I. GENERAL PROVISIONS

  1. UAB “Megasportas”, company code 304975508, registered address at Klauso Malūno g. 3, Klausmyliai, LT-91291 (hereinafter referred to as the Company), commits to protect and respect the privacy and personal data protection rights of its customers, including those of the buyers and visitors of the Company’s website evolve-fitness.eu (hereinafter referred to as the Website), job applicants (hereinafter referred to as Candidates), visitors of the Company-managed blogs at https://evolve-fitness.eu (hereinafter referred to as the Company-managed Blogs), and visitors of the Company-managed website, by lawfully and fairly processing and overseeing the personal data provided by the Customers, Candidates, visitors of the Company-managed Blogs, and visitors of the Company-managed website (hereinafter collectively referred to as the Data Subjects).
  2. This Privacy Policy (hereinafter referred to as the Policy) regulates the procedure and principles for collecting, processing, and storing the personal data of the Data Subjects.
  3. The Policy is implemented in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR), the Law on Legal Protection of Personal Data of the Republic of Lithuania, the Law on Electronic Communications of the Republic of Lithuania, and other legal acts regulating personal data protection.
  4. By using the Company’s Website, purchasing goods from it, using the Company-managed Blogs, or the Company-managed website, Data Subjects agree to the terms of the Policy. Customers are considered to have been acquainted with the Policy when they tick the “I have read” box while registering on the Website. Visitors of the Company-managed Blogs and the Company-managed website are considered to have been acquainted with the Policy when they tick the “I have read” box while registering on them. The Policy is also published in the “Privacy Policy” section of the Website, as well as in the Company-managed Blogs or the Company-managed website by providing a link to the Policy. This clause does not apply to actions that require separate consent from the Data Subject.

II. TERMS USED IN THE POLICY

  1. The following terms are used in the Policy:
    5.1. Personal data – any information relating to an identified or identifiable natural person (Data Subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as name and surname, identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
    5.2. Consent of the Data Subject – any freely given, specific, informed, and unambiguous indication of the Data Subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
    5.3. Data processing – any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
    5.4. Data Processor – a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the Data Controller.
    5.5. Cookie – a small piece of text information automatically created when browsing the Website, the Company-managed Blogs, or the Company-managed website and stored on the Data Subject’s computer or other terminal device.
    5.6. Direct marketing – activities intended to offer goods and/or services to individuals by mail, telephone, or any other direct means and/or to inquire their opinion regarding the offered goods and/or services.
    5.7. Other terms used in the Policy are understood as they are defined in the GDPR and the Law on Legal Protection of Personal Data of the Republic of Lithuania.

