Privacy Notice
The controller of the personal data specified below in this notice is MAXIMA GRUPĖ, UAB, company code 301066547, registered address: Ozo g. 25, Vilnius, Lithuania (hereinafter the Company).
This privacy notice (hereinafter the Privacy Notice) is intended for individuals (hereinafter you) who use the Company's services, have dealings with the Company (e.g. provide services) or visit the Company's website (www.maximagrupe.eu).
The Privacy Notice provides information about the processing of your personal data by the Company, the purposes for which personal data are collected, the scope of the personal data processed and your rights in relation to the processing of personal data. Additional information may be provided in the contracts that you enter into (or have entered into) with the Company.
The Company collects and processes personal data in accordance with the General Data Protection Regulation (hereinafter the GDPR) and other legislation governing the protection of personal data.
The scope of the personal data processed depends on the services used or provided and on the information provided by the individual who uses the services, browses our website or provides information for the purpose of applying for job in the Company.
The Company seeks to ensure that personal data are processed accurately, fairly and lawfully, that they are processed only for the purposes for which they were collected, and that they are processed in accordance with the clear and transparent principles and requirements for personal data processing laid down in legislation.
The Company may update this Privacy Notice at any time. The Company will inform you of updates by publishing a new version of the Privacy Notice on the website together with the dates of the amendments made. Updates to the Privacy Notice take effect upon their publication on the website.
This Privacy Notice is applied since 25 May 2018 and was last updated on 30 October 2026.
Why do we process your personal data, what data do we process, on what basis and for how long?
|
Why do we process information about you? |
What information do we collect about you? |
On what legal basis do we process your personal data? |
From what sources do we collect your personal data? |
For how long do we use or retain information about you? |
|
We select candidates to become our employees |
First name, surname, contact details, education, qualifications, work experience, skills and other information provided in application documents that is necessary to assess suitability for the position, as well as interview and test results and recruitment assessments. |
You have consented to the processing of your data for recruitment purposes, as expressed through your affirmative actions, i.e. by sending your CV to cv@maximagrupe.eu or submitting your CV by other means (Article 6(1)(a) GDPR). After the recruitment process has ended, we process your data based on our legitimate interest in reopening recruitment for the same position, if necessary, and contacting suitable candidates who took part in that process (Article 6(1)(f) GDPR). |
From you, recruitment service providers whom you have instructed to transfer your data, job search websites, specialized professional networking platforms (e.g. LinkedIn) and, with your consent to contact them, the referees you have named. |
During the recruitment process and, if you remain a suitable candidate for the same position, for no longer than 6 months after the end of the recruitment process, so that we can reopen recruitment if necessary. |
|
We consider your application for future job vacancies |
First name, surname, contact details, education, qualifications, work experience, skills and other information provided in application documents. |
You have consented to the processing of your data for the purpose of participating in future recruitment processes, as expressed through your affirmative actions, i.e. by sending your CV to cv@maximagrupe.eu (Article 6(1)(a) GDPR). |
From you or recruitment service providers transferring data on your instructions. |
For no longer than 18 months from the submission of your CV or until you withdraw your consent, whichever is earlier. |
|
We maintain an insider list in compliance with the requirements of the Market Abuse Regulation[1] |
First name, surname, work telephone number, date of birth, personal identification number, reason for inclusion, date and time of inclusion in the list, and date and time of removal from the list. |
Processing is necessary for compliance with a legal obligation to which the Company is subject (Article 6(1)(c) GDPR). |
We obtain your data directly from you or from the entities you represent, e.g. the parent company or subsidiaries, or external service providers. |
For 5 years from the date the list was last updated. |
|
We maintain a list of persons discharging managerial responsibilities within the Company and persons closely associated with them in compliance with the requirements of the Market Abuse Regulation1 |
Personal data of persons discharging managerial responsibilities within the Company and persons closely associated with them, as defined in the Market Abuse Regulation: first name, surname, nature of the relationship with the person discharging managerial responsibilities, and date of inclusion in the list. |
Processing is necessary for compliance with a legal obligation to which the Company is subject (Article 6(1)(c) GDPR). |
Your personal data are provided to us by you or by persons discharging managerial responsibilities within the Company with whom you are closely associated. |
For 1 year after the person discharging managerial responsibilities ceases to hold their position. |
|
We enter into and perform contracts and fulfil related tax obligations |
First name, surname, telephone number, email address and signature of the business partner's representative, the basis of their authority to represent the business partner, power of attorney number, job title, and other information relating to the conclusion and performance of the contract, depending on the nature of the contract. If a contract is concluded with you as a natural person, we also process your personal identification number or date of birth and bank account number. |
We have a legitimate interest in processing your personal data as an authorized representative of our business partner (Article 6(1)(f) GDPR). If a contract is concluded with you as a natural person, we are entitled to process your data for the purpose of entering into and performing the contract (Article 6(1)(b) GDPR). We are also entitled to process your personal data for the purpose of fulfilling tax obligations under the law (Article 6(1)(c) GDPR).
