This Privacy Policy provides information on the main rules governing the processing of your personal data (including their collection, use, storage, disclosure and erasure) when you use building management, maintenance, engineering or other services provided by the Civinity group of companies, use the customer self-service portal, visit www.civinity.com, www.civinity.lt, www.priemiestis.lt, www.jurita.lt, www.admeo.lt, www.civinityengineering.com, www.inservis.lt, submit enquiries, requests, complaints or feedback, participate in recruitment processes or otherwise communicate with companies of the Civinity group. This Privacy Policy also applies where your personal data are lawfully obtained from other sources, such as public registers, municipalities, associations of apartment building owners, customers, partners or other persons lawfully providing such data.
When processing your personal data, the Company complies with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter the GDPR), the Law of the Republic of Lithuania on Legal Protection of Personal Data (hereinafter the LPPD), and other applicable European Union and Lithuanian legislation. Terms used in this Privacy Notice have the meanings assigned to them in the GDPR and the LPPD.
PERSONAL DATA CONTROLLER
The Civinity group of companies comprises Civinity AB, legal entity code 302247881, and the companies directly or indirectly controlled by it, including:
(hereinafter the Company).
[email protected]If you wish to exercise your rights as a data subject or have any questions regarding the processing of personal data, please contact us at [email protected] or by telephone on 0 700 55 188 (or +370 5 279 9537 if calling from abroad).
PRINCIPLES RELATING TO PROCESSING OF PERSONAL DATA
When processing your personal data, the Company adheres to the following fundamental principles:
PURPOSES OF PROCESSING
BUILDING MANAGEMENT, MAINTENANCE AND PROVISION OF OTHER SERVICES
Purpose. To manage residential and commercial buildings and their common-use facilities; advise customers; prepare building maintenance and financial plans and activity reports; organise owners’ meetings and voting; maintain technical, heating, hot-water and other engineering systems; collect meter readings; arrange cleaning, grounds and landscaping maintenance, emergency response, installation, repairs and building renovation; conclude and administer contracts with service providers; supervise the performance of works; represent customers’ interests; and provide information about works, faults and emergencies.
Personal data processed. First name, surname, contact details, personal identification number where necessary to identify a person or ownership rights, property address, apartment or other premises number, information on ownership or use of the property, status as co-owner, tenant or representative, contract and order details, meter readings and consumption data, invoices, payments and outstanding debts, information on faults, emergencies, defects and completed or planned works, meeting, voting and decision records, service-related correspondence, photographs or other materials provided by the customer, and other data necessary for administering the services.
Legal basis. Article 6(1)(b) GDPR where personal data are necessary for entering into or performing a contract with the data subject; Article 6(1)(c) GDPR where the Company fulfils statutory obligations as a building manager or service provider; and Article 6(1)(f) GDPR where the Company administers contractual relationships with legal entities, organises building maintenance, customer meetings and voting, coordinates contractors, represents customers’ interests and establishes, exercises or defends legal claims.
Retention period. Data are retained for 10 years after the end of the contract.
Categories of recipients. Contractors and subcontractors engaged by the Company for building management, technical and engineering-system maintenance, heating and hot-water system maintenance, emergency response, cleaning, grounds and landscaping maintenance, construction, installation, repair and renovation; utilities, energy, water, waste management and other service providers; building owners’ associations, persons authorised under joint activity agreements, premises owners and their lawful representatives; municipalities, national and local authorities; insurers, claims handlers, experts, auditors and lawyers; payment, accounting, invoice delivery, postal and courier service providers; information-system, document-management, cloud, communications and data-storage providers; courts, law-enforcement and supervisory authorities and other competent bodies where disclosure is required by law or for the establishment, exercise or defence of legal claims.
Purpose. To create and administer self-service accounts, identify users, provide invoices, notices and information about works and services, receive payments or requests, and ensure the security of the self-service portal.
Personal data processed. First name, surname, contact details, customer and property identifiers, login and authentication data, selected settings, invoice, payment and service data, contents of requests, IP address, login times, activity logs and security logs. Data marked as mandatory are necessary to create or administer an account or provide a particular self-service function. If such data are not provided, the account or relevant function cannot be made available.
