Privacy notice for the epaslaugos.lt portal and mobile app
Effective date: 16 October 2026
I. GENERAL PROVISIONS
1. This Privacy Notice provides information on the processing of personal data when using the Portal epaslaugos.lt of the State Information Resources Interoperability Platform via the website or mobile app (hereinafter collectively – the Portal): what personal data is processed, for what purposes and on what legal grounds, how long it is retained and how data subjects can exercise their rights.
2. This Notice provides information on the processing of personal data of Portal users who act on their own behalf or on behalf of another natural person or legal entity. It also addresses the processing of the personal data of natural persons who are represented on the Portal, even though they do not use the Portal themselves.
3. The Notice covers the processing of personal data when logging in to the Portal and using its functions, including the initiation, ordering and payment for services provided by authorities, as well as when monitoring the progress of services and receiving results.
4. When a service provided by a service-providing authority is ordered via the Portal, data, including personal data, are processed to enable the Portal's functionality and the provision of the requested service. Information on the processing of personal data carried out on the Portal is provided in this Notice, whilst information on the processing carried out by the service-providing authority providing the service – on the privacy notice of that authority or by any other means of communication of its choice.
5. The purposes of personal data processing, the scope of personal data processed, the retention periods for personal data, the conditions for the provision of personal data and other conditions of personal data processing are set out in more detail in the Regulations of the State Information Resources Interoperability Platform (hereinafter – the SIRIP) and in other legal acts regulating the processing of personal data.
II. KEY TERMS USED IN THE PRIVACY NOTICE
6. Personal data – any information relating to an identified or identifiable natural person, as defined in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
7. Personal data processing – any operation or set of operations performed on personal data, as defined in Regulation (EU) 2016/679.
8. Personal data processors: State Digital Solutions Agency, legal entity code 188772433, operating at the address Konstitucijos ave. 15-89, Vilnius, [email protected], which processes personal data necessary for the provision of the SIRIP services; Public Management Agency, legal entity code 188784211, registered at Šventaragio st. 2, Vilnius, [email protected], which processes contact personal data specified in the descriptions of public and administrative services provided by institutions.
9. Personal data controller – the Ministry of the Economy and Innovation of the Republic of Lithuania, legal entity code 188621919, operating at the address Šeimyniškių g. 19-401, LT-09236 Vilnius, [email protected].
10. Data subject – a natural person whose personal data are being processed.
11. Service-providing authority – a state or municipal authority, agency or other entity whose public, administrative or other electronic service can be initiated or accessed via the Portal. Personal data relating to the ordering and provision of a specific service shall be provided to this authority to the extent necessary to provide the service.
12. Portal user – a natural person who uses the Portal in their own name or as a representative of another natural person or legal entity.
III. WHAT PRINCIPLES WE ADHERE TO
13. When processing the personal data of Portal Users, the principles of personal data processing set out in Regulation (EU) 2016/679 are complied with, therefore, personal data:
13.1. are processed lawfully, fairly and transparently;
13.2. are collected for specified, clearly defined and legitimate purposes and are not further processed in a manner that is incompatible with those purposes;
13.3. are adequate, relevant and limited to what is necessary for achieving the stated objectives;
13.4. are accurate and, where necessary, kept up to date;
13.5. are retained for no longer than necessary for the purposes for which the personal data are processed or for the period specified in legislation;
13.6. are processed in a manner that ensures their security, including protection against unauthorised or accidental destruction, loss, alteration, disclosure or unauthorised processing;
13.7. are processed only by authorised persons who have undertaken to ensure the confidentiality of the personal data being processed.
14. The scope of personal data processing depends on whether you use the Portal on your own behalf or represent another person, as well as on the Portal functions you select and the services you initiate via the Portal.
IV. FOR WHAT PURPOSES AND WHAT PERSONAL DATA WE PROCESS
15. This section specifies in what situations and for what purposes personal data are processed on the Portal. The scope of personal data of a particular person depends on the functions they use, the service they have chosen and whether they are acting on their own behalf or represent another person:
15.1. To ensure the functioning and security of the Portal
To ensure the proper and secure functioning of the Portal, its availability and information security, to prevent unlawful acts and investigate potential security incidents, the following personal data may be processed:
15.1.1. IP address;
15.1.2. date and time of login;
15.1.3. details of the browser, operating system used and, where a mobile app is used, its version;
15.1.4. technical data of the device and the network;
15.1.5. data on the actions carried out on the Portal;
15.1.6. data relating to technical enquiries to the extent necessary for the operation of the Portal, for the traceability of actions and the ensuring of security.
