Walk15, UAB
PERSONAL DATA PROCESSING POLICY
SECTION I
GENERAL PROVISIONS
- Walk15, UAB (hereinafter – Company ) Personal data processing policy (hereinafter – Policy ) is a part of a publicly disclosed Data processing policy that governs the purposes of processing personal data of natural persons whose data is processed by the Company, establishes procedures for enforcing their rights, sets the organizational and technical data protection measures, regulates the invocation of personal data processors.
- This Policy is prepared based on:
- Law on Legal Protection of Personal Data of the Republic of Lithuania (hereinafter – LLPPD );
- The General Data Protection Regulation ( hereinafter – GDPR );
- Order of the Government of the Republic of Lithuania of the 28th February 2001 No. 228 “Regarding the approval of the order of remuneration for the provision of data to the data subject and remuneration for data collection from registered data controllers”;
- other legislation related to the processing and protection of personal data.
- This Policy applies to the automatic processing of personal data of natural persons, as well as to the manual processing of systematic sets of personal data. This Policy also establishes the rights, obligations and responsibilities of the Company’s employees in relation to the processing of personal data.
- The requirements of this Policy are binding to all employees of the Company (hereinafter referred to as Employees ) and must also be complied with by data processors who, when providing data processing services to the Company, become aware of and process personal data, whereas not regulated by separate agreements between the Company and data processors.
SECTION II
GENERAL CONCEPTS
- Personal data / Data – means any information relating to an identified or identifiable natural person – directly or indirectly, in particular by reference to an identifier such as a name, a personal code, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
- Data processing – means any operation or series of operations performed in an automated or non-automated measure on personal data or personal data sets, such as collection, recording, sorting, systematizing, storing, adapting or modifying, extracting, familiarizing, using, disclosing by transmitting, distributing or otherwise making it available for use, as well as collation or interconnection with other data, restriction, deletion or destruction.
- Data controller – Walk15, UAB, which determines the ways and means of using the data when processing the data of the Data subjects.
- Data subject – Employees and other natural persons whose data is processed by Walk15, UAB.
- Data processor – entities that process personal data controlled by Walk15, UAB, under the instructions of Walk15, UAB in accordance with concluded service contracts.
- Data provision means the disclosure of personal data by transfer or other means of making them available (excluding publication in the media).
- Mobile application – Walk15 mobile application administered by the Company.
- Internal administration – activities ensuring the autonomous functioning of the data controller (structure management, personnel management, management and use of available material and financial resources, record keeping).
- Other terms used in the Policy shall be understood as defined in LLPPD and / or GDPR.
Section III
PRINCIPLES AND OBJECTIVES OF PERSONAL DATA PROCESSING
- In the performance of their duties and the processing of personal data, staff shall be required to:
- process personal data in a lawful, fair and transparent manner;
- collect data for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes;
- observe the principles of expediency, proportionality and data quantity minimization in the collection and processing of personal data, not require the provision of data that is not needed, not stored, and refrain from processing excess data;
- ensure the accuracy of personal data and, where necessary for the purposes of the processing of personal data, keep it up to date; to correct, supplement, delete or suspend processing of inaccurate or incomplete data;
- store personal data in a form, which allows identification of Data subjects for no longer than is necessary for the purposes for which the data was collected and processed;
- process personal data in such a way as to ensure adequate security of personal data by application of appropriate technical or organizational means, including protection against unauthorized processing or unlawful processing and from unintentional loss, destruction or damage of data (integrity and confidentiality principle).
- Administrator Valda Kairiūnienė is responsible for updating the data of the Data subjects of the Company.
- Information about the Data subject must be provided if required by law.
SECTION V
PROCESSING DATA OF EMPLOYMENT CANDIDATES
- The Company processes the following data of persons who wish to participate in the Company’s recruitment process: name, surname, date of birth, address, tel. number, email address, education, other details as specified in the documents provided by the candidates to the Company, including CV. In the event that the legislation of the Republic of Lithuania provides for additional restrictions on the kind of information on candidates that may be processed, the Data controller shall ensure that only the personal data of candidates that is allowed to be processed is processed. Sensitive data is not processed unless the candidate decides to provide this data about himself.
- The basis for data processing is consent. Candidates for the vacancies are giving their consent (by conclusive action) to process their data only until the end of the selection process. The data of candidates who have not been selected for the position (vacancy) shall be deleted at the end of the selection procedure, unless they give their explicit consent to the processing of the data at the end of the selection procedure.
