Procedures for exercising the rights of the data subject

1. ABBREVIATIONS AND TERMS

   • Abbreviations:

     • Company – UAB "TCG TELECOM", legal entity code 304120498, registered office at Perkūnkiemio g. 7, LT-12131, Vilnius, Lithuania.

     • Procedure – this procedure for exercising the rights of the data subject.

     • Rules – the Company's general rules for the processing of personal data.

     • Description – a description of the Company's standard procedures for processing personal data.

     • GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation).

     • ADTAĮ – Law on Legal Protection of Personal Data of the Republic of Lithuania.

     • ERO – Law on Electronic Communications of the Republic of Lithuania.

     • Employees of the Company – persons employed by the Company, with whom employment contracts have been concluded, as well as persons equivalent to them, acting on behalf and in the interests of the Company.

     • Company's website – www.tcg.lt.

   • The terms used herein are the same as those used in the GDPR and the Rules.

2. SCOPE

   • The purpose of this Procedure is to set out the procedure for the exercise of the rights of data subjects in order to implement the principle of accountability.

   • The Procedures apply throughout the Company.

   • The Procedures form an integral part of the Company's standard procedures for processing personal data.

   • All employees of the Company who process personal data or who, in the course of their duties, become aware of, or have the potential to become aware of, personal data are required to comply with this Procedure.

   • The Company shall comply with the GDPR, the DPA and the EIR in exercising the rights of the data subject.

3. RIGHT TO RECEIVE INFORMATION ABOUT PROCESSING

   • Information on the processing of the data subject's personal data by the Company, as referred to in Articles 13 and 14 of the GDPR, shall be provided orally and/or in writing at the time of receipt of the personal data, and shall be published on the Company's website in the Company's documents on the processing and protection of personal data.

   • IInformation on the processing of personal data of data subjects shall be provided at the time of receipt of personal data.

   • Where personal data of a data subject is not collected directly from the data subject, unless otherwise provided for by applicable law (e.g. Article 14(5) of the GDPR) and/or by the Company's internal documents which are applicable to the data subject, the processing of personal data of that data subject shall be notified:

     • within a reasonable period of time after receipt of the personal data, but at the latest within one month, taking into account the particular circumstances of the processing;

     • if the personal data will be used to communicate with the data subject, at the latest at the time of the first contact with that data subject; or

     • if the personal data are to be disclosed to another recipient, at the latest at the time of the first disclosure.

4. RIGHT OF ACCESS TO DATA

   • The Company shall, at the request of the data subject to exercise the right of access to his/her personal data, provide:

     • information as to whether or not the personal data of the data subject are being processed;

     • the information relating to the processing of the personal data provided for in Article 15(1) and (2) of the GDPR, if the data subject's personal data are processed;

     • a copy of the personal data processed.

   • The data subject shall have the right to request a copy of the personal data processed in a form other than that provided by the Company, subject, however, to a fee set by the Company based on the administrative costs.

5. RIGHT TO REQUEST RECTIFICATION

   • The data subject shall have the right, in accordance with Article 16 of the GDPR, to have any inaccurate personal data processed by him or her rectified and any incomplete personal data completed.

   • In order to verify that the personal data of the data subject being processed is inaccurate or incomplete, the Company may request the data subject to provide evidence of this.

   • If the personal data of the data subject (as rectified at the request of the data subject) have been transmitted to data recipients, the Company shall inform those recipients of the transmission, unless this would not be possible or would require a disproportionate effort. The data subject shall have the right to request information about such recipients.

6. THE RIGHT TO REQUEST ERASURE ("RIGHT TO BE FORGOTTEN")

   • The right of the data subject to erasure of his or her personal data ("right to be forgotten") shall be exercised in the cases provided for in Article 17 of the GDPR in all cases in relation to those personal data processed for the purposes set out below:

     • Processing of data for direct marketing purposes;

   • The data subject's right to have his or her personal data erased ("right to be forgotten") may not be exercised in the cases provided for in Article 17(3) of the GDPR.

   • If the personal data of the data subject (erased at the request of the data subject) have been transferred to data recipients, the Company shall inform these recipients of the transfer, unless this would not be possible or would require a disproportionate effort. The data subject shall have the right to request information about such recipients.

7. RIGHT TO RESTRICT PROCESSING

   • In the cases provided for in Article 18(1) of the GDPR, the Company must exercise the data subject's right to restrict the processing of his or her personal data.

   • The personal data whose processing has been restricted shall be stored and the data subject shall be informed in writing, orally and/or by electronic means before such restriction is lifted.

   • If the data subject's personal data (the processing of which has been restricted at the request of the data subject) have been transferred to data recipients, the Company shall inform those recipients of the transfer, unless this would be impossible or would require disproportionate effort. The data subject shall have the right to request information about such recipients.

8. RIGHT TO OBJECT TO PROCESSING

   • The data subject shall have the right, in accordance with Article 21 of the GDPR, to object at any time, on grounds relating to his or her particular situation, to processing of his or her personal data by the Company, unless otherwise provided by applicable law and/or the Company's internal documents applicable to the data subject.

   • The Company shall inform the data subject of his/her right to object to the processing of his/her personal data by means of oral, written and/or website information, as well as in the Company's internal documents applicable to the data subject.

