PRIVACY POLICY

DATA CONTROLLER

UAB “Lausna” (hereinafter referred to as the Company) is the controller of the personal data it processes and ensures that all personal data within the Company is managed in compliance with the data protection requirements applicable to data controllers.

Company information: UAB Lausna, a legal entity of the Republic of Lithuania, company code 300048222, registered office address: Ežero g. 39, Penkininkai, Trakai district, Lithuania, website: www.margis.ltemail:  info@margis.ltphone: +370 685 05550.

This Privacy Policy has been prepared in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter – GDPR). The Privacy Policy provides information about the purposes and legal grounds for personal data processing within the Company, the types and sources of personal data processed, retention periods, purposes of data disclosure, the procedure for exercising data subjects’ rights, and data recipients.

As a data subject, you have the right to contact the Company regarding any matters related to the processing of your personal data. Specifically, you have the following rights:

  • The right to receive information about data processing;
  • The right to access your personal data;
  • The right to request rectification of your data;
  • The right to request deletion of your data (“the right to be forgotten”);
  • The right to restrict data processing;
  • The right to data portability (when data is processed by automated means);
  • The right to object to the processing of personal data (when data is processed based on your consent and/or legitimate interest);
  • The right to request that no decision be based solely on automated processing, including profiling.

You have the right to contact the Company to exercise your data subject rights either verbally or in writing — by submitting a request in person, by mail, or by email at info@margis.ltIf you make the request in person or verbally, you must confirm your identity by presenting an identification document. Failure to do so will prevent the Company from processing your request and exercising your rights.

When submitting a written request to exercise your data subject rights, it is recommended to use the request form provided in the Personal Data Processing Rules.

Upon receiving your request, the Company will provide information about the actions taken in response no later than within one (1) month from the date of receipt. If there is a delay in providing the information, you will be informed within this period of the reasons for the delay and of your right to lodge a complaint with the State Data Protection Inspectorate.

The Company processes your personal data for the following purposes:

  • For the conclusion and execution of service or booking agreements (except where data processing is required by a legal obligation). Legal basis: data processing is necessary for the performance of a contract or to take steps at your request prior to entering into a contract (Article 6(1)(b) of the GDPR):
  1. To conclude service or booking agreements;
  2. To enter your booking details into the customer database and administer them for contract performance purposes;
  3. To fulfill other obligations arising from concluded service or booking agreements.
  • For the provision of car parking services. Legal basis: processing is necessary for the performance of a contract or to take steps at your request prior to entering into a contract (Article 6(1)(b) GDPR).
  • For the fulfillment of legal obligations established under: – Article 32(3) and Article 43(3) of the Law on Tourism of the Republic of Lithuania. – Article 13(3) and Article 18(1)(1) of the Law on Official Statistics and State Data Governance. Legal basis: processing is necessary for compliance with a legal obligation to which the data controller is subject (Article 6(1)(c) GDPR).
  • For the conclusion and execution of other contracts. Legal basis: processing is necessary for the performance of a contract or to take steps at your request prior to entering into a contract (Article 6(1)(b) GDPR): – To conclude other types of contracts; – To fulfill obligations arising from such contracts.
  • For direct marketing purposes. Legal basis: your consent (Article 6(1)(a) GDPR): – To send offers and newsletters about services; – To organize promotional campaigns (direct marketing games, quizzes, and contests).
  1. For the conclusion of other contracts;
  2. For the fulfillment of other obligations arising from concluded contracts;
  • For direct marketing purposes. Legal basis: your consent (Article 6(1)(a) of the GDPR):
  1. To provide offers and newsletters about services;
  2. To organize promotional campaigns (direct marketing games, quizzes, and contests).

For the purpose of concluding and performing service or booking agreements (except in cases where data processing is required by a legal obligation), the Company processes the following personal data:

  • First name, last name, date, email address, mobile or landline phone number, residential address;
  • Number of adults and children in the room (for arranging extra beds);
  • Room number;
  • Names, surnames, email addresses, and phone numbers of individuals authorized to represent a legal entity in its relations with third parties, as well as persons involved in the management, supervision, and/or control of the legal entity;
  • Information and financial data related to payment (account number, transaction amount).

For the purpose of providing car parking services, the Company processes the following data:

  • the vehicle’s registration (license plate) number.

For the purpose of fulfilling the legal obligations established in Article 32(3) and Article 43(3) of the Law on Tourism of the Republic of Lithuania, the Company processes the following personal data:

  • First name, last name, date of birth, residential address (in the country of origin);
  • Nationality, country that issued the identity document, identity document number;
  • Date of arrival and date of departure;
  • Names and surnames of accompanying spouse and/or minor children;
  • Indication of whether the person arrived with a tourist group;
  • Main purpose of the trip (leisure, work, health, other).

For the purpose of fulfilling the legal obligations established in Article 13(3) and Article 18(1)(1) of the Law on Official Statistics and State Data Governance of the Republic of Lithuania, the Company processes the following personal data:

  • Number of accommodated guests;
  • Country of origin of the accommodated guests;
  • Purpose of stay;
  • Duration of stay at the hotel.