Legal basis. Article 6(1)(b) GDPR where creating and using an account is necessary for entering into or performing a contract with a customer, including providing invoices, notices and service information, administering payments and receiving and fulfilling orders and requests; Article 6(1)(c) GDPR where data are processed through the self-service portal to comply with legal obligations applicable to the Company; and Article 6(1)(f) GDPR where processing is necessary to provide convenient electronic customer service, properly administer accounts and services, identify users, secure information systems and accounts, prevent fraud and unauthorised access, and investigate potential incidents and legal claims.
Retention period. Accounts and related administration data are retained while the account is active and in use. When a customer deletes an account or the service relationship ends, the account is closed and data needed solely for its operation are erased or anonymised within 90 days, except for data which the Company is required or entitled to retain for longer for another purpose specified in this Policy.
An inactive account is deleted if the user has not logged in for 24 months, after informing the user of the intended deletion where technically possible. Account login, activity and security logs are retained for 12 months from their creation; data relating to invoices, payments, orders, requests, complaints, accounting or legal claims are retained for the periods established in this Policy for the relevant processing purposes.
Categories of recipients. Providers of customer self-service, identity verification and authentication, electronic notices and invoicing, payment initiation, information-system maintenance, cloud services, data storage and cybersecurity; banks and payment service providers where payments are made through the portal; contractors and other service providers where orders are submitted or administered through the portal; and other Civinity group companies where necessary to administer the account and associated services.
Purpose. To calculate amounts payable, issue and deliver invoices, receive and reconcile payments, maintain financial accounts, administer outstanding debts and, where necessary, recover them.
Personal data processed. Identification and contact details, property address, service and consumption data, invoice details, bank account and payment information, amount and history of debts, payment-related correspondence and information contained in procedural documents.
Legal basis. Article 6(1)(b) GDPR (performance of a contract), Article 6(1)(c) GDPR (Article 7 of the Law of the Republic of Lithuania on Financial Accounting), and Article 6(1)(f) GDPR (legitimate interest in managing debts and establishing, exercising or defending legal claims).
Retention period. Accounting documents and the data contained in them are retained for 10 years unless legislation provides for a different period. Debt data are retained for 10 years after all obligations have been discharged.
Categories of recipients. The State Tax Inspectorate (VMI), SODRA and other competent authorities; banks and payment service providers; accounting, invoicing and invoice-delivery, postal, electronic communications, information-system and archiving service providers; debt management and collection companies, bailiffs, courts, external lawyers, notaries and insurers.
Purpose. To receive and examine your enquiries, answer questions, register faults or emergencies, resolve complaints, improve service quality and, where necessary, defend legal claims.
Personal data processed. First name, surname, contact details, property address, date and content of the enquiry, related documents, information on decisions and correspondence, and other information provided by you.
Legal basis. Article 6(1)(b) GDPR where the enquiry relates to entering into or performing a contract; Article 6(1)(c) GDPR where the Company handles the enquiry in compliance with a legal obligation; and Article 6(1)(f) GDPR where processing is necessary to manage customer enquiries, improve service quality and establish, exercise or defend legal claims.
Retention period. Enquiries and documents relating to contract performance, payments, disputes or legal claims are retained for 10 years after the end of the relevant relationship. Other requests, complaints and reports and documents relating to their handling are retained for one year from the date of the decision or response, unless legislation requires a longer period.
Categories of recipients. External legal service providers, courts, prosecutors, pre-trial investigation authorities, national and municipal authorities and other competent bodies legally empowered to consider matters raised in complaints, requests or reports.
QUALITY CONTROL AND ENSURING PROPER SERVICE DELIVERY (CALL RECORDING)
Purpose. To record telephone conversations with customer service staff in order to monitor customer service and service quality, train employees, accurately document orders and reports of faults or emergencies and, where necessary, investigate complaints or establish the circumstances of communications.
Personal data processed. Telephone numbers of the caller and call recipient, date, time, duration and technical details of the call, audio recording and information provided during the conversation.
Legal basis. Article 6(1)(a) GDPR (consent); Article 6(1)(f) GDPR – legitimate interest in ensuring customer service and service quality, accurately recording and fulfilling orders and reports, handling complaints and establishing, exercising or defending legal claims.
Retention period. Call recordings are retained for no longer than 180 days. A particular recording may be retained longer if required to investigate a complaint, incident, dispute or legal claim, until the relevant proceedings are concluded.