- The purpose of data processing is internal administration. If the candidate’s consent to the processing of his data after the end of the selection procedure is obtained with an objective to offer a future job, the data shall be processed on the basis of consent.
- Candidates submit their personal data when applying to the Company. In some cases, when sampling is conducted through third parties (the Company’s data processors), the data is first provided to them and only thereafter to the Company. In all cases, the Company is the Data controller.
- Candidate data shall not be disclosed to other Third parties unless the candidates request and where there are legitimate grounds for such transfer.
- Candidate data is systematically processed in the Company’s databases, the access to which is available to the Company’s IT service providers. Candidates’ CVs or motivation letters may also be kept in paper form.
- Candidates are made aware of their data processing and their rights, including the right to apply to the Company for data deletion. Informing shall be concluded in the Policy publicly available on the Company’s Websites.
SECTION VI
DATA ON NATURAL PERSONS PROCESSED FOR THE PURPOSES OF SERVICE PROVISION
- The Company can process the following data of persons, who use the Company’s service in a Mobile app: name, surname, sex, height, weight, length of step, language, e-mail, address, location, data which is received from payment service providers (i.e. Google Pay), as well as other data provided directly by the Data subject.
- Service users agree to the terms and conditions of use of the Company’s managed Mobile application before using it. The basis for data processing is the conclusion and performance of the contract.
- The purpose of data processing is to provide services properly.
- Data subjects themselves submit their personal data or give the Mobile app the ability to synchronize data from Samsung Health, Apple Health Kit or other mobile applications. In specific cases, data may be obtained from third parties, e.g. when Data subjects make purchases, the data comes from payment service companies or, when you sign in with your Google or Facebook account, the data comes directly from these companies.
- The data is stored in the Company’s databases, to which the companies providing IT services to the Company have access. Data shall not be disclosed to other third parties unless a request to do so is obtained and where there are legitimate grounds for such transfer. When data subjects use certain Mobile application features (i.e. participation in a challenge), their data may be made publicly available in the Mobile application, but in all cases, they may disable this feature and participate anonymously. Data may also be provided to third parties who, in collaboration with the Company, publish their offers in the Mobile application (the “Step wallet”). Data is provided when a Mobile application user chooses to use the Step wallet feature.
- Data subjects are made aware of the processing of their data and of their rights. Notification shall be made in the Policy publicly available the Company’s website and in the mobile Application, as well as rules of usage, provided in the Mobile application.
SECTION VII
DATA PROCESSING FOR DIRECT MARKETING PURPOSES
- For the purposes of direct marketing, the Company processes the following personal data: name, surname, email address. Other contact details may also be processed.
- Data processing is based on consent.
- Data subjects themselves submit their personal data to the Company.
- The data is stored in the Company’s databases, to which the companies providing IT services to the Company have access. Data shall not be disclosed to other third parties unless a request to do so from the Data subject is obtained and where there are legitimate grounds for such transfer.
- The Company does not process minor’s data or sensitive personal data for this purpose. Nevertheless, when collecting data for direct marketing purposes, the Company does not verify the age of the Data subjects as this would be treated as excess data collection.
- Data subjects are made aware of their data processing and their rights, including the right to apply to the Company for data deletion. Notification shall be made in the Policy, publicly disclosed on the Company’s website and in the Mobile Application. Data subjects, after the mobile app is downloaded and used, have the right to agree with direct marketing newsletters being sent to the Data subject via email or other ways provided by the Data subject. Data subject has the right to unsubscribe or cancel this option anytime.
SECTION VIII
DATA PROCESSING FOR INQUIRY, REQUEST OR COMPLAIN ADMINISTRATION, EVALUATION AND EXAMINATION
- The Company may process the following data of the contacting natural persons for the specified purpose: name, language, e-mail. address. The Company may also process other data directly obtained from the Data subject and necessary for the investigation, administration or evaluation of the request, inquiry or complaint.
- The basis for data processing is the conclusion and performance of the contract.
- Data subjects themselves submit their personal data.
- The data is stored in the Company’s databases, to which the companies providing IT services to the Company have access. Data shall not be disclosed to other third parties unless a request to do so from the Data subjects is obtained and where there are legitimate grounds for such transfer.
