Personal Data Processing Rules

STEAM Privacy Policy

General information

This Privacy Policy (hereinafter – the Policy) sets out the conditions for the processing of personal data when using the website https://steamlt.lt and, for registered users, the STEAM information system https://sistema.steamlt.lt (hereinafter – STEAM IS). The conditions laid down in the Policy apply every time you wish to access the content and/or service we provide, regardless of the device (computer, mobile phone, tablet, television, etc.) you use.

Please read this Policy carefully so that you correctly understand our approach and the main provisions concerning the processing of personal data.

Who is your data controller?

The controller of your personal data:

Lithuanian Centre of Non-formal Youth Education (hereinafter – the Controller) Legal entity code: 302848387 Registered office: Žirmūnų g. 1 B, Vilnius Tel. (85) 277 2394 E-mail: info@steamlt.lt

Name and surname of the Data Protection Officer: Janas Karolis E-mail of the Data Protection Officer: ada@lmnsc.lt

VAT payer code: LT100007095119

Supervisory authority: the State Data Protection Inspectorate.

When processing personal data, we comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter – the General Data Protection Regulation, or GDPR), the Law on Legal Protection of Personal Data of the Republic of Lithuania, the Law on Electronic Communications of the Republic of Lithuania and other directly applicable legal acts governing the protection of personal data, as well as with the instructions of the competent authorities.

WHAT PERSONAL DATA OF NATURAL PERSONS DO WE PROCESS?

The following users' personal data are processed in STEAM IS:

– Students attending STEAM centres:

• Name, surname
• School
• Class/group

– Teachers:

• Name, surname
• E-mail address
• Contact telephone number
• The municipality in which the institution where the teacher works is located
• The name of the institution where the teacher works
• Data on professional development courses completed at a STEAM centre, if the teacher attended professional development courses at a STEAM centre

– Employees of STEAM centres:

• Name, surname
• E-mail address
• Contact telephone number

Any other personal data of yours received from the Register of Students and the Register of Teachers is processed by us as a Data Processor under the agreement(s) signed with the data controller, the budgetary institution "National Agency for Education". You can find out which of your data are processed in the Register of Students and the Register of Teachers from the budgetary institution "National Agency for Education" at: https://www.nsa.smm.lt/

In addition to the information you provide when registering with STEAM IS, we use cookies to collect information about how you use our website. We may collect information about you, your device or your use of the content of our website with your consent.

For example, we may collect the following information:

• Device information, i.e. IP address, operating system version and the parameters of the device you use to access the content.
• Login information, i.e. the time and duration of your session, the search terms you enter on our websites, and any information stored in the cookies we have placed on your device (the cookie policy is provided below).

Information from third-party sources

Where teachers register students for the activities of STEAM centres, a check is made in the Register of Students as to whether the person being registered is registered in the Register of Students.

If you provide us with another person's data, we assume that you have duly obtained that person's consent to the provision of their personal data.

HOW DO WE OBTAIN YOUR PERSONAL DATA AND ON WHAT LEGAL BASIS DO WE PROCESS IT?

How we collect your personal data depends on whether you are a teacher, an employee of a STEAM centre, or a student whom a teacher registers for the activities of a STEAM centre, as well as on the channel through which the data were submitted.

Your data may be obtained from the Register of Students and the Register of Teachers.

Your data may also be provided by you yourself when registering with STEAM IS or in the other ways indicated below:

• We receive teachers' data from the teachers themselves when they register with STEAM IS;
• We receive students' data from teachers when registering them for the activities of STEAM centres;
• When you call the indicated number of STEAM IS or the website administration;
• When you send an enquiry by e-mail or complete the enquiry form on the website www.steamlt.lt;
• Through cookies, if you consent to them being placed on your device.

