{"id":10806,"date":"2022-06-07T13:56:58","date_gmt":"2022-06-07T10:56:58","guid":{"rendered":"https:\/\/lokys.lt\/?page_id=10806"},"modified":"2026-07-25T11:21:49","modified_gmt":"2026-07-25T08:21:49","slug":"privacy-policy","status":"publish","type":"page","link":"https:\/\/lokys.lt\/en\/privacy-policy\/","title":{"rendered":"Privacy Policy"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Privacy Policy<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

RULES FOR THE PROCESSING OF PERSONAL DATA OF CLIENTS, WEBSITE VISITORS AND OTHER EXTERNAL INDIVIDUALS<\/strong><\/p>

This personal data processing agreement has been drawn up in accordance with the laws of the Republic of Lithuania and the European Union.<\/p>

These terms and conditions are subject to change without prior notice to the user. By accessing, browsing and using our website on any platform, you acknowledge and agree to read, understand and agree to the terms and conditions set out below.<\/p>

This Privacy Policy governs the manner in which UAB \u201cSenasis Lokys\u201d collects, uses, maintains and discloses information collected from users of the lokys.lt website. This Privacy Policy applies to the Site and all goods and services provided by UAB \u201cSenasis Lokys\u201d.<\/p>

I. General provisions<\/strong><\/p>

1. UAB \u201cSenasis lokys\u201d, legal-entity code 121525187, registered-office address Stikli\u0173 St.\u00a08, LT-01131 Vilnius (hereinafter \u2013 the Company<\/strong>), is the controller of the processing specified in these Rules.<\/p>

2. These Rules apply to clients, persons who reserve a table or event, purchase goods or gift vouchers, contact the Company, participate in the loyalty programme, visit the Company\u2019s website and, where video surveillance is carried out, persons entering the monitored premises. Employee data is not governed by these Rules.
3. The Company processes only data necessary for a specific purpose, retains it only for the specified period and enables individuals to exercise their rights. When joining the loyalty programme and for the simple accumulation of points, the personal identification number, date of birth, place of employment or identity-document data are not collected. Where the transfer of a specific prize gives rise to a tax-reporting or tax-payment obligation for the Company, only the data mandatory for that specific prize record under item 7 is collected. A copy of the document, its expiry date, date and place of issue are not collected; where necessary, an employee only visually checks the document.
4. Each employee who needs data for their work may process it only within the scope of their functions and must comply with confidentiality requirements. The Company does not appoint a data protection officer unless such appointment is required by law or the nature of the Company\u2019s processing changes.
5. Data-protection questions and requests may be submitted by email at info@lokys.lt<\/strong>, by telephone at +370 661 30703<\/strong> or by post to Stikli\u0173 St.\u00a08, LT-01131 Vilnius. The Company\u2019s Director ensures the implementation of these Rules.
6. These Rules are based on Regulation (EU) 2016\/679 (GDPR), the Law of the Republic of Lithuania on Legal Protection of Personal Data, the Law on Electronic Communications and other applicable legislation. Where special legislation applies, it takes precedence over these Rules.<\/p>

II. Processing purposes, data and retention periods<\/strong><\/p>

7. The Company processes the following data and follows these rules:<\/p>

Purpose<\/strong><\/p><\/td>

Data and legal basis<\/strong><\/p><\/td>

Usual retention period<\/strong><\/p><\/td><\/tr>

Reservation of a table, event or tasting, enquiries about services and their performance<\/p><\/td>

Name, telephone number or email address, reservation date, time, number of people and only the information necessary for the order. Legal basis \u2013 steps taken at the individual\u2019s request prior to entering into a contract or performance of a contract.<\/p><\/td>

2 years after completion of the reservation or enquiry. If a dispute arises, the data is retained until its final resolution.<\/p><\/td><\/tr>

Sale and delivery of goods, gift vouchers and other services<\/p><\/td>

Name and, where necessary for delivery, the purchaser\u2019s and recipient\u2019s name, contact details, delivery address, order and payment information. Legal basis \u2013 the contract and steps taken prior to entering into it; after completion of the order \u2013 the Company\u2019s legitimate interest in responding to questions related to the order, handling claims and defending legal claims. The Company does not store all payment-card data.<\/p><\/td>

Order data \u2013 2 years after completion of the order; upon receipt of a claim or if a dispute arises \u2013 until its final resolution. Accounting documents \u2013 for the period prescribed by law.<\/p><\/td><\/tr>

Accounting, taxes and obligations established by law<\/p><\/td>

Data contained in accounting documents. Legal basis \u2013 a legal obligation applicable to the Company.<\/p><\/td>

For the period prescribed by legislation governing the retention of accounting documents.<\/p><\/td><\/tr>