|
We obtain your data directly from you or from the legal entities you represent (the Company's business partners). |
For the duration of the contract and for 10 years after its expiry or termination. |
|
We ensure compliance with international sanctions |
First name, surname, date of birth, personal identification number, job title, citizenship, place of residence, associated persons, whether sanctions apply and the reasons for them, and other data provided or published in databases concerning the business partner's beneficial owners, senior executives, and members of management and supervisory bodies, in order to identify individuals for sanctions compliance purposes before entering into and when performing contracts. |
Processing is necessary for compliance with a legal obligation to which the Company is subject (Article 6(1)(c) GDPR). |
We obtain your data from the legal entities you represent (the Company's business partners) and/or from specialized databases. |
For the duration of the contract and for 8 years after its expiry or termination. |
|
We carry out internal audits of the Company and Group companies |
Personal data of employees of Group companies and representatives of counterparties recorded in documents, including but not limited to emails and similar records, provided for the purpose of conducting an internal audit. |
We have a legitimate interest in processing your personal data to ensure the effectiveness of internal controls (Article 6(1)(f) GDPR). |
We obtain your data from Group companies when conducting internal audits. |
For 10 years after the completion of the relevant internal audit. |
|
We provide management and other related services to our Group companies |
First name, surname, job title, telephone number and email address of employees of Group companies and representatives of counterparties, any other personal data recorded when providing management and other advisory services, the number of hours spent on the consultation, and the consultation's subject area, category and description. |
We have a legitimate interest in processing your personal data when performing the functions of a parent company (Article 6(1)(f) GDPR). |
We obtain your data from Group companies when providing them with management and other related services. |
Personal data are retained for 10 years after the services have been provided. |
|
We administer the internal reporting channel for breaches (the Trust Line) and conduct internal investigations based on the information received |
We process the following data concerning reporting persons, persons who are the subject of reports, witnesses and other persons concerned: first name, surname, telephone number, personal identification number, email address, circumstances described in the report, date of submission of the report, data collected during the investigation, and findings. |
We have a legitimate interest in processing your personal data for the purpose of examining reports (Article 6(1)(f) GDPR). If a report is submitted under the Law on the Protection of Whistleblowers of the Republic of Lithuania, processing is necessary for compliance with a legal obligation to which the Company is subject (Article 6(1)(c) GDPR). |
Data is obtained from the person who submitted information about the breach and other persons involved in examining the report. Your personal data may also be obtained from competent public authorities. |
We retain personal data for 5 years from the date of the most recent decision taken when examining information about a breach. |
|
We examine and respond to your enquiries and requests submitted by email |
First name, surname, email address, the content of email correspondence and the personal data recorded in it. |
We have a legitimate interest in processing your personal data for the purpose of examining enquiries and requests received (Article 6(1)(f) GDPR). |
Data are obtained from the person who submitted the enquiry or request. |
We retain emails received for 18 months. |
Cookies
We use only strictly necessary cookies on the website, which help ensure convenient browsing and the efficient and secure operation of the website:
|
Cookie name |
Description / Type |
When created |
Expiry |
Data used |
|
CMSESSIDX |
A cookie used to maintain the user's session |
When you visit the website |
When the website window is closed |
Unique session identifier |
When and to which third parties do we disclose your data?
We may transfer your personal data to our partners, service providers and the entities listed below to the extent necessary to achieve the purposes specified above and where we have a legal basis for doing so:
- banks carrying out payment transactions;
- courts, supervisory authorities, law enforcement bodies and other public authorities;
- external auditors and lawyers providing audit and legal services to the Company;
- Group companies;
- companies providing data center, hosting, cloud, website administration and related services; companies creating, maintaining and developing software; companies providing information technology infrastructure services; companies providing communications and similar services; and other service providers (data processors).
In each case, we provide the data recipient with only the data necessary to carry out a specific assignment or provide a specific service.
The data processors we engage may process your personal data only on our instructions. They must also ensure the secure processing of your data and an appropriate level of data protection in accordance with the minimum technical and organizational measures we establish, as set out in written agreements.
Data may be provided to competent public authorities or law enforcement bodies, such as the police or supervisory authorities, only where required by applicable law or in the cases and in accordance with the procedures provided for by law, in order to safeguard our rights and the security of our Group companies, employees and resources, and to establish, exercise and defend legal claims.
In which territories and jurisdictions do we process your personal data?
We process your personal data only within the European Economic Area (hereinafter the EEA). We currently have no intention of transferring, and do not transfer, your personal data to third countries.
How do we protect your personal data?
