Privacy Policy

We, UAB OPAY Solutions, code of legal entity 302664558 (OPAY, “We”), take care of the protection and privacy of the personal data of our customers and other data subjects whose personal data we process (hereinafter - You) and take your privacy very seriously. Therefore, as your data controller, we aim to inform you about the processing of your personal data in detail.

Take the time to review this Policy, as it describes our collected data and the purposes we process it when you visit this page, intend to use or use our provided payment services, follow us or communicate on social networks, intend to apply for relevant positions at OPAY or otherwise. It also provides important information about the protection of your data, especially about the rights guaranteed to you by legislation.

We respect your privacy and undertake to process and store your personal data fairly and legally, in accordance with the requirements of the applicable legislation of the European Union and the Republic of Lithuania and the instructions of the controlling authorities. When processing your personal data, we comply with the principles and requirements related to the processing of personal data set out in the General Data Protection Regulation (hereinafter - the Regulation or GDPR), apply appropriate technical and organizational measures to protect personal data from loss, unauthorized use and disclosure and alteration.

The definitions used in the present Privacy Policy:

Client is a business customer, natural person or legal entity who has registered and created an account in the OPAY system and sells goods and/or services.

Payment is the payment order submitted by the Payer through OPAY for the goods and/or services or another procedure allowed by OPAY.

Payment service is the mediation services provided to the Client, with the help of which the Payers are given the opportunity to pay for goods and/or services.

Payer is a natural person or legal entity who initiates payment orders to pay for goods and/or services purchased from the Client’s website using the Company’s OPAY mediation services.

Goods and/or services / Services are the goods and/or services sold in an online store.

Regulation, GDPR is the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

Other definitions (e.g., data controller, data processor, special categories of personal data, personal data processing, etc.) are understood as they are defined and interpreted in the Regulation.

The law of the Republic of Lithuania is applied to the Privacy Policy.

SOURCES OF PERSONAL DATA PROCESSING

Personal data can be obtained in various ways:

Directly from you (for instance, when you use payment services, enter into contracts with OPAY on your own behalf or by representing other persons, when you send your curriculum vitae (CV) or other information related to employment or otherwise contact us, communicate with us through social networks or simply follow our activities on social networks or browsing the website).

From third parties (we may also obtain data and information about you indirectly through the provision of payment services (for instance, from your bank or trader from whom you purchase goods or services), if you have given your express consent at the time of payment initiation).

From databases, registers and information systems that accumulate separate data, other public sources, including, but not limited to the financial institutions, the State Enterprise “Centre of Registers”, public Register of Invalid Personal Documents, public Register of Wanted Persons, lists of international sanctions.

We inform you that you are not obliged to provide any personal data, but it is possible that we will not be able to provide you with services and achieve other set goals as a result.

WHAT YOUR PERSONAL DATA WE PROCESS?

We process your personal data for the main purposes specified below in the present Policy.

PURPOSES RELATED TO PROVISION OF PAYMENT SERVICES

Conclusion and execution of contracts for payment service provision

For the purpose of conclusion and execution of contracts for payment service provision, we process the following personal data of OPAY Clients - natural persons:

Name, surname

Personal code, date of birth

Place of residence (address)

Phone number

Email address

Bank account

Physical or electronic signature

If the contract for payment service provision is concluded with legal entity, we process the following personal data of the representative of the legal entity:

Name, surname

Position

Data related to representation

Contact details (phone number, email address)

Physical or electronic signature

Legal ground for data processing – execution of the contract between OPAY and the Client or when it is necessary to act at the Customer’s request before concluding the contract (Article 6 (1) (b) of GDPR).

Data storage period – during the contract validity and 10 years after the contract expiration and/or execution of contractual obligations.

Payment processing for payers

For the purpose of providing service to payment processing payers and payment processing clients and users (payers), we process the following personal data of the Payers:

Name, surname

Personal code (if specified)

Bank name and bank account number

Shopping cart identification data

Email address

Phone number

IP address

Other data necessary to create a payment order and provide information about payment execution/non-execution*.

