2025-03-18, Kaunas

The purpose of this Privacy Policy is to provide information about how the personal data of data subjects are collected and processed, how long they are stored, to whom they are provided, what rights data subjects have and where to go to implement them, or how to address any other issues related to the processing of personal data.

Personal data is processed in accordance with the General Data Protection Regulation (EU) 2016/679 (hereinafter referred to as the Regulation), the Law on Legal Protection of Personal Data of the Republic of Lithuania and other legal acts regulating the protection of personal data.

“Osama” UAB acts in accordance with the following basic principles of data processing:

• personal data is collected only for clearly defined and legitimate purposes;
• personal data is handled only accordance with law and fair purposes;
• personal data is kept up to date;
• personal data is stored securely and for no longer than required by the stated purposes of processing or by law;
• personal data shall be processed only by those employees of“Osama” UAB who are authorized to do so by virtue of their job functions, or by duly authorized data processors.

1. DEFINITIONS
   1.1 Data controller –“Osama” UAB (hereinafter – the Company), legal entity code 134993481, registration address: Energetikų g. 46.
   1.2 Data subject – any natural person whose data is processed bythe Company. The data controller shall only collect the data of the data subject which is considered necessary for the performance of the activities of the Company and/or for visiting, using, browsing the websites of the Company, “Facebook“ social network account, etc. (hereinafter referred to as the Website). The Company ensures that the collected and processed personal data will be secure and will only be used for a specific purpose.
   1.3 Personal data – any information relating to a data subject directly or indirectly, whose identity is known or can be established directly or indirectly, by reference to the data concerned. Processing of personal data means any operation performed on personal data (including collection, recording, storage, editing, alteration, granting access, requesting, transferring, archiving, etc.).
   1.4 Consent – any freely given and informed indication by which the data subject agrees to the processing of his or her personal data for a specified purpose.

2. SOURCES OF PERSONAL DATA

2.1 The personal data shall be provided by the data subject. The data subject shall contactthe Company, use the services provided by the Company, leave comments, ask questions, contact the Company for information, etc.

2.2 The personal data is obtained when the data subject visits thewebsite of the Company. The data subject fills in the forms therein, or leaves his or her contact details for whatever reason.

2.3 Personal data is obtained from other sources. Data obtained from other bodies or companies, publicly accessible registers, etc.

3. PROCESSING OF PERSONAL DATA

3.1 By providing personal data for the Company, the data subject agrees to the use of the data collected bythe Company in the performance of its obligations to the data subject, in the provision of the services that the data subject expects.

3.2 Personal datais processed for the following purposes:

3.2.1 Provision of food and non-food logistics and supply chain management services,management of Debtors of the Company. For this purpose, the following items of data are processed:

• The provision of food and non-food logistics and supply chain services may involve the processing of personal data of customers (natural persons): name(s), surname(s), date of birth, telephone number, e-mail address, residential address, bank account details, bank and other data related to the provision of services.
• For the purpose of management of debtors and debt recovery, personal data of its clients (debtors, natural persons): name(s), surname(s), date of birth, residential address, telephone number, e-mail address, amount of debt, information on services rendered, ad other data related to the debt may be processed.
• Contracts, VAT invoices and other related documents shall be stored in accordance with the time limits set out in the General Index of Document Storage approved by Order of the Chief Archivist of Lithuania.
• Data relating to the management of debtors of the Company shall be kept no longer than is necessary for the purposes for which the personal data is processed.
• The legal basis for the processing of the data is the need to perform a contract to which the customer is a party as a data subject or to take action at the request of the customer prior to entering into a contract with him/her (Article 6(1)(b) of the GDPR), where the processing of certain personal data is required by law (Article 6(1)(c) of the GDPR), and the need to pursue the legitimate interests of the  Company in order to improve the performance of its activities and the success rate of its business (Article 6(1)(f) of the GDPR).

