PRIVACY AND COOKIE POLICY

Introduction

This Privacy Policy ("Policy") governs how MB "Exploro LT", legal entity code 306988205, registered address Jonavos g. 6-5, Kaunas (hereinafter - the Company or We), processes, stores, and uses personal data when customers use our services, the website www.exploro.lt, via email, phone, or other communication channels.

The Policy is prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council ("GDPR"), the Law on Legal Protection of Personal Data of the Republic of Lithuania, and other applicable legal acts.

1. Definitions

• 1.1. Company – MB "Exploro LT".
• 1.2. Personal Data – any information about a natural person by which they can be directly or indirectly identified.
• 1.3. Data Subject – a natural person (customer, potential customer, partner) whose data is processed by the Company.
• 1.4. Data Controller – the Company, which determines the purposes and means of processing personal data.
• 1.5. Data Processor – a third party processing personal data on behalf of the Company.
• 1.6. Partners – insurance companies, leasing service providers, parking service operators, transport and ticket suppliers, gift voucher operators.
• 1.7. Cookies – small files stored on the user's device used for website functionality, statistics, or marketing.
• 1.8. GDPR – Regulation (EU) 2016/679 of April 27, 2016.

2. Data Controller

The Data Controller is:

3. Data Processing Principles

• lawfulness, fairness, and transparency;
• purpose limitation;
• data minimization;
• accuracy;
• storage limitation;
• integrity and confidentiality.

4. What Data We Collect

• name, surname;
• date of birth;
• personal code (when required for insurance or leasing);
• phone number;
• email address;
• vehicle license plate number (for parking services);
• payment and billing information;
• travel documents, special needs;
• cookie data.

5. Purposes and Grounds for Data Processing

• contract performance;
• customer service;
• marketing;
• compliance with legal obligations;
• legitimate interest.

6. Children's Personal Data

• 6.1. The Company does not knowingly collect or process personal data of children (under 16 years of age) without the consent of their parents or legal guardians.
• 6.2. Children's data may only be processed when services are ordered on behalf of family members.
• 6.3. Parents or guardians are responsible for providing children's data.
• 6.4. Children's data is never used for direct marketing.
• 6.5. Accidentally received data will be deleted immediately.
• 6.6. Parents or guardians may request to review, correct, or delete the data.

7. Cookies and Tracking Technologies

8. Transfer of Personal Data

9. Data Retention Periods

• Order data – 10 years.
• Marketing data – until consent is withdrawn.
• Cookie data – from session to 2 years.
• Documents – as long as necessary for disputes or under legal acts.

10. Data Security Measures

• encryption and technical protection;
• access only to authorized employees;
• employee confidentiality obligations;
• regular IT system maintenance.

11. Rights of the Data Subject

• 11.1. Right to receive information – the data subject has the right to be informed about how and for what purposes their personal data is processed.
• 11.2. Right to access data – the data subject has the right to obtain confirmation whether the Company processes their personal data and to receive a copy of it.
• 11.3. Right to rectification – the data subject can request to correct inaccurate or incomplete data.
• 11.4. Right to erasure ("right to be forgotten"), when data is no longer needed, consent is withdrawn, or data is processed unlawfully.
• 11.5. Right to restriction of processing, when accuracy is contested or data is no longer used but needed for legal claims.
• 11.6. Right to data portability – to receive data in a structured format and transfer it to another controller.
• 11.7. Right to object – especially when processed on the basis of legitimate interest (e.g., for direct marketing).
• 11.8. Right to withdraw consent at any time.
• 11.9. Exercise of rights – requests can be submitted via email labas@exploro.lt or at Jonavos g. 6-5, Kaunas. A response is provided within 1 month, in complex cases – within 3 months. The Company may request additional information to verify identity.
• 11.10. Complaints – If you believe your rights have been violated while processing your data, you have the right to lodge a complaint with the supervisory authority – State Data Protection Inspectorate (L. Sapiegos g. 17, Vilnius, ada@ada.lt).

12. Automated Decision Making

The Company does not use automated decision-making or profiling that produces legal or significant effects unless clearly informed to the customer.

13. Are You Required to Provide Your Personal Data?

Providing personal data is strictly voluntary, but failure to provide personal data may prevent the provision of services.

14. Data Sources

• directly from the customer;
• from partners;
• automatically (cookies, IP);
• from public sources.

15. Commercial Information and Newsletters

You are given the opportunity to subscribe to a newsletter by checking a box, indicating your email address or phone number, and giving consent to process your personal data for commercial marketing and information sending purposes. Subscription can be canceled at any time by writing to us at: labas@exploro.lt or clicking the "Unsubscribe" hyperlink in the newsletter.

16. Changes to Privacy Policy

The Company may change the Policy. The new version is published on the website www.exploro.lt. In case of significant changes, customers are informed via email or other means.

17. Contacts