Categories of recipients. Call-centre, telephony, call-recording, information-system maintenance and other service providers engaged by the Company, to whom data are disclosed only to the extent necessary to provide the relevant services.
COMMUNICATION BY EMAIL AND OTHER CHANNELS
Purpose. To maintain business communications, administer contractual relationships, review and fulfil requests, ensure business continuity and, where necessary, identify and investigate potential breaches.
Personal data processed. First name, surname, job title, employer, email address, telephone number, date, time and content of correspondence, attachments and technical communication data.
Legal basis. The legal basis depends on the content of the communication: Article 6(1)(b) GDPR (entering into or performing a contract), Article 6(1)(c) GDPR (compliance with legal obligations) or Article 6(1)(f) GDPR (legitimate interest in maintaining business communications, administering operations and ensuring business continuity).
Retention period. Data are retained according to the purpose of the communication. Communications relating to contract performance, accounting, disputes or legal claims are retained for 10 years after the end of the relevant relationship. Other communications not falling within the above categories are retained for no longer than three years after the communication ends.
Categories of recipients. Email, communications, document-management, customer-service, archiving, information-system maintenance and cloud-service providers; other Civinity group companies involved in handling the enquiry or providing the service; external lawyers, auditors, insurers and competent authorities where necessary in light of the content of the enquiry.
MAINTAINING BUSINESS RELATIONSHIPS AND ENTERING INTO AND ADMINISTERING CONTRACTS WITH BUSINESS PARTNERS
Purpose. To enter into and perform contracts, maintain business relationships, coordinate service provision, procurement, projects and payments, administer contact information and ensure fulfilment of contractual obligations.
Personal data processed. First name, surname, position, employer, email address, telephone number, signature, representation or authorisation details and business correspondence concerning representatives and contact persons of business customers, suppliers and partners. Where a contract is concluded with a natural person, we may also process their address, bank account number, individual activity certificate number, taxpayer identification number, payment information and other data necessary to perform the contract.
Legal basis. Where a contract is concluded with a natural person, entering into and performing the contract (Article 6(1)(b) GDPR); the Company’s legitimate interest in entering into and performing contracts with legal entities, maintaining business relationships, administering contact information and establishing, exercising or defending legal claims (Article 6(1)(f) GDPR).
Retention period. Data are retained for 10 years after the end of the relationship.
Categories of recipients. Other Civinity group companies; accounting, payment, electronic-signature, document-management, archiving, information-system and cloud-service providers; banks and payment service providers; auditors, insurers, external lawyers, courts and competent authorities.
Purpose. To assess candidates’ qualifications, experience and suitability for a specific position, organise recruitment, make job offers and, subject to separate consent, contact candidates about future employment opportunities.
Personal data processed. First name, surname, contact details, curriculum vitae, education, qualifications, work experience, language and IT skills, desired position and remuneration, assessment or assignment results, references and other information voluntarily provided by the candidate.
Legal basis. Article 6(1)(a) GDPR (consent to retention of data after recruitment) and Article 6(1)(b) GDPR (performance of a contract).
Retention period. After recruitment ends, the personal data of unsuccessful candidates are destroyed unless the data subject has consented to further processing. In that case, data are retained until consent is withdrawn, but for no longer than six months.
Categories of recipients. Recruitment, candidate search and recruitment-platform, testing, video-meeting, email, information-system and cloud-service providers; referees identified by the candidate; and other Civinity group companies where recruitment is conducted on their behalf.
Purpose. To prepare, register, organise, manage, store and administer Company documents, ensure their traceability, proper document management, business continuity and compliance with statutory document-retention obligations.
Personal data processed. First name, surname, position, email address, telephone number, work functions and personal information contained in documents, including the contents of requests, instructions, decisions, meeting minutes and other documents.
Legal basis. Article 6(1)(c) GDPR (legal obligation).
Retention period. Personal data contained in documents are retained for the periods established by legislation and the Company’s approved document retention schedules, depending on the type and category of document.
Categories of recipients. Document-management, electronic-signature, archiving, postal, courier, information-system maintenance, cloud and data-storage providers; other Civinity group companies; notaries, auditors, external lawyers, courts and competent authorities where documents are lawfully disclosed to them.
Purpose. To send invitations to participate in customer satisfaction and service quality surveys, collect and analyse responses and use them to improve the Company’s customer service and services.
Personal data processed. First name, surname, contact details, customer or property identifier, information about the service provided, survey responses, ratings, comments, survey invitation and completion dates, and technical data.