For marketing purposes, the Company processes the following personal data:

  • Email address, mobile or landline phone number;
  • Data confirming the right to participate in promotional campaigns, as well as documents verifying compliance with the terms of such campaigns (e.g., receipt date, number, etc.), insofar as they relate to participation in a promotion or eligibility to enter a contest;
  • Data related to consent confirmation and validity (first name, last name, confirmation/withdrawal status, and date).

For the purpose of concluding and performing other contracts, the Company processes the following personal data:

  • If the contract is concluded with a natural person – first name, last name, date of birth, residential address, phone number, email address, business license/individual activity certificate number, VAT payer code, bank account number, and other payment-related information;
  • If the contract is concluded with a legal entity – names, surnames, email addresses, and phone numbers of individuals authorized to represent the legal entity in its relations with third parties, as well as those involved in the management, supervision, and/or control of the legal entity.

The Company processes personal data that you voluntarily provide by mail, registered mail, email, fax, telephone, or in person at the Company’s service location, as well as when using the Company’s website.

When the Company acts as a data controller, personal data are retained as follows:

  • For the purpose of concluding and performing a service agreement, booking agreement, and/or other contract, personal data (except for data provided when acknowledging the Hotel Margis rules) are retained for the duration of the contract and 10 years after its termination. Personal data provided when acknowledging the Hotel Margis rules are retained for 3 years from the date of written confirmation.
  • Starting from January 1, 2024, personal data collected to fulfill the legal obligation established in Article 32(3) and Article 43(3) of the Law on Tourism of the Republic of Lithuania are provided in the registration card and stored until the guest’s departure. Within 24 hours of accommodation, the data controller submits the information to the National Tourism Information System, where personal data are retained for the period specified in the regulations of the system, approved by the Minister of Economy and Innovation. Registration cards completed before December 31, 2023 are retained for 5 years from the date of completion.
  • Personal data collected to fulfill the legal obligation established in Article 13(3) and Article 18(1)(1) of the Law on Official Statistics and State Data Governance of the Republic of Lithuania are retained until the submission of the statistical reports HOT1 (monthly) and HOT-1 (quarterly) to the State Data Agency.
  • Personal data processed for direct marketing purposes are retained for 3 years from the date of receipt, or for a shorter period if a request to unsubscribe from direct marketing messages is received. When personal data are processed for promotional campaigns (direct marketing games, quizzes, contests), they are retained for 1 year after the announcement of the campaign results or winners, or for a shorter period if a request to unsubscribe from direct marketing messages is received.

    You have the right to withdraw your consent to the use of your personal data for marketing purposes by notifying the Company via email a info@margis.lt .

Upon the expiration of the retention period of a document containing personal data, a decision is made regarding its destruction, and the document is destroyed in accordance with the procedures established by the Law on Documents and Archives of the Republic of Lithuania. Documents containing personal data that are subject to permanent retention are transferred to the state archives in accordance with the same law.

When acting as a data processor, the Company retains personal data for the period specified by the respective data controllers.

The information received from you as a data subject is managed and used solely for the purposes specified in this Privacy Policy.

Information received from you cannot be disclosed to third parties without a lawful basis, except to those individuals who participate in or in any way contribute to the execution or provision of the services you have ordered. Your personal data may also be transferred to data processors or joint controllers with whom the Company has entered into data processing agreements or other contracts specifying personal data processing and security requirements. In such cases, legal liability for any breach of data protection or damages rests with the processor or controller responsible for the violation. In other circumstances, personal data may be disclosed to third parties only when required or permitted by law. Personal data may also be provided to public administration or law enforcement authorities when such an obligation is established by legal acts.

Your data may be transferred to the following third parties, including but not limited to:

  • Ministry of the Economy and Innovation of the Republic of Lithuania;
  • State Data Agency (for statistical purposes);
  • UAB “Finansita” (provider of accounting services);
  • Other entities that provide services to the Company or are related to the Company’s service provision (e.g., archiving service providers, etc.);
  • Criminal intelligence authorities, pre-trial investigation bodies, prosecutors, courts, or judges;
  • Other state institutions and authorities to which data must be provided in accordance with legal requirements.

The Company conducts video surveillance for the purpose of protecting individuals and property. Legal basis for processing: Article 6(1)(f) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

Video surveillance is carried out:

  • In the following area: parking lot at Ežero g. 39, Penkininkai village, Trakai district;
  • In the following premises: building at Ežero g. 39, Penkininkai village, Trakai district — reception (cash desk), restaurant (cash desk), kitchen passage (corridor, beverage refrigerators), staff corridor, and pool area (swimming pool, jacuzzi).

Data recipients: pre-trial investigation bodies, prosecutors, or courts — in connection with administrative, civil, or criminal cases under their consideration, as evidence, or in other cases provided for by law.

Data retention period: 72 hours

If you have any questions related to personal data protection, please contact us by email at info@margis.ltor by phone at +370 685 05550.

The Company reserves the right to amend this Privacy Policy. Therefore, visitors to the website are kindly requested to regularly check whether the Privacy Policy has been updated and to familiarize themselves with any revised and/or new provisions.

Additions or amendments to this Policy take effect on the date they are published on the website.

Privacy Policy updated on January 1, 2024.  

REQUEST TO EXERCISE DATA SUBJECT RIGHT(S)