PRIVACY POLICY OF THE AGRICULTURAL KNOWLEDGE AND INNOVATION DIGITAL INFORMATION SYSTEM (ŽŪŽIS)

The Agricultural Agency under the Ministry of Agriculture (hereinafter – ŽŪA, we, us, our, etc.), acting as the data processor of the Agricultural Knowledge and Innovation digital information system (hereinafter – ŽŪŽIS), is committed to ensuring the fair and transparent processing of your personal data. Personal data are processed in accordance with the General Data Protection Regulation (GDPR) and applicable laws of the Republic of Lithuania.

This ŽŪŽIS Privacy Policy (hereinafter – the Privacy Policy) explains how we collect and process your personal data and what rights you have as a data subject.

Terms:

Personal Data Processing Principles

We care about the security of your Personal Data and therefore undertake to process your Personal Data properly, in line with the following personal data protection principles:

• Lawfulness, fairness and transparency: Personal Data must be processed lawfully, fairly and in a transparent manner. For this purpose, ŽŪA provides this Privacy Policy which contains all information required under Articles 13 or, where applicable, 14 of the GDPR;

• Purpose limitation: Personal Data must be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes;

• Data minimisation: Personal Data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;

• Accuracy: Personal Data must be accurate and, where necessary, kept up to date; reasonable steps must be taken to ensure that Personal Data which are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;

• Storage limitation: Personal Data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the Personal Data are processed;

• Integrity and confidentiality: Personal Data must be processed in a manner that ensures appropriate security using suitable technical and organisational measures, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.

I. GENERAL INFORMATION

When does this Privacy Policy apply?

The Privacy Policy applies when you use the website www.zuzis.lt, receive its newsletters, when you submit information on the ŽŪŽIS system website, or when information about your activities is published on this website.

In addition, the Privacy Policy also applies in cases where the relationship between you and ŽŪA (as the data processor of ŽŪŽIS) was established before the entry into force of this Privacy Policy and your Personal Data were obtained.

The Privacy Policy does not govern the processing of personal data of ŽŪA employees, as such relationships are regulated by the Labour Code, the GDPR and internal regulatory documents (work regulations, internal procedures).

What types of my Personal Data are processed?

The scope of Personal Data processed depends on your interaction with the ŽŪŽIS system (for example, whether you only browse the website or provide information to be published about projects, research or other agricultural innovations). The ŽŪŽIS system is a free, publicly accessible information system in which data on research, innovations and their results in the agricultural sector are collected, processed and published with the aim of encouraging more efficient, sustainable and environmentally friendly farming.

Your Personal Data are processed for the purpose of publishing the above-mentioned information on the ŽŪŽIS system website, enabling users to easily find information about completed research and innovations, as well as for statistical analysis in order to improve the functioning of the website and ensure that it provides relevant and useful information.

The specific use of Personal Data in accordance with the purpose of processing is detailed in Section II of the Privacy Policy, “Legal grounds and purposes for Personal Data processing.”

Personal Data collected and processed:

• Identity data: name, surname, image (in a photograph and/or video recording), voice (in a video recording).

• Contact data: postal address (for correspondence), email address, telephone number, records of correspondence or communications.

• Professional data: information about the employer (name of the research or academic institution and its structural unit), academic or scientific degree, education.

• Project or innovation-related data: source of funding, project number, project title, reports and other project documentation.

• Data on assigned roles in the project: roles of project manager, implementer, partner or other participants.

• Technical and location data: IP address, login location, login time.

We do not process special categories of data, such as genetic information, biometric data, data relating to criminal convictions, information about trade union membership, or data related to your health, ethnic origin, religious or political beliefs, or sexual orientation, except where required by law or in exceptional circumstances, for example where you yourself disclose such data.

From what sources are Personal Data obtained?

Normally, the ŽŪŽIS system processor obtains Personal Data directly from the data subject. For example, when you:

• browse and/or register on the ŽŪŽIS system website www.zuzis.lt;

• submit information about projects, research or innovations on the ŽŪŽIS system website www.zuzis.lt;

• information about your activities or project is published on the ŽŪŽIS system website www.zuzis.lt, based on information you provide or information that is publicly available.

Employees of the ŽŪŽIS system processor may access Personal Data only to the extent necessary for administrative purposes, to ensure the operation and administration of the ŽŪŽIS system website www.zuzis.lt, or in order to safeguard the legitimate interests of the ŽŪŽIS data processor (ŽŪA).

