Privacy policy

The controller of the personal data referred to in this Privacy Policy: is UAB “Okredo”, legal entity code 304106783 (hereinafter referred to as the "Company", the "Data Controller", “Okredo” or "We").

Who is this privacy policy for?

We care about your privacy and the protection of your personal data; therefore, we process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter referred to as the "Regulation"), the Law on the Legal Protection of Personal Data and other legal acts regulating the protection of personal data. Therefore, to ensure fair and transparent information about the processing of your personal data, we publish this privacy policy ("Policy").

In this Policy, we describe which of your personal data we collect and for what purposes we process it when you use our services; and/or open data platform www.okredo.com (hereinafter referred to as the "Okredo Platform"), visit our social networking accounts (Facebook, LinkedIn), or otherwise communicate with us. This Policy also contains important information about the protection of your personal data, the rights you have and how to exercise them. Therefore, please take the time to review this Policy and if you have any questions, please do not hesitate to contact us using the contact details provided. Please note that we reserve the right to change this Policy in the future. You will not receive additional notice of any changes, and we encourage you to review this Policy periodically.

Basic concepts and processing principles.

Personal data means any information relating directly or indirectly to you where your identity is known or can be established, directly or indirectly, by reference to relevant data (such as name, surname, telephone number, email address, etc.).

Processing of personal data means any operation performed on personal data (including collection, recording, storage, editing, modification, access, retrieval, transmission, archiving, etc.).

The Company complies with the following principles when processing your personal data:

Your personal data shall be processed only to the extent necessary to achieve the relevant clearly defined and legitimate purposes, considering the protection of your privacy.
Your personal data shall be processed accurately, fairly, and lawfully and shall be processed only for purposes that are consistent with the purposes specified before your personal data were collected.
Your personal data is processed in strict compliance with the clear and transparent requirements for the processing of personal data set out in the legislation.
Your personal data shall be processed only in a form which permits identification of your identity for no longer than is necessary for the purposes for which the personal data are processed.
The processing of your personal data is subject to appropriate technical and organizational measures to ensure the security of the personal data, including protection against unauthorized processing and against accidental loss, destruction, and damage.

How do we protect your personal data?

In processing your personal data, we apply appropriate organizational and technical data security measures to protect your personal data against accidental or unlawful disclosure, destruction, alteration, or other unauthorized acts. These measures are chosen considering the risks to your rights and freedoms as a data subject.

In this case, we ensure strict access control to the personal data we process, so we only grant access to the personal data to those employees who need your personal data to carry out their job functions and we monitor how the access granted is used. Access to personal data is secured using passwords at the appropriate level and by confidentiality agreements with the persons who have access to your personal data.

Please note that all Company employees who have access to your personal data are aware of the requirements for the protection of personal data and are obliged to ensure the confidentiality of the personal data processed.

External links on the Okredo platform.

The Okredo Platform may contain links to external websites, such as the websites of our business partners or websites that contain information that is relevant or interesting to you. If you follow such links to any of these websites, please note that the information and/or services provided on these websites are not affiliated with Us. Therefore, we do not accept any responsibility or liability for the services provided and/or personal data processed on these websites. Please note that if you move from the Okredo Platform to external websites operated by third parties, you should review the privacy policies of these websites and familiarize yourself with the processing of personal data on them.

For what purposes and what personal data do we process?

The Company processes your personal data for the following purposes:

1. Administration of public information about legal entities, for the purpose of informing the public:

Publication of general (public) information about legal entities on the Okredo platform (including the personal data of the head of the legal entity).

2. For administering enquiries (i.e., handling your requests, complaints, claims)

3. For direct marketing purposes:

4. Provision of services on the OKREDO platform (including account administration)

5. Provision of information services on the OKREDO platform (i.e., the development of OKREDO products and the provision of related goods and/or services to interested third parties)

6. Representation of the company (i.e., administration of social network accounts and/or other communication in public space).