- Data subjects are made aware of the processing of their data and of their rights. Notification shall be made in the Policy, publicly disclosed on the Company’s website and in the Mobile Application.
- The administration of the mobile app reserves the right to delete a user account if fraudulent user behavior has been recorded while participating in step challenges or other activities organized by the app (such as fictitiously added steps, etc.).
SECTION IX
CHAT FUNCTION DATA PROCESSING
Purpose and Scope
The Company introduces a chat function within the Walk15 mobile application to facilitate communication among users. This section outlines the data processing activities specific to the chat function and complements the overarching principles and commitments outlined in the Company's Personal Data Processing Policy.
Data Collected Through the Chat Function
In the context of the chat function, the Company processes the following data:
- Text Messages: Written communications between users.
- Photos and Images: Visual content shared to enhance conversations.
- Emojis and Stickers: Graphics used for expressive communication.
- Links: URLs leading to external content, shared within chats.
- Timestamps: The times at which any form of communication is sent or received.
- User Identifiers: Data used to identify users for the purpose of facilitating interactions.
- Any Other Data Users Share in the Chat: Recognizing that the ways in which users communicate can evolve, this includes any new forms of data that users might choose to share in the future to enrich their communication within the chat function.
The processing of personal data through the chat function is based on the performance of a contract to which the data subject is party, i.e., the terms of use of the Walk15 mobile application, which the users accept before using the chat function (GDPR Article 6(b)).
Chat function has been made possible in collaboration with Spike Technologies Inc., a leading data technology provider specializing in the aggregation of data from wearables and IoT devices. For more information, please review Spike Technologies Inc. Terms of Service.
Purpose of Processing
The purpose of processing personal data through the chat function is to provide a means of communication that enhances the user experience within the Walk15 mobile application. Data processed in this context is used exclusively for the facilitation of user-to-user communication and is not used for any other purposes, such as marketing or profiling.
Review of Inappropriate Content
To maintain a safe and respectful environment, Walk15 reserves the right to review content shared through the chat function. Content deemed inappropriate may be removed to ensure the well-being and comfort of all users.
Reporting Inappropriate Content
Users can contribute to the maintenance of a safe and respectful environment within the Walk15 community by reporting any inappropriate content encountered in the chat function. To report such content, users can send an email to info@walk15.app. Walk15 will promptly review and take necessary actions to address reported content.
Retention Period
Messages sent and received through the chat function are stored for a duration of 24 hours to ensure timely communication between users. After this period, messages are automatically deleted from our systems. This retention period is designed to respect the privacy of our users while ensuring the functionality of the chat service.
Security Measures
The Company implements appropriate technical and organizational measures to ensure the security of personal data processed through the chat function, including encryption of messages in transit and at rest, access controls, and regular security assessments.
Data Subject Rights
Users have the right to access their personal data processed through the chat function, including the right to obtain a copy of their chat messages within the 24-hour retention period. Users may also request the deletion of their messages before the automatic deletion period. The procedures for exercising these rights are consistent with those outlined in the Section on Data Subjects' Rights and Procedures for Their Implementation.
Changes to Chat Function Data Processing Policies
Any changes to the data processing practices related to the chat function will be communicated to users through updates to this Policy, available on the Company's website and within the Walk15 mobile application.
SECTION X
COOKIES
- The Company uses cookies to improve the navigation and services provided by the Walk15.com website. The Company’s website may use third-party analytical cookies- “Google Analytics”.
- These cookies are or may be used on the Company’s website.
Name of cookie Description Moment of creation Expiry time Data used _ga A unique ID is logged and used to generate statistics about how a visitor uses the site. By clicking the “I agree” button 2 years Unique identifier _gid This cookie is used to distinguish users. By clicking the “I agree” button 24 hours Unique identifier _gat* These cookies are used to limit the number of requests. When entering the page 10 min Unique identifier cookieconsent_status Used to save user consent to the use of cookies. By clicking the “I agree” button 1 year Unique identifier pll_language This cookie is used to save the visitor’s preferred language. When entering the page 1 year Language - The Company can collect data on visitor actions and their browsing habits on a website.
- For more information, you can visit: http://www.google.com/analytics .
- To learn how to disable tracking on the web pages with Google Analytics cookies, you can visit: http://tools.google.com/dlpage/gaoptout .