The legal bases for the processing of personal data are as follows:

• The personal data processing agreement on the provision of data from the Register of Students and the Register of Teachers (processing is necessary for the performance of a contract);
• Your consent given when registering to use STEAM IS;
• Your consent to receive our offers and news (for direct marketing purposes);
• Your consent to cookies;
• Compliance with obligations laid down in legal acts (accounting, archiving, notifications of personal data breaches, etc.).

FOR WHAT PURPOSES DO WE PROCESS YOUR DATA?

We may use your personal data for the following purposes:

• For the use and administration of STEAM IS (registration with STEAM IS, creation of an account, user identification, use of learning content, registration of students for the Centres, administration of the website, user enquiries);
• For direct marketing, if you have given your consent. If you do not wish to receive marketing information, you may opt out at any time by clicking the unsubscribe link in the e-mail or by asking us at the general e-mail address info@steamlt.lt;
• For the purpose of responding to an enquiry;
• For improving the website, its content and its operation by analysing the information obtained through cookies;
• For compliance with obligations laid down in legal acts and with professional standards.

WHAT PRINCIPLES DO WE FOLLOW WHEN PROCESSING YOUR DATA?

When processing personal data, we adhere to the following principles of personal data processing:

• personal data are collected for specified and legitimate purposes and may not be further processed in a manner incompatible with the purposes established before the personal data were collected (principle of purpose specification and legitimate purposes);
• personal data are processed lawfully, fairly and in a transparent manner (principle of lawfulness, fairness and transparency);
• personal data must be accurate and, where necessary, kept up to date; inaccurate or incomplete data must be rectified, supplemented, erased, or their processing suspended (principle of accuracy);
• personal data must be adequate in scope for the achievement of the specified purposes for which they are collected and further processed; excessive data are not accumulated or processed (principle of data minimisation);
• personal data are stored for no longer than is necessary to achieve the purposes pursued (principle of storage limitation);
• personal data are processed in such a manner that, through appropriate technical or organisational measures, appropriate security of the personal data is ensured, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage; access to personal data is granted only to those of our employees who need such data to perform their functions and assignments (principle of integrity and confidentiality);
• We are responsible for compliance with all data protection principles and for demonstrating our compliance; we process personal data properly and keep records of processing activities (principle of accountability).

HOW LONG DO WE STORE YOUR DATA?

We will store your personal data for as long as is necessary to achieve and implement the purposes set out in this Policy, taking into account the nature of the services provided to you and of the contracts concluded with you, except where longer storage of personal data and related documents is prescribed by applicable legal acts and is necessary (e.g. mandatory retention periods for accounting and other documents, etc.).

• Your data for the purposes of direct marketing and profiling for direct marketing, with a view to providing individualised offers, will be stored for 1 year from the last login to your account;
• Your data relating to the use of the STEAM IS platform will be stored for 1 year from the last active action, which is deemed to be logging in to your account, or for as long as required by legal acts;
• For the purpose of responding to an enquiry – 1 year from receipt of the enquiry;
• For the purpose of improving the website, its content and operation – see the retention periods in the list of cookies.

HOW DO WE PROTECT YOUR DATA?

We pay particular attention to data security and therefore responsibly implement organisational and technical data security measures that help protect personal data against accidental or unlawful destruction, alteration, disclosure, as well as against any other unlawful processing. The security measures we have implemented cover the protection of personnel, information, IT infrastructure, internal and public networks, as well as office buildings and technical equipment.

WHO HAS ACCESS TO YOUR DATA?

Your personal data may be accessible only to a limited circle of our employees and of the entities providing IT, marketing and legal services to our organisation, and only to the extent necessary to perform our functions and to ensure the proper processing of your personal data; strict requirements for the protection of confidential information will apply to all such persons. In order to achieve the purposes set out in this Policy, we may transfer your data to, or grant access to your data to, the following data recipients/processors:

• data processors that provide services and process your data on our behalf, in our interests and at our request (e.g. server lessors, other providers of IT services, auditors, consultants, other providers of necessary services, etc.);
• the National Agency for Education, which manages the Register of Students and the Register of Teachers (as a processor of the data contained in these registers, we only view the data of these registers but do not store them);
• other parties, where required by law or where necessary in order to pursue other legitimate purposes.