15.2. To ensure electronic identification and identity verification
To verify the identity of a Portal user and enable them to use services of the Portal, the personal data obtained from the selected electronic identification tool are processed.
Depending on the selected electronic identification tool, the following personal data may be processed:
15.2.1. name;
15.2.2. surname;
15.2.3. personal identification number;
15.2.4. name of the legal entity;
15.2.5. legal entity code;
15.2.6. other data necessary for identification when they are transmitted using the selected electronic identification tool.
Data for identifying a user may be obtained from electronic identification service providers, banks, other credit or payment institutions, participants in the eIDAS network and other entities lawfully providing such data.
15.3. To administer the account of a Portal user
To create and administer the account of a Portal user, provide access to self-service functions and manage the Portal user’s preferences, the following personal data may be processed:
15.3.1. name and surname;
15.3.2. personal identification number or other personal identifier used in the account;
15.3.3. email address, telephone number and, where provided, address;
15.3.4. user account settings;
15.3.5. information about the user’s preferences, including bookmarked services;
15.3.6. representation data;
15.3.7. data on the account creation and changes to its settings;
15.3.8. content of notifications sent to the user regarding the terms and conditions of service provision, date of their dispatch and status, when such notifications are sent.
15.4. To initiate and provide services by service-providing authorities
In order to enable a Portal user to select a service provided by a service-providing authority via the Portal, place an order for the service and transmit the personal data necessary for the service-providing authority, the following personal data are processed:
15.4.1. identity data specified in sub-paragraph 15.2;
15.4.2. contact details;
15.4.3. data necessary to receive the service;
15.4.4. documents submitted by the user;
15.4.5. information about the service ordered;
15.4.6. information about the service provider;
15.4.7. submission date and identifier of the order;
15.4.8. other data necessary for the provision of a specific service.
The scope of personal data processed on the Portal in each specific case depends on the nature of the service selected and the requirements set by the authority providing the service.
Personal ata are processed on the Portal only to the extent necessary to initiate and order the selected service, transmit the data necessary to the service provider and to provide the user with information on the progress and outcome of the service. The processing of data for the purpose of providing the service itself is carried out by the authority providing the service. Information on the personal data processing undertaken is provided by the authority in the manner specified in the service description or by another chosen means of communication.
15.5. To administer the history and results of the provision of services
To enable a Portal user to view information about the services ordered, in progress and completed, the following data may be processed:
15.5.1. duration of the provision of services;
15.5.2. service orders submitted, their dates and the authorities providing the services;
15.5.3. status of service orders and their changes;
15.5.4. progress in the provision of services, including tasks assigned to the user and notifications received via the Portal in relation to the service;
15.5.5. service results and documents relating to the delivery of those results, where the results or documents are submitted via the Portal;
15.5.6. other data relating to the provision of a specific service.
15.6. To send additional notifications selected by a Portal user
Information about the progress and results of the services ordered via the Portal is provided in the Portal user’s account. Portal users may also choose to receive notifications regarding this information and select the channel through which they are sent.
Depending on the notification channel selected by the user, the following data are processed for this purpose:
15.6.1. email address, where notifications by email have been selected;
15.6.2. telephone number, where SMS notifications have been selected;
15.6.3. delivery identifier for mobile app push notifications, where mobile notifications have been selected;
15.6.4. selected notification channel, their subjects and sending settings;
15.6.5. content, sending date and status of the notification.
15.7. To assess the functioning and usage quality of the Portal
To identify malfunctions of the Portal and assess whether users are able to successfully carry out actions on the Portal, including the submission of a service order and its forwarding to the relevant authority, the following data may be analysed:
15.7.1. type and time of actions carried out on the Portal;
15.7.2. status of the submission and transmission of the service order;
15.7.3. errors in the performance of actions and technical Portal operation data.
Where aggregated data that is not linked to a specific individual are sufficient for this purpose, such data are used.
15.8. To carry out surveys of the experience of Portal users
Portal users may be invited to take part, on a voluntary basis, in surveys regarding the use of the Portal and the services ordered through it. Depending on the survey method, the following data may be processed:
15.8.1. data relating to the sending of survey invitations and the contact details of the selected communication channel, where invitations are sent individually and the user has consented to receive them;
15.8.2. responses and feedback provided by the user;
15.8.3. the Portal function or service order stage assessed in the survey, where such information is collected.