* – the exact list of other processed categories of personal data depends on the requirements of your bank and the payment method selected by the seller or service provider from whom you seek to purchase goods or receive services.

Legal ground for data processing – legal obligation applied by OPAY and arising from the Law on Payments of the Republic of Lithuania (Article 6 (1) (c) of GDPR).

Data storage period – data is stored for no longer than 3 years, unless other legislation stipulate otherwise.

Personal data recipients – your personal data is transferred to the recipients of the transferred funds (i. e., to OPAY Clients whose goods or services you purchase), your bank.

Use of the function “Remember me”

OPAY enables the Payer to express consent through active actions and make the next payment to the relevant Customer faster to ensure the best payment experience. By ticking the checkbox "Remember me", the Payer agrees for OPAY to remember email and IP addresses that help to pay more conveniently with the payment methods offered by OPAY. For this purpose, we process the following personal data of the Payers:

Email address

IP address

Legal ground for data processing – the consent of the Payer for OPAY to remember his/her data for faster payment (Article 6 (1) (a) of GDPR).

Data storage period – 90 days from the date of submission of consent. After this period, the consent can be resubmitted.

Consent withdrawal – at any time by informing OPAY about the consent withdrawal by email [email protected].

PURPOSES RELATED TO IMPLEMENTATION OF MONEY LAUNDERING AND TERRORIST FINANCING PREVENTION

Implementation of the principle “Know Your Customer” of money laundering ad terrorist financing prevention

For the purpose of implementing the principle "Know Your Customer" of identification and prevention of money laundering and terrorist financing, we process the following data of OPAY Clients, their representatives and shareholders:

Name, surname

Date of birth

Citizenship

Address

Copy of personal data documents and its details

Data specified in the Client’s questionnaire

Personal data obtained during identification (face and identity document photo)

Value of planned transactions

Circumstance whether the person is politically vulnerable

Risk group

Reason for identification refusal

Date and time of identification

IP address

Browser data

Search for additional personal data from reliable or independent sources, public sources or other third-party sources

Documents confirming the representation (where the client is a legal entity)

In certain cases, physical or digital signature

Economic data, such as the origin of funds, registered country of tax payment, payment documents, other data required by the Law on the Prevention of Money Laundering and Terrorist Financing of the Republic of Lithuania or other legislation.

If the data subject (client or its representative) is identified remotely using electronic means of communication, we process the following personal data:

Name, surname

Image data (live image or photos)

Face of data subject

Identity document

Time and date of image transmission

Electronic signature

In case of identification by remote means of communication, we process the biometric data of the person who is identified, when your image and the personal identification document are combined to verify that you are the owner of the presented personal identification document. Such biometric data are processed only during the remote identification process to identify the Client properly; they are not recorded and stored separately. The processing of biometric data is necessary to implement the provisions of legislation, i. e., the requirements of the Law on Money Laundering and Terrorist Financing Prevention of the Republic of Lithuania, considering the Article 6 (1) (c) of the Regulation. Since biometric data are to be considered as special personal data, this requires the express consent of the person performing the remote identification based on Article 9 (2) (a) of the Regulation. If you disagree to the processing of your biometric data, contact us for another method of your identification without processing biometric data (for instance, come to our office, where we can identify you according to the provided identity document).

Legal ground for data processing – legal obligation applied by OPAY arising from the Law on Money Laundering and Terrorist Financing Prevention of the Republic of Lithuania (Article 6 (1) (c) of GDPR), the legitimate interest of the data controller to implement the principle “Know Your Customer” properly when processing personal data to obtain additional data about a specific person for risk management (Article 6 (1) (f) of GDPR) and your consent to the processing of special categories of personal data - biometric data (facial image) for the purpose of identification (Article 9 (2) (a) of GDPR).