II. LEGAL GROUNDS AND PURPOSES FOR PERSONAL DATA PROCESSING

Legal grounds for Personal Data processing:

Your Personal Data are collected and processed only on lawful grounds as provided for in Article 6 of the GDPR.

This means that data are processed on one or more of the following grounds:

• Consent. The data subject has given clear consent for their Personal Data to be processed for one or more specific purposes (e.g., consent to publish a photograph or to receive a newsletter).

• Legal obligation. Processing is necessary to comply with a legal obligation applicable to ŽŪA under laws or subordinate legislation.

• Public interest / exercise of official authority. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (e.g., ensuring the functioning of the ŽŪŽIS system).

• Legitimate interest. Processing is necessary for the purposes of the legitimate interests pursued by ŽŪA, except where such interests are overridden by the interests, fundamental rights or freedoms of the data subject.

For what purposes does ŽŪA collect and process my Personal Data?

III. SHARING AND PROTECTION OF MY PERSONAL DATA

Who may access my Personal Data?

Only authorised employees of the data controller or persons who require such access in order to perform their official duties may access your Personal Data, as well as other persons when such access is required by law.

With whom may my Personal Data be shared?

Depending on the purpose of the ŽŪŽIS system and the nature of the information published, your Personal Data may be disclosed to third parties only in cases provided for by law or where such disclosure is necessary to ensure the functionality of the ŽŪŽIS system.

Possible data recipients may include:

• Authorised data processors (e.g., IT service providers) engaged to ensure the technical administration and maintenance of the ŽŪŽIS system;

• Public information recipients, where data are published on the website and may be visible through third-party platforms (e.g., social networks or search engines such as Facebook, Instagram, Google);

• State authorities and institutions, where required by law (e.g., pre-trial investigation authorities, courts, supervisory bodies or other entities performing statutory functions).

In all other cases, your Personal Data are not disclosed to third parties.

How does the data processor protect my Personal Data?

To protect your Personal Data from unauthorised access, unlawful processing or disclosure, accidental loss, alteration or destruction, we apply organisational and technical measures that comply with legal requirements.

Taking into account the state of the art, implementation costs, the nature, scope, context and purposes of processing, as well as the potential risks to the rights and freedoms of natural persons, we implement:

• Technical measures – secure IT systems, data encryption, access control, protection against unauthorised software;

• Organisational measures – restricting access to data to authorised persons only, staff training;

• Physical measures – protecting workstations, servers and data storage media;

• Administrative and procedural measures – internal rules, procedures and incident management processes.

The purpose of these measures is to ensure that Personal Data processed within the ŽŪŽIS system are protected against any unlawful actions or potential security breaches.

IV. HOW LONG ARE MY PERSONAL DATA RETAINED?

Personal Data retention principles

Personal Data are kept in a form that permits the identification of data subjects no longer than is necessary for the purposes for which the data are processed.

The retention periods for Personal Data are established by law or - where permitted by law - by ŽŪA (as the ŽŪŽIS system data processor).

The retention period depends on the type of document, the legal basis for processing and the purpose of processing.

In certain cases, Personal Data may be retained on the basis of ŽŪA’s legitimate interests, for example where retention is necessary to defend its rights in legal proceedings.

In such cases, documents are retained until the expiry of the applicable limitation period.

Below is an indicative Personal Data retention period based on processing purposes:

What happens to my Personal Data after the retention period expires?

Once the established retention period expires, all Personal Data and documents containing such data are permanently deleted, destroyed or anonymised so that the data subject can no longer be identified.

Deletion, destruction or anonymisation is carried out in accordance with legal requirements and no later than within 6 months after the end of the retention period. Data subjects are not notified of these actions and their consent is not required for this process.

Please note that some Personal Data may temporarily remain in backup systems even after the end of the retention period, until such data are automatically overwritten. Backup storage is administered only by a limited number of authorised ŽŪA employees who are permitted to access these systems.

V. RIGHTS RELATED TO THE PROCESSING OF PERSONAL DATA

What rights do I have as a data subject?

The data controller ensures that the processing of Personal Data within the ŽŪŽIS system is fair and transparent, and that the rights of data subjects are exercised in accordance with the GDPR and the laws of the Republic of Lithuania.