Where possible, survey results are assessed in aggregate form, without linking them to specific users.
15.9. To initiate payments for services and report on their status
When a Portal user chooses to pay for the service ordered via the Portal, the Portal assists in initiating the payment and obtaining information about its status. Depending on the payment method for a specific service, the following data are processed:
15.9.1. the service being paid and the order related to the service;
15.9.2. the amount required to process the payment, the payment reference and other payment details provided by the service-providing authority;
15.9.3. the payment identifier, its status and, when these data are received, the date and time of the payment;
15.9.4. the payment result received from the payment service provider, including information as to whether the payment has been executed, not executed or failed;
15.9.5. the payer and their payment account, only to the extent such data are actually processed on the Portal in relation to a specific payment method.
The data necessary to make a payment are transmitted to the payment service provider chosen by the user, whilst the data necessary for determining the payment and maintaining the accounts are provided to the authority providing the service.
Payment service providers and other entities process the personal data transmitted to them for their own specified purposes and to the extent set out in legislation as independent data controllers, where this is provided for in the legislation regulating their activities, and in the terms and conditions applicable to them.
15.10. To identify representation rights and exercise them on the Portal
Where a Portal user acts on behalf of another natural person or legal entity, it is verified on the Portal whom they are authorised to represent and to what extent. Depending on the basis of representation, the following representation data obtained from state registers and information systems may be processed:
15.10.1. the identity of the representative and the natural person being represented;
15.10.2. the legal entity represented, including its name and code;
15.10.3. the basis of representation – representation according to law or by virtue of an authorisation/power of attorney;
15.10.4. representation rights and powers granted;
15.10.5. the details of the person on whose behalf the representative is acting on the Portal and the actions carried out by the representative on that person’s behalf;
15.10.6. other data necessary for verifying and exercising the rights of representation.
When a representative acts on behalf of the person represented on the Portal, the data relating to the ordering of services, their delivery progress, results and history, as described in this Notice, are also linked to the services ordered for that person. Such data are also processed on the Portal when actions are carried out on behalf of the person represented by a representative rather than the person represented.
15.11. To handle consultations and enquiries
When a person makes an enquiry regarding the use of the Portal or a service ordered via the Portal, depending on the method and matter of enquiry, the following data may be processed:
15.11.1. name and surname;
15.11.2. contact details;
15.11.3. date and time of the enquiry;
15.11.4. content of the enquiry;
15.11.5. information about the service ordered or used;
15.11.6. details of the enquiry handling progress and the response provided to the person;
15.11.7. other information provided by the Portal user as necessary to deal with the enquiry.
15.12. To establish, exercise and defend legal claims, and resolve disputes
Where a complaint or legal claim is submitted or a dispute arises in relation to the activities of the Portal, the data already processed on the Portal that are necessary to ascertain the facts, prepare a response and defend the data controller’s rights and legitimate interests may be used in order to address a specific issue, including:
15.12.1. data relating to logins and actions carried out on the Portal;
15.12.2. data relating to orders, progress and results of the services related to the dispute;
15.12.3. correspondence and documents submitted in relation to the matter under consideration;
15.12.4. details of the complaint or claim submitted, its examination and the decision taken;
15.12.5. other data necessary for the examination of a specific dispute or legal claim.