III. CATEGORIES OF PERSONAL DATA OF THE DATA SUBJECTS BEING PROCESSED, PURPOSES, AND PRINCIPLES OF PROCESSING

  1. The Company collects personal data about:
    6.1. Customers who register to receive the Company’s newsletters, as well as visitors of the Company-managed blog at https://evolve-fitness.eu who wish to receive new articles. Personal data collected and processed: email address.
    6.2. Customers who register on the Website. Personal data collected and processed: name, surname, email address, password, information about consent or dissent regarding information sent by the Company. When a Customer purchases goods from the Website, additional personal data related to the delivery of goods, order details, invoice numbers, payment details, and any other data provided by the person on their own initiative while registering and purchasing goods are also collected and processed. Personal data is stored for the duration of the Customer’s cooperation with the Company and for ten (10) years after the end of cooperation.
    6.3. Visitors of the Website, the Company-managed Blogs, and the Company-managed website (see the section “Cookies”).
    6.4. Users of social networks who contact the Company through the Company’s accounts on social networks or actively participate in them (see the section “Social Networks”).
    6.5. Candidates (see the section “Candidates”).
    6.6. Registered visitors of the Company-managed Blogs and the Company-managed website. Personal data collected: identification data (name, surname, email address). When writing comments, an email address or social network account is specified. The purpose is to ensure that comments are ethical and to quickly identify the user in case of violation of the laws of the Republic of Lithuania. Personal data, after writing a comment, is stored for 5 years from the time of writing the comment.
  2. Collected personal data of the Data Subjects is used for the following purposes:
    7.1. Identification of the Customer in the Company’s information systems, registration on the Website and/or logging into the Customer’s account, processing and execution of the Customer’s order for the purchase of goods. Also, for the identification of other Data Subjects in the Company-managed Blogs and the Company-managed website when they register on them and/or write comments;
    7.2. For direct marketing purposes based on the consent of the person: to send newsletters/new articles, information to Customers and visitors of the Company-managed blog at the internet address https://evolve-fitness.eu, to provide content tailored to the needs of the Data Subjects in the Company’s accounts on social networks or to remember relevant information.
    7.3. To improve the operation of the Website, the Company-managed Blogs, and the Company-managed website;
    7.4. For the organization of recruitment for job positions based on the consent of the Candidate, which is expressed by sending a CV and other information (cover letter, etc.) to the person providing employment services or to the Company;
  3. The following principles are adhered to when processing the personal data of the Data Subjects:
    8.1. Personal data of the Data Subjects is processed lawfully, fairly, and transparently, and is accurate;
    8.2. Personal data of the Data Subjects is collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
    8.3. Personal data of the Data Subjects is adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed;
    8.4. Personal data of the Data Subjects is processed in a manner that ensures appropriate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures.

