Privacy policy

1.Applicable law

We process personal data in accordance with:

• Regulation (EU) 2016/679 of 27 April 2016 (the General Data Protection Regulation, GDPR);
• the Republic of Lithuania Law on Legal Protection of Personal Data;
• the Republic of Lithuania Law on Electronic Communications, insofar as it concerns cookies and similar technologies;
• other applicable Lithuanian and European Union law, including rules on cash registers and i.EKA.

2.Definitions

Terms used in this Policy have the meaning given in the GDPR. For convenience:

• Personal data - any information relating to an identified or identifiable natural person (for example a name, email address, telephone number or IP address).
• Processing - any operation performed on personal data: collection, recording, storage, use, disclosure, erasure and so on.
• Controller - the Company, which determines the purposes and means of processing.
• Processor - a natural or legal person that processes personal data on behalf of the controller.
• Data subject - the natural person whose data we process (a site visitor, an enquirer, a customer’s representative).
• Consent - a freely given, specific, informed and unambiguous indication of the data subject’s wishes.

3.Controller

The controller is EPS LT, UAB, company code 302413851, VAT number LT100004811919, registered office Savanorių pr. 123A (3rd floor), 03150 Vilnius, Republic of Lithuania.

For questions on personal data write to sales@eps.lt or call +370 5 207 1000. We have not appointed a data protection officer, because the Company does not fall within the mandatory cases in Article 37 GDPR.

4.Categories of data subjects

This Policy covers processing of personal data of:

• visitors to the site;
• persons who submit an enquiry for a quote;
• representatives of legal persons who place EPS One purchase, rental or short-term rental orders;
• persons who order thermal paper;
• other persons who contact us by email, telephone or otherwise about EPS One products and services.

The site is intended for business customers. Data of a legal person (name, company code, VAT number, registered office) are not personal data, but we often process personal data of a representative (contact person) together with them.

5.Which personal data we collect

Depending on how you use the site and our services, we may process:

• Identity and representation data: first name, last name, the person who will sign the contract.
• Contact data: email address, telephone number.
• Employer / customer company data linked to the representative: company name, code, VAT number, address.
• Order data: chosen plan (purchase, rental, short-term rental), quantity, term, rental dates, VAT rates, alcohol trade, bank, account number, paper quantity, delivery method and address, postal code.
• Consent data: acknowledgement of the privacy policy, marketing consent, cookie choice.
• Technical site data: IP address, date and time, browser and device information, pages viewed, referrer.
• Analytics data (only with consent): usage statistics, session recordings, mouse movement / heatmaps, advertising conversion data.
• Correspondence: the content of emails and calls insofar as it relates to an order or enquiry.

We do not knowingly collect special-category data (health, biometric data, religion and similar). Please do not send us such data.

6.Purposes, legal bases and retention

We process data only for specified, explicit and legitimate purposes. Legal bases below refer to Article 6(1) GDPR.

When a retention period ends we erase the data or irreversibly anonymise them, unless longer storage is required by law or needed for a dispute.

7.Sources of data

We obtain personal data:

• directly from you - when you fill in forms, email us, call, or visit our office;
• automatically - when you browse the site (technical data and, if you agree, analytics data);
• from the company you represent, if another employee of that company sends us the data;
• from public registers or public authorities where needed to perform a contract or a legal duty (for example i.EKA procedures), to the extent the law allows.

If you refuse to provide data that are necessary for a contract or a legal duty, we will not be able to accept the order, prepare the contract or register the device.

8.Recipients and processors

We disclose personal data only as far as needed for the relevant purpose. Recipients may include:

• hosting, content-delivery and email-sending providers (processors);
• courier and parcel-locker services - for delivery;
• the bank or payment-service provider you name - for a card-acceptance agreement;
• the State Tax Inspectorate under the Ministry of Finance of the Republic of Lithuania - for i.EKA registration and cash-register duties;
• professional advisers (lawyers, auditors, IT support) under confidentiality duties;
• analytics and advertising providers - only if you consented to cookies;
• pre-trial investigation bodies, courts and other authorities - where the law requires it.

We conclude Article 28 GDPR contracts with processors. We do not sell personal data and do not provide them to third parties for marketing without a separate consent from you.

9.Transfers outside the European Economic Area

Most processing takes place in the European Economic Area (EEA). Some providers (in particular email, hosting or, if you consent, analytics and advertising) may process or access data outside the EEA.