7. For recruitment purposes (i.e., recruitment and hiring of employees).

More information on the processing of personal data for the purposes mentioned above

1. Public disclosure of information about legal entities, for the purpose of informing the public

Legitimacy condition(s) for processing: personal data are processed in accordance with the legitimacy condition for processing set out in Article 6(1)(f) of the Regulation (i.e., the Company’s legitimate interest in publishing information of a public nature and the public’s legitimate interest in knowing). Please note that public information about legal entities is published on the Okredo platform in accordance with the legal regulation.

Type of personal data processed: The Company publishes the following personal data of representatives of legal entities: name, surname, position.

Storage period: The company processes (publishes) only relevant information and relevant personal data, therefore the information is stored only for as long as it is relevant and corresponds to the information published in the public registers. Historical information is only stored if it is required by law or for the performance of our activities.

Source of personal data: We collect and update data about the company (including personal data of the company’s representatives) from official and approved sources (e.g. registers regarding legal entities in the Lithuania, Latvia, Estonia, Poland, United Kingdom and/or other public information registers) and/or such data distributors.

2. Administration of enquiries

Condition(s) of lawfulness of processing: Personal data shall be processed in accordance with the conditions of lawfulness of processing set out in Article 6(1)(a), (c), (f) of the Regulation:

Where the data subject makes enquiries about matters of interest to him/her using the contacts provided on the Okredo platform, point (a) shall apply, i.e., the data subject making the enquiry consents to the processing of his/her personal data for the purpose of answering the enquiry he/she has made (for the purpose of administering the enquiry).
Where the enquiry relates to complaints, claims made by data subjects in relation to a possible violation of your rights and/or interests protected by law, then point (c) or (f) applies, i.e., processing is necessary for compliance with an applicable legal obligation; or for the purposes of the legitimate interests of the Company and/or third parties (to assert, enforce, or defend a legal claim).
Type of personal data processed: the Company processes personal data of the data subjects (who have made the enquiry): name, surname, e-mail address, telephone number (where indicated), as well as the subject of the enquiry and the content of the enquiry (message), complaint or another request.
Retention period: The above personal data shall be processed for the duration of the examination and/or execution of the enquiry and shall not be retained for more than 3 years from the date of examination and/or execution of the enquiry. We note that information (including personal data) relating to complaints may be retained for up to 10 years, provided that the complaint or request, remark, claim, feedback or other enquiry has not been dealt with or is still being dealt with within that period, and provided that the personal data is necessary to protect our legitimate interests or those of third parties, e.g. in the event of a statutory limitation period or a legal dispute, or where the complaint has been settled by means of a settlement agreement.
Source of personal data: We receive this data directly from data subjects when they make an enquiry to us.

3. Direct marketing

Condition(s) of lawfulness of processing: personal data shall be processed in accordance with the conditions of lawfulness of processing set out in Article 6(1)(a), (f) of the Regulation:

Where the data subject uses the Okredo platform and/or otherwise uses (orders) services provided by the Company, then point (f) applies, i.e., the Company has a legitimate interest in using the email contact details received from its customers for the purpose of marketing its own similar goods or services (if allowed by applicable law).

Type of personal data processed:

When marketing its own similar products: name, surname, e-mail address and/or telephone number.

Retention period: the above personal data shall be processed for a period of 5 years from the date of registration on the platform and/or the date of ordering the services, or until the date of objection.

Source of receipt of personal data: We obtain this data directly from data subjects when they provide it while using the services offered by the Company.

4. Provision of services on the OKREDO platform (including account administration)

Purpose of processing personal data: The personal data is processed in accordance with the conditions for the lawfulness of the processing set out in Article 6(1)(b), (f) of the Regulation:

Where a data subject registers on the Okredo Platform (i.e., creates an account and uses Okredo services, including placing orders) then point (b) applies, i.e., the processing is necessary for the performance of a contract to which the data subject is a party, or for the purpose of acting at the data subject’s request prior to the conclusion of the contract.
Article 6(1)(f) of the Regulation applies, when Okredo: (1) pursue legitimate interests in entering into and performing contracts with legal entities and maintaining commercial relationships; (2) ensure the quality of services provided on the OKREDO platform and the administration of accounts (including account support, maintenance, improvement, and enhancement of the account and/or the goods and services offered, and other services related to account administration).