IV. RIGHTS OF THE DATA SUBJECTS AND PROCEDURE FOR THEIR EXERCISE

  1. Data Subjects have the following rights:
    9.1. The right to access their personal data (information is provided whether personal data is processed; information related to the processing of personal data as specified in Article 15(1) of the GDPR; a copy of the processed personal data);
    9.2. The right to request rectification of inaccurate or completion of incomplete personal data;
    9.3. The right to request erasure of data (not applicable if there are grounds specified in Article 17(3) of the GDPR), if:
    9.3.1. They are no longer necessary for the purposes for which they were collected or otherwise processed;
    9.3.2. The Data Subject withdraws consent and there is no other legal ground for processing the personal data of the Data Subject;
    9.3.3. The Data Subject objects to the processing of his or her personal data in accordance with Article 21 of the GDPR;
    9.3.4. The personal data of the Data Subject has been processed unlawfully;
    9.3.5. Other grounds specified in Article 17 of the GDPR.
    9.4. The right to request restriction of processing of the Data Subject’s personal data, if:
    9.4.1. The Data Subject contests the accuracy of his or her personal data for a period enabling the Company to verify the accuracy of the personal data;
    9.4.2. The processing of the Data Subject’s personal data is unlawful and the Data Subject opposes the erasure of the personal data and requests the restriction of their use instead;
    9.4.3. The Company no longer needs the personal data of the Data Subject for processing purposes, but they are required by the Company for the establishment, exercise, or defense of legal claims;
    9.4.4. When the Data Subject has objected to processing pending the verification whether the legitimate grounds of the Company override those of the Data Subject.
    9.5. The right to data portability, if it does not adversely affect the rights and freedoms of others, (i.e., the right to receive personal data concerning the Data Subject, which was provided to the Company in a structured, commonly used and machine-readable format, including the right to request the Company to transmit such data to another data controller, where technically feasible), when:
    9.5.1. The personal data of the Data Subject is processed by automated means;
    9.5.2. The processing of the personal data of the Data Subject is based on consent.
    9.6. The right to object, as well as the right at any later time to object to the processing of the personal data of the Customer or the visitor of the Company-managed blog at the internet address https://evolve-fitness.eu for direct marketing purposes, including the sending of newsletters/new articles by email specified by them. The Company has the right to refuse such a request of the person if his or her personal data is processed for compelling legitimate reasons which override the interests, rights, and freedoms of that person, or for the establishment, exercise, or defense of legal claims. Non-consent/later objection of the person specified in this clause regarding the processing of his or her personal data for direct marketing purposes does not affect his or her rights to use other services provided by the Company. The personal data of the persons specified in this clause is stored for direct marketing purposes until their separate withdrawal. Personal data from backup copies (back-up) is deleted within 30 days from the withdrawal.
    9.7. The right to lodge a complaint about the actions or inaction of the Company with the State Data Protection Inspectorate, A. Juozapavičiaus g. 6, Vilnius, email ada@ada.lt, website www.ada.lt, as well as with the court in accordance with the procedure established by the laws of the Republic of Lithuania.
  2. In some cases, the rights specified in clause 9 of the Policy may limit or terminate the right of Data Subjects to use the services provided by the Company if the personal data of the Data Subject is necessary to continue using the services provided by the Company, except for the case specified in clause 9.6 of the Policy. More information on this issue can be obtained by the Data Subject in accordance with the procedure specified in clause 20 of the Policy.
  3. To apply for the rights specified in clause 9 of the Policy, having provided a document confirming the identity of the person (when submitting a request by electronic means, the request is signed with a qualified electronic signature or formed by electronic means that ensure the integrity and immutability of the text), the Data Subject has the right to submit a request (hereinafter referred to as the request) (the request form, if desired by the Data Subject, can also be provided by the Company) by email info@evolve-fitness.eu, by mail to the address Klauso Malūno g. 3, Klausmyliai LT-91291, verbally by phone +370 699 564 52, or in person at the Company’s premises at Klauso Malūno g. 3, Klausmyliai LT-91291. This clause does not apply when the Data Subject applies for information about the processing of personal data in accordance with Articles 13 and 14 of the GDPR.
  4. The request must be legible, signed by the Data Subject, and must specify the name, surname, address of the Data Subject, and/or other contact details for maintaining communication or by which the Data Subject wishes to receive a response regarding the exercise of the Data Subject’s rights.
  5. The Data Subject has the right to exercise his or her rights personally or through a representative.
  6. The representative of the Data Subject in the request must specify his or her name, surname, address, and/or other contact details for maintaining communication, by which the representative of the Data Subject wishes to receive a response, as well as the name, surname of the represented person and provide a document confirming the representation or its copy.
  7. In case of doubts about the identity of the Data Subject, the Company has the right to request additional information necessary to confirm it.
  8. Upon receipt of the request, the Company provides the Data Subject with information on the actions taken in accordance with the request no later than one month from the receipt of the request. If there is a delay in providing information within the specified period, the Data Subject is informed about it, indicating the reasons for the delay and about the possibility to lodge a complaint with the State Data Protection Inspectorate.
  9. If the request is submitted not in accordance with the procedure and requirements set out in clauses 12-14 of the Policy, it is not considered and the Data Subject is immediately, but no later than within 5 working days, informed about it, indicating the reasons.
  10. The response is provided in the state language. If the request is submitted by electronic means, the Company provides the information in the commonly used electronic form, unless the Data Subject requests it to be provided differently.
  11. All actions related to the Data Subject’s request are carried out and the information is provided free of charge. In case of manifestly unfounded or disproportionate requests, including cases due to repetitive content, the Company has the right to charge a reasonable fee determined based on the actual administrative costs incurred.
  12. For all matters related to the processing of the personal data of the Data Subject and the exercise of his or her rights, the Data Subject has the right to apply by registered mail or to the address Klauso Malūno g. 3, Klausmyliai LT-91291, email info@evolve-fitness.eu, or by phone +370 46 222881.
    V. DISCLOSURE OF PERSONAL DATA OF DATA SUBJECTS TO OTHER PERSONS
  13. Personal data of the Data Subject may be disclosed to:
    21.1. Employees of the Company, whose functions include the processing of personal data and who must process the personal data of the Data Subject while performing their direct functions. In processing the personal data of the Data Subject, the employees of the Company adhere to the requirements for personal data protection, confidentiality, and other requirements;
    21.2. Governmental authorities, in case of their lawful request or in order to comply with the requirements of legal acts;
    21.3. Data Processors (for example, the company managing the IT system of the Company). In its activities, the Company engages only those data processors who ensure that appropriate organizational and technical measures are implemented in such a way that the processing of the personal data of the Data Subject complies with the GDPR and other legal act requirements.

