Privacy policy

1. WHAT IS THE PURPOSE OF THIS POLICY?

This privacy policy (hereinafter referred to as the policy) provides information on how UAB Kauno arena (hereinafter referred to as the Arena) collects, uses, and stores your personal data (hereinafter referred to as data) and what rights you have under applicable data protection laws.

We comply with the requirements of the EU General Data Protection Regulation (hereinafter referred to as the GDPR) and other data protection laws for the protection of your information. This policy is subject to change, so we recommend that you regularly review the latest version of this policy.

2. WHO IS THE CONTROLLER OF MY DATA?

Name: Kauno arena, UAB

Legal entity code: 302505310

Email address: info@zalgirioarena.lt

Address: Karaliaus Mindaugo pr. 50. LT-44334 Kaunas

3. PURPOSES AND LEGAL OF THE PROCESSING. CATEGORIES OF DATA CONCERNED

 3.1. Provision of services and/or goods

When you purchase our goods or order our services (e.g., tickets to events), we will process your data as specified below in order to deliver the goods or provide the services to you.

Legal basis for data processing	Categories of data concerned	Is the provision of data mandatory?
● Contract (GDPR Article 6(1)(b)) ● Legal obligation, when we are required by law to collect your address (GDPR Article 6(1)(c))	First and last name, email address, telephone number, account number, amount paid, goods/services, purchase history, health data (if tickets for disabled persons are purchased and/or employee assistance is requested), address (when required by law)	Yes. This is a requirement arising from the contract. If you do not provide this Data, you will not be able to order our goods

3.2. Administration of our websites

When you visit www.zalgirioarena.lt or www.salarestoranas.lt, we will process your data as described below for the purposes of administering these websites.

Legal basis for data processing	Categories of data concerned	Relevant data categories
Legitimate interest in processing data necessary for the security and proper functioning of the websites (GDPR Article 6(1)(f))	Device information (ID), IP address, login time, location data	No

3.3. Administration of our social media accounts

When you take active steps (e.g., respond to posts, write a message, or follow our accounts) on our social media accounts, we will process your data as described below.

Legal basis for data processing	Categories of data concerned	Is the provision of data mandatory?
● Consent (GDPR Article 6(1)(a)) ● Contract (GDPR Article 6(1)(b))	User name, comments on posts, shares, reactions ("like," "follow") and other information about posts, photos, message content, time of receipt and response, message attachments, information about participation in events, ratings, and other information you provide.	No

3.4. Ensuring your and our security

When you enter the Žalgirio Arena according to the pre-approved visitor list or after passing through the security checkpoint, as well as when you enter the field of view of the video cameras located in the Žalgirio Arena, the Žalgiris Basketball Center, or their territories, we will process your data as specified in the table below.

Legal basis for data processing	Categories of data concerned	Is the provision of data mandatory?
Legitimate interest in ensuring your and our safety (GDPR Article 6(1)(f))	First name, last name, signature, organization represented by the person, event and its date, video recording, place of visit/presence, behavior, personal property, time and date.	No

 3.5. Taking and publishing photos and/or videos from competitions and other events we organize

When you are photographed or filmed during an event, we will process your data as specified below.

Legal basis for data processing	Categories of data concerned	Is the provision of data mandatory?
● Consent (GDPR Article 6(1)(a)) ● Legitimate interest to capture and use images and/or videos from events we organize for representation purposes (GDPR Article 6(1)(f))	Video recordings, photographs, and related information (e.g., event, event date)	No

 3.6. Marketing

When you are our customer, you give us your consent, or we have a legitimate interest, we will provide you with relevant offers, information about our or our partners' services and goods, and ask for your opinion about the services we provide.

Legal basis for data processing	Categories of data concerned	Is the provision of data mandatory?
● Consent (GDPR Article 6(1)(a)) ● Legitimate interest in informing you about our goods and/or services (GDPR Article 6(1)(f))	First name, last name, email address, phone number, information on whether the sent email was opened, which active links were clicked, and other statistical data	No

 3.7. Because we organize games, promotions, and quizzes

When you participate in games, promotions, and quizzes organized by us (both on social networks and at event venues), we will process your data as specified below.