Type of personal data processed:

Data relating to natural persons of clients/customers: name, surname, e-mail address, telephone number (optional data), taxpayer data (e.g., address, VAT number, taxpayer identification number, etc.), information about service orders, order history, search queries, etc.; login and/or browsing data (e.g., IP address, connection information, activity, actions taken, etc.);
Data of representatives of legal persons of customers/clients: name, surname, e-mail address, telephone number (optional), position and information of the company represented.

Retention period: The above personal data shall be processed for the duration of the contract (order) and for 10 years after the expiry of the contract. When the data subject (i.e., a registered user of the Okredo platform) does not place any orders and does not enter any service contracts, then this account will be retained until it is deleted, but for no longer than 10 years from the date of the last login to the account.

Source of personal data: We receive this data directly from data subjects when they register their account on the Okredo platform (i.e., the data is collected on the registration form) and/or when they use their account.

5. Provision of information services on the OKREDO platform (i.e., the development of OKREDO products and the provision of related goods and/or services to interested third parties)

Legal basis for processing: Personal data is processed in accordance with the legal basis for processing set forth in Article 6(1)(f) of the Regulation:

The Company, in developing reports on legal entities, assessment models, and/or other products that enable interested parties to assess the reliability of legal entities registered in Lithuania, Latvia, Estonia, Poland, United Kingdom creditworthiness, carry out debt collection, company monitoring, customer screening, and the prevention of money laundering and/or terrorist financing, processes the personal data of representatives of legal entities (i.e., managers, owners, sole shareholders, etc.) in accordance with its legitimate interest in developing these products and providing the aforementioned goods and/or services to interested third parties (the Company’s clients) and the legitimate interest of interested third parties to know and/or making reasonable and informed decisions regarding matters relevant to them (e.g., when evaluating potential business partners, future or current employers, service providers, and/or debtors).

Type of personal data processed:

Personal data of representatives of legal entities (i.e., managers, owners, sole shareholders): first name, last name, unique identifier*, date of birth (DD-MM-YYYY)
Data on the representative’s status (e.g., start and end dates of management, etc.), as well as information about companies associated with this person (e.g., name of the legal entity, code, and other data on the legal entity provided in extracts from the public registers of legal entities (including the personal data of representatives of legal entities);
In addition, data on the companies represented by the aforementioned representative’s from public data sources, public registers, etc.

Retention period: Data from the public registers and/or other public sources (including the personal data of representatives) is processed for the entire duration of the legal entity’s existence and after its termination (i.e., for as long as the data is necessary for the intended purposes). Products created for specific legal entities (e.g., various reports) are prepared and provided in accordance with a specific order from the Company’s client, and the content of these reports is processed (stored) on the OKREDO platform for the entire duration of the client’s account, but for no longer than 10 years.

Source of personal data:

Data on legal entities registered in the Republic of Lithuania (including representatives) is collected from the Register of Legal Entities, and/or data distributors for the registers, the Court Administration, the State Social Insurance Fund Board under the Ministry of Social Security and Labor (Sodra), the Department of Statistics, and other sources;
Data on legal entities registered in the Republic of Latvia (including representatives) is collected from The Register of Enterprises of the Republic of Latvia (Latvian: Uzņēmumu reģistrs), State Tax inspectorate (Valsts ieņēmumu dienests), Court administration (Tiesu administrācija), etc.
Data on legal entities registered in the Republic of Estonia (including representatives) is collected from The Estonian Business Register (Estonian: E-äriregister), State tax inspectorate (est. Maksu- ja Tolliamet), Court administration (Kohtute infosüsteem / Riigikohus), etc.
Data on legal entities registered in the Republic of Poland (including representatives) is collected from National Court Register (Polish: Krajowy Rejestr Sądowy), registry of beneficial owners (Centralny Rejestr Beneficjentów Rzeczywistych), etc.
Data on legal entities registered in the United Kingdom (including representatives) is collected from The Companies House, etc.

