Data processing

1. About this document

This document supplements the Privacy policy and describes in more detail how data is processed in the client portal d14vilnius.lt/klientas (the “Portal”).

The controller of all data processed in the Portal is D 14, MB (a small partnership, company code 308115071, VAT code LT100020749413, registered office at Didžioji g. 14-1, LT-01128 Vilnius, Lithuania).

2. Data categories, purposes and legal bases

Legal bases refer to Article 6(1) of the GDPR.

• Account data (e-mail address, encrypted password, e-mail confirmation). Purpose: creating the account and logging in. Basis: conclusion and performance of a contract.
• Company and director details. Purpose: reviewing the application, concluding the contract, providing the registered office, assisting with company registration. Basis: conclusion and performance of a contract.
• Know-your-customer data (origin of funds, beneficial owners, politically exposed person status), the director’s identity document and the beneficial owners declaration. Purpose: identification and prevention of money laundering and terrorist financing. Basis: legal obligation.
• The contract and signature data from the Portal. Purpose: concluding the contract and evidencing it. Basis: conclusion and performance of a contract.
• Invoices, payment information and annual subscription renewal. Purpose: payment and accounting. Basis: performance of a contract and legal obligation.
• Contact form data. Purpose: responding to the enquiry. Basis: legitimate interest.
• Technical and security data. Purpose: system security and abuse prevention. Basis: legitimate interest.
• Marketing data. Not currently processed. If marketing begins, the basis will be your consent.

3. Where the data comes from

Data is provided by the Client or the Client’s representative in the Portal. A Client who provides data about the director and beneficial owners must ensure that it is entitled to do so and that those people have been informed.

4. Who has access

• The Client sees only the data of its own account, company, contracts, invoices and documents.
• Client data can be accessed only by authorised D14. staff who need it to perform their duties.
• Uploaded documents are accessible only to the Client and authorised D14. staff.
• Processors (Supabase, Cloudflare, Resend, Google Workspace) process data only on the instructions of D14. and under data processing agreements.

5. Security measures

• All traffic between the browser and the servers is encrypted.
• The database applies row-level access control, so each user can see only the records their permissions allow.
• Document storage is not public. Documents are served only to logged-in users who are entitled to them.
• Passwords are stored only in encrypted form.
• Access to administrative functions is granted only to authorised staff.

6. Retention and deletion

• Know-your-customer data and documents are kept for the period required by law, currently 8 years after the end of the business relationship.
• Invoices and other accounting records are kept for 10 years.
• Enquiries are kept for up to 2 years unless they lead to a contract.
• Other data is kept for as long as the contract is in force and afterwards for as long as necessary to bring or defend legal claims.

7. Personal data breaches

In the event of a personal data breach, D14. acts in accordance with the GDPR. It assesses the breach and, where required, notifies the State Data Protection Inspectorate and informs the data subjects.

8. Your rights and contacts

Your rights and how to exercise them are described in the Privacy policy. Please send questions and requests to info@d14vilnius.lt.