Legal basis. Article 6(1)(f) GDPR – the Company’s legitimate interest in assessing and improving customer service and the quality of services provided. Where survey invitations form part of direct marketing communications or the survey is used to personalise offers, data are processed on the basis of the data subject’s consent under Article 6(1)(a) GDPR.
Retention period. Data concerning invitations and survey responses are retained for no longer than three years after completion of the survey, except where a response is needed to investigate a specific complaint, incident or legal claim.
Categories of recipients. Survey-platform, electronic messaging, data analytics and information-system maintenance providers.
Information provided. Each survey invitation contains a link to this Privacy Policy and an option to opt out of further invitations of this kind.
Purpose. To carry out direct marketing by sending news, offers and information about the Company’s services; administer consents and opt-outs from direct marketing communications; and, where applicable, assess the effectiveness of those communications.
Personal data processed. First name, surname, email address, telephone number, selected communication channels and topics, records of consent being given, amended or withdrawn, and data on delivery, reading and opening of links in communications.
Legal basis. Article 6(1)(a) GDPR (consent). Where legislation permits electronic offers concerning the Company’s own similar services to be sent to existing customers without separate consent, data are processed on the basis of Article 6(1)(f) GDPR and subject to the conditions laid down in the Law of the Republic of Lithuania on Electronic Communications, with a clear and free-of-charge opt-out provided on each occasion.
Right to withdraw consent and object. You may withdraw your consent to direct marketing at any time or, where data are processed on the basis of legitimate interests, object to such processing at any time. Upon receiving a withdrawal of consent or an objection, the Company will cease processing your personal data for direct marketing purposes. You may do so by clicking the unsubscribe link in the communication or using the contact details provided in this Policy.
Retention period. Data are retained for the period during which consent remains valid, but no longer than three years, or until consent is withdrawn, whichever occurs first. Records evidencing consent are retained for a further two years after the end of the retention period for data processed on the basis of that consent.
Categories of recipients. Email and SMS delivery, customer relationship management, marketing automation, survey, analytics, information-system maintenance and cloud-service providers; other Civinity group companies where they lawfully participate in organising the relevant marketing activities.
Purpose. To manage Civinity social media accounts, publish information about the Company and its services, communicate with social media users, respond to comments and messages and raise awareness of the Company.
Personal data processed. First name, surname, social media account name, profile photograph, publicly available profile information, comments, reactions, content and history of messages and other communications, and location data where publicly available or provided by the individual.
Legal basis. Article 6(1)(f) GDPR (the Company’s legitimate interest in managing its social media accounts, communicating with the public, presenting its services and raising awareness of the Company).
Retention period. Data are retained in accordance with the retention periods set by the social media platforms.
Categories of recipients. The controllers of the Facebook and Instagram social media platforms.
WEBSITE STATISTICS (COOKIES)
Purpose. To analyse website traffic and usage, assess website performance and improve website content, functionality and user experience.
Personal data processed. IP address, cookie and other browser or device identifiers, browser type, operating system, device type, screen resolution, language settings, date and time of visit, pages viewed, visit frequency, session duration, user activity on the website, approximate location data and, where applicable, aggregated demographic data.
Legal basis. Article 6(1)(f) GDPR (the Company’s legitimate interest in ensuring the proper and secure operation of the website where strictly necessary cookies are used) and Article 6(1)(a) GDPR (website visitor’s consent where analytics and other non-essential cookies are used).
Retention period. Data are retained until consent is withdrawn or the relevant cookie expires. The specific use and retention periods for each cookie are set out in the Cookie Policy.
Categories of recipients. Google Ireland Limited.
ORGANISATION AND ADMINISTRATION OF VIRTUAL MEETINGS
Purpose. To organise and administer remote meetings, conference calls, training sessions and webinars and ensure smooth and secure communication between participants.
Personal data processed. Participant’s first name, surname, email address, meeting subject, participants’ IP addresses, information about devices and software used, and login and logout times. Where a meeting is recorded, the participant’s image, voice, statements, chat content, information displayed on screen, presentations and other materials shared during the meeting are also processed.
Legal basis. Article 6(1)(f) GDPR – the Company’s legitimate interest in organising and administering virtual meetings and ensuring smooth and secure communication. Where a virtual meeting is recorded, data are processed on the basis of the participant’s consent under Article 6(1)(a) GDPR.
