Privacy policy.

This privacy policy sets out how MB GRIMM.LT collects, uses, stores and otherwise processes personal data when you use the pdvs.lt website, PDVS – the people and document management system, contact us or conclude a service agreement with us.

1.1.Purpose of this policy

The purpose of this policy is to inform you clearly how we process your personal data, on what grounds, how long we keep it, to whom we may disclose it and what rights you have.

1.2.Data controller

MB GRIMM.LT
Company code: 305728699
VAT number: LT100013931112
Address: Gedimino g. 59, Kaišiadorys, Lithuania
E-mail: administracija@grimm.lt

1.3.Our role

Depending on the situation, MB GRIMM.LT may act as:

• data controller – where we ourselves determine the purposes and means of processing (e.g. when handling pdvs.lt enquiries and customer contacts);
• data processor – where we process data provided by a customer on its behalf through the PDVS system (e.g. the customer’s employee, candidate or supplier data).

If your personal data is processed on behalf of our customer, you should first contact that customer, who is considered the data controller, to exercise your rights.

1.4.Data protection contact

For any questions about the processing of personal data you can contact us at administracija@grimm.lt. You also have the right to lodge a complaint with the State Data Protection Inspectorate of Lithuania (VDAI, vdai.lrv.lt).

1.5.Changes to this policy

We may update this policy from time to time. The latest version is always published on pdvs.lt.

Depending on how you interact with us and which PDVS functions are used, we may process the following categories of personal data:

Personal data may be collected in the following ways:

• directly from you when you fill in the enquiry form on the website, register or contact us;
• from your employer or the organisation that uses PDVS, or from a PDVS partner (reseller) when it registers your organisation as a prospect or orders a licence for it;
• automatically when you use the website or the system;
• from integrated third-party systems (e.g. Microsoft 365, Dokobit, Vikarina, BioStar 2, Worksober) where such integrations are enabled;
• from documents and files you upload to the system.

4.1.Responding to enquiries

We process website enquiry data to answer your enquiry, agree a demo time and prepare a proposal. Legal basis: steps taken at your request prior to entering into a contract (GDPR Art. 6(1)(b)) and our legitimate interest in answering enquiries (GDPR Art. 6(1)(f)).

4.2.Performance of a contract

We process personal data to conclude and perform contracts, provide access to PDVS, administer accounts, deliver services and provide customer support.

4.3.Compliance with legal obligations

We also process data to comply with legal obligations that apply to us, including accounting, tax, employment law, security and compliance requirements.

4.4.Legitimate interests

We may process data to ensure security, prevent incidents, audit, improve the system and service quality and defend our rights.

4.5.Consent

In some cases personal data is processed on the basis of your consent – e.g. statistics cookies on the website, or where required by law or by a specific system function. You may withdraw consent at any time.

PDVS and customer data are hosted on server infrastructure managed by MB GRIMM.LT or, by agreement with the customer, on the customer’s own infrastructure. Data is stored in an environment protected by technical and organisational measures designed to ensure confidentiality, integrity and availability.

PDVS may use artificial intelligence and automated processing functions – e.g. automatic CV parsing in recruitment, document recognition (OCR) or integrations with OpenAI / Azure OpenAI services. Such data is processed only to the extent necessary for the function. Where applicable, we require service providers not to use the data to train their models unless expressly agreed otherwise. No automated decisions with legal effects on a person are made without human involvement.

Personal data may be disclosed to:

• hosting and server maintenance providers;
• AI, OCR, e-mail (the enquiry mailbox runs on Microsoft 365) or technical infrastructure providers; website statistics data goes to Google (Google Analytics, only with your consent);
• providers of integrated systems where integrations are enabled by the customer (Microsoft 365, Dokobit, Vikarina, BioStar 2, Worksober and others);
• accounting, legal, audit and consulting service providers;
• public authorities where required by law;
• potential business acquirers in the event of reorganisation or transfer of assets.

If certain integrations or service providers operate outside the European Economic Area, personal data is transferred only with appropriate safeguards provided for by law (e.g. EU standard contractual clauses). Google Analytics data may be transferred to Google LLC in the USA under the EU–US Data Privacy Framework.

We implement technical and organisational security measures that help protect personal data from unauthorised access, loss, destruction, alteration or disclosure:

• two-factor authentication (2FA);
• role-based and object-level access control;
• encryption of sensitive fields and HTTPS protection;
• audit logs with user, time and IP address;
• sign-in attempt limits and IP blocking;
• secure document download and file validation.

Personal data is kept no longer than necessary to achieve the purposes for which it was collected, unless a longer period is required by law or to defend legitimate interests. Website enquiry data is kept for up to 12 months after the last correspondence: enquiries stored in the website database are deleted automatically 12 months after submission, and their IP addresses after 30 days. If a contract is concluded, data is kept for its term and the statutory period after it. Technical server logs are kept for up to 14 days. Retention periods for data processed in PDVS on behalf of a customer are set by that customer.

You have the right to:

• be informed about the processing;
• access your data;
• have inaccurate data rectified;
• have data erased;
• restrict processing;
• object to processing;
• data portability;
• withdraw consent where processing is based on consent.

To exercise your rights, contact us at administracija@grimm.lt. We reply within 30 days.

MB GRIMM.LT
Company code: 305728699
VAT number: LT100013931112
Address: Gedimino g. 59, Kaišiadorys, Lithuania
Data protection e-mail: administracija@grimm.lt
Commercial enquiries and demos: komercija@grimm.lt