V. WHAT LEGAL BASES FOR THE PROCESSING OF PERSONAL DATA WE RELY ON
16. Personal data are processed on the Portal on the basis of one or more grounds for lawful processing as set out in Article 6 of Regulation (EU) 2016/679, depending on the specific personal data processing activity undertaken:
| Purpose of data processing | Legal basis |
|---|---|
| 16.1. To ensure the functioning and security of the Portal | Public interest task – to ensure the functioning, accessibility of and traceability of actions on the Portal (Article 6(1)(e) of Regulation (EU) 2016/679). Legal obligation – to ensure the security of personal data and handle their security breaches (Article 6(1)(c) and Articles 32–34 of Regulation (EU) 2016/679). |
| 16.2. To ensure electronic identification and identity verification | Public interest task – to identify a person logging in to the Portal and to grant them access to electronic services (Article 6(1)(e) of Regulation (EU) 2016/679). |
| 16.3. To administer the account of a Portal user | Public interest task – to enable self-service for a person on the Portal through which they can access the services by service-providing authorities (Article 6(1)(e) of Regulation (EU) 2016/679). |
| 16.4. To initiate and provide services by service-providing authorities | Public interest task – to enable the ordering of services from service-providing authorities via the Portal and forward the orders to the authorities providing them (Article 6(1)(e) of Regulation (EU) 2016/679). |
| 16.5. To administer the history and results of the provision of services | Public interest task – to provide the user with information on the progress and results of the services ordered, as well as information on previous orders (Article 6(1)(e) of Regulation (EU) 2016/679). |
| 16.6. To send additional notifications selected by the Portal user | The user’s consent to receive additional notifications via the selected channel (Article 6(1)(a) of Regulation (EU) 2016/679). |
| 16.7. To assess the functioning and usage quality of the Portal | Public interest task – to monitor the functioning of the Portal, identify malfunctions and improve its usability (Article 6(1)(e) of Regulation (EU) 2016/679) to the extent that this requires the processing of personal data. |
| 16.8. To carry out surveys of the experience of Portal users | Public interest task – to assess the quality of the Portal and improve the experience of Portal users (Article 6(1)(e) of Regulation (EU) 2016/679). Individual survey invitations are sent to users via the selected communication channel where the Portal user has consented to receive such invitations (Article 6(1)(a) of Regulation (EU) 2016/679). |
| 16.9. To initiate payments for services and report on their status | Public interest task – to enable payment initiation for the service provided by the authority, the receipt of payment result and its transmission to the authority providing the service via the Portal (Article 6(1)(e) of Regulation (EU) 2016/679). |
| 16.10. To identify representation rights and exercise them on the Portal | Public interest task – to enable the use of the Portal on behalf of the person represented after verifying the right of representation and recording who acted on their behalf (Article 6(1)(e) of Regulation (EU) 2016/679). |
| 16.11. To handle consultations and enquiries | Public interest task – to provide assistance with using the Portal (Article 6(1)(e) of Regulation (EU) 2016/679). Where an official request or complaint has been submitted which must be examined, a legal obligation applies (Article 6(1)(c) of the same Regulation). |
| 16.12. To handle legal claims and disputes | Legal obligation – to handle a complaint or a data subject’s request where it is mandatory (Article 6(1)(c) of Regulation (EU) 2016/679). Where a dispute relates to the performance of functions of the Portal, it is a public interest task to ascertain the facts of the dispute and to substantiate the position related to the performance of such functions (Article 6(1)(e) of the same Regulation). |
17. Where data are processed on the basis of consent, that consent may be withdrawn at any time under the procedure set out in paragraph 41. Once consent has been withdrawn, the personal data are no longer used for that purpose. The withdrawal of consent does not affect the lawfulness of the personal data processing carried out prior to the withdrawal of the consent. Personal data are removed, unless specific data must be retained on another legal basis applicable to such processing.
18. Consent to receive additional notifications or to take part in a survey is not a precondition for using the core functions of the Portal.
19. Where documents processed via the Portal in relation to a specific service contain special categories of personal data, their processing requires not only the legal basis set out in Article 6 of Regulation (EU) 2016/679 but also the exemption provided for in Article 9(2) of this Regulation, as applicable to the specific service. The receipt, transmission and retention of such documents on the Portal depend on the method of provision of the selected service. The service-providing authority separately determines the purposes and legal grounds for the data processing it carries out and informs data subjects about them.
VI. WHERE WE OBTAIN YOUR PERSONAL DATA FROM
20. The personal data of Portal users and represented natural persons may be obtained:
20.1. directly from the Portal user;
20.2. from the electronic identification means chosen by the Portal user;
20.3. from state and municipal authorities, agencies, enterprises and other entities;
20.4. from state registers and information systems;
20.5. from payment service providers, when a payment is initiated on the Portal.
VII. DO YOU HAVE TO PROVIDE PERSONAL DATA?
21. To log in to the Portal and order a service, identification data are necessary. The data required for a specific service are specified when ordering the service. A Portal user must provide only those personal data which are required under the terms and conditions of a specific service of the Portal, and which are necessary for the provision of that specific service or for the performance of functions set out in legislation.
22. If a Portal user fails to provide the personal data necessary for a specific service, it may not be possible to provide the relevant Portal service or to initiate and provide the requested service via the Portal.
23. Where personal data are processed based on consent, the provision of such data is voluntary. If such data are not provided or consent is withdrawn, information about the services remains available in the Portal account. The contact details and notification preferences for additional notifications are provided or set by the user according to the functions offered; if they are not provided, information about the service remains accessible in the Portal account.