Handling enquiries, complaints, requests and feedback<\/p><\/td>

Name, contact details, the content of the communication and related documents. Legal basis \u2013 a contract, steps taken prior to entering into a contract or a legitimate interest in responding and defending the Company\u2019s rights.<\/p><\/td>

2 years after the response; in the event of a dispute \u2013 until its final resolution.<\/p><\/td><\/tr>

Loyalty programme, accounting for points and transfer of non-taxable gifts \/ prizes<\/p><\/td>

Name and surname, loyalty-account identifier, records of points earned and used, the selected and received gift \/ prize, its value, transfer date and, where necessary, confirmation of receipt. Legal basis \u2013 performance of the contract for participation in the loyalty programme. Telephone number, email address, address, place of employment, personal identification number and document data are not collected for this purpose.<\/p><\/td>

2 years after the last points transaction or the end of participation in the programme. An inactive account and unused points expire after 2 years.<\/p><\/td><\/tr>

Transfer of a taxable or otherwise reportable loyalty prize, calculation and reporting of personal income tax<\/p><\/td>

In addition to the transfer data specified in the preceding row, only the recipient identifier required for the personal-income-tax return and other data established by law. For a permanent resident of Lithuania, this may be the taxpayer identification number or the number of an identity document permitted by the State Tax Inspectorate. Legal basis \u2013 a legal obligation applicable to the Company. The data is collected when the specific prize is transferred, not when joining the programme.<\/p><\/td>

Together with the relevant tax and accounting document, for the period prescribed by law.<\/p><\/td><\/tr>

Website operation and security<\/p><\/td>

Technical log data, such as IP address, browser data, time of activity and information about a security event. Legal basis \u2013 the Company\u2019s legitimate interest in ensuring the operation and protection of the website.<\/p><\/td>

30 days, except in relation to a specific security incident or dispute.<\/p><\/td><\/tr>

Non-essential website analytics, personalisation or marketing<\/p><\/td>

Data from cookies and similar technologies. Legal basis \u2013 separate consent given in the consent window.<\/p><\/td>

According to the period of each cookie displayed in the consent tool; consent choices are reviewed at least every 6 months.<\/p><\/td><\/tr>

Video surveillance, if actually carried out<\/p><\/td>

Video recording, date, time and location of the recording. Legal basis \u2013 the Company\u2019s legitimate interest in protecting persons and property. Audio recording is not carried out.<\/p><\/td>

30 calendar days; a recording related to an incident \u2013 until the end of the investigation, dispute or proceedings.<\/p><\/td><\/tr><\/tbody><\/table>

8. The Company does not use client data for automated decisions that would produce legal or similarly significant effects for an individual, and does not carry out profiling.
9. The Company does not request data concerning health, allergies, religion, political opinions, sex life, criminal convictions or other special categories of data. If such information is received without a clear request to retain it, it is not entered into the client or loyalty database and is deleted as soon as it is no longer necessary to handle the specific enquiry.
10. If there is reasonable doubt about the age of a person purchasing alcohol or tobacco products, an employee may ask to see an identity document and only visually verify the person\u2019s age. No document data, copy or photograph is made or retained.
11. The Company generally receives data from the individual themselves. When a purchaser provides another person\u2019s delivery details, only the data necessary for delivery is used, and information about the processing is provided to the recipient no later than the first time they are contacted.<\/p>

3. Privacy information for individuals<\/strong><\/p>

12. The Company may transfer data only to the extent necessary to achieve the purpose to the following categories of recipients: providers of IT, website hosting, reservation, email and cookie services; payment and delivery service providers; accounting, legal and document-archiving service providers; and public authorities and law-enforcement institutions where required by law.
13. Before entrusting data processing to a service provider, the Company verifies the provider\u2019s role. A written agreement complying with Article 28 of the GDPR is concluded with a data processor. Where a payment or delivery service provider independently determines the purposes of its processing, it processes the data in accordance with its own privacy information.
14. These Rules do not permit the transfer of data outside the European Economic Area until the Company has established the transfer mechanism required under Chapter V of the GDPR and, before the transfer, clearly updated the information provided to the individual about the recipient, country and safeguards.
15. An individual has the right to:<\/p>

\u2013 access their data and obtain a copy of it;
\u2013 request the rectification of inaccurate data or completion of incomplete data;
\u2013 request the erasure of data where there is no basis for further processing;
\u2013 request restriction of processing;
\u2013 object to processing based on a legitimate interest; in the case of marketing, the Company terminates the processing immediately;
\u2013 withdraw consent as easily as it was given; withdrawal does not affect the lawfulness of processing carried out before withdrawal;
\u2013 receive data concerning them that is processed by automated means and provided by them, in a commonly used machine-readable format, where the right to data portability applies;
\u2013 lodge a complaint with the State Data Protection Inspectorate (VDAI) or defend their rights in court.<\/p>