In those cases we apply Chapter V GDPR: we transfer to a country covered by an adequacy decision of the European Commission, or we use appropriate safeguards under Article 46 GDPR, in particular the Commission’s standard contractual clauses, and additional technical and organisational measures where needed.

You may ask sales@eps.lt about a specific transfer and the safeguards applied.

10.Automated decision-making and profiling

We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).

If you consented to analytics, we may compile aggregated usage statistics and, for advertising measurement, attribute a conversion event. This is not used to decide automatically on your creditworthiness, a contract or a price.

11.Security measures

We apply organisational and technical measures to protect personal data against accidental or unlawful destruction, alteration, disclosure and other unlawful processing. Measures are chosen according to risk, and include:

• access limited to what a person’s role requires;
• encrypted transmission on the site (HTTPS);
• selection of providers and control of contracts with them;
• back-ups and access logs where proportionate;
• staff instruction on confidentiality.

No system is completely secure. If we become aware of a personal-data breach that risks your rights, we will take the steps in Articles 33 and 34 GDPR, including notifying the supervisory authority and, where required, data subjects.

12.Rights of the data subject

Chapter III GDPR gives you the following rights, to the extent they apply to the processing in question:

• Right to be informed - this Policy is the main such notice.
• Right of access (Art. 15) - confirmation of whether we process your data, and a copy.
• Right to rectification (Art. 16) - inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”, Art. 17) - where the data are no longer needed, consent is withdrawn and there is no other basis, processing is unlawful, and in the other cases in Art. 17. This right does not apply where processing is necessary for a legal obligation or for the establishment, exercise or defence of legal claims.
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20) - where processing is based on consent or a contract and is carried out by automated means.
• Right to object (Art. 21) - where we process on the basis of legitimate interest; we then stop unless we demonstrate compelling legitimate grounds.
• Right to withdraw consent (Art. 7(3)) - at any time, where processing is based on consent. Withdrawal does not affect processing before that point.
• Right not to be subject to a solely automated decision (Art. 22).

13.How to exercise your rights

Send requests to sales@eps.lt or in writing to Savanorių pr. 123A, 03150 Vilnius. State your name, contact details and which right you wish to exercise. To avoid disclosing data to the wrong person, we may ask for information confirming your identity.

We will reply within one month of receiving the request. Taking into account the complexity and number of requests, that period may be extended by a further two months; we will tell you within the first month if so.

Handling a request is free of charge. If requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may charge a reasonable fee or refuse to act (Article 12(5) GDPR).

You may withdraw marketing consent via the unsubscribe link in each message or by writing to sales@eps.lt. Cookie consent is managed under the Cookie Policy.

14.Cookies and similar technologies

We use cookies and similar technologies (including browser local storage) on the site. Necessary cookies do not require your consent. Analytics and advertising cookies are used only after consent.

A full description of the technologies, categories, retention and how to manage consent is set out in the separate Cookie Policy, which forms part of this Policy.

15.Children’s data

The site and services are intended for business, not for children. We do not knowingly collect data of persons under 14 (the age set in Lithuania for consent to information-society services under Article 8 GDPR).

If we learn that a child’s data were provided without the required parental or guardian consent, we will erase them. Please tell us at sales@eps.lt.

16.Validity and changes

This version takes effect on the date stated in the heading. The Policy is published on skaitytuvas-kasa.lt.

We may amend the Policy when the law, our activities, site functions or processing practices change. The current version is always published on this page, with the update date and version number. For material changes, if we have your email as a customer representative, we may also notify you separately.

Continued use of the site after an update means you have read the new version. Orders and contracts concluded before a change remain subject to the version then in force, except where mandatory law provides otherwise.

17.Supervisory authority and complaints

If you believe your personal data are processed in breach of the law, we invite you to contact us first at sales@eps.lt. We aim to resolve complaints amicably.

You also have the right to lodge a complaint with the supervisory authority - the State Data Protection Inspectorate (VDAI):

• address: L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania;
• tel. +370 5 271 2804;
• email ada@ada.lt;
• website: https://vdai.lrv.lt;
• the complaint form and procedure are published on the VDAI website.

If you live or work in another EU Member State, you may also complain to that state’s supervisory authority. You also have the right to bring proceedings before a court.