Legal basis for data processing	Categories of data concerned	Is the provision of data mandatory?
● Consent (GDPR Article 6(1)(a)) ● Contract (GDPR Article 6(1)(b))	First name, last name, contact details (e-mail, phone number), social media reactions and comments, information about participation in events, ratings, photos or videos, date of birth, team, address, other information necessary for organizing a specific event or activity	No

 3.8. Analysis of your purchase history, habits, and behavior

When you use our websites or purchase our goods or services, we analyze your purchasing habits and behavior in order to continuously improve our products and services. For this purpose, we will process your data as described in the table below.

Legal basis for data processing	Categories of data concerned	Is the provision of data mandatory?
● Consent (GDPR Article 6(1)(a)) ● Legitimate interest in informing you about our goods and/or services (GDPR Article 6(1)(f))	Device information, IP address, login time, location data, purchase history, your actions on our website	No

 3.9. Processing of your inquiries, requests, or complaints

When you submit an inquiry, request, or complaint to us, we process your data as specified below.

Legal basis for data processing	Categories of data concerned	Is the provision of data mandatory?
● Consent (GDPR Article 6(1)(a) ● Legitimate interest to administer and respond to your inquiries (GDPR Article 6(1)(f))	First and last name, email address, telephone number, address, inquiry, request or complaint, information related to the inquiry, request or complaint	No

3.10. Selection of potential employees

 When you apply for a vacant position with us or we contact you about job opportunities, we process your data related to the employee selection process.

Legal basis for data processing	Categories of data concerned	Is the provision of data mandatory?
● Consent (GDPR Article 6(1)(a)) ● Legitimate interest in contacting you about job opportunities at our company (GDPR Article 6(1)(f))	First name, last name, place of residence, e-mail address, telephone number, employment and education information (work experience, qualifications, language skills, IT and other competencies), information provided in your CV, cover letter or other application documents, references, interview summary, selection notes and test results	No

3.11. Compliance with legal requirements

In accordance with the limitation periods established by law, we will store data so that we can defend our rights and legal interests if necessary. We are required to retain certain data in order to comply with legal requirements in the areas of accounting, archiving, and others. In rare cases where you become involved in legal proceedings to which we are a party, we will use this data for the purposes of those legal proceedings.

Legal basis for data processing	Categories of data concerned	Is the provision of data mandatory?
● Legal obligation (GDPR Article 6(1)(c)) ● Legitimate interest in protecting our rights and legal interests (GDPR Article 6(1)(f))	First name, last name, email address, contracts, documents and data of legal significance, communications, legal documents, procedural documents, attachments, court documents, investigation information, information about convictions and criminal offenses, other data submitted and collected	In cases where we are required by law to collect, use, or store your data, you must provide us with your personal data. If you do not provide the aforementioned data, we will not be able to provide you with services and/or goods or fulfill our other obligations to you.

4. HOW LONG DO YOU STORE MY DATA?

We store data in a form that allows your identity to be determined for no longer than is necessary for the purposes for which the data is processed and in accordance with legal requirements:

• We store photos and videos from events we organize for different periods of time. In general, we delete data 10 years after the date of publication of the photo, but this period may be longer if you are a public figure and the photo or video is taken during the award ceremony.
• We store video and visitor list data for up to 6 weeks, except in cases where there is reason to believe that illegal activities have been recorded - until the end of the relevant investigation and/or court proceedings.
• We store your job application data for 3 years after the end of the relevant selection process. If you give your consent or we collect data from professional social media platforms, we store the data for 5 years.
• We store data that is necessary for the defense of our legal interests for 10 years, which is the general limitation period for claims (Article 1.125(1) of the Civil Code of the Republic of Lithuania), calculated in accordance with the rules set out in the aforementioned legal act.

5. WHERE DO YOU COLLECT INFORMATION ABOUT ME?

We collect most of the information from you. In addition, for certain purposes, we may obtain information from other sources, as indicated in the table below.

Source of data	Purpose of data processing
Other Žalgiris Group companies	Providing you with information about our goods and/or services
Social network service providers	Administration of our social network accounts
Personnel search service providers	Search for potential job candidates
Courts, law enforcement agencies, and other government agencies	Compliance with legal obligations and/or protection of our legal interests

 6. TO WHOM DO YOU TRANSFER INFORMATION ABOUT ME?

Where necessary for the purposes described above and permitted by applicable law, we share your data with data recipients both within and outside the European Economic Area (EEA).