3.2.2 Ensuring the integrity and continuity of operations of the Company. For this purpose, the following items of data are processed:

• For the purpose of concluding and performing contracts, personal data of suppliers (natural persons) may be processed: name(s), surname(s), personal identification number or date of birth, place of residence (address), telephone number, e-mail address, place of work, position, signature, data included in the business certificate (type of activity, group, code, name, periods of activity, date of issue, amount), number on the certificate of self-employment, data on whether the data subject is a VAT payer, bank account and bank, amount of the services/goods, currency and other data provided by the person himself/herself, which are received by the Company in accordance with the legislation in the course of the activity of the Company and/or which the Company is obliged to process by law and/or other legislation.
• For the purpose of concluding and executing contracts, the following data shall be processed for representatives of the suppliers: name(s), surname(s), telephone number, e-mail address, company name, address, job title, data of authorization (number, date, date of birth of the authorized person, signature).
• Contracts, VAT invoices and other related documents shall be stored in accordance with the time limits set out in the General Index of Document Storage approved by Order of the Chief Archivist of Lithuania.
• The legal basis for processing – the necessity to perform a contract to which the customer is a party as a data subject or to take action at the request of the customer before entering into a contract with him/her (Article 6(1)(b) of the GDPR), where the processing of certain personal data is required by law (Article 6(1)(c) of the GDPR).

3.2.3 Execution of traineeship contracts. For this purpose, the following items of data are processed:

• Name(s), surname(s), personal identification number, if it is available and/or date of birth, signature, telephone number, e-mail address, address, educational institution, time of traineeship, activities.
• The personal data of trainees contained in the texts of relevant documents (contracts, orders, applications, etc.) (in cyberspace, in a paper document or in any other form of media) shall be stored in accordance with the time limits set out in the General Index of Document Retention approved by the Order of the Chief Archivist of Lithuania.
• The legal basis for processing is the need to perform a contract to which the trainee is a party as a data subject or to take action at the request of the trainee prior to the conclusion of a contract with the trainee (Article 6(1)(b) of the GDPR) and where the processing of certain personal data is required by law (Article 6(1)(c) of the GDPR).

3.2.4 Managing a database of CVs of job candidates. For this purpose, the following items of data are processed:

• Name(s), surname(s), date of birth (age), residential address, contact details (telephone number, e-mail address), information on the education of the candidate (training institution, period of training, education/qualifications obtained), information on further training (training attended, certificates obtained), information on the work experience of the candidate (employer, period of employment, duties, responsibilities and/or achievements), information on language skills, information technology, driving skills, other competences, other information you provide in your CV, cover letter or other application documents, references from employers, feedbacks: the persons recommending or giving feedback to, their contact details and the content of the recommendation or feedback.
• After the end of the selection period for a specific position and without the data subject having been selected and without an employment contract having been concluded with the data subject,the Company shall delete the curriculum vitae and other data sent by the candidates, unless the Company has obtained the consent of the candidate to process his/her personal data for a longer period of time in order to be able to offer the job position. In this case, the data of the data subject shall be stored for 6 (six) months from the date of submission of the data, as part of the automated processing. After the expiry of the specified period of processing and storage, the data will be destroyed by responsible persons of the data controller within 1 (one) week. Longer storage of personal data may be carried out when the personal data is necessary in the event of a dispute/complaint or on other grounds provided for by law.
• The legal basis for processing is the consent of the data subject (Article 6(1)(a) GDPR).
  
  3.2.5 Management of requests, comments and complaints. For this purpose, the following data are processed:
• Name(s), surname(s) and/or first name of the user, email address, telephone number, address, subject of the request, comment or complaint, text of the request, comment or complaint.
• The data on requests, comments and complaints shall be kept for 1 (one) year from the date of their submission.
• The legal basis for processing is that the processing is necessary for the purposes of the legitimate interests of the controller or of a third party, except where such interests or fundamental rights and freedoms of the data subject override those interests or fundamental rights and freedoms which make it necessary to ensure the protection of personal data, in particular where the data subject is a child (Art. 6 (1) (f) of the GDPR), and the consent of the data subject is required (Art. 6 (1) (a) of the GDPR).