VI. CANDIDATES FOR JOB POSITIONS

  1. The Company processes all information provided by the candidate to the Company when applying for certain positions. Personal data is processed based on the consent expressed by the Candidate to the Company or to the person providing employment services by sending his or her CV.
  2. The Candidate has the right to withdraw his or her consent at any time, but in such a case, the Company or the employment service providing company has the right to remove the Candidate from the list of candidates if further consideration of the candidacy is not possible without the use of his or her personal data.
  3. If separate consent is not expressed, the personal data of the person as a Candidate will be destroyed within 5 working days after signing the employment contract.
  4. If the Candidate does not pass the selection and expresses separate consent, the Company has the right to include the Candidate’s personal data in the Candidate’s database. If the Candidate withdraws his or her consent at any later time for his or her personal data to be included in the Candidate’s database, the Candidate’s personal data is immediately destroyed, but in such a case, the Company will not have the Candidate’s personal data in the Candidate’s database.
  5. Personal data of Candidates may be disclosed to:
    26.1. Data processors;
    26.2. Employees of the Company, whose functions include the processing of personal data, and who must process personal data while performing their direct functions. In processing personal data, the employees of the Company adhere to the requirements for personal data protection, confidentiality, and other requirements;
    26.3. Companies or other organizations in relations with which the employees of the Company represent it. The personal data provided are those necessary to ensure proper representation of the Company;
    26.4. Governmental authorities, in case of their lawful request or in order to comply with the requirements of legal acts.

VII. COOKIES

  1. The main purpose of cookies is to recognize the needs of the Data Subjects, better adapt to the needs of the Data Subjects, and make the operation of the Website, the Company-managed Blogs, or the Company-managed website as effective and useful as possible for the Data Subject.
  2. Session cookies are divided into:
    28.1. Session (performance-enhancing) cookies. These cookies improve the operation of the Website, the Company-managed Blogs, and the Company-managed website and collect general, encrypted (anonymous) information about the use of a specific website;
    28.2. Analytical (Google Analytics) cookies. These cookies enable the Company to count the visitors of the Website, the Company-managed Blogs, and the Company-managed website, see how users move around these websites using them. They help improve the operation of the Website, the Company-managed Blogs, and the Company-managed website, ensuring that it meets the expectations of the Data Subject.
    28.3. Functional cookies, which help recognize the users of the Website, the Company-managed Blogs, and the Company-managed website when they visit them again. This enables the Company to provide content tailored to the needs of the users on social networks (e.g., Facebook).
  3. A specific list of cookies, information about the storage period, purpose of use, and collected data can be found by clicking this link.
  4. The Data Subject has the right to disable cookies in his or her browser, but in such a case, the Company cannot guarantee that he or she will be able to use all the functions necessary for the Website, the Company-managed Blogs, and the Company-managed website to operate properly.
  5. More information on how to disable cookies through browser settings or how to remove existing cookies can be found by the Data Subject by clicking this link: https://www.aboutcookies.org/.

VIII. SOCIAL NETWORKS

  1. The information provided by the Data Subject to the Company, which he or she provides through the Company’s accounts on social networks, is controlled by the specific social network operator.
  2. The Company currently has the following accounts on social networks:
    33.1. https://www.facebook.com/ EvolveFitnessEurope
    33.2. https://www.instagram.com/evolve_fitness_europe
    In case of questions regarding the use of the personal data of the Data Subject in the networks specified in clause 33 of the Policy, it is recommended to contact the operators of those social networks and read the privacy notices they provide.