Data recipients or categories of data recipients	If the Data is to be transferred to a third country or international organization:
	Third country	Safeguard or exception allowing the transfer
UAB Interneto vizija (website administration service provider)	---
UAB Baltnetos komunikacijos (website administration service provider)	---
Other companies in the Žalgiris group, including UAB Žalgiris Ventures (data optimization and analysis service provider)	---
UAB Ekskomisarų biuras (security services provider)	---
UAB Asistentai.lt (visitor access management service provider)	---
Typeform SL (survey and quiz creation service provider)	---
Lawyers, notaries, bailiffs, data protection officers, auditors, tax, business, human resources management, and other consultants	---
IT tools and services, electronic communications service providers, travel agencies, insurance companies, archiving and other service providers	---
State labor, social security, tax, supervisory authorities, police, prosecutor's office, courts, law enforcement and other state and municipal institutions	---
Facebook (Meta) (social networking service provider)	USA	EU Standard Contractual Clauses
LinkedIn (social networking service provider)	United States	EU Standard Contractual Clauses
Microsoft Cooropration (IT infrastructure and service provider)	USA	EU Standard Contractual Clauses
Potential or actual buyers of the business or part thereof and their authorized advisors or representatives	Various	EU Standard Contract Terms

7. WHAT ARE MY RIGHTS?

Subject to the conditions, restrictions, and exceptions set out in data protection laws, you have the following rights:

My right	When does this right apply to me?
Right of access	The right to obtain confirmation from us as to whether Data relating to you is being processed and, if such Data is being processed, you have the right to access the Data and information about the processing
Right to request rectification	The right to request that we correct inaccurate Data relating to you.
Right to request erasure of data ("right to be forgotten")	- when the Data is no longer necessary to achieve the purposes for which it was collected or otherwise processed; - when you withdraw your consent on which the processing of Data is based and there is no other legal basis for processing the Data; - when you object to the processing of the Data and there are no overriding legitimate reasons for processing the Data, or when you object to the processing of the Data for direct marketing purposes; - when the Data has been processed unlawfully; - when the Data must be deleted in order to comply with a legal obligation; - when the Data was collected for the direct offering of information society services directly and based on consent.
Right to restrict data processing	- when you contest the accuracy of the Data; - when the processing of the Data is unlawful and you do not agree to have it deleted and instead request that its use be restricted; - when we no longer need the Data for the purposes for which it was collected, but you need it to establish, exercise, or defend legal claims; - when you have objected to the processing of the Data and pending verification whether our legitimate interests override yours.
Right to data portability	when you seek to obtain your submitted Data or transfer this Data to another Data controller, and the processing of the Data is based on consent or a contract and is carried out by automated means.
Right to object	When we collect and use Data based on a task carried out in the public interest, public authority, or our legitimate interests, or for direct marketing purposes.
Right to withdraw consent	where the processing of Data is based on consent and you wish to withdraw it at any time, without affecting the lawfulness of the processing based on consent before its withdrawal.
Right to lodge a complaint	Right to lodge a complaint with a supervisory authority.

 8. DO YOU PROFILE ME AND MAKE AUTOMATED DECISIONS?

We do not use automated data processing, including profiling, to make decisions that have legal consequences for you or similarly significantly affect you.

9. DO YOU USE COOKIES AND OTHER SIMILAR TECHNOLOGIES?

When you visit websites, cookies and other similar technologies are used to ensure the quality of content and functionality. Cookies are small text files stored in your web browser or on your computer that help us recognize you as a visitor to the website, store your website visit history, and tailor content to you based on that history. ensure faster and more convenient use of the website, analyze your behavior, and thus improve the services provided. You can find a list of the cookies we use at: https://zalgiris.lt/slapuku-politika/.

10. HOW CAN I CONTACT YOUR DATA PROTECTION OFFICERS?

You can contact our data protection officer by email: dap@zalgiris.lt.

11. CAN THIS POLICY BE CHANGED?

We occasionally update this policy. The latest version of this policy can be found on our website.

Last updated: October 2025