Data storage period – data is stored for 8 years from the date of expiration of transactions or business relations with the Client. The correspondence of business relations with the Client is stored for 5 years from the date of the end of transactions or business relations with the Client. If the transaction was not concluded and the basis for such refusal is not the implementation of measures to prevent money laundering and terrorist financing, the data is stored for 1 year.

Recipients of personal data – your personal data is transferred to service providers performing remote personal identification by using electronic means (UAB “Ondato”).

Determination of the ultimate beneficial owner

For the purpose of determination of the ultimate beneficial owner, we may process the following personal data of the ultimate beneficial owners of OPAY Clients:

Name, surname

Personal code, date of birth

Citizenship

Address

Data contained in the Client questionnaire (name, surname, personal code, number of shares)

In certain cases, copy of the identity documents, data contained in the identity document.

Legal ground for data processing – the data processing is necessary to fulfil the legal obligation applicable to OPAY in implementing the requirements of the Law on the Prevention of Money Laundering and Terrorist Financing of the Republic of Lithuania (Article 6 (1) (c) of GDPR).

Data storage period – the data is stored for 8 years from the date of the expiration of transactions or business relations with the Client.

Recipients of personal data – the data may be transferred to the Financial Crimes Investigation Service under the Ministry of Internal Affairs of the Republic of Lithuania (FNTT), the Bank of Lithuania or other state authorities (if necessary).

Monitoring of business relations and data renewal

For the purpose of monitoring of business relations and data renewal, we process the following data of OPAY Clients and beneficial owners:

Data provided in the questionnaire of the Client and beneficial owner (name, surname, personal code, number of shares)

Share of rights in the legal entity

Data related to the change of share of rights in the legal entity

Data about the legal entity from the registers and public sources.

Legal ground for data processing – the data processing is necessary to fulfil the legal obligation applied to OPAY in implementing the requirements of the Law on the Prevention of Money Laundering and Terrorist Financing of the Republic of Lithuania (Article 6 (1) (c) of GDPR).

Data storage period – the data is stored for 8 years from the date of the expiration of transactions or business relations with the Client.

Recipients of personal data – the data may be transferred to the Financial Crimes Investigation Service under the Ministry of Internal Affairs of the Republic of Lithuania (FNTT), the Bank of Lithuania or other state authorities (if necessary).

Monitoring of suspicious monetary transactions

For the purpose of monitoring of suspicious monetary transaction, we process the following personal data of OPAY Payers and Clients:

Name and surname of the Payer

Executed monetary transactions, including their payment method

Additional data of the Payer, such as bank, mobile phone number or email address

IP address.

Legal ground for data processing – the data processing is necessary to fulfil the legal obligation applicable to OPAY in implementing the requirements of the Law on the Prevention of Money Laundering and Terrorist Financing of the Republic of Lithuania (Article 6 (1) (c) of GDPR).

Data storage period – the data is stored for 8 years from the date of the expiration of transactions or business relations with the Client.

Recipients of personal data – the data may be transferred to the Financial Crimes Investigation Service under the Ministry of Internal Affairs of the Republic of Lithuania (FNTT), the Bank of Lithuania or other state authorities (if necessary).

We can analyse personal data by dividing data subjects into groups after assessing the personal aspects related to data subjects to implement the requirements of the Law on the Prevention of Money Laundering and Terrorist Financing of the Republic of Lithuania. We make such decisions, including the profiling, in compliance with a legal obligation when we need to carry out a risk assessment for anti-money laundering or fraud detection purposes.

You are entitled to receive explanations about the profiling process and you are also entitled to information about the data protection measures applied during the profiling.

OTHER PURPOSES OF DATA PROCESSING

Administration of Client zone (OPAY self-service)

We process the following personal data to ensure the functionality and administration of Client zone:

Email address

Password

Login data to the platform (date, time, actions performed in the system)

IP address

Legal ground for data processing – the data processing is necessary to execute the contract between OPAY and the Client (Article 6 (1) (b) of GDPR).

