EU) 2016/679, to the State Data Protection Inspectorate, L. Sapiegos st. 17, Vilnius, e-mail address ada@ada.lt, website www.ada.lt, as well as to the competent court.

12. In case of material or non-material damage due to the violation of the data subject’s rights, the data subject has the right to compensation, for the award of which they have the right to apply to the court competent to hear such disputes.

Procedures for the implementation of data subject rights

Annex 1

___________________________________________

(Data subject name, surname)

______________________________________________________________________________________

(Address and (or) other contact details (telephone number or e-mail address (provided at the request of the applicant)

______________________________________________________________________________________

(Representative and basis for representation, if the request is submitted by a representative of the data subject)

UAB Autocom Lt

Legal entity code: 302482395

Address: Savanorių pr.129, Vilnius, Republic of Lithuania

REQUEST

TO IMPLEMENT THE RIGHTS OF THE DATA SUBJECT

____________

(Date)

________

(Place)

1. Please exercise the following data subject right(s):

(Cross the appropriate box):

 The right to receive information about data processing

 The right to access the data

 Right to demand correction of data

 Right to request the deletion of data (“right to be forgotten”)

 Right to limit data processing

 Right to data portability

 Right to object to data processing

 Right to request for a decision not based only on automated data processing, including profiling

2. Specify what you are specifically requesting and provide as much information as possible that would allow you to properly exercise your right(s) (for example, if you want to receive a copy of your personal data, please specify which data specifically (for example, a copy of the e-mail sent on day X of X month,of X year), you would like to receive; if you want to correct the data, please indicate which of your personal data are inaccurate; if you do not agree to the processing of your personal data, then indicate the arguments on which you base your disagreement, indicate which specific data processing you do not agree with; if you are applying for the implementation of the right to data portability, please indicate in relation to which data you wish to exercise this right, whether you wish to transfer it to your device or to another data controller, if the latter, then indicate which one):

______________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________.

ATTACHED:

1. ________________________________________________________________________

2. ________________________________________________________________________

3. ________________________________________________________________________

4. ________________________________________________________________________

______________ __________________

(Date) (Signature)

_______________________________

(Name, surname)