The Company implements and regularly updates appropriate organizational and technical security measures that help protect personal data against accidental or unlawful destruction, alteration, disclosure and any other unlawful processing.
What rights do data protection laws give you and how can you exercise them?
Personal data protection laws give you a number of rights which you are free to exercise, and we must ensure that you are able to do so. Where permitted by law, you have the following rights:
a) The right to access the personal data we process about you and obtain a copy of your personal data
You have the right to obtain confirmation from us as to whether we process your personal data, to access the personal data we process about you and information about the purposes of processing, the categories of data processed, the categories of data recipients, the data sources and the data processing period, and to obtain a copy of your personal data. We provide most of this information in this Privacy Notice and believe that you will find it useful.
b) The right to rectification of personal data
If you believe that the information we process about you is inaccurate or incorrect, you may also contact us using the methods specified in this Privacy Notice and request that we correct or clarify your data.
c) The right to withdraw consent
Where we process your data based on your consent, you have the right to withdraw your consent at any time, and processing based on your consent will cease. Withdrawal of consent does not affect the lawfulness of the personal data processing carried out before its withdrawal. To withdraw your consent, please contact us by email at dpo@maximagrupe.eu.
d) The right to lodge a complaint
If you believe that we process your data in breach of data protection legislation, we always ask that you contact us directly first. We believe that, through good-faith efforts, we can resolve any concerns you may have, fulfil your requests and correct any errors we may have made. If you are not satisfied with our proposed solution or believe that we are not taking the action required in response to your request, you have the right to lodge a complaint with the supervisory authority, which in the Republic of Lithuania is the State Data Protection Inspectorate (for more information: https://vdai.lrv.lt/lt/). Please note that contacting us is not a prerequisite for lodging a complaint with the State Data Protection Inspectorate.
e) The right to object to processing based on legitimate interests
You have the right to object to the processing of personal data where the processing is based on our legitimate interests, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defense of our legal claims.
f) The right to erasure (the right to be forgotten)
In certain circumstances specified in data protection legislation (where personal data are processed unlawfully, the legal basis for processing no longer exists, etc.), you have the right to request that we erase your personal data.
g) The right to restriction of processing
In certain circumstances specified in data protection legislation (where personal data are processed unlawfully, you have contested the accuracy of the data, you have objected to processing based on our legitimate interest, etc.), you also have the right to restrict the processing of your data.
h) The right to data portability
You have the right to transfer to another data controller the data that we process by automated means based on consent or a contract. We will provide the data you wish to transfer in a machine-readable format commonly used in our systems and, at your request and where technically feasible, transmit the data directly to another data controller you designate.
Procedure for handling requests
To protect data against unlawful disclosure, we will need to verify your identity when we receive your request to access data or exercise your other rights. For this purpose, we may ask you to provide your first name, surname, email address or telephone number and check whether the details you provide match the corresponding data we hold. As part of this verification, we may also send a verification message by SMS or email asking you to complete an authentication step. To verify your identity, we may also ask you to send a request to exercise your data subject rights signed with a qualified electronic signature or to provide a copy of an identity document. We do not request a copy of an identity document if your identity can be reliably verified by means requiring less personal data. If the verification procedure is unsuccessful (e.g. the details you provide do not match the data we hold; you do not authenticate yourself using the SMS or email received; or you do not provide a request signed with a qualified electronic signature or a copy of an identity document), we will have to conclude that you are not the person from whom we received the request and will be required to reject your request.
Once we have received your request to exercise any of your rights and have successfully completed the verification procedure described above, we undertake to provide you with information on the action taken in response to your request without undue delay and, in any event, within one month of receiving your request. Considering the complexity and number of requests, we may extend the one-month period by a further two months, notifying you before the end of the first month and giving the reasons for the extension.
If your request is submitted electronically, we will also respond electronically, unless this is impossible (e.g. due to a particularly large volume of information) or you ask us to respond by other means. Where the circumstances specified in legislation apply, we will refuse to comply with your request and inform you in writing, giving the reasons for our refusal.
How and using which contact details can you get in touch with us?
For any questions concerning data processing, you can contact us as follows:
By email: info@maximagrupe.eu
By telephone: +370 669 00118
Contact details of the person responsible for data protection:
Email address: dpo@maximagrupe.eu
Postal address: Ozo g. 25, Vilnius, Republic of Lithuania
Our details as the data controller:
MAXIMA GRUPĖ, UAB
Legal entity code: 301066547
Registered office address: Ozo g. 25, Vilnius, Republic of Lithuania
[1] Regulation (EU) No 596/2014 of the European Parliament and of the Council of 16 April 2014 on market abuse (Market Abuse Regulation) and repealing Directive 2003/6/EC of the European Parliament and of the Council and Commission Directives 2003/124/EC, 2003/125/EC and 2004/72/EC