Data storage period – the data is stored during the validity of the contract and for 10 years after the termination of the contract.

Examination of complaints and applications, administration of enquiries and electronic communication

We process the following personal data of OPAY Clients, Payers and other persons who submitted a complaint, application, enquiry or any other document to ensure the examination of complaints and applications, administration of enquiries and electronic communication:

Name, surname

Email address

Phone number

Place of residence / seat address

Document topic (if the document is provided in the website)

Content of complaint, application or any other document and personal data contained in the document

Physical or electronic signature

Legal ground for data processing – the data processing is necessary to fulfil the legal obligation applicable to OPAY in the implementation of the Resolution No. 03-105 “On approval of the rules for handling complaints received by financial market participants” of the Board of the Bank of Lithuania of 6 June 2013 (Article 6 (1) (c) of GDPR) (the personal data is processed on this ground, when the Payer, Customer or third party applies with a complaint regarding the services provided by OPAY). The legitimate interest of the Company is to ensure the proper administration of received documents and submission of answers (Article 6 (1) (f) of GDPR) (the personal data is processed on this ground when the data subject applies to OPAY for purposes unrelated to the provision of OPAY services or not due to a complaint).

Personal data storage period – the data is stored for 3 years after the resolution of the enquiry, application, complaint or any other document submitted by the data subject.

Provision of consultations by filling out a form on the OPAY website

In cases where you contact us by filling out an enquiry form on the OPAY website and submit the questions to us related to our provided services or want to receive personal consultation or advice, OPAY may contact you through the specified contacts and provide the requested information about our services or answer the questions received. For the purposes of consultation provision, we may process the following personal data:

Name

Email address

Phone number

Content of the message / question and personal data that may be provided in them

Date of consent

IP address

Legal ground for data processing – consent of the data subject (Article 6 (1) (a) of GDPR).

Data storage period – personal data storage period is 2 years from the date of consent, unless you withdraw your consent by notifying our Data Protection Officer in advance by email: [email protected].

Assurance of the proper operation and functionality of OPAY website

OPAY website opay.eu uses cookies, plug-ins and similar technologies to improve the website, collect and analyse website visitor statistics and ensure the proper provision of electronic services and website functionalities. For the said purpose, we process the following personal data of website visitors:

IP address

Used browser and its version

Language selection

Region

Browsing time

Set time zone

Login data to Client account

Other information collected by cookies.

Legal ground for data processing – our (OPAY) legitimate interest to ensure the proper functioning of the website and the maintenance of functionalities (Article 6 (1) (f) of GDPR) (the personal data collected by necessary cookies are processed on this ground) and your consent as a data subject (Article 6 (1) (a) of GDPR) (the personal data collected by unnecessary cookies are processed on this ground).

Data storage period – the personal data storage period depends on the specific cookie used to collect personal data, but in all cases, the storage period is no longer than 2 years. In any case, you are entitled to withdraw your consent to the use of cookies at any time (except for essential cookies) by changing your cookie settings.

More information about the use of cookies is provided in our Cookie Policy.

Increase of OPAY awareness through social accounts

We manage the following social media accounts:

Facebook

LinkedIn

As social network account administrators, we want to inform you about our activities and how we process your personal data, considering our target audience and the goals of activity management and promotion. The manager of specific social network (for instance, Meta or Linkedin) allows OPAY to create a social network account and administer it. However, it is important to note that certain important settings may be restricted because they are set by the social network operator. It means we do not have the power to change such settings and influence what data the social network operator will collect about you and how such collected data will be processed further.

All these settings may affect the processing of your personal data when you visit your OPAY account or read OPAY messages on social networks. Even if you only follow our messages on Facebook or LinkedIn accounts, the operator of the social network may collect certain data about you, for instance, used device, IP address, etc.