Retention period. Video recordings are retained for no longer than 30 days after the meeting.
Categories of recipients. Virtual-meeting, email, calendar, cloud, recording-storage and information-system maintenance providers; other Civinity group companies and meeting participants, depending on the purpose of the meeting.
CONDUCTING EXTERNAL AND INTERNAL AUDITS
Purpose. To organise and conduct mandatory external and internal audits, assess the adequacy of financial statements, accounting and other business processes, evaluate the effectiveness of internal controls, identify potential risks and ensure compliance with legal requirements.
Personal data processed. Suppliers’ first names, surnames, email addresses, telephone numbers, addresses, payment histories, invoice, debt and business activity data, including individual activity certificate numbers and taxpayer identification numbers. First names, surnames, positions and contact details of representatives of legal entities. First names, surnames, positions, employment contract details, remuneration, working-time records and other financial data necessary for the audit relating to employees and managers. Auditors’ first names, surnames, auditor certificate numbers, audit firm names, certificate numbers, registered office addresses, email addresses, telephone numbers, status of authorisation to perform sustainability reporting assurance engagements and information about suspension of an auditor certificate.
Legal basis. Article 6(1)(c) GDPR – compliance with the Company’s legal obligation to undergo mandatory audits, including the requirements of the Law of the Republic of Lithuania on the Audit of Financial Statements and Other Assurance Services.
Retention period. Personal data collected and prepared during an audit are retained for 10 years from the date on which the relevant audit is completed.
Categories of recipients. External auditors and audit firms and, in cases prescribed by law, audit supervisory authorities or other competent authorities.
Purpose. To record, assess and investigate personal data breaches, establish their circumstances, causes and consequences, implement breach management and prevention measures and comply with statutory breach documentation and notification obligations.
Personal data processed. First names, surnames and contact details of persons reporting or recording a breach and information contained in their reports. Identification, contact and other personal data of affected individuals necessary to investigate the breach, including information about data disclosed, lost, altered or otherwise affected by the breach. First names, surnames, positions and actions of employees potentially responsible for or involved in the breach. Information about the circumstances, causes and consequences of the breach and measures taken to manage it is also processed.
Legal basis. Article 6(1)(c) GDPR (compliance with the Company’s legal obligations to record, document and, where applicable, notify personal data breaches under Articles 33 and 34 GDPR).
Retention period. Data relating to the recording, assessment and investigation of a personal data breach are retained for 10 years from the date on which the breach report is received.
Categories of recipients. The State Data Protection Inspectorate where notification of a personal data breach is required under Article 33 GDPR; affected data subjects where they must be informed under Article 34 GDPR; law-enforcement authorities, insurers, external lawyers and cybersecurity and incident-management providers where necessary to investigate and manage the breach.
HANDLING DATA SUBJECT RIGHTS AND ENQUIRIES
Purpose. To receive, register and examine data subject requests and enquiries, facilitate the exercise of their rights, provide responses and document the Company’s actions in complying with data protection requirements.
Personal data processed. First name, surname, contact details, information necessary to verify identity, content of the request or enquiry, related correspondence, decisions made and responses provided.
Legal basis. Article 6(1)(c) GDPR – compliance with the Company’s legal obligation to facilitate data subject rights and handle their requests under Articles 12–23 GDPR.
Retention period. Data are retained for three years from the date on which the request or enquiry is resolved.
Categories of recipients. External lawyers and an external data protection officer.
PROTECTION OF PERSONS AND PROPERTY (VIDEO SURVEILLANCE)
These provisions apply only to areas and premises managed or used by the Company where video surveillance is actually carried out.
Purpose. To ensure the safety of employees, customers, visitors and other persons and the security of Company property, prevent unlawful acts, identify and investigate security incidents and protect the Company’s legal interests.
Personal data processed. Images of individuals, their actions captured in video footage, and the date, time and location of the recording.
Legal basis. Article 6(1)(f) GDPR – the Company’s legitimate interest in ensuring the safety of persons and property, preventing unlawful acts and identifying and investigating security incidents.
Retention period. Video recordings are retained for 14 days from the date of recording and are then automatically deleted, except where an incident has been captured. In that case, the recording is retained for as long as necessary to investigate the incident or establish, exercise or defend legal claims.