   • If the data subject objects to the processing of personal data, such processing shall only be carried out if it is reasonably decided that the reasons for processing the personal data override the interests, rights and freedoms of the data subject or if the personal data are necessary for the establishment, exercise or defence of legal claims.

9. RIGHT TO DATA PORTABILITY

   • The data subject's right to data portability provided for in Article 20 of the GDPR shall in all cases be exercised by the Company in respect of personal data processed by automated means on the basis of the data subject's consent or a contract to which the data subject is a party.

   • The Company shall have the right to refuse to exercise the data subject's right to data portability where the Company does not process the data subject's personal data by automated means on the basis of the data subject's consent or on the basis of a contract to which the data subject is party. The data subject shall not have the right to data portability in respect of personal data which are processed in non-automated structured files, such as paper files.

   • Where the Company does not carry out processing of personal data for which the data subject may exercise the right to data portability under Article 20 of the GDPR, the right to data portability shall not be exercised.

   • The data subject must indicate whether he or she wishes his or her personal data to be transferred to him or her or to another controller when applying for the right to data portability.

   • The transfer of personal data pursuant to a data subject's request shall not automatically erase the personal data. If the data subject so requests, he or she must contact the controller to exercise the right to have the data erased ('right to be forgotten').

10. THE RIGHT TO HAVE A DECISION BASED SOLELY ON AUTOMATED PROCESSING, INCLUDING PROFILING, DISAPPLIED

    • The data subject shall have the right to have a decision based solely on automated processing with respect to him or her overturned and to have such decision reviewed.

    • Where the data subject requests a review of a decision based on automated processing, the controller must carry out a thorough assessment of all relevant data, including information provided by the data subject.

11. MAKING A REQUEST FOR THE EXERCISE OF THE DATA SUBJECT'S RIGHT

    • The data subject shall have the right to request the exercise of the data subject's rights orally or in writing, in person, by post or electronically at info@tcg.lt.

    • If the application for the exercise of the data subject's rights is made orally or in writing in person, the data subject shall be required to provide proof of identity by means of a document proving his or her identity. Failure to do so shall result in the non-enforcement of the data subject's rights. This provision does not apply if the data subject requests information on the processing of personal data in accordance with Articles 13 and 14 of the GDPR.

    • If the exercise of the data subject's rights is requested in writing, by mail, then a notarised copy of the identity document must be submitted with the request. In the case of a request made by electronic means, the request must be signed with a qualified electronic signature or be made by electronic means which ensure the integrity and the unalterability of the text. This provision does not apply if the data subject requests information on the processing of personal data in accordance with Articles 13 and 14 of the GDPR.

    • The request for the exercise of the data subject's rights must be legible, signed by the data subject, and contain the data subject's name, surname, address and/or other contact details for contacting the data subject or for obtaining a response regarding the exercise of the data subject's rights. The Company may, in individual cases, request additional data or information.

    • The data subject may exercise his or her rights himself or herself or through a representative.

    • The representative of the data subject shall indicate in the request his/her name, address and/or other contact details for communication, by which the representative of the data subject wishes to receive a reply, as well as the name of the person represented, and shall provide a document or a copy of a document confirming representation. The Company may, on a case-by-case basis, request additional data or information.

    • In case of doubt as to the identity of the data subject, the controller shall request additional information necessary to verify it.

    • When making a written request for the exercise of the data subject's rights, it is recommended to submit a request in the form set out in the Annex to the Procedures.

    • In all matters relating to the processing of personal data of the data subject and the exercise of his/her rights, the data subject shall have the right to contact the Data Protection Officer of the Company (telephone number +370 52 058212, e-mail address info@tcg.lt). In order to ensure the confidentiality provided for in Article 38(5) of the GDPR, when contacting the Data Protection Officer by post, the envelope shall be marked as addressed to the Data Protection Officer.

12. HANDLING A REQUEST TO EXERCISE THE DATA SUBJECT'S RIGHTS

    • Upon receipt of a request from a data subject, the data subject shall be provided, within one month of receipt of the request at the latest, with information on the action taken in response to the request. If there is a delay in providing the information, the data subject shall be informed within the specified time limit, indicating the reasons for the delay and the possibility of lodging a complaint with the State Data Protection Inspectorate.

    • If the request is not submitted in accordance with the procedures and requirements established by the Company, it shall not be examined and the data subject shall be informed immediately, but at the latest within 5 working days, indicating the reasons for this.

    • If, during the examination of the request, it is established that the data subject's rights are restricted on the grounds provided for in Article 23(1) of the GDPR, the data subject shall be informed thereof.

    • The information in response to a data subject's request for the exercise of his or her rights shall be provided in Lithuanian.

    • All actions in response to requests from the data subject to exercise the data subject's rights shall be carried out and information shall be provided free of charge, with the exceptions referred to in Article 12(5) of GDPR.

    • The data subject shall have the right to complain against the Company's actions or omissions in the exercise of the data subject's rights to the State Data Protection Inspectorate, A. Juozapavičius g. 6, Vilnius, e-mail: ada@ada.lt, website: https://vdai.lrv.lt/lt/, or to a court of law of the Republic of Lithuania, in the manner and under the conditions established by the legislation.

    • In the event of material or immaterial damage as a result of the violation of the data subject's rights, the data subject shall have the right to compensation, for which he/she shall have the right to apply to a court operating in the Republic of Lithuania in accordance with the procedures and conditions established by the legislation.