Generally, the operator of the social network processes your personal data, including the data that may be made available to us, according to the purposes determined by the operator of the social network in accordance with the privacy policy of the operator of the social network. However, when using a social network, the communication with OPAY via a social network, visit of OPAY account on a social network or following OPAY posts, we also receive information about you. The extent of the collection of information about you depends on our selected account settings, agreements with the operator of the social network regarding the order of additional services, as well as on the cookies set by the operator of the social network and your selected privacy settings. We recommend to familiarize yourself with the privacy policy of the operator of the social network and the relevant settings to better understand how your personal data is processed when you use the social network and to choose privacy settings that ensure the protection of your privacy and personal data:

LinkedIn Privacy Policy

Facebook Privacy Policy.

Processed personal data:

Identification data specified in your account (name, surname, title, etc.)

Email address and other contact details (if specified in account)

Other data publicly available in your account

Legal ground for data processing – the data processing is necessary for legitimate interests of OPAY to ensure the business development (Article 6 (1) (f) of GDPR).

Data processing of candidates for a vacant position

If you wish to participate in our published employee selection procedures and join the OPAY team, we may process your personal data provided in your curriculum vitae (CV), motivation letter or other documents to evaluate your candidacy when conducting selections for vacant positions:

Name and surname

Email address

Phone number

Information about your education and professional / work experience

Other data provided in your curriculum vitae (CV) or other submitted documents.

The third parties (e.g., the companies providing job search, selection or mediation services) may also provide us with personal data required for the purposes of selection if you are registered with a specific company providing job search services and participate in employee selections carried out by such companies on our order. These companies process the data based on their Privacy Policies or Rules for personal data processing.

Legal ground for data processing – your consent expressed by applying for a specific position and sending us your personal data (Article 6 (1) (a) of GDPR).

Data storage period – until the end of the specific employment process (selection), but no longer than 1 year.

You can withdraw your consent at any time by informing our Data Protection Officer by email [email protected].

Do not send us redundant information or data, i.e., that we do not ask for and that is not necessary for the evaluation of you as a candidate for a specific position at OPAY. By sending the unnecessary or redundant data, you do it at your own risk and liability – OPAY assumes no liability for ensuring the security of such data.

If you are applying for the positions of managers, persons performing key functions and other employees related to the provision of financial services (for instance, the persons responsible for the prevention of money laundering and terrorist financing, performing risk functions, the persons managing finances, etc.), in addition to the specified personal data, we are obliged to assess whether the candidates for certain positions meet the requirements of impeccable reputation, qualifications and experience. Considering this, we can process personal data and information confirming the candidate’s impeccable reputation, qualifications, experience and independence, including but not limited to:

Conviction data (whether the candidate has been found guilty of having committed a serious, very serious crime or an intentional crime against property, property rights and property interests, economics and business order, financial system, public safety, public service and public interests as provided for in the Criminal Code of the Republic of Lithuania or corresponding criminal acts according to criminal laws of other states, regardless of whether the criminal record has disappeared or been cancelled or the person has been found guilty of having committed a criminal offense other than that specified in Point 1 of this part provided for in the Criminal Code of the Republic of Lithuania or the laws of other states and three years have not passed since the execution of the sentence, suspension of the execution of the sentence or exemption from the execution of the sentence);

Information about initiated pre-trial investigations, investigations conducted or previously conducted by law enforcement authorities and/or other institutions or professional entities, procedural or other coercive measures or administrative sanctions applied to the candidate;

Information about civil lawsuits, administrative or criminal cases, investments or assumed risks and taken loans that may have a significant impact on the financial reliability of the person;

Information about the declared or initiated bankruptcy of the candidate as a natural person;

Information whether the candidate was suspended or dismissed from his/her position or job or lost the right to engage in certain activities for non-compliance with the requirements of an impeccable reputation set by law or for violating the legislation regulating the financial market;

Information about the refusal to issue a permit (license) to the candidate or the right not otherwise granted to perform certain actions or to engage in certain professional or other activities, as well as the suspension of the issued permit (license) or otherwise granted right to perform certain actions or to engage in certain professional or other activities or cancellation;