Categories of recipients. Pre-trial investigation and other law-enforcement authorities where disclosure of video recordings is required in accordance with the law.
PROTECTION OF PERSONS AND PROPERTY (ACCESS CONTROL)
These provisions apply only to areas and premises managed or used by the Company where access control is actually in operation.
Purpose. To control access to Company premises, ensure that only authorised persons enter, protect persons and property on the premises and identify and investigate security incidents.
Personal data processed. First name, surname, date and time of entry, access location and, where used, access card or other access identifier data.
Legal basis. Article 6(1)(f) GDPR – the Company’s legitimate interest in controlling access to premises and ensuring the safety of persons and property.
Retention period. Access control data are retained for one month from the date of recording, except where required to investigate a security incident or establish, exercise or defend legal claims.
Categories of recipients. Access control, physical security, building management, information-system maintenance and equipment servicing providers; law-enforcement authorities, courts, insurers and other competent authorities where data are necessary to investigate incidents or establish, exercise or defend legal claims.
We obtain personal data directly from you; premises owners, residents, tenants and their representatives; apartment building owners’ associations and persons authorised under joint activity agreements; municipalities and other public authorities and registers; utilities and energy suppliers; contractors and other service providers; banks and payment service providers; other Civinity group companies; and other persons lawfully providing data. The specific source depends on the service and your relationship with the Company.
Depending on the purpose of processing, your personal data may be disclosed to: (i) other Civinity group companies involved in providing or administering services; (ii) contractors, subcontractors and providers of utilities, energy, water, waste management, technical maintenance, emergency response, cleaning, construction, repair and renovation services; (iii) IT, customer self-service, communications, telephony, call recording, email, cloud, data storage, cybersecurity, document management, electronic signature, archiving, analytics, survey and marketing service providers; (iv) banks and payment, accounting, invoice delivery, debt management and collection service providers; (v) insurers, claims handlers, auditors, experts, external lawyers, notaries and bailiffs; (vi) municipalities, public registers, courts, law-enforcement and supervisory authorities and other competent bodies; (vii) building owners’ associations, persons authorised under joint activity agreements, premises owners and their lawful representatives; and (viii) other recipients where disclosure is necessary to perform a contract, required by law, based on your consent or necessary to establish, exercise or defend legal claims. Data processors process personal data only in accordance with the Company’s instructions and the agreements concluded with them, while independent controllers process data for their own purposes and in accordance with their own privacy information.
As a rule, we process and store data subjects’ personal data within the European Union or European Economic Area (EU/EEA). However, we may also transfer personal data outside the EU/EEA where necessary to achieve the purposes for which the data were collected and are processed.
We transfer your personal data outside the EU/EEA in accordance with Chapter V GDPR where at least one of the following measures is in place:
The Company does not make decisions based solely on automated processing of personal data, including profiling, which produce legal effects concerning individuals or similarly significantly affect them.
Data subjects have the following rights:
A request to exercise data subject rights may be submitted:
The request must contain information enabling the identification of the person submitting it, clearly indicate the right they wish to exercise and include the information necessary to handle the request. Where the Company has reasonable doubts concerning the identity of the person making the request, it may request additional information necessary to confirm that identity. A representative submitting a request must also provide a document evidencing their authority to act.
The Company responds to a request without undue delay and in any event within one month of receipt. Taking into account the complexity and number of requests, this period may be extended by a further two months. The data subject is informed of the extension and the reasons for it within one month of receipt of the request.
This Policy and relationships concerning the processing of personal data are governed by the GDPR, the laws of the Republic of Lithuania and other applicable legislation.
The Company’s websites may contain links to third-party websites, social media platforms or other services. The processing of personal data by such third parties is governed by their respective privacy policies, which you are advised to read before using the relevant website or service. The Company is responsible for personal data processing independently determined by third parties only to the extent provided by applicable law. Where the Company’s website contains a link to an offer from a financing partner, that partner processes application data submitted on its website as an independent controller in accordance with its own privacy information. The Company does not receive financing application data unless the individual is clearly informed of a different arrangement for data disclosure before submitting the data.
The Company may update this Policy to reflect changes in legislation, the Company’s operations, the services provided or the technologies used. The updated version of the Policy and its effective date are published on the Company’s website. The Company will provide additional notification of material changes by appropriate means where required by law or where the changes may significantly affect data subjects.