As a data subject, you have the following rights:

• Right to be informed about the processing of your Personal Data;

• Right of access to your Personal Data processed in the ŽŪŽIS system;

• Right to rectification of inaccurate or incomplete Personal Data;

• Right to withdraw consent, where processing is based on consent
  (withdrawal does not affect the lawfulness of processing carried out before the withdrawal);

• Right to data portability – to receive your data in a structured, commonly used and machine-readable format and, where applicable, to transmit it to another controller;

• Right to be forgotten – to request the erasure of your data where circumstances set out in the GDPR apply;

• Right to restrict processing under certain circumstances;

• Right to object to the processing of your Personal Data for certain purposes or under certain conditions;

• Right to lodge a complaint with the State Data Protection Inspectorate (www.ada.lt) if you believe your data are being processed in breach of the GDPR or other applicable legislation.

How can I exercise my rights?

You can exercise your rights by contacting the ŽŪA Data Protection Officer by phone at +370 685 54 097, by email at [email protected], or in writing at Gedimino pr. 19, LT-01103 Vilnius. If you decide to exercise your rights, request templates are provided for your convenience on the ŽŪŽIS website.

Completed forms may be submitted by email, sent using the contact details above, or delivered to ŽŪA in person. All received requests will be reviewed and your rights will be enforced in accordance with ŽŪA’s approved Procedure for the Examination of Data Subjects’ Requests and the Exercise of Their Rights, within the time limits set by the General Data Protection Regulation.

VI. OBLIGATIONS AND RESPONSIBILITIES OF THE DATA SUBJECT

When using the ŽŪŽIS system (e.g., by providing information on the ŽŪŽIS website or subscribing to newsletters), the Data Subject must ensure that the information submitted to the ŽŪŽIS system, particularly Personal Data, is accurate and correct.

If the data change, the Data Subject must notify ŽŪA.

The Data Subject alone is responsible for the data, text, documents, information, images, graphics, photographs, video recordings, links to third-party websites and their content submitted, uploaded or displayed on or through the ŽŪŽIS system, as well as for the accuracy and correctness of the submitted data.

The Data Subject is also responsible for ensuring that they have obtained the necessary consent or permission from the authors and/or co-authors to publish intellectual works, creations, software or other intellectual or scientific outputs.

ŽŪA is not responsible for the content, accuracy or legality of information provided by third parties on or through the ŽŪŽIS system. Responsibility for such information lies with the person who submitted it.

VII. USE OF COOKIES

What are cookies?

Cookies are small text files that—with your consent—are stored on your end device (computer, tablet, phone) and are used to ensure the proper functioning of the website, improve its performance and enhance user experience. Cookies do not cause damage to your device and cannot independently access or modify information stored on it.

When you visit the website for the first time, cookies are transferred to your device and are later used to recognise the device, facilitate browsing, remember your choices and simplify access to information provided on the website.
Most browsers automatically accept cookies, but you have the right to change your browser settings at any time and refuse cookies. In such cases, certain website functionalities may not work or may operate only partially.

Cookies are also used to automatically collect certain statistical information about website traffic: the number of visitors, the domain name of their internet service provider’s server, the most frequently visited sections and other similar data. This information is used solely for analysing website traffic, improving service quality and ensuring information accessibility.

For what purposes and what types of cookies does ŽŪA use?

This website (ŽŪŽIS link) uses the Google Analytics tool, which collects information about your IP address, visit location, time and duration, internal pages viewed on the site, and actions taken on those pages.

This information is used to generate statistical reports on website usage without identifying individual visitors.

If you do not agree to cookies being stored on your computer or device, you may change your browser settings and disable cookies.

However, please note that doing so may slow down your browsing experience, limit certain website functionalities, or block access to parts of the site

VIII. FINAL PROVISIONS

The Privacy Policy is not a legally binding contract between ŽŪA and the Data Subject; rather, it provides guidance on the personal data protection standards we apply.

As we continuously improve and further develop the ŽŪŽIS system and the electronic services provided, this Privacy Policy may be updated from time to time. Such updates will not restrict your rights as a data subject in any way.

We will notify you of substantial changes - or, in our assessment, in other cases where this is necessary - via the ŽŪŽIS website, by email, or by any other method chosen by us, no later than 1 month before such changes take effect.

If you have any questions or concerns about how ŽŪA processes your Personal Data, or if you wish to exercise your rights, please contact us:

• by phone: +370 685 54 097

• by email: [email protected]

• or in writing: Agriculture Agency under the Ministry of Agriculture Gedimino pr. 19, LT-01103 Vilnius, Lithuania.