Privacy Policy

APPROVED

By Order No. 2026-08-31
of the Director of the “Gerų darbų dirbtuvės” Support Foundation
dated 31 August 2026

Updated: 31 August 2026

This Privacy Policy (hereinafter referred to as the Policy) provides information on how the “Gerų darbų dirbtuvės” Support Foundation (hereinafter referred to as the Foundation) processes personal data and for what purposes and by what means such data processing is carried out. This Policy applies to the relationship between the Foundation and Data Subjects, including relationships with donors and beneficiaries that arose prior to the entry into force of this Policy.

To the extent not covered by this Policy, when processing data the Foundation shall comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

1. DEFINITIONS

Foundation – the “Gerų darbų dirbtuvės” Support Foundation, legal entity code 303379747, registered office address J. Jasinskio 16 G, Vilnius, Lithuania.

Data Subjects – donors, beneficiaries, employees of the Foundation, partners and other natural persons who participate in the activities of the Foundation or are otherwise related to the activities of the Foundation and/or provide monetary or other forms of support through the Foundation’s website and/or online store and whose personal data is processed by the Foundation.

Personal Data – any information relating to a Data Subject who is identified or can be identified.

Data Controller – the Foundation, as the Foundation determines the purposes and means of processing Personal Data.

Data Processor – a natural or legal person who processes Personal Data on behalf of and under the instructions of the Foundation.

Data Processing – any operation or set of operations performed on Personal Data by automated or non-automated means (including collection, recording, storage, alteration, granting access, retrieval, transmission, etc.).

Profiling – any form of automated processing of Personal Data consisting of the use of Personal Data to evaluate certain personal aspects relating to a natural person.

Regulation – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC.

Consent – any freely given, specific and unambiguous indication of the properly informed Data Subject’s wishes, by a statement or by a clear affirmative action, by which they agree to the processing of Personal Data relating to them.

Direct Marketing – activities intended to invite persons, by post, email, telephone or other direct means, to donate to the Foundation’s activities and/or to communicate information about such activities.

2. GENERAL PROVISIONS

2.1. This Policy sets out the general provisions governing how the Foundation processes Personal Data. Additional information on the processing of Personal Data is provided in the Foundation’s data processing description and on the Foundation’s website [www.ankstukai.lt](http://www.ankstukai.lt).

2.2. The Foundation ensures the confidentiality of Personal Data in accordance with the requirements of applicable legislation and applies and implements appropriate technical and organisational measures designed to protect Personal Data against unauthorised access, disclosure, accidental loss, alteration, destruction or other unlawful processing.

2.3. The Foundation may engage Data Processors for the processing of Personal Data. In such cases, the Foundation shall take the necessary measures to ensure that such Data Processors process Personal Data in accordance with the Foundation’s instructions and applicable legislation and shall require them to implement appropriate measures to ensure the security of Personal Data.

2.4. In order to ensure the full functionality of the Foundation’s website [www.ankstukai.lt](http://www.ankstukai.lt), the Foundation uses cookies. The Foundation uses cookie information to identify a person as a previous user of the website and to compile website traffic statistics. By using the Foundation’s website, the Data Subject agrees to the Policy. The Data Subject has the right to object to the use of cookies, in which case certain functions of the Foundation’s website may not be available.

3. CATEGORIES OF PERSONAL DATA

3.1. The main categories of Personal Data processed by the Foundation include, but are not limited to:

3.1.1. Data related to providing or receiving support – the Data Subject’s first name, surname, personal identification number (if provided), bank account number and amount of support.

3.1.2. Data used for communication with the Foundation’s partners, employees, service providers or volunteers – the Data Subject’s first name, surname, personal email address, personal telephone number and residential address (if provided).

3.1.3. Financial data – data relating to allocated and provided support.

3.1.4. Data collected through communication and other technical means – Personal Data obtained directly at the locations of the Foundation’s fundraising or other direct marketing campaigns, when communicating with a donor by telephone, email or other means of communication, for example through social networks or similar channels – the Data Subject’s first name, surname, personal identification number (if provided), bank account number and amount of support.

3.1.5. Data related to a donor’s visits to the website or use of other Foundation donation channels.

4. LEGAL BASES FOR PROCESSING PERSONAL DATA

4.1. Personal Data may be processed on the following legal bases:

4.1.1. The Consent of the Data Subject;

4.1.2. Other lawful bases for data processing established by the Regulation.

5. PURPOSES OF PROCESSING PERSONAL DATA

5.1. To ensure that support is provided and received properly and transparently;

5.2. To provide information on the use of received support and to send newsletters.

5.3. To provide reports and information on issues faced by families and communities receiving support;

5.4. To develop fundraising sources (Direct Marketing);

5.5. To inform the public (presentation of activities, shaping public opinion, education, presentation of the use of support, representation of the premature baby community, etc.);