16. A request may be submitted to the Company by email, post or orally. The Company may request only such additional information as is reasonably necessary to verify the identity of the person making the request; an identity-document copy is not ordinarily required.
17. The Company responds without undue delay and no later than one month after receiving the request. Due to the complexity or number of requests, the period may be extended by a further two months; the individual is informed of this and the reasons within the first month. Ordinary requests are handled free of charge.
18. Information about which data is necessary for a contract or order is provided in the relevant form or during the ordering process. If the contact or delivery details necessary for the service are not provided, the Company may be unable to confirm the reservation, fulfill the order or deliver the goods.<\/p>

4. Marketing and cookies<\/strong><\/p>

19. The Company does not carry out direct marketing: it does not use clients\u2019 contact details for advertising messages and does not send such messages to loyalty-programme participants.
20. If the Company decides to carry out direct marketing in the future, it will update these Rules before commencing it and obtain separate, freely given and not pre-ticked consent, unless the exception under Article 81(2) of the Law on Electronic Communications may lawfully apply in a particular case. For proof of consent, the contact details, choice, date, time and method are sufficient.
21. Each future marketing message would state the Company\u2019s name and provide an operative and straightforward means of unsubscribing from messages. Upon receiving an unsubscribe request, the contact would no longer be used for marketing.
22. Strictly necessary cookies and similar technologies are used to ensure the website, reservations, shopping cart, security and the individual\u2019s choices function properly. Analytics, preference and marketing cookies are enabled only after the individual gives separate consent to the relevant category. The consent tool always provides the provider, purpose, period and method for changing or withdrawing the choice.<\/p>

5. Security, recipients and incidents<\/strong><\/p>

23. Taking into account the risks of processing, the Company applies proportionate measures: access is granted only to employees who need it; individual logins and passwords are used; documents are protected from unauthorised persons; copies are destroyed when no longer needed; and devices and software are kept up to date.
24. An employee who becomes aware of lost data, unauthorised access, incorrect transmission, a suspicious email or another possible security breach must immediately notify the Director or email info@lokys.lt. The Director or a person appointed by them assesses the incident, takes measures to mitigate the damage and documents the decision.
25. If a breach is likely to pose a risk to the rights and freedoms of individuals, the Company notifies the VDAI without undue delay and, where possible, no later than 72 hours after becoming aware of it. If there is a high risk, the Company also informs the affected individuals of the breach in clear language without undue delay.
26. Video surveillance, if carried out, is limited to entrances, passageways, the cash desk and other objectively necessary locations for the security of property and people. It is not carried out in toilets, changing rooms or rest areas. Before entering a monitored area, a clear sign is provided containing the Company\u2019s contact details and a reference to these Rules.<\/p>

6. Final provisions<\/strong><\/p>

27. The Company begins new processing that would materially change the purposes, categories of data, categories of recipients or risks specified in Section II of this document only after updating these Rules. If a data protection impact assessment is required under the GDPR, it is carried out before such processing begins.
28. The Rules are reviewed when the processing or legislation changes. If Section III is amended, the updated version is published on lokys.lt before it begins to apply, except for purely editorial changes.
29. These Rules enter into force on the date they are approved.<\/p>

The Rules were last updated on 22 July 2026.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

RULES FOR THE PROCESSING OF PERSONAL DATA OF CLIENTS, WEBSITE VISITORS AND OTHER EXTERNAL INDIVIDUALS This personal data processing agreement has been drawn up in accordance with the laws of the Republic of Lithuania and the European Union. These terms and conditions are subject to change without prior notice to the user. By accessing, browsing […]<\/p>\n","protected":false},"author":2,"featured_media":0,"parent":0,"menu_order":47,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"footnotes":""},"class_list":["post-10806","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/lokys.lt\/en\/wp-json\/wp\/v2\/pages\/10806","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lokys.lt\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/lokys.lt\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/lokys.lt\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/lokys.lt\/en\/wp-json\/wp\/v2\/comments?post=10806"}],"version-history":[{"count":3,"href":"https:\/\/lokys.lt\/en\/wp-json\/wp\/v2\/pages\/10806\/revisions"}],"predecessor-version":[{"id":38180,"href":"https:\/\/lokys.lt\/en\/wp-json\/wp\/v2\/pages\/10806\/revisions\/38180"}],"wp:attachment":[{"href":"https:\/\/lokys.lt\/en\/wp-json\/wp\/v2\/media?parent=10806"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}