3.2.6 Ensuring the quality of telephone advice on the services provided toimprove the quality of customer service, and by monitoring to ensure that information is provided competently and promptly (recording telephone conversations). For this purpose, the following items of data are processed:

• A record of the phone call, the phone number of the caller and the phone number of the call recipient, the date of the phone call and the duration of the phone call.
• Telephone records are kept for 3 (three) working days.
• The legal basis for processing is the consent of the data subject (Article 6(1)(a) GDPR).
  
  3.2.7 For the purpose of ensuring the security of employees, other data subjects and property (video surveillance). For this purpose, the following items of data are processed:
• Video surveillance systems do not use facial recognition and/or technologies for analysis and do not group or profile the video data captured by them according to a specific data subject (person). The data subject shall be informed about the video surveillance by means of information signs with the symbol of the video camera and the details ofthe Company, which shall be displayed prior to entering the monitored area and/or premises. The field of surveillance of CCTV cameras shall exclude premises where the data subject expects absolute protection of personal data.
• Personal data (video data) obtained by CCTV cameras shall be stored for up to 14 (fourteen) calendar days from the moment of recording and shall be automatically destroyed thereafter, unless there are grounds to believe that an offence, criminal offence or other illegal act has been recorded (until the end of the relevant investigation and/or proceedings).
• The legal basis for processing is that the processing is necessary for the purposes of the legitimate interests of the controller or of a third party, unless such interests of the data subject or the fundamental rights and freedoms of the data subject, which require the protection of personal data, override those interests, in particular where the data subject is a child (Article 6(1)(f) of GDPR).

3.2.8 Management of whistleblowers in the Company:

• Personal data of the notifiers: name(s), surname(s), personal identification number, place of work (service, employment or contractual relationship with ), position, telephone number, personal e-mail address or residential address.
• Details of the infringement: the infringement, the place and time of the infringement, and other information collected about the infringement.
• Person(s) who may have committed the infringement: name(s), surname(s), place of work, job title.
• Witness(es) to the infringement: name(s), surname(s), job title, workplace, telephone number, email address.
• Documents and data shall be stored in accordance with the time limits specified in the General Index of Document Storage approved by the Order of the Chief Archivist of Lithuania.
• The legal basis for processing is where the processing of certain personal data is required by law (Article 6(1)(c) GDPR).

3.2.9 Other purposes for whichthe Company is entitled to process the personal data of the data subject, where the data subject has expressed his or her consent, where the processing is necessary for the legitimate interest of the Company or where the processing of the data is required by relevant legal acts.

4. USE OF SOCIAL NETWORKS
   
   4.1 Any information you provide via social media (including posts, the use of the “Like” and “Follow” boxes, and other communications) is under the control of the operator of the relevant social network.
   4.2 Currently, ourCompany has an account on the social network “Facebook“, whose privacy policy is available at https://www.facebook.com/privacy/explanation;
   4.3 Currently, our Company has an account on the social network “Instagram“, whose privacy policy is available at https://help.instagram.com/519522125107875;
   4.4 Currently, ourCompany has an account on the social network “LinkedIn“, whose privacy policy is available at https://www.linkedin.com/legal/privacy-policy.
   4.5 We recommend that you read the privacy notices of third parties and contact the service providers directly if you have any questions about how they use your personal data.

5. PROVISION OF PERSONAL DATA
   
   5.1 The Company undertakes to respect the duty of confidentiality towards data subjects. Personal data may be disclosed to third parties only if this is necessary for the conclusion and performance of a contract for the benefit of the data subject or for other legitimate reasons.
   5.2 The Company may provide personal data to its data processors who provide services tothe Company and process personal data on behalf of the Company. The processors are only entitled to process the personal data in accordance with the instructions of the Company and to the extent necessary for the proper performance of their contractual obligations. The Company will only use processors who can provide sufficient guarantees that appropriate technical and organizational measures will be implemented in order to ensure that the processing complies with the requirements of the Regulation and to safeguard the rights of the data subject.
   5.3 The Company may also provide personal data in response to requests from the courts or public authorities to the extent necessary for the proper execution of applicable laws and regulations and to comply with the orders of the public authorities.
   5.4 The Company guarantees that personal data will not be sold or rented to third parties.