VIII. TO WHOM WE PROVIDE PERSONAL DATA
24. The personal data processed on the Portal may be provided to:
24.1. entities providing administrative, public or other services initiated via the Portal;
24.2. state and municipal authorities, agencies, enterprises and other entities, where the provision of data is necessary for the performance of functions laid down in legislation;
24.3. the controllers or processors of state register information systems and information systems, where the provision of personal data is necessary for the provision of a specific service or for the performance of functions laid down in legislation;
24.4. providers of electronic identification services, where this is necessary to establish the user’s identity;
24.5. payment service providers and payment institutions when a payment is initiated;
24.6. providers of information systems, software, infrastructure, communications, data storage and other services, who process personal data on behalf of and under the instructions of the data controller;
24.7. courts, law enforcement institutions, supervisory authorities and other competent authorities and entities, where the provision of personal data is necessary for the performance of their functions set out in legislation;
24.8. other recipients of data, where the specific provision of personal data is permitted under Regulation (EU) 2016/679 and other applicable legislation.
25. Data processors process personal data only in accordance with the conditions and instructions set out in the data controller’s documents and in compliance with the requirements of Regulation (EU) 2016/679 and other applicable legislation.
IX. TRANSFER OF PERSONAL DATA OUTSIDE THE EUROPEAN ECONOMIC AREA
26. Personal data processed on the Portal are transferred to third countries or international organisations only where such a transfer is necessary and is carried out in accordance with the requirements of Chapter V of Regulation (EU) 2016/679.
27. Where personal data are transferred to a third country or to an international organisation, it is ensured that at least one of the conditions for the transfer of personal data set out in Chapter V of Regulation (EU) 2016/679 applies.
X. HOW LONG WE RETAIN PERSONAL DATA
28. The personal data of Portal users are retained only for the period necessary to achieve the purposes of personal data processing and in accordance with the time limits set out in the Regulations of the State Information Resources Interoperability Platform.
29. Other personal data processed on the Portal are retained for the following periods:
| Data | Retention period |
|---|---|
| User ID, personal identification number (legal entity code), data relating to representation, service orders, tasks involved in their execution and recipients, statuses, result delivery, payment initiation and their statuses, and data relating to the sending of notifications concerning service orders | As long as the account exists; once the account is deleted, the data are retained 10 years after its deletion |
| Name, surname, email address, telephone number, address provided by the user, bank account details | As long as the account exists; deleted upon account deletion |
| Delivery identifier for mobile notifications | As long as the user receives mobile notifications; if notifications are disabled or the account is deleted, the data are erased |
| Bookmarked services and selected service categories | As long as the account exists; deleted upon account deletion |
| History of changes to notification settings and consents | As long as the account exists; once the account is deleted, the data are retained 2 years after its deletion |
| Content of notifications | As long as the account exists; once the account is deleted, the data are retained 2 years after its deletion |
| Uncompleted service requests (drafts) | 1 month from the date of the last edit; deleted upon account deletion |
| Feedback on services | As long as published on the Portal; once the account is deleted, they are displayed without a user’s name. Link to the user – 2 years after the account is deleted |
| Data on consultations and enquiries | 2 years from the date on which the consultation or enquiry was finally resolved |
| Data on the processing of data subjects’ requests | 2 years from the date on which the request was finally resolved |
30. Other personal data provided on the Portal, to which the specific retention periods set out in paragraph 29 of this Section do not apply, are retained for 10 years, unless a shorter or longer statutory retention period applies to the specific data processing.
31. Log records of logins and the actions carried out on the Portal are retained for 2 years from the date they were created. After the expiry of this period, they are destroyed or anonymised, unless their continued retention is necessary for the investigation of an ongoing cyber security incident or for compliance with legal requirements; in such a case, they are retained until the end of the investigation or dispute.
32. At the expiry of the specified retention period of personal data, the personal data are destroyed, unless legislation or a specific legal basis for data retention stipulates a different method or period of retention.
XI. HOW WE ENSURE THE SECURITY OF PERSONAL DATA
33. To protect the personal data processed on the Portal from accidental or unlawful destruction, loss, alteration, disclosure or any other unlawful processing, appropriate organisational and technical measures are implemented to ensure the security of personal data.
34. The security measures applied are selected taking into account the nature and scope of the personal data undergoing processing, the purposes of the processing, the potential risks to the rights and freedoms of data subjects and the requirements of legislation.
35. Access to the personal data processed on the Portal is granted only to those persons for whom it is necessary to carry out their functions and only to the extent necessary for the performance of such functions.