- Data is passed to IT service providers and Google. Data shall not be disclosed to other third parties unless a request to do so is obtained and where there are legitimate grounds for such transfer.
- The website allows you to opt out of the use of cookies.
SECTION XI
TERMS OF DATA STORAGE
- The data controller shall apply the following time limits for the storage of personal data:
No. Purpose of processing of personal data Term of storage 1. Processing of employee data for the purposes of internal administration. Up to 50 years after the end of the employment contract, in accordance with the Index for retention periods in the General documentation. 2. Processing of personal data of job candidates. Until the end of selection. 3. Processing of personal data of job candidates after the end of the selection takes place after obtaining permission to process data. Two years from the date of receipt of the curriculum vitae. 4. Provision of services. Data shall be processed for a period which shall not exceed 10 years, as laid down by law. 5. Administration, evaluation and examination of requests, inquiries or complaints. 6 months from the date of receipt of the request. 6. For direct marketing purposes. 3 years from obtaining consent. 7. Cookies to improve the quality of your use of the site. The length of time a cookie stays on your computer depends on the type of cookie. - Exceptions to the above retention periods may be determined insofar as such exceptions do not violate the rights of the Data subjects, meet legal requirements and are properly documented.
CHAPTER XII
DATA SUBJECTS RIGHTS AND PROCEDURES FOR THEIR IMPLEMENTATION
Ensuring Data subjects’ rights and awareness
- Data subjects have the right to:
- to know (be informed) about the processing of their personal data.
- by submitting to the Company an identity document or by electronic means that allows the person to be properly identified – to access their personal data and its processing, to obtain information on the sources and what specific personal data is collected, the purpose for which it is processed, the recipients at least in the last 1 year, in addition – to receive a copy of the documents containing their personal data;
- require the rectification, erasure or restriction of personal data except for storage where the processing is in breach of legal requirements;
- to object to the processing of their personal data;
- to request transfer of data to another data controller or to provide it directly to the Data subject in a form that is convenient for the Data subject (such data provided to the Company by the Data subject itself);
- lodge a complaint with the supervisory authority;
- revoke consent (if personal data is processed on the basis of consent).
- In all cases, the Company must provide the Data subject with information (unless the Data subject already has such information) about:
- its name, legal entity code and registered office;
- contact details of the data protection officer, if any;
- for what purposes and on what legal basis is the personal data of the Data subject processed;
- the recipients of the data and their categories;
- the period for which the data will be stored or the criteria used to determine that period;
- other additional information (what of the Personal data must be provided by the Data subject and the consequences of failure to provide the data, about the Data subject’s right of access to his personal data and his right to correct incorrect, incomplete, inaccurate personal data) in the volume that is needed, in order to ensure the proper personal data processing without the violation of the rights of the Data subject;
- the communication of his personal data to third parties at the latest at the time the data are first provided during the first time and if the Data subject was unaware that the data will be transferred to another party.
Order for the implementation of data subjects’ rights
- The Company is obliged to:
- enable the Data subject to exercise the specified rights of the Data Subject, except as in cases stipulated by law, when it is necessary to ensure national security or defense, public order, crime prevention, investigation, detection or criminal prosecution, important state economic or financial interests, prevention of violations of service or professional ethics, its investigation and detection, protection of the rights and freedoms of the Data subject or other persons;
- Data subjects must contact the Company branch to exercise their rights at the following contacts: info@walk15.lt.
- The Company must ensure that all necessary information is provided to the Data subject in a clear and comprehensible manner.
- The data subject must reply no later than in 20 (twenty) business days from the date of receipt of the request. If the Data subject is refused access to the data, he shall be given a reasoned and substantiated reply regarding the non-execution of his request.
- The Company shall immediately inform the data recipients of the personal data, which was corrected or destroyed at the request of the data subject, the suspended processing of personal data, unless the provision of such information would be impossible or excessively difficult (due to the high number of data subjects, data period, unreasonably high costs). In this case, the State Data Protection Inspectorate must be notified immediately.
- The Company shall provide the data to the Data subject free of charge. In certain cases (whenever the Data subject clearly abuses his rights, submits unreasonably repeated requests for information, excerpts, documents), such provision of information and data to the Data subject may require remuneration in accordance with legal requirements and the rates set by the Company.
Provision of data to data recipients
- The Company shall provide the Data of the Data subject according to the requirements of the legal acts and while ensuring their confidentiality.