6. PROCESSING OF PERSONAL DATA OF MINOR CHILDREN
   
   6.1 Persons under the age of 14 may not submit any personal data through website of the Company. If a person is under the age of 14, in order to use the services ofCompany, the written consent of a representative (parent, mother, guardian) for the processing of personal data is required before personal information can be submitted.

7. STORAGE PERIOD FOR PERSONAL DATA
   
   7.1 The personal data collected by the Company is stored in printed documents and/or in the company’s information systems. Personal data is processed for no longer than is necessary to achieve the purposes of the processing or for no longer than is required by the data subjects and/or provided for by law.
   7.2 Although the data subject may terminate the contract and refuse the services ofthe Company, the Company remains obliged to keep the data of the data subject for the purpose of any future claims or legal claims that may arise, until the time the data retention periods expire.

8. RIGHTS OF DATA SUBJECT
   
   8.1 The right to receive information about processing.
   8.2 The right of access to processed data.
   8.3 The right to request rectification.
   8.4 The right to have your data deleted (“The right to be forgotten“). This right does not apply if the personal data for which erasure is requested is also processed on another legal basis, such as processing necessary for the performance of a contract or the performance of an obligation under applicable law.
   8.5 The right to restrict the processing.
   8.6 The right to disagree with the processing.
   8.7 The right to data portability. The right to data portability must not adversely affect the rights and freedoms of others. The data subject shall not have the right to data portability in respect to personal data which is processed in non-automatically structured files, such as paper files.
   8.8 The right to request that a decision based solely on automated processing, including profiling, is not applied.
   8.9 The right to lodge a complaint about the processing of personal data with the State Data Protection Inspectorate.

9. The Company is obliged to enable the Data Subject to exercise the rights of the above-mentioned data subject, except in cases provided for by law, where it is necessary to ensure national security or defense, public order, the prevention, investigation, detection or prosecution of criminal offences, the protection of important economic or financial interests of the State, the prevention, investigation and detection of breaches of official or professional ethics, or the protection of the rights of the data subject or rights or freedoms of other person.

10. PROCEDURES FOR EXERCISING THE RIGHTS OF THE DATA SUBJECT

10.1 In order to exercise their rights, the data subject may contactThe Company:

10.1.1 by written application in person, by post, by a representative or by electronic means – via email: info@osama.lt;

10.1.2 verbally by phone: +370 37 352404;

10.1.3 in written form to the address:Energetikų g. 46 , Kaunas.

10.2 In order to protect against unauthorized disclosure,the Company shall verify the identity of the data subject, upon receipt of thedata subject’s request for data or for the exercise of other rights.

10.3 The Company shall reply to the data subject at the latest within one month from the date of receipt of the request of the data subject, taking into account the specific circumstances of the processing of personal data. This period may be extended by a further two months if necessary, depending on the complexity and number of requests.

11. RESPONSIBILITIES OF DATA SUBJECT
    
    11.1. The data subject must:
    11.1.1 informthe Company of any changes to the information and data provided. It is important  to have the data subject’s correct and valid information;
    11.1.2 provide the necessary information to enable the Company to identify the data subject at the request of the data subject and to verify that he or she is actually communicating or cooperating with a specific data subject (to provide proof of identity or by means of a procedure established by law or by means of electronic communications which permit the data subject to be properly identified). This is necessary for the protection of the data of the data subject and the data of others, so that the information disclosed about the data subject is provided only to the data subject, without prejudice to the rights of other persons.

12. FINAL PROVISIONS 
    
    12.1 By submitting personal data tothe Company, the data subject accepts this Privacy Policy, understands its provisions and agrees to comply with it.
    12.2 As part of the development and improvement ofthe Company, the Company has the right to unilaterally change this Privacy Policy at any time. The Company has the right to unilaterally modify this Privacy Policy, in whole or in part, by means of a notice on the website: www.osama.lt.
    12.3 Amendments or changes to the Privacy Policy shall come into force from the date of their publication, i.e. from the date on which they are posted on the website: www.osama.lt.