Information on how the candidate fulfilled and fulfils the monetary or other obligations, including the data on the restructuring, bankruptcy processes, lawsuits filed in civil cases in his/her respect;

Information whether the candidate abuses psychotropic, narcotic, other psychoactive substances or alcohol;

Information about relationships with other companies, economic and commercial activities, current or previously held positions in a financial market participant or other legal entities to avoid potential conflicts of interest and to manage them;

Personal, professional or other economic relationships with members of the bodies or administration of the same financial market participant, its parent company or subsidiary companies, shareholders controlling the financial market participant, parent company or subsidiary companies;

Any other significant circumstances (candidates for positions of managers and persons performing key functions).

Legal ground for data processing – the data processing is necessary to process data to fulfil the legal obligation applied to OPAY in implementing the requirements of the Law on Banks of the Republic of Lithuania, the Law on Payment Institutions of the Republic of Lithuania, the provisions on the evaluation of managers and persons performing key functions of financial market participants supervised by the Bank of Lithuania on the impeccable reputation, experience, qualifications and independence of OPAY managers and other persons performing key functions (Article 6 (1) (c) of GDPR).

Data storage period – until the end of the specific employment process (selection), but no longer than 1 year.

Recipients of personal data – the data may be transferred to the Bank of Lithuania to obtain approval for the appointment of candidates for managers and persons performing key functions.

Maintenance, development and control of business relations with partners

For the purpose of maintaining and developing business relations with business partners, we process the following personal data of business partners and their representatives:

Name, surname of representatives

Place of work, position

Address

Phone number

Email address

Physical or electronic signature

Legal ground for data processing – the data processing is necessary to fulfil the contract or to take steps before the conclusion of the contract (Article 6 (1) (b) of GDPR).

Data storage period – the data is processed for 10 years after the end of the relationship with business partners.

WHO CAN WE SHARE YOUR PERSONAL DATA WITH (PERSONAL DATA RECIPIENTS)

We may transfer your personal data to other recipients, considering the grounds of data provision and ensuring the security of transmitted data to ensure the proper provision of services, as well as in other cases (for example, when such obligation is imposed on us by applicable legislation, it is necessary to defend or assert legal claims, it is necessary to ensure the operation of information systems, etc.):

To the state authorities and institutions, other entities performing maintenance or other functions assigned to them (including, but not limited to, law enforcement institutions, courts, arbitration or other dispute resolution institutions, bailiffs, notaries, the Bank of Lithuania, the State Data Protection Inspectorate, the State Tax Inspectorate under the Ministry of Finance of the Republic of Lithuania, the Financial Crimes Investigation Service under the Ministry of Internal Affairs of the Republic of Lithuania, the Ministry of Foreign Affairs, the State Data Agency, other law enforcement institutions);

Companies providing information technology, cloud computing, telecommunications, website hosting, administration and related services;

Providers of personal identification services (UAB “Ondato”);

Operators of money laundering prevention and verification platforms for politically vulnerable persons;

Potential investors and other persons participating in the process of evaluating or executing investment opportunities;

Beneficiaries when the payment initiation service is provided, to other financial institutions (your bank);

Persons providing us with legal, financial, audit and other consulting services (attorneys, auditors, other consultants);

Business partners;

Institutions managing the state registers and state information systems.

We do not disclose or transfer more personal data than necessary for the specific purpose. Data recipients may process data acting as data processors on our behalf and/or independent data controllers. Each time where data is transferred to persons who are our engaged data processors, the data processing conditions and applicable requirements are always determined in data processing agreements or other data processing conditions. Where the data recipient processes data acting as a data controller, it determines the purposes and means of data processing in accordance with its approved Privacy Policy or other legislation.

If we disclose your personal data to other data recipients or their groups than specified in the present Privacy Policy, we will inform you about it no later than the time of data disclosure, except if we have already provided you with such information earlier.