*A unique identifier is generated individually by the Company for each representative of a legal entity (i.e., manager, owner, sole shareholder) and assigned on the OKREDO platform for the purpose of identifying a specific natural person and is used to uniquely associate that person with specific legal entities related to them. This unique identifier is assigned and used as an alternative to a personal identification number (i.e., by replacing the legal entity representative’s personal identification number received from the registers with a unique identifier (RID) in the Company’s systems). In this way, the Company implements the principle of data minimization and can properly identify a specific data subject without processing the subject’s personal identification number, thereby ensuring that accurate data is used for the development of the aforementioned products.

6. Representation of the company

Processing legality condition(s): Personal data are processed in accordance with the processing legality conditions set out in Article 6(1)(a), (f) of the Regulation:

Where a data subject communicates with Us using social networks and/or visits accounts administered by Us, then point (a) shall apply, i.e., the data subject providing the communication gives consent to the processing of the personal data he/she provides.
The accounts managed by the Company on the social networks (including personal data) shall be processed in accordance with point (f), i.e., the processing is necessary for the purposes of the legitimate interests of the Company (i.e., for the purpose of the Company’s proper representation, communication, and advertising in the public domain).

Type of personal data processed: The Company processes personal data of social network users on the accounts it manages: name; information about the communication on the account ("like", "follow", "comment", "share", etc.); photos (profile and/or with the Company’s name on them); the message sent; the information about the message (time of receipt of the message, the content of the message, attachments to the message, correspondence history, etc.); information about participation in events and/or games organised by the Company (participation, non-participation, interest, fulfilment of game rules, etc.); and information about the Company’s rating (rating score, review, etc.).

Storage period: the data shall be stored on social media platforms no longer than the data subject’s consent is valid (i.e. until the deletion/removal of the personal data provided from the account and/or platform). Please note that the specific data retention periods are set by the social network platform owners. In the Company uses the personal data collected for this purpose for other purposes, the data is a subject to different retention periods (in accordance with the specific purposes of use of the data).

Personal data source: We receive this data directly from data subjects when they provide it to us on they accounts that they manage on social network platforms.

Additional information: In order to be able to properly represent the Company, to communicate with data subjects and to increase the awareness of our brand OKREDO in the public space, the Company owns and manages the following social network accounts:

Please note that the personal data provided on social networks is processed jointly with the owners of social network platforms (i.e. Facebook; LinkedIn platform), therefore, for further information on the processing of personal data on social networks, we suggest you to read privacy policies provided by owners and managers of social network platforms.

7. Employment purpose

Legitimacy condition(s) for data processing: applicants’ personal data is processed in accordance with the legitimacy condition for processing set out in Article 6(1)(a) of the Regulation, i.e. by applying for a job in the Company and submitting his/her personal data to us for this purpose, the applicant is giving his/her consent to the processing of his/her application for employment with the Company, to the assessment of his/her suitability for employment with the Company, and to the communication and/or communication with him/her on the progress of the recruitment process.