5.6. To maintain relationships with donors (maintaining feedback);

5.7. To comply with legal requirements;

5.8. To ensure proper management of the Foundation’s finances and accounting and the proper fulfilment of obligations towards donors;

5.9. To ensure the transparent and justified use of received support;

5.10. To ensure that independent auditors are able to obtain all relevant information necessary to carry out an audit of the Foundation;

5.11. To ensure data processing within IT systems;

5.12. To provide support for the Foundation’s activities.

6. PROFILING | DIRECT MARKETING

6.1. Profiling carried out by the Foundation involves the automated processing of Personal Data in order to evaluate certain personal characteristics of the Data Subject and thereby analyse or predict, for example, the choices of such a person and similar aspects.

6.2. Profiling activities for the purposes of preparing personalised offers and marketing are based on the Foundation’s legitimate interest. The Foundation provides donors with the opportunity to manage their privacy settings.

6.3. The Foundation may collect statistical data about the Data Subject. Statistical data used to create segments/profiles may be collected from external sources and may be used together with data held by the Foundation.

6.4. By agreeing to receive newsletters or other Direct Marketing offers, the Data Subject confirms that the Personal Data provided is accurate and correct and that they are at least 16 years of age.

6.5. The Foundation sends news about its activities, offers and other promotional material only where the Data Subject has given Consent to receive such information.

6.6. Where the Data Subject has given Consent to receive Direct Marketing communications by email, the Foundation, in order to understand whether the information being sent is relevant, collects statistical information relating to sent newsletters (whether the newsletter was opened, when and how many times it was opened, whether it was forwarded to others, and which operating system and email server, including its location, were used).

6.7. Data provided when subscribing to Direct Marketing communications will be stored until the Data Subject expresses their wish to no longer receive Direct Marketing communications.

7. RECIPIENTS OF PERSONAL DATA

7.1. State authorities and institutions and other persons performing functions assigned to them by law (for example, law enforcement authorities, bailiffs, notaries, tax administration authorities, institutions supervising the Foundation and institutions carrying out financial crime investigations).

7.2. Auditors, legal and financial advisers; Data Processors authorised by the Foundation.

7.3. Third parties maintaining registers or acting as intermediaries in the provision of Personal Data from such registers.

7.4. Other persons involved in the provision of the Foundation’s services, such as archiving service providers, postal service providers, etc.

8. RIGHTS OF THE DATA SUBJECT

8.1. A Data Subject who has submitted an identity document or has otherwise confirmed their identity in accordance with the procedure established by law or by electronic means of communication allowing the person to be properly identified has the right to obtain information as to whether the Foundation processes the Data Subject’s Personal Data and, if so, to access such data.

8.2. If, after accessing their Personal Data, the Data Subject determines that their Personal Data is incorrect, incomplete or inaccurate, the Data Subject may submit a request to the Foundation, and the Foundation shall without delay correct incorrect or inaccurate Personal Data and complete incomplete Personal Data being processed.

8.3. To withdraw their Consent to the processing of Personal Data.

8.4. To receive Personal Data provided by the Data Subject themselves and processed by the Foundation in writing or in a commonly used electronic format and, where possible, to transmit such data to another service provider (data portability).

8.5. To restrict the processing of Personal Data in certain circumstances in accordance with applicable legislation.

8.6. To object to the processing of Personal Data where the processing is based on the legitimate interests of the Foundation or third parties.

8.7. To object to the processing of Personal Data for Direct Marketing purposes, including Profiling.

8.8. To withdraw Consent to the processing of Personal Data at any time.

8.9. The Foundation will exercise these rights of the Data Subject if the Data Subject applies to the Foundation in writing or contacts the Foundation using the contact details specified in Section 9 of this Policy. If the Data Subject believes that the Foundation’s processing of Personal Data does not comply with applicable legislation, we recommend contacting the State Data Protection Inspectorate.

9. STORAGE OF IP ADDRESSES

When you use our website, your IP address is stored in log files. We use this information to evaluate the use of the website and to optimise it – these files are not stored in our database and are not used for any other purposes. An IP address is a globally valid unique identifier of a computer.

10. CONTACT INFORMATION

10.1. The Data Subject has the right to contact the Foundation in order to submit enquiries, withdraw previously given Consents, submit requests regarding the exercise of the Data Subject’s rights and submit complaints regarding the processing of Personal Data.

10.2. The Foundation’s contact details are published on the website [www.ankstukai.lt](http://www.ankstukai.lt)

11. FINAL PROVISIONS

11.1. Data Subjects may familiarise themselves with these Principles on the Foundation’s website www.ankstukai.lt

11.2. The Foundation has the right to unilaterally amend these Principles at any time by informing the Data Subject of the changes on the website or by email no later than 30 (thirty) calendar days before such changes enter into force.