We usually process and store your personal data in the countries of the European Union or the European Economic Area (EU/EEA), but some of the recipients of the data may be located in countries outside the EU/EEA. In such cases, we transfer your personal data outside the EU/EEA only on the grounds of a decision on eligibility made by the European Commission (a country, territory or international organization recognized by the European Commission as ensuring EU-level personal data security) or with a contract concluded with a data recipient or processor in a third country in accordance with standard contract terms approved by the European Commission.

WHAT ARE YOUR RIGHTS AND HOW TO EXECUTE THEM?

You have the following rights:

The right to access your personal data processed by OPAY and to receive copies of this data;

The right to demand the correction of incorrect, inaccurate or incomplete data;

The right to limit the processing of your personal data until the legality of their processing has been verified at your request;

The right to demand the deletion of your processed personal data or to limit their processing in certain circumstances, under the conditions and cases set out in the Regulation;

The right to object to the processing of personal data for direct marketing purposes and when personal data is processed for our legitimate interests;

The right to receive your processed personal data in a systematized, commonly used and computer-readable format and the right to forward that personal data to another controller under certain conditions;

The right to withdraw your consent, without affecting the use of your personal data carried out before the withdrawal of consent where the processing of personal data is based on consent;

The right to submit a complaint to the State Data Protection Inspectorate (more information is provided here)

You can submit a request for the exercise of the specified rights verbally, in writing (by presenting directly or sending it by mail) or by electronic means:

The verbal or written applications may be submitted upon arrival to OPAY Office at M. K. Paco g. 4, Vilnius (Entry IX) or by sending the application to specified address;

The electronic application may be submitted by filling out the contact form on our website or by sending an application by email [email protected].

When applying in writing, we recommend submitting a free-form application that must be legible and signed with indicated your name, surname, address and/or other contact details for communication or receipt of response and the rights you wish to execute. The applications are implemented only after the identification of the data subject that is carried out:

If you apply verbally or submit an application personally upon arrival to our office – by verifying your personal identity document by our employee;

If you apply by electronic means – the person is identified according to email address (if the application was sent from email address registered / managed in OPAY systems) and other data (for instance, name, surname, IP address), or the application is signed with an electronic signature allowing identification and verification of the identity of the signatory.

If the application is sent by post or other delivery services are used - submit a copy of the document confirming the identity of the person certified by a notary or in another manner established by law together with an application.

You can exercise your rights yourself or through a representative; if a representative applies on behalf of the represented data subject for the exercise of the rights of the data subject, the application must include the name and surname of the representative, contact details, the name, surname, contact details of the person represented, information on what rights and to what extent they wish to exercise and other related information with attached document confirming the representation or a copy of the representation document approved in accordance with the law.

In case of any doubts about your identity, we are entitled to request additional information that would help establish your identity.

In all cases, we will try to respond to your received application as soon as possible, but no later than within 1 (one) month from the date of receipt of the appropriate application and other related data or documents. In certain cases, and depending on the complexity of the application and/or the number of applications received, this deadline may be extended for another 2 (two) months. In this case, we will notify you about such extension of the deadline and the reasons for it within 1 (one) month from the date of receipt of the application.

If you are not satisfied with the response received or if you believe that we have not exercised or exercised your rights improperly, you are entitled to file a complaint with the data protection supervisory authority of your place of residence. In Lithuania, you can apply and file a complaint to the State Data Protection Inspectorate (more information is provided here).

OUR CONTACT INFORMATION

You can contact OPAY Data Protection Officer for any question related to the processing of your personal data:

By phone +370 611 55554

By email [email protected]

Come to our office or by post to M. K. Paco g. 4, 10309 Vilnius (Entry IX), Lithuania.

REVIEW OF THE PRIVACY POLICY

We are entitled to change the present Privacy Policy unilaterally at any time by notifying data subjects of the changes on the OPAY website.

The last renewal of the Privacy Policy was made on 21 June 2024.