- In the case of one-time data provision, the Company shall give priority to the provision of information by electronic means.
- The provision of personal data to state and municipal institutions and bodies, when such institutions and bodies receive personal data for the performance of the statutory control functions, shall not be considered as the provision of data to recipients.
CHAPTER XIII
ORGANIZATIONAL AND TECHNICAL MEASURES FOR PERSONAL DATA PROTECTION
- The Company makes every effort to ensure that the Company’s organizational and technical data security measures comply with GDPR requirements. The following infrastructural, administrative and telecommunications (electronic) measures shall be taken to protect personal data against accidental or unlawful destruction, alteration, disclosure or any other unlawful processing:
- proper hardware layout and maintenance, information systems maintenance, network management, ensuring Internet usage security and other information technology measures:
- access to Data and the right to carry out Data processing operations shall be granted only to the Employees who need access to the personal data in the context of their duties and performed work functions.
- ensuring security of premises where personal data is stored (only authorized persons have access to concerned premises).
- after assigning a computer or electronic communication device to a particular Employee, such computer / electronic communication device (s) must be password protected. Passwords must be changed periodically, as well as in the presence of certain circumstances (changes of employee, threat of hacking, suspicion that the password has become known to third parties, etc.).
- ensuring the protection of personal data against unauthorized access to the internal computer network by electronic means of communications.
- ensuring the use of secure protocols for the transmission of personal data through external data communication networks.
- strict adherence to safety standards issued by the security service;
- proper organization of work and other administrative measures;
- the necessary data security measures are installed taking into account the results of the risk assessment;
- backup and recovery of data;
- ensuring that data is restored from the latest available backup copies in the event of loss of data due to hardware failure, software error or other data integrity violation;
- other means.
- The Company’s Administrator Valda Kairiūnienė is responsible for the implementation, control and enforcement of these organizational and technical data security measures.
- Employees who process personal data must observe the principle of confidentiality and keep any relevant information they have accessed in the course of their duties confidential. This obligation shall continue to apply after transfer to another position within the Company or upon termination of the employment or contractual relationship with the Company.
- Employees may process personal data in an automatic way only after they have been granted access to the relevant information system. Access to personal data may only be granted to a person who needs personal data to perform his functions. Upon termination of employment relationships, the Employee’s rights to access registers and other programs shall be revoked.
- Employees may transfer documents containing personal data only to Employees who are entitled to work with personal data under duties or separate assignments.
- Employees performing Data subject’s Data processing functions, shall prevent accidental or unauthorized processing, and shall maintain records in a proper and secure manner (avoiding unnecessary storage of the Data Subject’s data, etc.). Copies of documents containing data of the Data subject shall be destroyed in such a way that the contents of such documents cannot be reproduced and their contents identified.
- Employees whose computers store the Data or whose computers are enabled to access the Company’s information systems where the Data is stored must use passwords on their computers; “Guest” type user accounts in such systems, i.e. no-password accounts are prohibited. These computers also need to use a screen saver with a password.
- Unless necessary, files with Data need not be digitally duplicated, i.e., copies of them being made to local computer disks, removable media, remote file storage, etc.
- The security control and erasure of personal data contained in external data storage media and electronic mail after their use is ensured by transferring them to databases.
- Administrator Valda Kairiūnienė must ensure:
- control of unauthorized access to server premises;
- protection of the Company’s internal computer network.
- Employees must organize their work in such a way as to limit the access of other persons to the personal data processed as much as possible. This provision shall be implemented:
- by refraining from leaving documents with processed personal data or a computer that can open files containing personal data, without supervision, so that information contained therein can be read by Employees who are not authorized to work with specific personal data, students or other persons;
- by storing documents in such a way that they (or their fragments) cannot be read by accidental persons;
- if documents containing personal data are transmitted to other Employees, units, branches, offices via persons who are not authorized to process personal data, or by post or courier, they must be transmitted in a sealed opaque envelope. This paragraph shall not apply where such messages are issued personally and confidentially.
- Administrator Valda Kairiūnienė is responsible for managing and responding to personal data breaches.
SECTION XIV
FINAL PROVISIONS
- The Company has the right to change Privacy Policy at any time. The changes made are valid from the time the Privacy Policy is updated on the website https://www.walk15.app/en/legal/privacy-policy/. The Data Subjects are always recommended to read the updated Privacy Policy.