Please note that our data processors process your data only in accordance with our clearly given instructions, undertaking to ensure appropriate protection and confidentiality of the data received from us for processing, as well as organisational and technical measures meeting security requirements, as set out in more detail in the agreements concluded between us and the service providers on data processing. The data processors to which we transfer your data or to which we grant access to your data may be established outside the Republic of Lithuania, the European Union or the European Economic Area. Data are transferred to such processors only where this is permitted under legal acts, where the requirements of the General Data Protection Regulation on data transfers are complied with, and only by taking all the measures necessary to ensure the protection of your privacy.

Cases in which we may disclose/transfer your information to other parties (data recipients):

• in order not to breach the law or in response to a mandatory requirement of legal proceedings (e.g. having received a lawful ruling or order to carry out a search, or another court decision);
• in order to confirm the lawfulness of our actions;
• in order to protect the rights and property of the Controller or of any of the companies of its group, or to ensure their security;
• in other cases where there is a legitimate basis (e.g. your consent or request, the legitimate interest of a third party, etc.).

RIGHTS GUARANTEED TO YOU

We guarantee the implementation of the following rights of yours and the provision of information upon your request or enquiry:

• to know (to be informed) about the processing of your data (right to know);
• to access your data and to know how they are processed (right of access);
• to request rectification of, or, taking into account the purposes of the processing, completion of your incomplete personal data (right to rectification);
• to request the erasure of personal data relating to you (right "to be forgotten");
• to request that the Controller restrict the processing of personal data (right to restriction);
• to object at any time to the processing of your personal data where such processing is carried out in the public interest or where processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party (right to object);
• the right to lodge a complaint with the State Data Protection Inspectorate of the Republic of Lithuania, e-mail: ada@ada.lt.

WHERE TO TURN?

If you have any request concerning the processing of your data or any related question, please contact the Data Protection Officer at ada@lmnsc.lt, write to us at info@steamlt.lt, or contact us at Žirmūnų g. 1 B, Vilnius.

COOKIE POLICY

When you visit our website https://steamlt.lt or https://sistema.steamlt.lt, we want to provide content and functions that are tailored precisely to your needs. Cookies are needed for this. These are small pieces of information stored in your web browser. They help us to recognise you as a previous visitor to the website, to record your browsing history on the website and to tailor the content accordingly. Cookies also help ensure the smooth operation of the websites, make it possible to monitor the duration and frequency of visits to the website and to collect statistical information about the number of website visitors. By analysing these data, we can improve our website and make it more convenient for you to use.

How to manage and delete cookies

When you use a browser to access the content we provide, you can configure your browser to accept all cookies, reject all cookies, or notify you when a cookie is sent. Every browser is different, so if you do not know how to change your cookie settings, please consult its help menu. Your device's operating system may have additional cookie controls. If you do not want information to be collected by means of cookies, use the simple procedure available in most browsers that allows you to refuse the use of cookies. To find out more about how to manage cookies, visit: http://www.allaboutcookies.org/manage-cookies/.

However, please remember that some services may be designed to work only with cookies, and if you disable them you will no longer be able to use those services or certain parts of them.

Below is a list of the strictly necessary cookies used on the Website:

Below is a list of the statistics and analytics cookies used on the Website:

Below is a list of the marketing cookies used on the Website:

APPROVAL OF AND AMENDMENTS TO THE PRIVACY AND COOKIE POLICY

This Policy is reviewed at least once every two years. When we update the Policy, we will inform you of what we consider to be material changes by publishing a notice on the relevant website https://steamlt.lt. If you log in or use the content and/or services we provide after the publication of such a notice, we will consider that you have familiarised yourself with the new changes set out in the update. The most recent version of the Policy is always available at https://steamlt.lt or https://sistema.steamlt.lt.