XII. WHAT RIGHTS DO YOU HAVE?
36. The data subject has the rights specified in Regulation (EU) 2016/679 and other legislation, subject to the conditions and restrictions applicable to the specific processing of personal data, including:
36.1. the right to be informed about the processing of your personal data;
36.2. the right to access your personal data;
36.3. the right to request the rectification of inaccurate or incomplete personal data;
36.4. the right to request the erasure of your personal data in the cases set out in Regulation (EU) 2016/679;
36.5. the right to request the restriction of personal data processing;
36.6. the right to object to the processing of personal data in the cases and under the conditions set out in Article 21 of Regulation (EU) 2016/679;
36.7. the right to withdraw consent where personal data are processed on the basis of consent;
36.8. the right not to be subject to a decision based solely on automated data processing, including profiling, where such a decision produces legal effects or similarly significantly affects the data subject, except where there are exemptions provided for in Article 22 of Regulation (EU) 2016/679 and other legislation;
36.9. the right to lodge a complaint with the State Data Protection Inspectorate.
37. The rights of data subjects are not absolute and may be restricted in the cases and under the conditions set out in Regulation (EU) 2016/679 and other legislation.
XIII. HOW YOU CAN EXERCISE YOUR RIGHTS
38. In order to exercise your rights as a data subject in relation to the processing of personal data as set out in the Privacy Notice, you may submit a request to the State Digital Solutions Agency.
39. To protect personal data from unauthorised disclosure, the data subject may be asked to verify their identity before their rights are exercised.
40. Identity may be verified by the means specified in legislation, taking into account the method of submission of the application and specific circumstances.
41. A request can be submitted on the Portal, at the bottom of the home page of the Portal, or by clicking the Submit a request in the Account section of the mobile app.
42. The request should specify which right of the data subject and to what extent you wish to exercise and should also include any other information necessary for the examination of the request.
43. Requests concerning the exercise of data subjects’ rights are examined and responses are provided within the time limits specified in Regulation (EU) 2016/679 and, in the cases when specific legislation applies, within the time limits set out therein.
44. An account in the Portal may be deleted independently, without submitting a separate request to the State Digital Solutions Agency, by clicking the Delete account button in the Portal user settings (https://spp.epaslaugos.lt/lt/user-settings) or by selecting Account → Personal information → Delete account in the mobile app. The deletion of the account does not mean that all the personal data associated with the account are immediately destroyed, if their retention is required by legislation or is necessary to achieve legitimate purposes.
45. If you believe that your personal data are being processed unlawfully or that your, as a data subject’s, rights are being infringed, you have the right to submit a complaint to the State Data Protection Inspectorate.
State Data Protection Inspectorate
L. Sapiegos g. 17, 10312 Vilnius
Website of the State Data Protection Inspectorate
46. Before contacting the supervisory authority, it is recommended that you first contact the State Digital Solutions Agency so that the situation can be investigated and, if possible, resolved.
XIV. DATA PROTECTION OFFICER
47. The Data Protection Officer may be contacted by email [email protected] regarding any matters relating to the personal data processed on the Portal, their processing and other data protection issues.
48. Requests regarding the exercise of data subject’s rights shall be submitted under the procedure set out in Section XIII of this Privacy Notice. You may also contact the Data Protection Officer at the email address indicated above regarding the exercise of your rights as a data subject.
49. In carrying out his/her functions, the Data Protection Officer ensures the confidentiality of the information submitted and acts in accordance with the requirements of Regulation (EU) 2016/679.
XV. USE OF COOKIES
50. The Portal uses essential cookies and, where the Portal user consents, non-essential analytical and other cookies, which are intended to ensure the proper functioning of the Portal, remember the user’s preferences, ensure security, analyse the use of the Portal and for other specified purposes.
51. Detailed information on the cookies used on the Portal, their types, purposes, usage and retention periods, the data processed and the options available to Portal users to manage their preferences is available in separate Portal Cookie Regulations published on the Portal.
XVI. FINAL PROVISIONS
52. The Privacy Notice may be reviewed and updated periodically, considering changes in the Portal functionalities, the services provided, legislation or the processing of personal data.
53. The updated version of the Privacy Notice is published on the Portal. In case of material changes to the Privacy Notice, Portal users will be notified on the Portal or by other appropriate means.
54. The Privacy Notice applies from the date of its publication on the Portal, unless otherwise stated therein.
55. If, after reading the Privacy Notice, you have questions regarding the processing of personal data carried out on the Portal, please contact us using the details provided in this Privacy Notice.