Type of personal data processed: the Company processes the data of individuals who wish to be employed by the Company and who have provided data about themselves (CV (curriculum vitae) and/or cover letter):

Name, surname, date of birth, place of birth, address, e-mail address, telephone number, educational degree, program, year of study, institution, location, name of former employers, period of employment at former employers, positions held at former employers, responsibilities, functions from previous employers, foreign languages spoken and their level, information on ability to work with computer programs, information on seminars or other qualifications, training (name, date, institution), information on the type of job the candidate wishes to do, preferred place of work (city/position), preferred salary, hobbies, personal qualities, or other data and motives, and any other ("supplementary") information contained in the CV, the content of which is beyond the Company’s influence;
Also, the candidate’s cover letter or references and the information contained therein on the candidate’s performance/performance of job functions, competences, personal qualities, the contact details of the person recommending the candidate (e-mail address, telephone number) and/or the comments/assessment of the recruiter.
Retention period: Personal data provided by applicants shall be retained for a maximum period of 1 month from the date of the end of the selection process for a specific job (where the applicant is applying for a specific job); and/or 1 year from the date of receipt of the data (where the applicant submits his/her data to the Company for the purpose of applying for future selections.
Source of receipt of personal data: We receive this data directly from data subjects when they apply for employment with the Company and send their data. Please note that letters sent by applicants should not contain information of a private nature (i.e., personal life), so we recommend that you protect your own privacy and think carefully about what personal data you may provide before sending your CV to us.

Who can your personal data be provided to?

It should be noted that data processed for the purpose of public information is published on the OKREDO platform and is publicly available to every visitor to the website (some data may be accessible only to registered users). Additionally, data processed for the purpose of providing information services on the OKREDO platform may be provided (including sold) to the Company’s customers (including registered users).

We will not use your personal data in any way other than in accordance with this Privacy Policy. However, we reserve the right to provide information about you if we are required to do so by law or if we are requested to do so by lawful law enforcement authorities or prosecuting authorities.

If necessary, we may disclose the data collected about you to the following third parties (data processors), i.e., service providers (e.g., technical service providers in the performance of our contracts with these service providers, including the performance of services for sending newsletters); and/or service providers whose services we normally use for data storage, telecommunications, and hosting purposes on the Okredo platform.

Please note that the above service providers are limited in their ability to use your data for purposes other than providing services to us, i.e., the data will only be transferred to the extent necessary for the performance of a specific personal data processing contract.

What rights do you have and how can you exercise them?

Data subjects whose personal data we process have the right to:

Request access to and a copy of their personal data.
Request the rectification or restriction of inaccurate or incomplete personal data.
Request the erasure of personal data that are excessive or unlawfully processed.
To object to the processing of his/her personal data.
To request the transfer of his/her personal data provided in a structured, computer-readable format.
The right to withdraw his or her consent at any time where the processing is based on the data subject’s consent (pursuant to Article 6(1)(a)). Withdrawal of the data subject’s consent shall not affect the lawfulness of the processing prior to the withdrawal of consent.
lodge a complaint with the national supervisory authority (E.g., State Data Protection Inspectorate).

The Company does not use solely automated processing, including profiling, for the purpose of making decisions based on the processing of data that could lead to legal consequences for you or similarly affect you significantly.

The data subject may exercise his/her rights by submitting a written request to the Company in person (to an employee of the Company), by mail, through a representative or by electronic means: by e-mail: [email protected].

When submitting a request, the data subject must confirm his or her identity in one of the following ways:

By submitting the request by post or by courier, enclosing a copy of a valid identity document certified in accordance with the procedure established by law.
By submitting the application electronically, authenticated by electronic means of communication which allow proper identification of the person (e.g., mobile signature, qualified electronic signature, etc.).

Upon the receipt of your request regarding the exercise of the rights of data subjects, we will provide you with a reply without delay, but at the latest within 1 month from the date of the request. This period may be extended by a further two months if necessary, depending on the complexity and number of requests. You will be informed of any such extension in the first month. The information you request will be provided free of charge. However, if we see that your requests are manifestly unfounded or disproportionate, in particular because of their repetitive content, we have the right to charge a reasonable fee (i.e., to request reimbursement of administrative costs) or to refuse to act on such a request from the data subject.

A response will be provided in the manner chosen in your request. If you do not specify in your request the method by which you wish to receive the response, the response will be sent to you in the same way as the request was made.

Any further questions?

For any questions you may have regarding the services provided by the Company and/or this Policy, please contact us by email at: [email protected].